1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@mx.gw.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File$ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83#------------------------------------------------------------------------------ 84# $File$ 85# adi: file(1) magic for ADi's objects 86# From Gregory McGarry <g.mcgarry@ieee.org> 87# 880 leshort 0x521c COFF DSP21k 89>18 lelong &02 executable, 90>18 lelong ^02 91>>18 lelong &01 static object, 92>>18 lelong ^01 relocatable object, 93>18 lelong &010 stripped 94>18 lelong ^010 not stripped 95 96#------------------------------------------------------------------------------ 97# $File: adventure,v 1.13 2010/12/31 16:32:54 christos Exp $ 98# adventure: file(1) magic for Adventure game files 99# 100# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 101# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 102# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 103# 104# ALAN 105# I assume there are other, lower versions, but these are the only ones I 106# saw in the archive. 1070 beshort 0x0206 ALAN game data 108>2 byte <10 version 2.6%d 109 110 111# Infocom (see z-machine) 112#------------------------------------------------------------------------------ 113# Z-machine: file(1) magic for Z-machine binaries. 114# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 115# 116#http://www.gnelson.demon.co.uk/zspec/sect11.html 117#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 118#http://en.wikipedia.org/wiki/Z-machine 119# The first byte is the Z-machine revision; it is always between 1 and 8. We 120# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 121# well as an occasional MP3 file), so we sanity-check the version number. 122# 123# It might be possible to sanity-check the release number as well, as it seems 124# (at least in classic Infocom games) to always be a relatively small number, 125# always under 150 or so, but as this isn't rigorous, we'll wait on that until 126# it becomes clear that it's needed. 127# 1280 ubyte >0 129>0 ubyte <9 130>>16 belong&0xfe00f0f0 0x3030 131>>>0 ubyte < 10 132>>>>2 ubeshort < 10 133>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 134>>>>>>0 ubyte < 10 Infocom (Z-machine %d, 135>>>>>>>2 ubeshort < 10 Release %d / 136>>>>>>>>18 string >\0 Serial %.6s) 137!:strength + 40 138 139#------------------------------------------------------------------------------ 140# Glulx: file(1) magic for Glulx binaries. 141# 142# I haven't checked for false matches yet. 143# 1440 string Glul Glulx game data 145>4 beshort x (Version %d 146>>6 byte x \b.%d 147>>8 byte x \b.%d) 148>36 string Info Compiled by Inform 149 150 151 152# For Quetzal and blorb magic see iff 153 154 155# TADS (Text Adventure Development System) version 2 156# All files are machine-independent (games compile to byte-code) and are tagged 157# with a version string of the form "V2.<digit>.<digit>\0". 158# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1590 string TADS2\ bin TADS 160>9 belong !0x0A0D1A00 game data, CORRUPTED 161>9 belong 0x0A0D1A00 162>>13 string >\0 %s game data 163# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 1640 string TADS2\ rsc TADS 165>9 belong !0x0A0D1A00 resource data, CORRUPTED 166>9 belong 0x0A0D1A00 167>>13 string >\0 %s resource data 168# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 169# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 170# "TADS2 save\n\r\032\0" and the interpreter version. 1710 string TADS2\ save/g TADS 172>12 belong !0x0A0D1A00 saved game data, CORRUPTED 173>12 belong 0x0A0D1A00 174>>(16.s+32) string >\0 %s saved game data 175# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 176# version. 1770 string TADS2\ save TADS 178>10 belong !0x0A0D1A00 saved game data, CORRUPTED 179>10 belong 0x0A0D1A00 180>>14 string >\0 %s saved game data 181 182# TADS (Text Adventure Development System) version 3 183# Game files start with "T3-image\015\012\032" 1840 string T3-image\015\012\032 185>11 leshort x TADS 3 game data (format version %d) 186# Saved game files start with "T3-state-v####\015\012\032" 187# where #### is a format version number 1880 string T3-state-v 189>14 string \015\012\032 TADS 3 saved game data (format version 190>>10 byte x %c 191>>11 byte x \b%c 192>>12 byte x \b%c 193>>13 byte x \b%c) 194 195# Danny Milosavljevic <danny.milo@gmx.net> 196# this are adrift (adventure game standard) game files, extension .taf 197# depending on version magic continues with 0x93453E6139FA (V 4.0) 198# 0x9445376139FA (V 3.90) 199# 0x9445366139FA (V 3.80) 200# this is from source (http://www.adrift.org.uk/) and I have some taf 201# files, and checked them. 202#0 belong 0x3C423FC9 203#>4 belong 0x6A87C2CF Adrift game file 204#!:mime application/x-adrift 205 206#------------------------------------------------------------------------------ 207# $File$ 208# allegro: file(1) magic for Allegro datafiles 209# Toby Deshane <hac@shoelace.digivill.net> 210# 2110 belong 0x736C6821 Allegro datafile (packed) 2120 belong 0x736C682E Allegro datafile (not packed/autodetect) 2130 belong 0x736C682B Allegro datafile (appended exe data) 214 215#------------------------------------------------------------------------------ 216# $File$ 217# alliant: file(1) magic for Alliant FX series a.out files 218# 219# If the FX series is the one that had a processor with a 68K-derived 220# instruction set, the "short" should probably become "beshort" and the 221# "long" should probably become "belong". 222# If it's the i860-based one, they should probably become either the 223# big-endian or little-endian versions, depending on the mode they ran 224# the 860 in.... 225# 2260 short 0420 0420 Alliant virtual executable 227>2 short &0x0020 common library 228>16 long >0 not stripped 2290 short 0421 0421 Alliant compact executable 230>2 short &0x0020 common library 231>16 long >0 not stripped 232 233#------------------------------------------------------------------------------ 234# $File$ 235# alpha architecture description 236# 237 2380 leshort 0603 COFF format alpha 239>22 leshort&030000 !020000 executable 240>24 leshort 0410 pure 241>24 leshort 0413 paged 242>22 leshort&020000 !0 dynamically linked 243>16 lelong !0 not stripped 244>16 lelong 0 stripped 245>22 leshort&030000 020000 shared library 246>24 leshort 0407 object 247>27 byte x - version %d 248>26 byte x .%d 249>28 byte x -%d 250 251# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 252# 253# The actual magic number is just "Core", followed by a 2-byte version 254# number; however, treating any file that begins with "Core" as a Digital 255# UNIX core dump file may produce too many false hits, so we include one 256# byte of the version number as well; DU 5.0 appears only to be up to 257# version 2. 258# 2590 string Core\001 Alpha COFF format core dump (Digital UNIX) 260>24 string >\0 \b, from '%s' 2610 string Core\002 Alpha COFF format core dump (Digital UNIX) 262>24 string >\0 \b, from '%s' 263 264 265#------------------------------------------------------------------------------ 266# $File$ 267# amanda: file(1) magic for amanda file format 268# 2690 string AMANDA:\ AMANDA 270>8 string TAPESTART\ DATE tape header file, 271>>23 string X 272>>>25 string >\ Unused %s 273>>23 string >\ DATE %s 274>8 string FILE\ dump file, 275>>13 string >\ DATE %s 276 277#------------------------------------------------------------------------------ 278# $File: amigaos,v 1.14 2009/09/19 16:28:07 christos Exp $ 279# amigaos: file(1) magic for AmigaOS binary formats: 280 281# 282# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 283# 2840 belong 0x000003fa AmigaOS shared library 2850 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 2860 belong 0x000003e7 AmigaOS object/library data 287# 2880 beshort 0xe310 Amiga Workbench 289>2 beshort 1 290>>48 byte 1 disk icon 291>>48 byte 2 drawer icon 292>>48 byte 3 tool icon 293>>48 byte 4 project icon 294>>48 byte 5 garbage icon 295>>48 byte 6 device icon 296>>48 byte 7 kickstart icon 297>>48 byte 8 workbench application icon 298>2 beshort >1 icon, vers. %d 299# 300# various sound formats from the Amiga 301# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 302# 3030 string FC14 Future Composer 1.4 Module sound file 3040 string SMOD Future Composer 1.3 Module sound file 3050 string AON4artofnoise Art Of Noise Module sound file 3061 string MUGICIAN/SOFTEYES Mugician Module sound file 30758 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 3080 string Synth4.0 Synthesis Module sound file 3090 string ARP. The Holy Noise Module sound file 3100 string BeEp\0 JamCracker Module sound file 3110 string COSO\0 Hippel-COSO Module sound file 312# Too simple (short, pure ASCII, deep), MPi 313#26 string V.3 Brian Postma's Soundmon Module sound file v3 314#26 string BPSM Brian Postma's Soundmon Module sound file v3 315#26 string V.2 Brian Postma's Soundmon Module sound file v2 316 317# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 3180 beshort 0x0f00 AmigaOS bitmap font 3190 beshort 0x0f03 AmigaOS outline font 3200 belong 0x80001001 AmigaOS outline tag 3210 string ##\ version catalog translation 3220 string EMOD\0 Amiga E module 3238 string ECXM\0 ECX module 3240 string/c @database AmigaGuide file 325 326# Amiga disk types 327# 3280 string RDSK Rigid Disk Block 329>160 string x on %.24s 3300 string DOS\0 Amiga DOS disk 3310 string DOS\1 Amiga FFS disk 3320 string DOS\2 Amiga Inter DOS disk 3330 string DOS\3 Amiga Inter FFS disk 3340 string DOS\4 Amiga Fastdir DOS disk 3350 string DOS\5 Amiga Fastdir FFS disk 3360 string KICK Kickstart disk 337 338# From: Alex Beregszaszi <alex@fsn.hu> 3390 string LZX LZX compressed archive (Amiga) 340 341# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 3420 string .KEY AmigaDOS script 3430 string .key AmigaDOS script 344 345#------------------------------------------------------------ 346# $File: android,v 1.6 2014/08/04 06:00:36 christos Exp $ 347# Various android related magic entries 348#------------------------------------------------------------ 349 350# Dalvik .dex format. http://retrodev.com/android/dexformat.html 351# From <mkf@google.com> "Mike Fleming" 352# Fixed to avoid regexec 17 errors on some dex files 353# From <diff@lookout.com> "Tim Strazzere" 3540 string dex\n 355>0 regex dex\n[0-9]{2}\0 Dalvik dex file 356>4 string >000 version %s 3570 string dey\n 358>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 359>4 string >000 version %s 360 361# Android bootimg format 362# From https://android.googlesource.com/\ 363# platform/system/core/+/master/mkbootimg/bootimg.h 3640 string ANDROID! Android bootimg 365>1024 string LOKI\01 \b, LOKI'd 366>8 lelong >0 \b, kernel 367>>12 lelong >0 \b (0x%x) 368>16 lelong >0 \b, ramdisk 369>>20 lelong >0 \b (0x%x) 370>24 lelong >0 \b, second stage 371>>28 lelong >0 \b (0x%x) 372>36 lelong >0 \b, page size: %d 373>38 string >0 \b, name: %s 374>64 string >0 \b, cmdline (%s) 375 376# Android Backup archive 377# From: Ariel Shkedi 378# File extension: .ab 379# No mime-type defined 380# URL: https://github.com/android/platform_frameworks_base/blob/\ 381# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 382# android/server/BackupManagerService.java#L2367 383# After the header comes a tar file 384# If compressed, the entire tar file is compressed with JAVA deflate 385# 386# Include the version number hardcoded with the magic string to avoid 387# false positives 3880 string/b ANDROID\ BACKUP\n1\n Android Backup 389>17 string 0\n \b, Not-Compressed 390>17 string 1\n \b, Compressed 391# any string as long as it's not the word none (which is matched below) 392>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 393>>19 string none\n \b, Not-Encrypted 394# Commented out because they don't seem useful to print 395# (but they are part of the header - the tar file comes after them): 396#>>>&1 regex/1l .* \b, Password salt: %s 397#>>>>&1 regex/1l .* \b, Master salt: %s 398#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 399#>>>>>>&1 regex/1l .* \b, IV: %s 400#>>>>>>>&1 regex/1l .* \b, Key: %s 401 402# *.pit files by Joerg Jenderek 403# http://forum.xda-developers.com/showthread.php?p=9122369 404# http://forum.xda-developers.com/showthread.php?t=816449 405# Partition Information Table for Samsung's smartphone with Android 406# used by flash software Odin 4070 ulelong 0x12349876 408# 1st pit entry marker 409>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 410# minimal 13 and maximal 18 PIT entries found 411>>4 ulelong <128 Partition Information Table for Samsung smartphone 412>>>4 ulelong x \b, %d entries 413# 1. pit entry 414>>>4 ulelong >0 \b; #1 415>>>0x01C use PIT-entry 416>>>4 ulelong >1 \b; #2 417>>>0x0A0 use PIT-entry 418>>>4 ulelong >2 \b; #3 419>>>0x124 use PIT-entry 420>>>4 ulelong >3 \b; #4 421>>>0x1A8 use PIT-entry 422>>>4 ulelong >4 \b; #5 423>>>0x22C use PIT-entry 424>>>4 ulelong >5 \b; #6 425>>>0x2B0 use PIT-entry 426>>>4 ulelong >6 \b; #7 427>>>0x334 use PIT-entry 428>>>4 ulelong >7 \b; #8 429>>>0x3B8 use PIT-entry 430>>>4 ulelong >8 \b; #9 431>>>0x43C use PIT-entry 432>>>4 ulelong >9 \b; #10 433>>>0x4C0 use PIT-entry 434>>>4 ulelong >10 \b; #11 435>>>0x544 use PIT-entry 436>>>4 ulelong >11 \b; #12 437>>>0x5C8 use PIT-entry 438>>>4 ulelong >12 \b; #13 439>>>>0x64C use PIT-entry 440# 14. pit entry 441>>>4 ulelong >13 \b; #14 442>>>>0x6D0 use PIT-entry 443>>>4 ulelong >14 \b; #15 444>>>0x754 use PIT-entry 445>>>4 ulelong >15 \b; #16 446>>>0x7D8 use PIT-entry 447>>>4 ulelong >16 \b; #17 448>>>0x85C use PIT-entry 449# 18. pit entry 450>>>4 ulelong >17 \b; #18 451>>>0x8E0 use PIT-entry 452 4530 name PIT-entry 454# garbage value implies end of pit entries 455>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 456# skip empty partition name 457>>0x24 ubyte !0 458# partition name 459>>>0x24 string >\0 %-.32s 460# flags 461>>>0x0C ulelong&0x00000002 2 \b+RW 462# partition ID: 463# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER 464# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 465>>>0x08 ulelong x (0x%x) 466# filename 467>>>0x44 string >\0 "%-.64s" 468#>>>0x18 ulelong >0 469# blocksize in 512 byte units ? 470#>>>>0x18 ulelong x \b, %db 471# partition size in blocks ? 472#>>>>0x22 ulelong x \b*%d 473 474# Android bootimg format 475# From https://android.googlesource.com/\ 476# platform/system/core/+/master/libsparse/sparse_format.h 4770 lelong 0xed26ff3a Android sparse image 478>4 leshort x \b, version: %d 479>6 leshort x \b.%d 480>16 lelong x \b, Total of %d 481>12 lelong x \b %d-byte output blocks in 482>20 lelong x \b %d input chunks. 483 484#------------------------------------------------------------------------------ 485# $File: animation,v 1.55 2014/09/13 14:29:51 christos Exp $ 486# animation: file(1) magic for animation/movie formats 487# 488# animation formats 489# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 490# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 491 492# SGI and Apple formats 4930 string MOVI Silicon Graphics movie file 494!:mime video/x-sgi-movie 4954 string moov Apple QuickTime 496!:mime video/quicktime 497>12 string mvhd \b movie (fast start) 498>12 string mdra \b URL 499>12 string cmov \b movie (fast start, compressed header) 500>12 string rmra \b multiple URLs 5014 string mdat Apple QuickTime movie (unoptimized) 502!:mime video/quicktime 503#4 string wide Apple QuickTime movie (unoptimized) 504#!:mime video/quicktime 505#4 string skip Apple QuickTime movie (modified) 506#!:mime video/quicktime 507#4 string free Apple QuickTime movie (modified) 508#!:mime video/quicktime 5094 string idsc Apple QuickTime image (fast start) 510!:mime image/x-quicktime 511#4 string idat Apple QuickTime image (unoptimized) 512#!:mime image/x-quicktime 5134 string pckg Apple QuickTime compressed archive 514!:mime application/x-quicktime-player 5154 string/W jP JPEG 2000 image 516!:mime image/jp2 517# http://www.ftyps.com/ with local additions 5184 string ftyp ISO Media 519>8 string 3g2 \b, MPEG v4 system, 3GPP2 520!:mime video/3gpp2 521>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 522>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 523>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 524>>11 byte a \b C.S0050-0 V1.0 525>>11 byte b \b C.S0050-0-A V1.0.0 526>>11 byte c \b C.S0050-0-B V1.0 527>8 string 3ge \b, MPEG v4 system, 3GPP 528!:mime video/3gpp 529>>11 byte 6 \b, Release 6 MBMS Extended Presentations 530>>11 byte 7 \b, Release 7 MBMS Extended Presentations 531>8 string 3gg \b, MPEG v4 system, 3GPP 532>11 byte 6 \b, Release 6 General Profile 533!:mime video/3gpp 534>8 string 3gp \b, MPEG v4 system, 3GPP 535>11 byte 1 \b, Release %d (non existent) 536>11 byte 2 \b, Release %d (non existent) 537>11 byte 3 \b, Release %d (non existent) 538>11 byte 4 \b, Release %d 539>11 byte 5 \b, Release %d 540>11 byte 6 \b, Release %d 541>11 byte 7 \b, Release %d Streaming Servers 542!:mime video/3gpp 543>8 string 3gs \b, MPEG v4 system, 3GPP 544>11 byte 7 \b, Release %d Streaming Servers 545!:mime video/3gpp 546>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] 547!:mime video/mp4 548>8 string/W qt \b, Apple QuickTime movie 549!:mime video/quicktime 550>8 string CAEP \b, Canon Digital Camera 551>8 string caqv \b, Casio Digital Camera 552>8 string CDes \b, Convergent Design 553>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG 554>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP 555>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images 556>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP 557>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG 558>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP 559>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images 560>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP 561>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec 562>8 string dmpf \b, Digital Media Project 563>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4) 564>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS 565>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP 566>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS 567>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP 568>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS 569>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP 570>8 string dvr1 \b, DVB (.DVB) over RTP 571!:mime video/vnd.dvb.file 572>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream 573!:mime video/vnd.dvb.file 574>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V) 575!:mime video/mp4 576>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P) 577!:mime video/mp4 578>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A) 579!:mime audio/mp4 580>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B) 581!:mime audio/mp4 582>8 string isc2 \b, ISMACryp 2.0 Encrypted File 583# ?/enc-isoff-generic 584>8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005] 585!:mime video/mp4 586>8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003] 587!:mime video/mp4 588>8 string/W jp2 \b, JPEG 2000 589!:mime image/jp2 590>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?] 591!:mime image/jp2 592>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent) 593>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6] 594!:mime image/jpm 595>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2] 596!:mime image/jpx 597>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones 598!:mime video/3gpp2 599>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio 600!:mime audio/x-m4a 601>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book 602!:mime audio/mp4 603>8 string M4P \b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio 604!:mime video/mp4 605>8 string M4V \b, Apple iTunes Video (.M4V) Video 606!:mime video/x-m4v 607>8 string M4VH \b, Apple TV (.M4V) 608!:mime video/x-m4v 609>8 string M4VP \b, Apple iPhone (.M4V) 610!:mime video/x-m4v 611>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile 612!:mime video/mj2 613>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile 614!:mime video/mj2 615>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT) 616!:mime video/mp4 617>8 string mobi \b, MPEG-4, MOBI format 618!:mime video/mp4 619>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9] 620>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13] 621!:mime video/mp4 622>8 string mp42 \b, MP4 v2 [ISO 14496-14] 623!:mime video/mp4 624>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12] 625>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 626>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 627>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 628!:mime video/mp4 629>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3] 630>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 631!:mime video/quicktime 632>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP 633!:mime audio/mp4 634>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio 635!:mime audio/mp4 636>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile 637!:mime video/mp4 638>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile 639!:mime video/mp4 640>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile 641!:mime video/mp4 642>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile 643!:mime video/mp4 644>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile 645!:mime video/mp4 646>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile 647!:mime video/mp4 648>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile 649!:mime video/mp4 650>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile 651!:mime video/mp4 652>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile 653!:mime video/mp4 654>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile 655!:mime video/mp4 656>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A) 657>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C) 658>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C) 659>8 string pana \b, Panasonic Digital Camera 660>8 string qt \b, Apple QuickTime (.MOV/QT) 661!:mime video/quicktime 662>8 string ROSS \b, Ross Video 663>8 string sdv \b, SD Memory Card Video 664>8 string ssc1 \b, Samsung stereo, single stream (patent pending) 665>8 string ssc2 \b, Samsung stereo, dual stream (patent pending) 666 667# MPEG sequences 668# Scans for all common MPEG header start codes 6690 belong 0x00000001 670>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 671>>5 byte 66 \b, baseline 672>>5 byte 77 \b, main 673>>5 byte 88 \b, extended 674>>7 byte x \b @ L %u 6750 belong&0xFFFFFF00 0x00000100 676>3 byte 0xBA MPEG sequence 677!:mime video/mpeg 678>>4 byte &0x40 \b, v2, program multiplex 679>>4 byte ^0x40 \b, v1, system multiplex 680>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 681>3 byte&0x1F 0x07 MPEG sequence, H.264 video 682>>4 byte 66 \b, baseline 683>>4 byte 77 \b, main 684>>4 byte 88 \b, extended 685>>6 byte x \b @ L %u 686# GRR too general as it catches also FoxPro Memo example NG.FPT 687>3 byte 0xB0 MPEG sequence, v4 688# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 689#>>4 byte !0 MPEG sequence, v4 690!:mime video/mpeg4-generic 691>>5 belong 0x000001B5 692>>>9 byte &0x80 693>>>>10 byte&0xF0 16 \b, video 694>>>>10 byte&0xF0 32 \b, still texture 695>>>>10 byte&0xF0 48 \b, mesh 696>>>>10 byte&0xF0 64 \b, face 697>>>9 byte&0xF8 8 \b, video 698>>>9 byte&0xF8 16 \b, still texture 699>>>9 byte&0xF8 24 \b, mesh 700>>>9 byte&0xF8 32 \b, face 701>>4 byte 1 \b, simple @ L1 702>>4 byte 2 \b, simple @ L2 703>>4 byte 3 \b, simple @ L3 704>>4 byte 4 \b, simple @ L0 705>>4 byte 17 \b, simple scalable @ L1 706>>4 byte 18 \b, simple scalable @ L2 707>>4 byte 33 \b, core @ L1 708>>4 byte 34 \b, core @ L2 709>>4 byte 50 \b, main @ L2 710>>4 byte 51 \b, main @ L3 711>>4 byte 53 \b, main @ L4 712>>4 byte 66 \b, n-bit @ L2 713>>4 byte 81 \b, scalable texture @ L1 714>>4 byte 97 \b, simple face animation @ L1 715>>4 byte 98 \b, simple face animation @ L2 716>>4 byte 99 \b, simple face basic animation @ L1 717>>4 byte 100 \b, simple face basic animation @ L2 718>>4 byte 113 \b, basic animation text @ L1 719>>4 byte 114 \b, basic animation text @ L2 720>>4 byte 129 \b, hybrid @ L1 721>>4 byte 130 \b, hybrid @ L2 722>>4 byte 145 \b, advanced RT simple @ L! 723>>4 byte 146 \b, advanced RT simple @ L2 724>>4 byte 147 \b, advanced RT simple @ L3 725>>4 byte 148 \b, advanced RT simple @ L4 726>>4 byte 161 \b, core scalable @ L1 727>>4 byte 162 \b, core scalable @ L2 728>>4 byte 163 \b, core scalable @ L3 729>>4 byte 177 \b, advanced coding efficiency @ L1 730>>4 byte 178 \b, advanced coding efficiency @ L2 731>>4 byte 179 \b, advanced coding efficiency @ L3 732>>4 byte 180 \b, advanced coding efficiency @ L4 733>>4 byte 193 \b, advanced core @ L1 734>>4 byte 194 \b, advanced core @ L2 735>>4 byte 209 \b, advanced scalable texture @ L1 736>>4 byte 210 \b, advanced scalable texture @ L2 737>>4 byte 211 \b, advanced scalable texture @ L3 738>>4 byte 225 \b, simple studio @ L1 739>>4 byte 226 \b, simple studio @ L2 740>>4 byte 227 \b, simple studio @ L3 741>>4 byte 228 \b, simple studio @ L4 742>>4 byte 229 \b, core studio @ L1 743>>4 byte 230 \b, core studio @ L2 744>>4 byte 231 \b, core studio @ L3 745>>4 byte 232 \b, core studio @ L4 746>>4 byte 240 \b, advanced simple @ L0 747>>4 byte 241 \b, advanced simple @ L1 748>>4 byte 242 \b, advanced simple @ L2 749>>4 byte 243 \b, advanced simple @ L3 750>>4 byte 244 \b, advanced simple @ L4 751>>4 byte 245 \b, advanced simple @ L5 752>>4 byte 247 \b, advanced simple @ L3b 753>>4 byte 248 \b, FGS @ L0 754>>4 byte 249 \b, FGS @ L1 755>>4 byte 250 \b, FGS @ L2 756>>4 byte 251 \b, FGS @ L3 757>>4 byte 252 \b, FGS @ L4 758>>4 byte 253 \b, FGS @ L5 759>3 byte 0xB5 MPEG sequence, v4 760!:mime video/mpeg4-generic 761>>4 byte &0x80 762>>>5 byte&0xF0 16 \b, video (missing profile header) 763>>>5 byte&0xF0 32 \b, still texture (missing profile header) 764>>>5 byte&0xF0 48 \b, mesh (missing profile header) 765>>>5 byte&0xF0 64 \b, face (missing profile header) 766>>4 byte&0xF8 8 \b, video (missing profile header) 767>>4 byte&0xF8 16 \b, still texture (missing profile header) 768>>4 byte&0xF8 24 \b, mesh (missing profile header) 769>>4 byte&0xF8 32 \b, face (missing profile header) 770>3 byte 0xB3 MPEG sequence 771!:mime video/mpeg 772>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 773>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 774>>12 belong 0x000001B5 \b, v2, 775>>>16 byte&0x0F 1 \b HP 776>>>16 byte&0x0F 2 \b Spt 777>>>16 byte&0x0F 3 \b SNR 778>>>16 byte&0x0F 4 \b MP 779>>>16 byte&0x0F 5 \b SP 780>>>17 byte&0xF0 64 \b@HL 781>>>17 byte&0xF0 96 \b@H-14 782>>>17 byte&0xF0 128 \b@ML 783>>>17 byte&0xF0 160 \b@LL 784>>>17 byte &0x08 \b progressive 785>>>17 byte ^0x08 \b interlaced 786>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 787>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 788>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 789>>11 byte &0x02 790>>>75 byte &0x01 791>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 792>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 793>>>>140 belong 0x000001B5 \b, v2, 794>>>>>144 byte&0x0F 1 \b HP 795>>>>>144 byte&0x0F 2 \b Spt 796>>>>>144 byte&0x0F 3 \b SNR 797>>>>>144 byte&0x0F 4 \b MP 798>>>>>144 byte&0x0F 5 \b SP 799>>>>>145 byte&0xF0 64 \b@HL 800>>>>>145 byte&0xF0 96 \b@H-14 801>>>>>145 byte&0xF0 128 \b@ML 802>>>>>145 byte&0xF0 160 \b@LL 803>>>>>145 byte &0x08 \b progressive 804>>>>>145 byte ^0x08 \b interlaced 805>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 806>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 807>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 808>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 809>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 810>>76 belong 0x000001B5 \b, v2, 811>>>80 byte&0x0F 1 \b HP 812>>>80 byte&0x0F 2 \b Spt 813>>>80 byte&0x0F 3 \b SNR 814>>>80 byte&0x0F 4 \b MP 815>>>80 byte&0x0F 5 \b SP 816>>>81 byte&0xF0 64 \b@HL 817>>>81 byte&0xF0 96 \b@H-14 818>>>81 byte&0xF0 128 \b@ML 819>>>81 byte&0xF0 160 \b@LL 820>>>81 byte &0x08 \b progressive 821>>>81 byte ^0x08 \b interlaced 822>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 823>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 824>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 825>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 826>>>7 byte&0xF0 0x10 \b, 16:9 827>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 828>>>7 byte&0xF0 0x10 \b, 16:9 829>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 830>>>7 byte&0xF0 0x10 \b, 4:3 831>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 832>>>5 beshort&0x0FFF 0x01E0 \b NTSC 833>>>5 beshort&0x0FFF 0x0240 \b PAL 834>>>7 byte&0xF0 0x20 \b, 4:3 835>>>7 byte&0xF0 0x30 \b, 16:9 836>>>7 byte&0xF0 0x40 \b, 11:5 837>>>7 byte&0xF0 0x80 \b, PAL 4:3 838>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 839>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 840>>>7 byte&0xF0 0x10 \b, 4:3 841>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 842>>>7 byte&0xF0 0x10 \b, 4:3 843>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 844>>>7 byte&0xF0 0x10 \b, 4:3 845>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 846>>>7 byte&0xF0 0x10 \b, 4:3 847>>4 beshort&0xFFF0 0x1600 \b, CIF 848>>>5 beshort&0x0FFF 0x00F0 \b NTSC 849>>>5 beshort&0x0FFF 0x0120 \b PAL 850>>>7 byte&0xF0 0x20 \b, 4:3 851>>>7 byte&0xF0 0x30 \b, 16:9 852>>>7 byte&0xF0 0x40 \b, 11:5 853>>>7 byte&0xF0 0x80 \b, PAL 4:3 854>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 855>>>5 beshort&0x0FFF 0x0240 \b PAL 625 856>>>>7 byte&0xF0 0x20 \b, 4:3 857>>>>7 byte&0xF0 0x30 \b, 16:9 858>>>>7 byte&0xF0 0x40 \b, 11:5 859>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 860>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 861>>>5 beshort&0x0FFF 0x0240 \b PAL 625 862>>>7 byte&0xF0 0x20 \b, 4:3 863>>>7 byte&0xF0 0x30 \b, 16:9 864>>>7 byte&0xF0 0x40 \b, 11:5 865>>4 beshort&0xFFF0 0x1E00 \b, SVCD 866>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 867>>>5 beshort&0x0FFF 0x0240 \b PAL 625 868>>>7 byte&0xF0 0x20 \b, 4:3 869>>>7 byte&0xF0 0x30 \b, 16:9 870>>>7 byte&0xF0 0x40 \b, 11:5 871>>7 byte&0x0F 1 \b, 23.976 fps 872>>7 byte&0x0F 2 \b, 24 fps 873>>7 byte&0x0F 3 \b, 25 fps 874>>7 byte&0x0F 4 \b, 29.97 fps 875>>7 byte&0x0F 5 \b, 30 fps 876>>7 byte&0x0F 6 \b, 50 fps 877>>7 byte&0x0F 7 \b, 59.94 fps 878>>7 byte&0x0F 8 \b, 60 fps 879>>11 byte &0x04 \b, Constrained 880 881# MPEG ADTS Audio (*.mpx/mxa/aac) 882# from dreesen@math.fu-berlin.de 883# modified to fully support MPEG ADTS 884 885# MP3, M1A 886# modified by Joerg Jenderek 887# GRR the original test are too common for many DOS files 888# so don't accept as MP3 until we've tested the rate 8890 beshort&0xFFFE 0xFFFA 890# rates 891>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps 892!:mime audio/mpeg 893>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps 894!:mime audio/mpeg 895>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps 896!:mime audio/mpeg 897>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps 898!:mime audio/mpeg 899>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps 900!:mime audio/mpeg 901>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps 902!:mime audio/mpeg 903>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps 904!:mime audio/mpeg 905>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps 906!:mime audio/mpeg 907>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps 908!:mime audio/mpeg 909>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps 910!:mime audio/mpeg 911>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps 912!:mime audio/mpeg 913>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps 914!:mime audio/mpeg 915>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps 916!:mime audio/mpeg 917>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps 918!:mime audio/mpeg 919# timing 920>2 byte&0x0C 0x00 \b, 44.1 kHz 921>2 byte&0x0C 0x04 \b, 48 kHz 922>2 byte&0x0C 0x08 \b, 32 kHz 923# channels/options 924>3 byte&0xC0 0x00 \b, Stereo 925>3 byte&0xC0 0x40 \b, JntStereo 926>3 byte&0xC0 0x80 \b, 2x Monaural 927>3 byte&0xC0 0xC0 \b, Monaural 928#>1 byte ^0x01 \b, Data Verify 929#>2 byte &0x02 \b, Packet Pad 930#>2 byte &0x01 \b, Custom Flag 931#>3 byte &0x08 \b, Copyrighted 932#>3 byte &0x04 \b, Original Source 933#>3 byte&0x03 1 \b, NR: 50/15 ms 934#>3 byte&0x03 3 \b, NR: CCIT J.17 935 936# MP2, M1A 9370 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 938!:mime audio/mpeg 939# rates 940>2 byte&0xF0 0x10 \b, 32 kbps 941>2 byte&0xF0 0x20 \b, 48 kbps 942>2 byte&0xF0 0x30 \b, 56 kbps 943>2 byte&0xF0 0x40 \b, 64 kbps 944>2 byte&0xF0 0x50 \b, 80 kbps 945>2 byte&0xF0 0x60 \b, 96 kbps 946>2 byte&0xF0 0x70 \b, 112 kbps 947>2 byte&0xF0 0x80 \b, 128 kbps 948>2 byte&0xF0 0x90 \b, 160 kbps 949>2 byte&0xF0 0xA0 \b, 192 kbps 950>2 byte&0xF0 0xB0 \b, 224 kbps 951>2 byte&0xF0 0xC0 \b, 256 kbps 952>2 byte&0xF0 0xD0 \b, 320 kbps 953>2 byte&0xF0 0xE0 \b, 384 kbps 954# timing 955>2 byte&0x0C 0x00 \b, 44.1 kHz 956>2 byte&0x0C 0x04 \b, 48 kHz 957>2 byte&0x0C 0x08 \b, 32 kHz 958# channels/options 959>3 byte&0xC0 0x00 \b, Stereo 960>3 byte&0xC0 0x40 \b, JntStereo 961>3 byte&0xC0 0x80 \b, 2x Monaural 962>3 byte&0xC0 0xC0 \b, Monaural 963#>1 byte ^0x01 \b, Data Verify 964#>2 byte &0x02 \b, Packet Pad 965#>2 byte &0x01 \b, Custom Flag 966#>3 byte &0x08 \b, Copyrighted 967#>3 byte &0x04 \b, Original Source 968#>3 byte&0x03 1 \b, NR: 50/15 ms 969#>3 byte&0x03 3 \b, NR: CCIT J.17 970 971# MPA, M1A 972# updated by Joerg Jenderek 973# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 974# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 975# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 976#0 beshort&0xFFFE 0xFFFE 977#>2 ubyte&0xF0 >0x0F 978#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 979## rate 980#>>>2 byte&0xF0 0x10 \b, 32 kbps 981#>>>2 byte&0xF0 0x20 \b, 64 kbps 982#>>>2 byte&0xF0 0x30 \b, 96 kbps 983#>>>2 byte&0xF0 0x40 \b, 128 kbps 984#>>>2 byte&0xF0 0x50 \b, 160 kbps 985#>>>2 byte&0xF0 0x60 \b, 192 kbps 986#>>>2 byte&0xF0 0x70 \b, 224 kbps 987#>>>2 byte&0xF0 0x80 \b, 256 kbps 988#>>>2 byte&0xF0 0x90 \b, 288 kbps 989#>>>2 byte&0xF0 0xA0 \b, 320 kbps 990#>>>2 byte&0xF0 0xB0 \b, 352 kbps 991#>>>2 byte&0xF0 0xC0 \b, 384 kbps 992#>>>2 byte&0xF0 0xD0 \b, 416 kbps 993#>>>2 byte&0xF0 0xE0 \b, 448 kbps 994## timing 995#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 996#>>>2 byte&0x0C 0x04 \b, 48 kHz 997#>>>2 byte&0x0C 0x08 \b, 32 kHz 998## channels/options 999#>>>3 byte&0xC0 0x00 \b, Stereo 1000#>>>3 byte&0xC0 0x40 \b, JntStereo 1001#>>>3 byte&0xC0 0x80 \b, 2x Monaural 1002#>>>3 byte&0xC0 0xC0 \b, Monaural 1003##>1 byte ^0x01 \b, Data Verify 1004##>2 byte &0x02 \b, Packet Pad 1005##>2 byte &0x01 \b, Custom Flag 1006##>3 byte &0x08 \b, Copyrighted 1007##>3 byte &0x04 \b, Original Source 1008##>3 byte&0x03 1 \b, NR: 50/15 ms 1009##>3 byte&0x03 3 \b, NR: CCIT J.17 1010 1011# MP3, M2A 10120 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 1013!:mime audio/mpeg 1014# rate 1015>2 byte&0xF0 0x10 \b, 8 kbps 1016>2 byte&0xF0 0x20 \b, 16 kbps 1017>2 byte&0xF0 0x30 \b, 24 kbps 1018>2 byte&0xF0 0x40 \b, 32 kbps 1019>2 byte&0xF0 0x50 \b, 40 kbps 1020>2 byte&0xF0 0x60 \b, 48 kbps 1021>2 byte&0xF0 0x70 \b, 56 kbps 1022>2 byte&0xF0 0x80 \b, 64 kbps 1023>2 byte&0xF0 0x90 \b, 80 kbps 1024>2 byte&0xF0 0xA0 \b, 96 kbps 1025>2 byte&0xF0 0xB0 \b, 112 kbps 1026>2 byte&0xF0 0xC0 \b, 128 kbps 1027>2 byte&0xF0 0xD0 \b, 144 kbps 1028>2 byte&0xF0 0xE0 \b, 160 kbps 1029# timing 1030>2 byte&0x0C 0x00 \b, 22.05 kHz 1031>2 byte&0x0C 0x04 \b, 24 kHz 1032>2 byte&0x0C 0x08 \b, 16 kHz 1033# channels/options 1034>3 byte&0xC0 0x00 \b, Stereo 1035>3 byte&0xC0 0x40 \b, JntStereo 1036>3 byte&0xC0 0x80 \b, 2x Monaural 1037>3 byte&0xC0 0xC0 \b, Monaural 1038#>1 byte ^0x01 \b, Data Verify 1039#>2 byte &0x02 \b, Packet Pad 1040#>2 byte &0x01 \b, Custom Flag 1041#>3 byte &0x08 \b, Copyrighted 1042#>3 byte &0x04 \b, Original Source 1043#>3 byte&0x03 1 \b, NR: 50/15 ms 1044#>3 byte&0x03 3 \b, NR: CCIT J.17 1045 1046# MP2, M2A 10470 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 1048!:mime audio/mpeg 1049# rate 1050>2 byte&0xF0 0x10 \b, 8 kbps 1051>2 byte&0xF0 0x20 \b, 16 kbps 1052>2 byte&0xF0 0x30 \b, 24 kbps 1053>2 byte&0xF0 0x40 \b, 32 kbps 1054>2 byte&0xF0 0x50 \b, 40 kbps 1055>2 byte&0xF0 0x60 \b, 48 kbps 1056>2 byte&0xF0 0x70 \b, 56 kbps 1057>2 byte&0xF0 0x80 \b, 64 kbps 1058>2 byte&0xF0 0x90 \b, 80 kbps 1059>2 byte&0xF0 0xA0 \b, 96 kbps 1060>2 byte&0xF0 0xB0 \b, 112 kbps 1061>2 byte&0xF0 0xC0 \b, 128 kbps 1062>2 byte&0xF0 0xD0 \b, 144 kbps 1063>2 byte&0xF0 0xE0 \b, 160 kbps 1064# timing 1065>2 byte&0x0C 0x00 \b, 22.05 kHz 1066>2 byte&0x0C 0x04 \b, 24 kHz 1067>2 byte&0x0C 0x08 \b, 16 kHz 1068# channels/options 1069>3 byte&0xC0 0x00 \b, Stereo 1070>3 byte&0xC0 0x40 \b, JntStereo 1071>3 byte&0xC0 0x80 \b, 2x Monaural 1072>3 byte&0xC0 0xC0 \b, Monaural 1073#>1 byte ^0x01 \b, Data Verify 1074#>2 byte &0x02 \b, Packet Pad 1075#>2 byte &0x01 \b, Custom Flag 1076#>3 byte &0x08 \b, Copyrighted 1077#>3 byte &0x04 \b, Original Source 1078#>3 byte&0x03 1 \b, NR: 50/15 ms 1079#>3 byte&0x03 3 \b, NR: CCIT J.17 1080 1081# MPA, M2A 10820 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 1083!:mime audio/mpeg 1084# rate 1085>2 byte&0xF0 0x10 \b, 32 kbps 1086>2 byte&0xF0 0x20 \b, 48 kbps 1087>2 byte&0xF0 0x30 \b, 56 kbps 1088>2 byte&0xF0 0x40 \b, 64 kbps 1089>2 byte&0xF0 0x50 \b, 80 kbps 1090>2 byte&0xF0 0x60 \b, 96 kbps 1091>2 byte&0xF0 0x70 \b, 112 kbps 1092>2 byte&0xF0 0x80 \b, 128 kbps 1093>2 byte&0xF0 0x90 \b, 144 kbps 1094>2 byte&0xF0 0xA0 \b, 160 kbps 1095>2 byte&0xF0 0xB0 \b, 176 kbps 1096>2 byte&0xF0 0xC0 \b, 192 kbps 1097>2 byte&0xF0 0xD0 \b, 224 kbps 1098>2 byte&0xF0 0xE0 \b, 256 kbps 1099# timing 1100>2 byte&0x0C 0x00 \b, 22.05 kHz 1101>2 byte&0x0C 0x04 \b, 24 kHz 1102>2 byte&0x0C 0x08 \b, 16 kHz 1103# channels/options 1104>3 byte&0xC0 0x00 \b, Stereo 1105>3 byte&0xC0 0x40 \b, JntStereo 1106>3 byte&0xC0 0x80 \b, 2x Monaural 1107>3 byte&0xC0 0xC0 \b, Monaural 1108#>1 byte ^0x01 \b, Data Verify 1109#>2 byte &0x02 \b, Packet Pad 1110#>2 byte &0x01 \b, Custom Flag 1111#>3 byte &0x08 \b, Copyrighted 1112#>3 byte &0x04 \b, Original Source 1113#>3 byte&0x03 1 \b, NR: 50/15 ms 1114#>3 byte&0x03 3 \b, NR: CCIT J.17 1115 1116# MP3, M25A 11170 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 1118!:mime audio/mpeg 1119# rate 1120>2 byte&0xF0 0x10 \b, 8 kbps 1121>2 byte&0xF0 0x20 \b, 16 kbps 1122>2 byte&0xF0 0x30 \b, 24 kbps 1123>2 byte&0xF0 0x40 \b, 32 kbps 1124>2 byte&0xF0 0x50 \b, 40 kbps 1125>2 byte&0xF0 0x60 \b, 48 kbps 1126>2 byte&0xF0 0x70 \b, 56 kbps 1127>2 byte&0xF0 0x80 \b, 64 kbps 1128>2 byte&0xF0 0x90 \b, 80 kbps 1129>2 byte&0xF0 0xA0 \b, 96 kbps 1130>2 byte&0xF0 0xB0 \b, 112 kbps 1131>2 byte&0xF0 0xC0 \b, 128 kbps 1132>2 byte&0xF0 0xD0 \b, 144 kbps 1133>2 byte&0xF0 0xE0 \b, 160 kbps 1134# timing 1135>2 byte&0x0C 0x00 \b, 11.025 kHz 1136>2 byte&0x0C 0x04 \b, 12 kHz 1137>2 byte&0x0C 0x08 \b, 8 kHz 1138# channels/options 1139>3 byte&0xC0 0x00 \b, Stereo 1140>3 byte&0xC0 0x40 \b, JntStereo 1141>3 byte&0xC0 0x80 \b, 2x Monaural 1142>3 byte&0xC0 0xC0 \b, Monaural 1143#>1 byte ^0x01 \b, Data Verify 1144#>2 byte &0x02 \b, Packet Pad 1145#>2 byte &0x01 \b, Custom Flag 1146#>3 byte &0x08 \b, Copyrighted 1147#>3 byte &0x04 \b, Original Source 1148#>3 byte&0x03 1 \b, NR: 50/15 ms 1149#>3 byte&0x03 3 \b, NR: CCIT J.17 1150 1151# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 1152 1153# Stored AAC streams (instead of the MP4 format) 11540 string ADIF MPEG ADIF, AAC 1155!:mime audio/x-hx-aac-adif 1156>4 byte &0x80 1157>>13 byte &0x10 \b, VBR 1158>>13 byte ^0x10 \b, CBR 1159>>16 byte&0x1E 0x02 \b, single stream 1160>>16 byte&0x1E 0x04 \b, 2 streams 1161>>16 byte&0x1E 0x06 \b, 3 streams 1162>>16 byte &0x08 \b, 4 or more streams 1163>>16 byte &0x10 \b, 8 or more streams 1164>>4 byte &0x80 \b, Copyrighted 1165>>13 byte &0x40 \b, Original Source 1166>>13 byte &0x20 \b, Home Flag 1167>4 byte ^0x80 1168>>4 byte &0x10 \b, VBR 1169>>4 byte ^0x10 \b, CBR 1170>>7 byte&0x1E 0x02 \b, single stream 1171>>7 byte&0x1E 0x04 \b, 2 streams 1172>>7 byte&0x1E 0x06 \b, 3 streams 1173>>7 byte &0x08 \b, 4 or more streams 1174>>7 byte &0x10 \b, 8 or more streams 1175>>4 byte &0x40 \b, Original Stream(s) 1176>>4 byte &0x20 \b, Home Source 1177 1178# Live or stored single AAC stream (used with MPEG-2 systems) 11790 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 1180!:mime audio/x-hx-aac-adts 1181>1 byte &0x08 \b, v2 1182>1 byte ^0x08 \b, v4 1183# profile 1184>>2 byte &0xC0 \b LTP 1185>2 byte&0xc0 0x00 \b Main 1186>2 byte&0xc0 0x40 \b LC 1187>2 byte&0xc0 0x80 \b SSR 1188# timing 1189>2 byte&0x3c 0x00 \b, 96 kHz 1190>2 byte&0x3c 0x04 \b, 88.2 kHz 1191>2 byte&0x3c 0x08 \b, 64 kHz 1192>2 byte&0x3c 0x0c \b, 48 kHz 1193>2 byte&0x3c 0x10 \b, 44.1 kHz 1194>2 byte&0x3c 0x14 \b, 32 kHz 1195>2 byte&0x3c 0x18 \b, 24 kHz 1196>2 byte&0x3c 0x1c \b, 22.05 kHz 1197>2 byte&0x3c 0x20 \b, 16 kHz 1198>2 byte&0x3c 0x24 \b, 12 kHz 1199>2 byte&0x3c 0x28 \b, 11.025 kHz 1200>2 byte&0x3c 0x2c \b, 8 kHz 1201# channels 1202>2 beshort&0x01c0 0x0040 \b, monaural 1203>2 beshort&0x01c0 0x0080 \b, stereo 1204>2 beshort&0x01c0 0x00c0 \b, stereo + center 1205>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1206>2 beshort&0x01c0 0x0140 \b, surround 1207>2 beshort&0x01c0 0x0180 \b, surround + LFE 1208>2 beshort &0x01C0 \b, surround + side 1209#>1 byte ^0x01 \b, Data Verify 1210#>2 byte &0x02 \b, Custom Flag 1211#>3 byte &0x20 \b, Original Stream 1212#>3 byte &0x10 \b, Home Source 1213#>3 byte &0x08 \b, Copyrighted 1214 1215# Live MPEG-4 audio streams (instead of RTP FlexMux) 12160 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1217!:mime audio/x-mp4a-latm 1218#>1 beshort&0x1FFF x \b, %hu byte packet 1219>3 byte&0xE0 0x40 1220>>4 byte&0x3C 0x04 \b, single stream 1221>>4 byte&0x3C 0x08 \b, 2 streams 1222>>4 byte&0x3C 0x0C \b, 3 streams 1223>>4 byte &0x08 \b, 4 or more streams 1224>>4 byte &0x20 \b, 8 or more streams 1225>3 byte&0xC0 0 1226>>4 byte&0x78 0x08 \b, single stream 1227>>4 byte&0x78 0x10 \b, 2 streams 1228>>4 byte&0x78 0x18 \b, 3 streams 1229>>4 byte &0x20 \b, 4 or more streams 1230>>4 byte &0x40 \b, 8 or more streams 1231# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1232#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1233#!:mime audio/x-mp4a-latm 1234 1235# Summary: FLI animation format 1236# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1237# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 12384 leshort 0xAF11 1239# standard FLI always has 320x200 resolution and 8 bit color 1240>8 leshort 320 1241>>10 leshort 200 1242>>>12 leshort 8 FLI animation, 320x200x8 1243!:mime video/x-fli 1244>>>>6 leshort x \b, %d frames 1245# frame speed is multiple of 1/70s 1246>>>>16 leshort x \b, %d/70s per frame 1247 1248# Summary: FLC animation format 1249# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1250# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 12514 leshort 0xAF12 1252# standard FLC always use 8 bit color 1253>12 leshort 8 FLC animation 1254!:mime video/x-flc 1255>>8 leshort x \b, %d 1256>>10 leshort x \bx%dx8 1257>>6 uleshort x \b, %d frames 1258>>16 uleshort x \b, %dms per frame 1259 1260# DL animation format 1261# XXX - collision with most `mips' magic 1262# 1263# I couldn't find a real magic number for these, however, this 1264# -appears- to work. Note that it might catch other files, too, so be 1265# careful! 1266# 1267# Note that title and author appear in the two 20-byte chunks 1268# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1269# 255 (hex FF)! The DL format is really bad. 1270# 1271#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1272#!:mime video/x-unknown 1273#>42 byte x - %d screens, 1274#>43 byte x %d commands 1275#0 byte 2 DL version 2 1276#!:mime video/x-unknown 1277#>1 byte 1 - large format (320x200,1 image/screen), 1278#>1 byte 2 - medium format (160x100,4 images/screen), 1279#>1 byte >2 - unknown format, 1280#>42 byte x %d screens, 1281#>43 byte x %d commands 1282# Based on empirical evidence, DL version 3 have several nulls following the 1283# \003. Most of them start with non-null values at hex offset 0x34 or so. 1284#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1285 1286# iso 13818 transport stream 1287# 1288# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1289# syncbyte 8 bit 0x47 1290# error_ind 1 bit - 1291# payload_start 1 bit 1 1292# priority 1 bit - 1293# PID 13 bit 0x0000 1294# scrambling 2 bit - 1295# adaptfld_ctrl 2 bit 1 or 3 1296# conti_count 4 bit - 12970 belong&0xFF5FFF10 0x47400010 1298>188 byte 0x47 MPEG transport stream data 1299 1300# DIF digital video file format <mpruett@sgi.com> 13010 belong&0xffffff00 0x1f070000 DIF 1302>4 byte &0x01 (DVCPRO) movie file 1303>4 byte ^0x01 (DV) movie file 1304>3 byte &0x80 (PAL) 1305>3 byte ^0x80 (NTSC) 1306 1307# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 13080 belong 0x3026b275 Microsoft ASF 1309!:mime video/x-ms-asf 1310 1311# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 13120 string \x8aMNG MNG video data, 1313!:mime video/x-mng 1314>4 belong !0x0d0a1a0a CORRUPTED, 1315>4 belong 0x0d0a1a0a 1316>>16 belong x %d x 1317>>20 belong x %d 1318 1319# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 13200 string \x8bJNG JNG video data, 1321!:mime video/x-jng 1322>4 belong !0x0d0a1a0a CORRUPTED, 1323>4 belong 0x0d0a1a0a 1324>>16 belong x %d x 1325>>20 belong x %d 1326 1327# Vivo video (Wolfram Kleff) 13283 string \x0D\x0AVersion:Vivo Vivo video data 1329 1330# VRML (Virtual Reality Modelling Language) 13310 string/w #VRML\ V1.0\ ascii VRML 1 file 1332!:mime model/vrml 13330 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1334!:mime model/vrml 1335 1336# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] 1337# From Michel Briand <michelbriand@free.fr> 13380 string/t \<?xml\ version=" 1339!:strength +1 1340>20 search/1000/cw \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1341!:mime model/x3d 1342 1343#--------------------------------------------------------------------------- 1344# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1345# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1346# 13470 string HVQM4 %s 1348>6 string >\0 v%s 1349>0 byte x GameCube movie, 1350>0x34 ubeshort x %d x 1351>0x36 ubeshort x %d, 1352>0x26 ubeshort x %dus, 1353>0x42 ubeshort 0 no audio 1354>0x42 ubeshort >0 %dHz audio 1355 1356# From: "Stefan A. Haubenthal" <polluks@web.de> 13570 string DVDVIDEO-VTS Video title set, 1358>0x21 byte x v%x 13590 string DVDVIDEO-VMG Video manager, 1360>0x21 byte x v%x 1361 1362# From: Behan Webster <behanw@websterwood.com> 1363# NuppelVideo used by Mythtv (*.nuv) 1364# Note: there are two identical stanzas here differing only in the 1365# initial string matched. It used to be done with a regex, but we're 1366# trying to get rid of those. 13670 string NuppelVideo MythTV NuppelVideo 1368>12 string x v%s 1369>20 lelong x (%d 1370>24 lelong x \bx%d), 1371>36 string P \bprogressive, 1372>36 string I \binterlaced, 1373>40 ledouble x \baspect:%.2f, 1374>48 ledouble x \bfps:%.2f 13750 string MythTV MythTV NuppelVideo 1376>12 string x v%s 1377>20 lelong x (%d 1378>24 lelong x \bx%d), 1379>36 string P \bprogressive, 1380>36 string I \binterlaced, 1381>40 ledouble x \baspect:%.2f, 1382>48 ledouble x \bfps:%.2f 1383 1384# MPEG file 1385# MPEG sequences 1386# FIXME: This section is from the old magic.mime file and needs 1387# integrating with the rest 1388#0 belong 0x000001BA 1389#>4 byte &0x40 1390#!:mime video/mp2p 1391#>4 byte ^0x40 1392#!:mime video/mpeg 1393#0 belong 0x000001BB 1394#!:mime video/mpeg 1395#0 belong 0x000001B0 1396#!:mime video/mp4v-es 1397#0 belong 0x000001B5 1398#!:mime video/mp4v-es 1399#0 belong 0x000001B3 1400#!:mime video/mpv 1401#0 belong&0xFF5FFF10 0x47400010 1402#!:mime video/mp2t 1403#0 belong 0x00000001 1404#>4 byte&0x1F 0x07 1405#!:mime video/h264 1406 1407# Type: Bink Video 1408# Extension: .bik 1409# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container 1410# From: <hoehle@users.sourceforge.net> 2008-07-18 14110 string BIK Bink Video 1412>3 regex =[a-z] rev.%s 1413#>4 ulelong x size %d 1414>20 ulelong x \b, %d 1415>24 ulelong x \bx%d 1416>8 ulelong x \b, %d frames 1417>32 ulelong x at rate %d/ 1418>28 ulelong >1 \b%d 1419>40 ulelong =0 \b, no audio 1420>40 ulelong !0 \b, %d audio track 1421>>40 ulelong !1 \bs 1422# follow properties of the first audio track only 1423>>48 uleshort x %dHz 1424>>51 byte&0x20 0 mono 1425>>51 byte&0x20 !0 stereo 1426#>>51 byte&0x10 0 FFT 1427#>>51 byte&0x10 !0 DCT 1428 1429# Type: NUT Container 1430# URL: http://wiki.multimedia.cx/index.php?title=NUT 1431# From: Adam Buchbinder <adam.buchbinder@gmail.com> 14320 string nut/multimedia\ container\0 NUT multimedia container 1433 1434# Type: Nullsoft Video (NSV) 1435# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1436# From: Mike Melanson <mike@multimedia.cx> 14370 string NSVf Nullsoft Video 1438 1439# Type: REDCode Video 1440# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode 1441# From: Mike Melanson <mike@multimedia.cx> 14424 string RED1 REDCode Video 1443 1444# Type: MTV Multimedia File 1445# URL: http://wiki.multimedia.cx/index.php?title=MTV 1446# From: Mike Melanson <mike@multimedia.cx> 14470 string AMVS MTV Multimedia File 1448 1449# Type: ARMovie 1450# URL: http://wiki.multimedia.cx/index.php?title=ARMovie 1451# From: Mike Melanson <mike@multimedia.cx> 14520 string ARMovie\012 ARMovie 1453 1454# Type: Interplay MVE Movie 1455# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE 1456# From: Mike Melanson <mike@multimedia.cx> 14570 string Interplay\040MVE\040File\032 Interplay MVE Movie 1458 1459# Type: Windows Television DVR File 1460# URL: http://wiki.multimedia.cx/index.php?title=WTV 1461# From: Mike Melanson <mike@mutlimedia.cx> 1462# This takes the form of a Windows-style GUID 14630 bequad 0xB7D800203749DA11 1464>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1465 1466# Type: Sega FILM/CPK Multimedia 1467# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM 1468# From: Mike Melanson <mike@multimedia.cx> 14690 string FILM Sega FILM/CPK Multimedia, 1470>32 belong x %d x 1471>28 belong x %d 1472 1473# Type: Nintendo THP Multimedia 1474# URL: http://wiki.multimedia.cx/index.php?title=THP 1475# From: Mike Melanson <mike@multimedia.cx> 14760 string THP\0 Nintendo THP Multimedia 1477 1478# Type: BBC Dirac Video 1479# URL: http://wiki.multimedia.cx/index.php?title=Dirac 1480# From: Mike Melanson <mike@multimedia.cx> 14810 string BBCD BBC Dirac Video 1482 1483# Type: RAD Game Tools Smacker Multimedia 1484# URL: http://wiki.multimedia.cx/index.php?title=Smacker 1485# From: Mike Melanson <mike@multimedia.cx> 14860 string SMK RAD Game Tools Smacker Multimedia 1487>3 byte x version %c, 1488>4 lelong x %d x 1489>8 lelong x %d, 1490>12 lelong x %d frames 1491 1492#------------------------------------------------------------------------------ 1493# $File$ 1494# aout: file(1) magic for a.out executable/object/etc entries that 1495# handle executables on multiple platforms. 1496# 1497 1498# 1499# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1500# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1501# 1502# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1503# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1504# works only for binaries using shared libraries. Grabbing the entry 1505# point from the a.out header, using it to find the first code executed 1506# in the program, and looking at that might help. 1507# 15080 lelong 0407 a.out little-endian 32-bit executable 1509>16 lelong >0 not stripped 1510>32 byte 0x6a (uses BSD/OS shared libs) 1511 15120 lelong 0410 a.out little-endian 32-bit pure executable 1513>16 lelong >0 not stripped 1514>32 byte 0x6a (uses BSD/OS shared libs) 1515 15160 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1517>16 lelong >0 not stripped 1518>32 byte 0x6a (uses BSD/OS shared libs) 1519 1520# 1521# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1522# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1523# 1524# XXX - is there anything we can look at to distinguish old SunOS 68010 1525# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1526# the first instruction or instructions in the program. 1527# 15280 belong 0407 a.out big-endian 32-bit executable 1529>16 belong >0 not stripped 1530 15310 belong 0410 a.out big-endian 32-bit pure executable 1532>16 belong >0 not stripped 1533 15340 belong 0413 a.out big-endian 32-bit demand paged executable 1535>16 belong >0 not stripped 1536 1537 1538#------------------------------------------------------------------------------ 1539# $File$ 1540# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1541# workspaces) 1542# 15430 long 0100554 APL workspace (Ken's original?) 1544 1545#------------------------------------------------------------------------------ 1546# $File: apple,v 1.28 2014/04/28 12:04:50 christos Exp $ 1547# apple: file(1) magic for Apple file formats 1548# 15490 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 15500 string \x0aGL Binary II (apple ][) data 15510 string \x76\xff Squeezed (apple ][) data 15520 string NuFile NuFile archive (apple ][) data 15530 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 15540 belong 0x00051600 AppleSingle encoded Macintosh file 15550 belong 0x00051607 AppleDouble encoded Macintosh file 1556 1557# Type: Apple Emulator 2IMG format 1558# From: Radek Vokal <rvokal@redhat.com> 15590 string 2IMG Apple ][ 2IMG Disk Image 1560>4 string XGS! \b, XGS 1561>4 string CTKG \b, Catakig 1562>4 string ShIm \b, Sheppy's ImageMaker 1563>4 string WOOF \b, Sweet 16 1564>4 string B2TR \b, Bernie ][ the Rescue 1565>4 string !nfc \b, ASIMOV2 1566>4 string x \b, Unknown Format 1567>0xc byte 00 \b, DOS 3.3 sector order 1568>>0x10 byte 00 \b, Volume 254 1569>>0x10 byte&0x7f x \b, Volume %u 1570>0xc byte 01 \b, ProDOS sector order 1571>>0x14 short x \b, %u Blocks 1572>0xc byte 02 \b, NIB data 1573 1574# magic for Newton PDA package formats 1575# from Ruda Moura <ruda@helllabs.org> 15760 string package0 Newton package, NOS 1.x, 1577>12 belong &0x80000000 AutoRemove, 1578>12 belong &0x40000000 CopyProtect, 1579>12 belong &0x10000000 NoCompression, 1580>12 belong &0x04000000 Relocation, 1581>12 belong &0x02000000 UseFasterCompression, 1582>16 belong x version %d 1583 15840 string package1 Newton package, NOS 2.x, 1585>12 belong &0x80000000 AutoRemove, 1586>12 belong &0x40000000 CopyProtect, 1587>12 belong &0x10000000 NoCompression, 1588>12 belong &0x04000000 Relocation, 1589>12 belong &0x02000000 UseFasterCompression, 1590>16 belong x version %d 1591 15920 string package4 Newton package, 1593>8 byte 8 NOS 1.x, 1594>8 byte 9 NOS 2.x, 1595>12 belong &0x80000000 AutoRemove, 1596>12 belong &0x40000000 CopyProtect, 1597>12 belong &0x10000000 NoCompression, 1598 1599# The following entries for the Apple II are for files that have 1600# been transferred as raw binary data from an Apple, without having 1601# been encapsulated by any of the above archivers. 1602# 1603# In general, Apple II formats are hard to identify because Apple DOS 1604# and especially Apple ProDOS have strong typing in the file system and 1605# therefore programmers never felt much need to include type information 1606# in the files themselves. 1607# 1608# Eric Fischer <enf@pobox.com> 1609 1610# AppleWorks word processor: 1611# 1612# This matches the standard tab stops for an AppleWorks file, but if 1613# a file has a tab stop set in the first four columns this will fail. 1614# 1615# The "O" is really the magic number, but that's so common that it's 1616# necessary to check the tab stops that follow it to avoid false positives. 1617 16184 string O==== AppleWorks word processor data 1619>85 byte&0x01 >0 \b, zoomed 1620>90 byte&0x01 >0 \b, paginated 1621>92 byte&0x01 >0 \b, with mail merge 1622#>91 byte x \b, left margin %d 1623 1624# AppleWorks database: 1625# 1626# This isn't really a magic number, but it's the closest thing to one 1627# that I could find. The 1 and 2 really mean "order in which you defined 1628# categories" and "left to right, top to bottom," respectively; the D and R 1629# mean that the cursor should move either down or right when you press Return. 1630 1631#30 string \x01D AppleWorks database data 1632#30 string \x02D AppleWorks database data 1633#30 string \x01R AppleWorks database data 1634#30 string \x02R AppleWorks database data 1635 1636# AppleWorks spreadsheet: 1637# 1638# Likewise, this isn't really meant as a magic number. The R or C means 1639# row- or column-order recalculation; the A or M means automatic or manual 1640# recalculation. 1641 1642#131 string RA AppleWorks spreadsheet data 1643#131 string RM AppleWorks spreadsheet data 1644#131 string CA AppleWorks spreadsheet data 1645#131 string CM AppleWorks spreadsheet data 1646 1647# Applesoft BASIC: 1648# 1649# This is incredibly sloppy, but will be true if the program was 1650# written at its usual memory location of 2048 and its first line 1651# number is less than 256. Yuck. 1652# update by Joerg Jenderek at Feb 2013 1653 1654# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 1655#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 16560 belong&0x00ff00ff 0x00080000 1657# assuming that line number must be positive 1658>2 leshort >0 Applesoft BASIC program data, first line number %d 1659#>2 leshort x \b, first line number %d 1660 1661# ORCA/EZ assembler: 1662# 1663# This will not identify ORCA/M source files, since those have 1664# some sort of date code instead of the two zero bytes at 6 and 7 1665# XXX Conflicts with ELF 1666#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1667#>5 byte x \b, build number %d 1668 1669# Broderbund Fantavision 1670# 1671# I don't know what these values really mean, but they seem to recur. 1672# Will they cause too many conflicts? 1673 1674# Probably :-) 1675#2 belong&0xFF00FF 0x040008 Fantavision movie data 1676 1677# Some attempts at images. 1678# 1679# These are actually just bit-for-bit dumps of the frame buffer, so 1680# there's really no reasonably way to distinguish them except for their 1681# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1682# or, occasionally, 8184. 1683# 1684# Nevertheless this will manage to catch a lot of images that happen 1685# to have a solid-colored line at the bottom of the screen. 1686 1687# GRR: Magic too weak 1688#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1689#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 1690#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 1691#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 1692#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 1693 1694# Beagle Bros. Apple Mechanic fonts 1695 16960 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 1697 1698# Apple Universal Disk Image Format (UDIF) - dmg files. 1699# From Johan Gade. 1700# These entries are disabled for now until we fix the following issues. 1701# 1702# Note there might be some problems with the "VAX COFF executable" 1703# entry. Note this entry should be placed before the mac filesystem section, 1704# particularly the "Apple Partition data" entry. 1705# 1706# The intended meaning of these tests is, that the file is only of the 1707# specified type if both of the lines are correct - i.e. if the first 1708# line matches and the second doesn't then it is not of that type. 1709# 1710#0 long 0x7801730d 1711#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 1712# 1713# Note that this entry is recognized correctly by the "Apple Partition 1714# data" entry - however since this entry is more specific - this 1715# information seems to be more useful. 1716#0 long 0x45520200 1717#>0x410 string disk\ image UDIF read/write image (UDRW) 1718 1719# From: Toby Peterson <toby@apple.com> 17200 string bplist00 Apple binary property list 1721 1722# Apple binary property list (bplist) 1723# Assumes version bytes are hex. 1724# Provides content hints for version 0 files. Assumes that the root 1725# object is the first object (true for CoreFoundation implementation). 1726# From: David Remahl <dremahl@apple.com> 17270 string bplist 1728>6 byte x \bCoreFoundation binary property list data, version 0x%c 1729>>7 byte x \b%c 1730>6 string 00 \b 1731>>8 byte&0xF0 0x00 \b 1732>>>8 byte&0x0F 0x00 \b, root type: null 1733>>>8 byte&0x0F 0x08 \b, root type: false boolean 1734>>>8 byte&0x0F 0x09 \b, root type: true boolean 1735>>8 byte&0xF0 0x10 \b, root type: integer 1736>>8 byte&0xF0 0x20 \b, root type: real 1737>>8 byte&0xF0 0x30 \b, root type: date 1738>>8 byte&0xF0 0x40 \b, root type: data 1739>>8 byte&0xF0 0x50 \b, root type: ascii string 1740>>8 byte&0xF0 0x60 \b, root type: unicode string 1741>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 1742>>8 byte&0xF0 0xa0 \b, root type: array 1743>>8 byte&0xF0 0xd0 \b, root type: dictionary 1744 1745# Apple/NeXT typedstream data 1746# Serialization format used by NeXT and Apple for various 1747# purposes in YellowStep/Cocoa, including some nib files. 1748# From: David Remahl <dremahl@apple.com> 17492 string typedstream NeXT/Apple typedstream data, big endian 1750>0 byte x \b, version %d 1751>0 byte <5 \b 1752>>13 byte 0x81 \b 1753>>>14 ubeshort x \b, system %d 17542 string streamtyped NeXT/Apple typedstream data, little endian 1755>0 byte x \b, version %d 1756>0 byte <5 \b 1757>>13 byte 0x81 \b 1758>>>14 uleshort x \b, system %d 1759 1760#------------------------------------------------------------------------------ 1761# CAF: Apple CoreAudio File Format 1762# 1763# Container format for high-end audio purposes. 1764# From: David Remahl <dremahl@apple.com> 1765# 17660 string caff CoreAudio Format audio file 1767>4 beshort <10 version %d 1768>6 beshort x 1769 1770 1771#------------------------------------------------------------------------------ 1772# Keychain database files 17730 string kych Mac OS X Keychain File 1774 1775#------------------------------------------------------------------------------ 1776# Code Signing related file types 17770 belong 0xfade0c00 Mac OS X Code Requirement 1778>8 belong 1 (opExpr) 1779>4 belong x - %d bytes 1780 17810 belong 0xfade0c01 Mac OS X Code Requirement Set 1782>8 belong >1 containing %d items 1783>4 belong x - %d bytes 1784 17850 belong 0xfade0c02 Mac OS X Code Directory 1786>8 belong x version %x 1787>12 belong >0 flags 0x%x 1788>4 belong x - %d bytes 1789 17900 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 1791>4 belong x - %d bytes 1792 17930 belong 0xfade0cc1 Mac OS X Detached Code Signature 1794>8 belong >1 (%d elements) 1795>4 belong x - %d bytes 1796 1797# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1798# .vdi 17994 string innotek\ VirtualBox\ Disk\ Image %s 1800 1801# Apple disk partition stuff, strengthen the magic using byte 4 18020 beshort 0x4552 1803>4 byte 0 Apple Driver Map 1804>>2 beshort x \b, blocksize %d 1805>>4 belong x \b, blockcount %d 1806>>10 beshort x \b, devtype %d 1807>>12 beshort x \b, devid %d 1808>>20 beshort x \b, descriptors %d 1809# Assume 8 partitions each at a multiple of the sector size. 1810# We could glean this from the partition descriptors, but they are empty!?!? 1811>>(2.S*1) indirect \b, contains[@0x%x]: 1812>>(2.S*2) indirect \b, contains[@0x%x]: 1813>>(2.S*3) indirect \b, contains[@0x%x]: 1814>>(2.S*4) indirect \b, contains[@0x%x]: 1815>>(2.S*5) indirect \b, contains[@0x%x]: 1816>>(2.S*6) indirect \b, contains[@0x%x]: 1817>>(2.S*7) indirect \b, contains[@0x%x]: 1818>>(2.S*8) indirect \b, contains[@0x%x]: 1819 1820# Yes, the 3rd and 4th bytes are reserved, but we use them to make the 1821# magic stronger. 18220 belong 0x504d0000 Apple Partition Map 1823>4 belong x \b, map block count %d 1824>8 belong x \b, start block %d 1825>12 belong x \b, block count %d 1826>16 string >0 \b, name %s 1827>48 string >0 \b, type %s 1828>124 string >0 \b, processor %s 1829>140 string >0 \b, boot arguments %s 1830>92 belong & 1 \b, valid 1831>92 belong & 2 \b, allocated 1832>92 belong & 4 \b, in use 1833>92 belong & 8 \b, has boot info 1834>92 belong & 16 \b, readable 1835>92 belong & 32 \b, writable 1836>92 belong & 64 \b, pic boot code 1837>92 belong & 128 \b, chain compatible driver 1838>92 belong & 256 \b, real driver 1839>92 belong & 512 \b, chain driver 1840>92 belong & 1024 \b, mount at startup 1841>92 belong & 2048 \b, is the startup partition 1842 1843#http://wiki.mozilla.org/DS_Store_File_Format` 1844#http://en.wikipedia.org/wiki/.DS_Store 18450 string \0\0\0\1Bud1\0 Apple Desktop Services Store 1846 1847#------------------------------------------------------------------------------ 1848# $File$ 1849# applix: file(1) magic for Applixware 1850# From: Peter Soos <sp@osb.hu> 1851# 18520 string *BEGIN Applixware 1853>7 string WORDS Words Document 1854>7 string GRAPHICS Graphic 1855>7 string RASTER Bitmap 1856>7 string SPREADSHEETS Spreadsheet 1857>7 string MACRO Macro 1858>7 string BUILDER Builder Object 1859#------------------------------------------------------------------------------ 1860# $File: archive,v 1.87 2014/06/03 19:15:58 christos Exp $ 1861# archive: file(1) magic for archive formats (see also "msdos" for self- 1862# extracting compressed archives) 1863# 1864# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 1865# pre-POSIX "tar" archives are handled in the C code. 1866 1867# POSIX tar archives 1868257 string ustar\0 POSIX tar archive 1869!:mime application/x-tar # encoding: posix 1870257 string ustar\040\040\0 GNU tar archive 1871!:mime application/x-tar # encoding: gnu 1872 1873# Incremental snapshot gnu-tar format from: 1874# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 18750 string GNU\ tar- GNU tar incremental snapshot data 1876>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 1877 1878# cpio archives 1879# 1880# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 1881# The idea is to indicate archives produced on machines with the same 1882# byte order as the machine running "file" with "cpio archive", and 1883# to indicate archives produced on machines with the opposite byte order 1884# from the machine running "file" with "byte-swapped cpio archive". 1885# 1886# The SVR4 "cpio(4)" hints that there are additional formats, but they 1887# are defined as "short"s; I think all the new formats are 1888# character-header formats and thus are strings, not numbers. 18890 short 070707 cpio archive 1890!:mime application/x-cpio 18910 short 0143561 byte-swapped cpio archive 1892!:mime application/x-cpio # encoding: swapped 18930 string 070707 ASCII cpio archive (pre-SVR4 or odc) 18940 string 070701 ASCII cpio archive (SVR4 with no CRC) 18950 string 070702 ASCII cpio archive (SVR4 with CRC) 1896 1897# 1898# Various archive formats used by various versions of the "ar" 1899# command. 1900# 1901 1902# 1903# Original UNIX archive formats. 1904# They were written with binary values in host byte order, and 1905# the magic number was a host "int", which might have been 16 bits 1906# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 1907# been ports to little-endian 16-bit-int or 32-bit-int platforms 1908# (x86?) using some of those formats; if none existed, feel free 1909# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 1910# 32-bit. There might have been big-endian ports of that sort as 1911# well. 1912# 19130 leshort 0177555 very old 16-bit-int little-endian archive 19140 beshort 0177555 very old 16-bit-int big-endian archive 19150 lelong 0177555 very old 32-bit-int little-endian archive 19160 belong 0177555 very old 32-bit-int big-endian archive 1917 19180 leshort 0177545 old 16-bit-int little-endian archive 1919>2 string __.SYMDEF random library 19200 beshort 0177545 old 16-bit-int big-endian archive 1921>2 string __.SYMDEF random library 19220 lelong 0177545 old 32-bit-int little-endian archive 1923>4 string __.SYMDEF random library 19240 belong 0177545 old 32-bit-int big-endian archive 1925>4 string __.SYMDEF random library 1926 1927# 1928# From "pdp" (but why a 4-byte quantity?) 1929# 19300 lelong 0x39bed PDP-11 old archive 19310 lelong 0x39bee PDP-11 4.0 archive 1932 1933# 1934# XXX - what flavor of APL used this, and was it a variant of 1935# some ar archive format? It's similar to, but not the same 1936# as, the APL workspace magic numbers in pdp. 1937# 19380 long 0100554 apl workspace 1939 1940# 1941# System V Release 1 portable(?) archive format. 1942# 19430 string =<ar> System V Release 1 ar archive 1944!:mime application/x-archive 1945 1946# 1947# Debian package; it's in the portable archive format, and needs to go 1948# before the entry for regular portable archives, as it's recognized as 1949# a portable archive whose first member has a name beginning with 1950# "debian". 1951# 19520 string =!<arch>\ndebian 1953>8 string debian-split part of multipart Debian package 1954!:mime application/vnd.debian.binary-package 1955>8 string debian-binary Debian binary package 1956!:mime application/vnd.debian.binary-package 1957>8 string !debian 1958>68 string >\0 (format %s) 1959# These next two lines do not work, because a bzip2 Debian archive 1960# still uses gzip for the control.tar (first in the archive). Only 1961# data.tar varies, and the location of its filename varies too. 1962# file/libmagic does not current have support for ascii-string based 1963# (offsets) as of 2005-09-15. 1964#>81 string bz2 \b, uses bzip2 compression 1965#>84 string gz \b, uses gzip compression 1966#>136 ledate x created: %s 1967 1968# 1969# MIPS archive; they're in the portable archive format, and need to go 1970# before the entry for regular portable archives, as it's recognized as 1971# a portable archive whose first member has a name beginning with 1972# "__________E". 1973# 19740 string =!<arch>\n__________E MIPS archive 1975!:mime application/x-archive 1976>20 string U with MIPS Ucode members 1977>21 string L with MIPSEL members 1978>21 string B with MIPSEB members 1979>19 string L and an EL hash table 1980>19 string B and an EB hash table 1981>22 string X -- out of date 1982 19830 search/1 -h- Software Tools format archive text 1984 1985# 1986# BSD/SVR2-and-later portable archive formats. 1987# 19880 string =!<arch> current ar archive 1989!:mime application/x-archive 1990>8 string __.SYMDEF random library 1991>68 string __.SYMDEF\ SORTED random library 1992 1993# 1994# "Thin" archive, as can be produced by GNU ar. 1995# 19960 string =!<thin>\n thin archive with 1997>68 belong 0 no symbol entries 1998>68 belong 1 %d symbol entry 1999>68 belong >1 %d symbol entries 2000 2001# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 2002# 2003# The first byte is the magic (0x1a), byte 2 is the compression type for 2004# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 2005# filename of the first file (null terminated). Since some types collide 2006# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 2007# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 20080 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 2009!:mime application/x-arc 20100 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 2011!:mime application/x-arc 20120 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 2013!:mime application/x-arc 20140 lelong&0x8080ffff 0x0000031a ARC archive data, packed 2015!:mime application/x-arc 20160 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 2017!:mime application/x-arc 20180 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 2019!:mime application/x-arc 2020# [JW] stuff taken from idarc, obviously ARC successors: 20210 lelong&0x8080ffff 0x00000a1a PAK archive data 2022!:mime application/x-arc 20230 lelong&0x8080ffff 0x0000141a ARC+ archive data 2024!:mime application/x-arc 20250 lelong&0x8080ffff 0x0000481a HYP archive data 2026!:mime application/x-arc 2027 2028# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 2029# I can't create either SPARK or ArcFS archives so I have not tested this stuff 2030# [GRR: the original entries collide with ARC, above; replaced with combined 2031# version (not tested)] 2032#0 byte 0x1a RISC OS archive (spark format) 20330 string \032archive RISC OS archive (ArcFS format) 20340 string Archive\000 RISC OS archive (ArcFS format) 2035 2036# All these were taken from idarc, many could not be verified. Unfortunately, 2037# there were many low-quality sigs, i.e. easy to trigger false positives. 2038# Please notify me of any real-world fishy/ambiguous signatures and I'll try 2039# to get my hands on the actual archiver and see if I find something better. [JW] 2040# probably many can be enhanced by finding some 0-byte or control char near the start 2041 2042# idarc calls this Crush/Uncompressed... *shrug* 20430 string CRUSH Crush archive data 2044# Squeeze It (.sqz) 20450 string HLSQZ Squeeze It archive data 2046# SQWEZ 20470 string SQWEZ SQWEZ archive data 2048# HPack (.hpk) 20490 string HPAK HPack archive data 2050# HAP 20510 string \x91\x33HF HAP archive data 2052# MD/MDCD 20530 string MDmd MDCD archive data 2054# LIM 20550 string LIM\x1a LIM archive data 2056# SAR 20573 string LH5 SAR archive data 2058# BSArc/BS2 20590 string \212\3SB\020\0 BSArc/BS2 archive data 2060# Bethesda Softworks Archive (Oblivion) 20610 string BSA\0 BSArc archive data 2062>4 lelong x version %d 2063# MAR 20642 string =-ah MAR archive data 2065# ACB 2066#0 belong&0x00f800ff 0x00800000 ACB archive data 2067# CPZ 2068# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 2069# JRC 20700 string JRchive JRC archive data 2071# Quantum 20720 string DS\0 Quantum archive data 2073# ReSOF 20740 string PK\3\6 ReSOF archive data 2075# QuArk 20760 string 7\4 QuArk archive data 2077# YAC 207814 string YC YAC archive data 2079# X1 20800 string X1 X1 archive data 20810 string XhDr X1 archive data 2082# CDC Codec (.dqt) 20830 belong&0xffffe000 0x76ff2000 CDC Codec archive data 2084# AMGC 20850 string \xad6" AMGC archive data 2086# NuLIB 20870 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 2088# PakLeo 20890 string LEOLZW PAKLeo archive data 2090# ChArc 20910 string SChF ChArc archive data 2092# PSA 20930 string PSA PSA archive data 2094# CrossePAC 20950 string DSIGDCC CrossePAC archive data 2096# Freeze 20970 string \x1f\x9f\x4a\x10\x0a Freeze archive data 2098# KBoom 20990 string \xc2\xa8MP\xc2\xa8 KBoom archive data 2100# NSQ, must go after CDC Codec 21010 string \x76\xff NSQ archive data 2102# DPA 21030 string Dirk\ Paehl DPA archive data 2104# BA 2105# TODO: idarc says "bytes 0-2 == bytes 3-5" 2106# TTComp 21070 string \0\6 TTComp archive data 2108# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 21090 string ESP ESP archive data 2110# ZPack 21110 string \1ZPK\1 ZPack archive data 2112# Sky 21130 string \xbc\x40 Sky archive data 2114# UFA 21150 string UFA UFA archive data 2116# Dry 21170 string =-H2O DRY archive data 2118# FoxSQZ 21190 string FOXSQZ FoxSQZ archive data 2120# AR7 21210 string ,AR7 AR7 archive data 2122# PPMZ 21230 string PPMZ PPMZ archive data 2124# MS Compress 21254 string \x88\xf0\x27 MS Compress archive data 2126# updated by Joerg Jenderek 2127>9 string \0 2128>>0 string KWAJ 2129>>>7 string \321\003 MS Compress archive data 2130>>>>14 ulong >0 \b, original size: %d bytes 2131>>>>18 ubyte >0x65 2132>>>>>18 string x \b, was %.8s 2133>>>>>(10.b-4) string x \b.%.3s 2134# MP3 (archiver, not lossy audio compression) 21350 string MP3\x1a MP3-Archiver archive data 2136# ZET 21370 string OZ\xc3\x9d ZET archive data 2138# TSComp 21390 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 2140# ARQ 21410 string gW\4\1 ARQ archive data 2142# Squash 21433 string OctSqu Squash archive data 2144# Terse 21450 string \5\1\1\0 Terse archive data 2146# PUCrunch 21470 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 2148# UHarc 21490 string UHA UHarc archive data 2150# ABComp 21510 string \2AB ABComp archive data 21520 string \3AB2 ABComp archive data 2153# CMP 21540 string CO\0 CMP archive data 2155# Splint 21560 string \x93\xb9\x06 Splint archive data 2157# InstallShield 21580 string \x13\x5d\x65\x8c InstallShield Z archive Data 2159# Gather 21601 string GTH Gather archive data 2161# BOA 21620 string BOA BOA archive data 2163# RAX 21640 string ULEB\xa RAX archive data 2165# Xtreme 21660 string ULEB\0 Xtreme archive data 2167# Pack Magic 21680 string @\xc3\xa2\1\0 Pack Magic archive data 2169# BTS 21700 belong&0xfeffffff 0x1a034465 BTS archive data 2171# ELI 5750 21720 string Ora\ ELI 5750 archive data 2173# QFC 21740 string \x1aFC\x1a QFC archive data 21750 string \x1aQF\x1a QFC archive data 2176# PRO-PACK 21770 string RNC PRO-PACK archive data 2178# 777 21790 string 777 777 archive data 2180# LZS221 21810 string sTaC LZS221 archive data 2182# HPA 21830 string HPA HPA archive data 2184# Arhangel 21850 string LG Arhangel archive data 2186# EXP1, uses bzip2 21870 string 0123456789012345BZh EXP1 archive data 2188# IMP 21890 string IMP\xa IMP archive data 2190# NRV 21910 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 2192# Squish 21930 string \x73\xb2\x90\xf4 Squish archive data 2194# Par 21950 string PHILIPP Par archive data 21960 string PAR Par archive data 2197# HIT 21980 string UB HIT archive data 2199# SBX 22000 belong&0xfffff000 0x53423000 SBX archive data 2201# NaShrink 22020 string NSK NaShrink archive data 2203# SAPCAR 22040 string #\ CAR\ archive\ header SAPCAR archive data 22050 string CAR\ 2.00RG SAPCAR archive data 2206# Disintegrator 22070 string DST Disintegrator archive data 2208# ASD 22090 string ASD ASD archive data 2210# InstallShield CAB 22110 string ISc( InstallShield CAB 2212# TOP4 22130 string T4\x1a TOP4 archive data 2214# BatComp left out: sig looks like COM executable 2215# so TODO: get real 4dos batcomp file and find sig 2216# BlakHole 22170 string BH\5\7 BlakHole archive data 2218# BIX 22190 string BIX0 BIX archive data 2220# ChiefLZA 22210 string ChfLZ ChiefLZA archive data 2222# Blink 22230 string Blink Blink archive data 2224# Logitech Compress 22250 string \xda\xfa Logitech Compress archive data 2226# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 22271 string (C)\ STEPANYUK ARS-Sfx archive data 2228# AKT/AKT32 22290 string AKT32 AKT32 archive data 22300 string AKT AKT archive data 2231# NPack 22320 string MSTSM NPack archive data 2233# PFT 22340 string \0\x50\0\x14 PFT archive data 2235# SemOne 22360 string SEM SemOne archive data 2237# PPMD 22380 string \x8f\xaf\xac\x84 PPMD archive data 2239# FIZ 22400 string FIZ FIZ archive data 2241# MSXiE 22420 belong&0xfffff0f0 0x4d530000 MSXiE archive data 2243# DeepFreezer 22440 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 2245# DC 22460 string =<DC- DC archive data 2247# TPac 22480 string \4TPAC\3 TPac archive data 2249# Ai 22500 string Ai\1\1\0 Ai archive data 22510 string Ai\1\0\0 Ai archive data 2252# Ai32 22530 string Ai\2\0 Ai32 archive data 22540 string Ai\2\1 Ai32 archive data 2255# SBC 22560 string SBC SBC archive data 2257# Ybs 22580 string YBS Ybs archive data 2259# DitPack 22600 string \x9e\0\0 DitPack archive data 2261# DMS 22620 string DMS! DMS archive data 2263# EPC 22640 string \x8f\xaf\xac\x8c EPC archive data 2265# VSARC 22660 string VS\x1a VSARC archive data 2267# PDZ 22680 string PDZ PDZ archive data 2269# ReDuq 22700 string rdqx ReDuq archive data 2271# GCA 22720 string GCAX GCA archive data 2273# PPMN 22740 string pN PPMN archive data 2275# WinImage 22763 string WINIMAGE WinImage archive data 2277# Compressia 22780 string CMP0CMP Compressia archive data 2279# UHBC 22800 string UHB UHBC archive data 2281# WinHKI 22820 string \x61\x5C\x04\x05 WinHKI archive data 2283# WWPack data file 22840 string WWP WWPack archive data 2285# BSN (BSA, PTS-DOS) 22860 string \xffBSG BSN archive data 22871 string \xffBSG BSN archive data 22883 string \xffBSG BSN archive data 22891 string \0\xae\2 BSN archive data 22901 string \0\xae\3 BSN archive data 22911 string \0\xae\7 BSN archive data 2292# AIN 22930 string \x33\x18 AIN archive data 22940 string \x33\x17 AIN archive data 2295# XPA32 22960 string xpa\0\1 XPA32 archive data 2297# SZip (TODO: doesn't catch all versions) 22980 string SZ\x0a\4 SZip archive data 2299# XPack DiskImage 23000 string jm XPack DiskImage archive data 2301# XPack Data 23020 string xpa XPack archive data 2303# XPack Single Data 23040 string \xc3\x8d\ jm XPack single archive data 2305 2306# TODO: missing due to unknown magic/magic at end of file: 2307#DWC 2308#ARG 2309#ZAR 2310#PC/3270 2311#InstallIt 2312#RKive 2313#RK 2314#XPack Diskimage 2315 2316# These were inspired by idarc, but actually verified 2317# Dzip archiver (.dz) 23180 string DZ Dzip archive data 2319>2 byte x \b, version %i 2320>3 byte x \b.%i 2321# ZZip archiver (.zz) 23220 string ZZ\ \0\0 ZZip archive data 23230 string ZZ0 ZZip archive data 2324# PAQ archiver (.paq) 23250 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 23260 string PAQ PAQ archive data 2327>3 byte&0xf0 0x30 2328>>3 byte x (v%c) 2329# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 23300xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 23310 string JARCS JAR (ARJ Software, Inc.) archive data 2332 2333# ARJ archiver (jason@jarthur.Claremont.EDU) 23340 leshort 0xea60 ARJ archive data 2335!:mime application/x-arj 2336>5 byte x \b, v%d, 2337>8 byte &0x04 multi-volume, 2338>8 byte &0x10 slash-switched, 2339>8 byte &0x20 backup, 2340>34 string x original name: %s, 2341>7 byte 0 os: MS-DOS 2342>7 byte 1 os: PRIMOS 2343>7 byte 2 os: Unix 2344>7 byte 3 os: Amiga 2345>7 byte 4 os: Macintosh 2346>7 byte 5 os: OS/2 2347>7 byte 6 os: Apple ][ GS 2348>7 byte 7 os: Atari ST 2349>7 byte 8 os: NeXT 2350>7 byte 9 os: VAX/VMS 2351>3 byte >0 %d] 2352# [JW] idarc says this is also possible 23532 leshort 0xea60 ARJ archive data 2354 2355# HA archiver (Greg Roelofs, newt@uchicago.edu) 2356# This is a really bad format. A file containing HAWAII will match this... 2357#0 string HA HA archive data, 2358#>2 leshort =1 1 file, 2359#>2 leshort >1 %hu files, 2360#>4 byte&0x0f =0 first is type CPY 2361#>4 byte&0x0f =1 first is type ASC 2362#>4 byte&0x0f =2 first is type HSC 2363#>4 byte&0x0f =0x0e first is type DIR 2364#>4 byte&0x0f =0x0f first is type SPECIAL 2365# suggestion: at least identify small archives (<1024 files) 23660 belong&0xffff00fc 0x48410000 HA archive data 2367>2 leshort =1 1 file, 2368>2 leshort >1 %u files, 2369>4 byte&0x0f =0 first is type CPY 2370>4 byte&0x0f =1 first is type ASC 2371>4 byte&0x0f =2 first is type HSC 2372>4 byte&0x0f =0x0e first is type DIR 2373>4 byte&0x0f =0x0f first is type SPECIAL 2374 2375# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 23760 string HPAK HPACK archive data 2377 2378# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 23790 string \351,\001JAM\ JAM archive, 2380>7 string >\0 version %.4s 2381>0x26 byte =0x27 - 2382>>0x2b string >\0 label %.11s, 2383>>0x27 lelong x serial %08x, 2384>>0x36 string >\0 fstype %.8s 2385 2386# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 23872 string -lh0- LHarc 1.x/ARX archive data [lh0] 2388!:mime application/x-lharc 23892 string -lh1- LHarc 1.x/ARX archive data [lh1] 2390!:mime application/x-lharc 23912 string -lz4- LHarc 1.x archive data [lz4] 2392!:mime application/x-lharc 23932 string -lz5- LHarc 1.x archive data [lz5] 2394!:mime application/x-lharc 2395# [never seen any but the last; -lh4- reported in comp.compression:] 23962 string -lzs- LHa/LZS archive data [lzs] 2397!:mime application/x-lha 23982 string -lh\40- LHa 2.x? archive data [lh ] 2399!:mime application/x-lha 24002 string -lhd- LHa 2.x? archive data [lhd] 2401!:mime application/x-lha 24022 string -lh2- LHa 2.x? archive data [lh2] 2403!:mime application/x-lha 24042 string -lh3- LHa 2.x? archive data [lh3] 2405!:mime application/x-lha 24062 string -lh4- LHa (2.x) archive data [lh4] 2407!:mime application/x-lha 24082 string -lh5- LHa (2.x) archive data [lh5] 2409!:mime application/x-lha 24102 string -lh6- LHa (2.x) archive data [lh6] 2411!:mime application/x-lha 24122 string -lh7- LHa (2.x)/LHark archive data [lh7] 2413!:mime application/x-lha 2414>20 byte x - header level %d 2415# taken from idarc [JW] 24162 string -lZ PUT archive data 24172 string -lz LZS archive data 24182 string -sw1- Swag archive data 2419 2420# RAR archiver (Greg Roelofs, newt@uchicago.edu) 24210 string Rar! RAR archive data, 2422!:mime application/x-rar 2423>44 byte x v%0x, 2424>10 byte >0 flags: 2425>>10 byte &0x01 Archive volume, 2426>>10 byte &0x02 Commented, 2427>>10 byte &0x04 Locked, 2428>>10 byte &0x08 Solid, 2429>>10 byte &0x20 Authenticated, 2430>35 byte 0 os: MS-DOS 2431>35 byte 1 os: OS/2 2432>35 byte 2 os: Win32 2433>35 byte 3 os: Unix 2434# some old version? idarc says: 24350 string RE\x7e\x5e RAR archive data 2436 2437# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 24380 string SQSH squished archive data (Acorn RISCOS) 2439 2440# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 2441# [JW] see exe section for self-extracting version 24420 string UC2\x1a UC2 archive data 2443 2444# PKZIP multi-volume archive 24450 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 2446!:mime application/zip 2447 2448# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 24490 string PK\005\006 Zip archive data (empty) 24500 string PK\003\004 2451 2452# Specialised zip formats which start with a member named 'mimetype' 2453# (stored uncompressed, with no 'extra field') containing the file's MIME type. 2454# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 2455# contents starting with "application/": 2456>26 string \x8\0\0\0mimetypeapplication/ 2457 2458# KOffice / OpenOffice & StarOffice / OpenDocument formats 2459# From: Abel Cheung <abel@oaka.org> 2460 2461# KOffice (1.2 or above) formats 2462# (mimetype contains "application/vnd.kde.<SUBTYPE>") 2463>>50 string vnd.kde. KOffice (>=1.2) 2464>>>58 string karbon Karbon document 2465>>>58 string kchart KChart document 2466>>>58 string kformula KFormula document 2467>>>58 string kivio Kivio document 2468>>>58 string kontour Kontour document 2469>>>58 string kpresenter KPresenter document 2470>>>58 string kspread KSpread document 2471>>>58 string kword KWord document 2472 2473# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 2474# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 2475>>50 string vnd.sun.xml. OpenOffice.org 1.x 2476>>>62 string writer Writer 2477>>>>68 byte !0x2e document 2478>>>>68 string .template template 2479>>>>68 string .global global document 2480>>>62 string calc Calc 2481>>>>66 byte !0x2e spreadsheet 2482>>>>66 string .template template 2483>>>62 string draw Draw 2484>>>>66 byte !0x2e document 2485>>>>66 string .template template 2486>>>62 string impress Impress 2487>>>>69 byte !0x2e presentation 2488>>>>69 string .template template 2489>>>62 string math Math document 2490>>>62 string base Database file 2491 2492# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 2493# http://lists.oasis-open.org/archives/office/200505/msg00006.html 2494# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 2495>>50 string vnd.oasis.opendocument. OpenDocument 2496>>>73 string text 2497>>>>77 byte !0x2d Text 2498!:mime application/vnd.oasis.opendocument.text 2499>>>>77 string -template Text Template 2500!:mime application/vnd.oasis.opendocument.text-template 2501>>>>77 string -web HTML Document Template 2502!:mime application/vnd.oasis.opendocument.text-web 2503>>>>77 string -master Master Document 2504!:mime application/vnd.oasis.opendocument.text-master 2505>>>73 string graphics 2506>>>>81 byte !0x2d Drawing 2507!:mime application/vnd.oasis.opendocument.graphics 2508>>>>81 string -template Template 2509!:mime application/vnd.oasis.opendocument.graphics-template 2510>>>73 string presentation 2511>>>>85 byte !0x2d Presentation 2512!:mime application/vnd.oasis.opendocument.presentation 2513>>>>85 string -template Template 2514!:mime application/vnd.oasis.opendocument.presentation-template 2515>>>73 string spreadsheet 2516>>>>84 byte !0x2d Spreadsheet 2517!:mime application/vnd.oasis.opendocument.spreadsheet 2518>>>>84 string -template Template 2519!:mime application/vnd.oasis.opendocument.spreadsheet-template 2520>>>73 string chart 2521>>>>78 byte !0x2d Chart 2522!:mime application/vnd.oasis.opendocument.chart 2523>>>>78 string -template Template 2524!:mime application/vnd.oasis.opendocument.chart-template 2525>>>73 string formula 2526>>>>80 byte !0x2d Formula 2527!:mime application/vnd.oasis.opendocument.formula 2528>>>>80 string -template Template 2529!:mime application/vnd.oasis.opendocument.formula-template 2530>>>73 string database Database 2531!:mime application/vnd.oasis.opendocument.database 2532>>>73 string image 2533>>>>78 byte !0x2d Image 2534!:mime application/vnd.oasis.opendocument.image 2535>>>>78 string -template Template 2536!:mime application/vnd.oasis.opendocument.image-template 2537 2538# EPUB (OEBPS) books using OCF (OEBPS Container Format) 2539# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 2540# From: Ralf Brown <ralf.brown@gmail.com> 2541>>50 string epub+zip EPUB document 2542!:mime application/epub+zip 2543 2544# Catch other ZIP-with-mimetype formats 2545# In a ZIP file, the bytes immediately after a member's contents are 2546# always "PK". The 2 regex rules here print the "mimetype" member's 2547# contents up to the first 'P'. Luckily, most MIME types don't contain 2548# any capital 'P's. This is a kludge. 2549# (mimetype contains "application/<OTHER>") 2550>>50 string !epub+zip 2551>>>50 string !vnd.oasis.opendocument. 2552>>>>50 string !vnd.sun.xml. 2553>>>>>50 string !vnd.kde. 2554>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 2555!:mime application/zip 2556# (mimetype contents other than "application/*") 2557>26 string \x8\0\0\0mimetype 2558>>38 string !application/ 2559>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 2560!:mime application/zip 2561 2562# Java Jar files 2563>(26.s+30) leshort 0xcafe Java archive data (JAR) 2564!:mime application/java-archive 2565 2566# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 2567# Next line excludes specialized formats: 2568>(26.s+30) leshort !0xcafe 2569>>26 string !\x8\0\0\0mimetype Zip archive data 2570!:mime application/zip 2571>>>4 byte 0x09 \b, at least v0.9 to extract 2572>>>4 byte 0x0a \b, at least v1.0 to extract 2573>>>4 byte 0x0b \b, at least v1.1 to extract 2574>>>4 byte 0x14 \b, at least v2.0 to extract 2575>>>4 byte 0x2d \b, at least v3.0 to extract 2576>>>0x161 string WINZIP \b, WinZIP self-extracting 2577 2578# StarView Metafile 2579# From Pierre Ducroquet <pinaraf@pinaraf.info> 25800 string VCLMTF StarView MetaFile 2581>6 beshort x \b, version %d 2582>8 belong x \b, size %d 2583 2584# Zoo archiver 258520 lelong 0xfdc4a7dc Zoo archive data 2586!:mime application/x-zoo 2587>4 byte >48 \b, v%c. 2588>>6 byte >47 \b%c 2589>>>7 byte >47 \b%c 2590>32 byte >0 \b, modify: v%d 2591>>33 byte x \b.%d+ 2592>42 lelong 0xfdc4a7dc \b, 2593>>70 byte >0 extract: v%d 2594>>>71 byte x \b.%d+ 2595 2596# Shell archives 259710 string #\ This\ is\ a\ shell\ archive shell archive text 2598!:mime application/octet-stream 2599 2600# 2601# LBR. NB: May conflict with the questionable 2602# "binary Computer Graphics Metafile" format. 2603# 26040 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 2605# 2606# PMA (CP/M derivative of LHA) 2607# 26082 string -pm0- PMarc archive data [pm0] 26092 string -pm1- PMarc archive data [pm1] 26102 string -pm2- PMarc archive data [pm2] 26112 string -pms- PMarc SFX archive (CP/M, DOS) 26125 string -pc1- PopCom compressed executable (CP/M) 2613 2614# From Rafael Laboissiere <rafael@laboissiere.net> 2615# The Project Revision Control System (see 2616# http://prcs.sourceforge.net) generates a packaged project 2617# file which is recognized by the following entry: 26180 leshort 0xeb81 PRCS packaged project 2619 2620# Microsoft cabinets 2621# by David Necas (Yeti) <yeti@physics.muni.cz> 2622#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 2623#>25 byte x v%d 2624#>24 byte x \b.%d 2625# MPi: All CABs have version 1.3, so this is pointless. 2626# Better magic in debian-additions. 2627 2628# GTKtalog catalogs 2629# by David Necas (Yeti) <yeti@physics.muni.cz> 26304 string gtktalog\ GTKtalog catalog data, 2631>13 string 3 version 3 2632>>14 beshort 0x677a (gzipped) 2633>>14 beshort !0x677a (not gzipped) 2634>13 string >3 version %s 2635 2636############################################################################ 2637# Parity archive reconstruction file, the 'par' file format now used on Usenet. 26380 string PAR\0 PARity archive data 2639>48 leshort =0 - Index file 2640>48 leshort >0 - file number %d 2641 2642# Felix von Leitner <felix-file@fefe.de> 26430 string d8:announce BitTorrent file 2644!:mime application/x-bittorrent 2645 2646# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 26470 beshort 0x0e0f Atari MSA archive data 2648>2 beshort x \b, %d sectors per track 2649>4 beshort 0 \b, 1 sided 2650>4 beshort 1 \b, 2 sided 2651>6 beshort x \b, starting track: %d 2652>8 beshort x \b, ending track: %d 2653 2654# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 26550 string PK00PK\003\004 Zip archive data 2656 2657# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 2658# by Stefan `Sec` Zehl <sec@42.org> 26597 string **ACE** ACE archive data 2660>15 byte >0 version %d 2661>16 byte =0x00 \b, from MS-DOS 2662>16 byte =0x01 \b, from OS/2 2663>16 byte =0x02 \b, from Win/32 2664>16 byte =0x03 \b, from Unix 2665>16 byte =0x04 \b, from MacOS 2666>16 byte =0x05 \b, from WinNT 2667>16 byte =0x06 \b, from Primos 2668>16 byte =0x07 \b, from AppleGS 2669>16 byte =0x08 \b, from Atari 2670>16 byte =0x09 \b, from Vax/VMS 2671>16 byte =0x0A \b, from Amiga 2672>16 byte =0x0B \b, from Next 2673>14 byte x \b, version %d to extract 2674>5 leshort &0x0080 \b, multiple volumes, 2675>>17 byte x \b (part %d), 2676>5 leshort &0x0002 \b, contains comment 2677>5 leshort &0x0200 \b, sfx 2678>5 leshort &0x0400 \b, small dictionary 2679>5 leshort &0x0800 \b, multi-volume 2680>5 leshort &0x1000 \b, contains AV-String 2681>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 2682>5 leshort &0x2000 \b, with recovery record 2683>5 leshort &0x4000 \b, locked 2684>5 leshort &0x8000 \b, solid 2685# Date in MS-DOS format (whatever that is) 2686#>18 lelong x Created on 2687 2688# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 2689# <doj@cubic.org> 26900x1A string sfArk sfArk compressed Soundfont 2691>0x15 string 2 2692>>0x1 string >\0 Version %s 2693>>0x2A string >\0 : %s 2694 2695# DR-DOS 7.03 Packed File *.??_ 26960 string Packed\ File\ Personal NetWare Packed File 2697>12 string x \b, was "%.12s" 2698 2699# EET archive 2700# From: Tilman Sauerbeck <tilman@code-monkey.de> 27010 belong 0x1ee7ff00 EET archive 2702!:mime application/x-eet 2703 2704# rzip archives 27050 string RZIP rzip compressed data 2706>4 byte x - version %d 2707>5 byte x \b.%d 2708>6 belong x (%d bytes) 2709 2710# From: "Robert Dale" <robdale@gmail.com> 27110 belong 123 dar archive, 2712>4 belong x label "%.8x 2713>>8 belong x %.8x 2714>>>12 beshort x %.4x" 2715>14 byte 0x54 end slice 2716>14 beshort 0x4e4e multi-part 2717>14 beshort 0x4e53 multi-part, with -S 2718 2719# Symbian installation files 2720# http://www.thouky.co.uk/software/psifs/sis.html 2721# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 27228 lelong 0x10000419 Symbian installation file 2723!:mime application/vnd.symbian.install 2724>4 lelong 0x1000006D (EPOC release 3/4/5) 2725>4 lelong 0x10003A12 (EPOC release 6) 27260 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 2727!:mime x-epoc/x-sisx-app 2728 2729# From "Nelson A. de Oliveira" <naoliv@gmail.com> 27300 string MPQ\032 MoPaQ (MPQ) archive 2731 2732# From: Dirk Jagdmann <doj@cubic.org> 2733# xar archive format: http://code.google.com/p/xar/ 27340 string xar! xar archive 2735>6 beshort x - version %d 2736 2737# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2738# .kgb 27390 string KGB_arch KGB Archiver file 2740>10 string x with compression level %.1s 2741 2742# xar (eXtensible ARchiver) archive 2743# From: "David Remahl" <dremahl@apple.com> 27440 string xar! xar archive 2745#>4 beshort x header size %d 2746>6 beshort x version %d, 2747#>8 quad x compressed TOC: %d, 2748#>16 quad x uncompressed TOC: %d, 2749>24 belong 0 no checksum 2750>24 belong 1 SHA-1 checksum 2751>24 belong 2 MD5 checksum 2752 2753# Type: Parity Archive 2754# From: Daniel van Eeden <daniel_e@dds.nl> 27550 string PAR2 Parity Archive Volume Set 2756 2757# Bacula volume format. (Volumes always start with a block header.) 2758# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 2759# From: Adam Buchbinder <adam.buchbinder@gmail.com> 276012 string BB02 Bacula volume 2761>20 bedate x \b, started %s 2762 2763# ePub is XHTML + XML inside a ZIP archive. The first member of the 2764# archive must be an uncompressed file called 'mimetype' with contents 2765# 'application/epub+zip' 2766 2767 2768# From: "Michael Gorny" <mgorny@gentoo.org> 2769# ZPAQ: http://mattmahoney.net/dc/zpaq.html 27700 string zPQ ZPAQ stream 2771>3 byte x \b, level %d 2772 2773# BBeB ebook, unencrypted (LRF format) 2774# URL: http://www.sven.de/librie/Librie/LrfFormat 2775# From: Adam Buchbinder <adam.buchbinder@gmail.com> 27760 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 2777>8 beshort x \b, version %d 2778>36 byte 1 \b, front-to-back 2779>36 byte 16 \b, back-to-front 2780>42 beshort x \b, (%dx, 2781>44 beshort x %d) 2782 2783# Symantec GHOST image by Joerg Jenderek at May 2014 2784# http://us.norton.com/ghost/ 2785# http://www.garykessler.net/library/file_sigs.html 27860 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 2787# *.GHO 2788>2 ubyte&0x08 0x00 \b, first file 2789# *.GHS or *.[0-9] with cns program option 2790>2 ubyte&0x08 0x08 \b, split file 2791# part of split index interesting for *.ghs 2792>>4 ubyte x id=0x%x 2793# compression tag minus one equals numeric compression command line switch z[1-9] 2794>3 ubyte 0 \b, no compression 2795>3 ubyte 2 \b, fast compression (Z1) 2796>3 ubyte 3 \b, medium compression (Z2) 2797>3 ubyte >3 2798>>3 ubyte <11 \b, compression (Z%d-1) 2799>2 ubyte&0x08 0x00 2800# ~ 30 byte password field only for *.gho 2801>>12 ubequad !0 \b, password protected 2802>>44 ubyte !1 2803# 1~Image All, sector-by-sector only for *.gho 2804>>>10 ubyte 1 \b, sector copy 2805# 1~Image Boot track only for *.gho 2806>>>43 ubyte 1 \b, boot track 2807# 1~Image Disc only for *.gho implies Image Boot track and sector copy 2808>>44 ubyte 1 \b, disc sector copy 2809# optional image description only *.gho 2810>>0xff string >\0 "%-.254s" 2811# look for DOS sector end sequence 2812>0xE08 search/7776 \x55\xAA 2813>>&-512 indirect x \b; contains 2814 2815#------------------------------------------------------------------------------ 2816# $File: assembler,v 1.5 2013/09/17 17:33:36 christos Exp $ 2817# make: file(1) magic for assembler source 2818# 28190 regex \^[\040\t]{0,50}\\.asciiz assembler source text 2820!:mime text/x-asm 28210 regex \^[\040\t]{0,50}\\.byte assembler source text 2822!:mime text/x-asm 28230 regex \^[\040\t]{0,50}\\.even assembler source text 2824!:mime text/x-asm 28250 regex \^[\040\t]{0,50}\\.globl assembler source text 2826!:mime text/x-asm 28270 regex \^[\040\t]{0,50}\\.text assembler source text 2828!:mime text/x-asm 28290 regex \^[\040\t]{0,50}\\.file assembler source text 2830!:mime text/x-asm 28310 regex \^[\040\t]{0,50}\\.type assembler source text 2832!:mime text/x-asm 2833 2834#------------------------------------------------------------------------------ 2835# $File$ 2836# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 2837# strings as "long" - we assume they're just strings: 2838# From: guy@netapp.com (Guy Harris) 2839# 28400 string *STA Aster*x 2841>7 string WORD Words Document 2842>7 string GRAP Graphic 2843>7 string SPRE Spreadsheet 2844>7 string MACR Macro 28450 string 2278 Aster*x Version 2 2846>29 byte 0x36 Words Document 2847>29 byte 0x35 Graphic 2848>29 byte 0x32 Spreadsheet 2849>29 byte 0x38 Macro 2850 2851 2852#------------------------------------------------------------------------------ 2853# $File: att3b,v 1.8 2009/09/19 16:28:08 christos Exp $ 2854# att3b: file(1) magic for AT&T 3B machines 2855# 2856# The `versions' should be un-commented if they work for you. 2857# (Was the problem just one of endianness?) 2858# 2859# 3B20 2860# 2861# The 3B20 conflicts with SCCS. 2862#0 beshort 0550 3b20 COFF executable 2863#>12 belong >0 not stripped 2864#>22 beshort >0 - version %d 2865#0 beshort 0551 3b20 COFF executable (TV) 2866#>12 belong >0 not stripped 2867#>22 beshort >0 - version %d 2868# 2869# WE32K 2870# 28710 beshort 0560 WE32000 COFF 2872>18 beshort ^00000020 object 2873>18 beshort &00000020 executable 2874>12 belong >0 not stripped 2875>18 beshort ^00010000 N/A on 3b2/300 w/paging 2876>18 beshort &00020000 32100 required 2877>18 beshort &00040000 and MAU hardware required 2878>20 beshort 0407 (impure) 2879>20 beshort 0410 (pure) 2880>20 beshort 0413 (demand paged) 2881>20 beshort 0443 (target shared library) 2882>22 beshort >0 - version %d 28830 beshort 0561 WE32000 COFF executable (TV) 2884>12 belong >0 not stripped 2885#>18 beshort &00020000 - 32100 required 2886#>18 beshort &00040000 and MAU hardware required 2887#>22 beshort >0 - version %d 2888# 2889# core file for 3b2 28900 string \000\004\036\212\200 3b2 core file 2891>364 string >\0 of '%s' 2892 2893#------------------------------------------------------------------------------ 2894# $File: audio,v 1.71 2014/05/14 23:30:28 christos Exp $ 2895# audio: file(1) magic for sound formats (see also "iff") 2896# 2897# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 2898# and others 2899# 2900 2901# Sun/NeXT audio data 29020 string .snd Sun/NeXT audio data: 2903>12 belong 1 8-bit ISDN mu-law, 2904!:mime audio/basic 2905>12 belong 2 8-bit linear PCM [REF-PCM], 2906!:mime audio/basic 2907>12 belong 3 16-bit linear PCM, 2908!:mime audio/basic 2909>12 belong 4 24-bit linear PCM, 2910!:mime audio/basic 2911>12 belong 5 32-bit linear PCM, 2912!:mime audio/basic 2913>12 belong 6 32-bit IEEE floating point, 2914!:mime audio/basic 2915>12 belong 7 64-bit IEEE floating point, 2916!:mime audio/basic 2917>12 belong 8 Fragmented sample data, 2918>12 belong 10 DSP program, 2919>12 belong 11 8-bit fixed point, 2920>12 belong 12 16-bit fixed point, 2921>12 belong 13 24-bit fixed point, 2922>12 belong 14 32-bit fixed point, 2923>12 belong 18 16-bit linear with emphasis, 2924>12 belong 19 16-bit linear compressed, 2925>12 belong 20 16-bit linear with emphasis and compression, 2926>12 belong 21 Music kit DSP commands, 2927>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2928!:mime audio/x-adpcm 2929>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2930>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2931>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2932>12 belong 27 8-bit A-law (CCITT G.711), 2933>20 belong 1 mono, 2934>20 belong 2 stereo, 2935>20 belong 4 quad, 2936>16 belong >0 %d Hz 2937 2938# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 2939# that uses little-endian encoding and has a different magic number 29400 lelong 0x0064732E DEC audio data: 2941>12 lelong 1 8-bit ISDN mu-law, 2942!:mime audio/x-dec-basic 2943>12 lelong 2 8-bit linear PCM [REF-PCM], 2944!:mime audio/x-dec-basic 2945>12 lelong 3 16-bit linear PCM, 2946!:mime audio/x-dec-basic 2947>12 lelong 4 24-bit linear PCM, 2948!:mime audio/x-dec-basic 2949>12 lelong 5 32-bit linear PCM, 2950!:mime audio/x-dec-basic 2951>12 lelong 6 32-bit IEEE floating point, 2952!:mime audio/x-dec-basic 2953>12 lelong 7 64-bit IEEE floating point, 2954!:mime audio/x-dec-basic 2955>12 belong 8 Fragmented sample data, 2956>12 belong 10 DSP program, 2957>12 belong 11 8-bit fixed point, 2958>12 belong 12 16-bit fixed point, 2959>12 belong 13 24-bit fixed point, 2960>12 belong 14 32-bit fixed point, 2961>12 belong 18 16-bit linear with emphasis, 2962>12 belong 19 16-bit linear compressed, 2963>12 belong 20 16-bit linear with emphasis and compression, 2964>12 belong 21 Music kit DSP commands, 2965>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 2966!:mime audio/x-dec-basic 2967>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 2968>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 2969>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 2970>12 belong 27 8-bit A-law (CCITT G.711), 2971>20 lelong 1 mono, 2972>20 lelong 2 stereo, 2973>20 lelong 4 quad, 2974>16 lelong >0 %d Hz 2975 2976# Creative Labs AUDIO stuff 29770 string MThd Standard MIDI data 2978!:mime audio/midi 2979>8 beshort x (format %d) 2980>10 beshort x using %d track 2981>10 beshort >1 \bs 2982>12 beshort&0x7fff x at 1/%d 2983>12 beshort&0x8000 >0 SMPTE 2984 29850 string CTMF Creative Music (CMF) data 2986!:mime audio/x-unknown 29870 string SBI SoundBlaster instrument data 2988!:mime audio/x-unknown 29890 string Creative\ Voice\ File Creative Labs voice data 2990!:mime audio/x-unknown 2991# is this next line right? it came this way... 2992>19 byte 0x1A 2993>23 byte >0 - version %d 2994>22 byte >0 \b.%d 2995 2996# first entry is also the string "NTRK" 29970 belong 0x4e54524b MultiTrack sound data 2998>4 belong x - version %d 2999 3000# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 3001# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 30020 string EMOD Extended MOD sound data, 3003>4 byte&0xf0 x version %d 3004>4 byte&0x0f x \b.%d, 3005>45 byte x %d instruments 3006>83 byte 0 (module) 3007>83 byte 1 (song) 3008 3009# Real Audio (Magic .ra\0375) 30100 belong 0x2e7261fd RealAudio sound file 3011!:mime audio/x-pn-realaudio 30120 string .RMF\0\0\0 RealMedia file 3013!:mime application/vnd.rn-realmedia 3014#video/x-pn-realvideo 3015#video/vnd.rn-realvideo 3016#application/vnd.rn-realmedia 3017# sigh, there are many mimes for that but the above are the most common. 3018 3019# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 3020# Oct 31, 1995 3021# fixed by <doj@cubic.org> 2003-06-24 3022# Too short... 3023#0 string MTM MultiTracker Module sound file 3024#0 string if Composer 669 Module sound data 3025#0 string JN Composer 669 Module sound data (extended format) 30260 string MAS_U ULT(imate) Module sound data 3027 3028#0 string FAR Module sound data 3029#>4 string >\15 Title: "%s" 3030 30310x2c string SCRM ScreamTracker III Module sound data 3032>0 string >\0 Title: "%s" 3033 3034# Gravis UltraSound patches 3035# From <ache@nagual.ru> 3036 30370 string GF1PATCH110\0ID#000002\0 GUS patch 30380 string GF1PATCH100\0ID#000002\0 Old GUS patch 3039 3040# mime types according to http://www.geocities.com/nevilo/mod.htm: 3041# audio/it .it 3042# audio/x-zipped-it .itz 3043# audio/xm fasttracker modules 3044# audio/x-s3m screamtracker modules 3045# audio/s3m screamtracker modules 3046# audio/x-zipped-mod mdz 3047# audio/mod mod 3048# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 3049 3050# 3051# Taken from loader code from mikmod version 2.14 3052# by Steve McIntyre (stevem@chiark.greenend.org.uk) 3053# <doj@cubic.org> added title printing on 2003-06-24 30540 string MAS_UTrack_V00 3055>14 string >/0 ultratracker V1.%.1s module sound data 3056!:mime audio/x-mod 3057#audio/x-tracker-module 3058 30590 string UN05 MikMod UNI format module sound data 3060 30610 string Extended\ Module: Fasttracker II module sound data 3062!:mime audio/x-mod 3063#audio/x-tracker-module 3064>17 string >\0 Title: "%s" 3065 306621 string/c =!SCREAM! Screamtracker 2 module sound data 3067!:mime audio/x-mod 3068#audio/x-screamtracker-module 306921 string BMOD2STM Screamtracker 2 module sound data 3070!:mime audio/x-mod 3071#audio/x-screamtracker-module 30721080 string M.K. 4-channel Protracker module sound data 3073!:mime audio/x-mod 3074#audio/x-protracker-module 3075>0 string >\0 Title: "%s" 30761080 string M!K! 4-channel Protracker module sound data 3077!:mime audio/x-mod 3078#audio/x-protracker-module 3079>0 string >\0 Title: "%s" 30801080 string FLT4 4-channel Startracker module sound data 3081!:mime audio/x-mod 3082#audio/x-startracker-module 3083>0 string >\0 Title: "%s" 30841080 string FLT8 8-channel Startracker module sound data 3085!:mime audio/x-mod 3086#audio/x-startracker-module 3087>0 string >\0 Title: "%s" 30881080 string 4CHN 4-channel Fasttracker module sound data 3089!:mime audio/x-mod 3090#audio/x-fasttracker-module 3091>0 string >\0 Title: "%s" 30921080 string 6CHN 6-channel Fasttracker module sound data 3093!:mime audio/x-mod 3094#audio/x-fasttracker-module 3095>0 string >\0 Title: "%s" 30961080 string 8CHN 8-channel Fasttracker module sound data 3097!:mime audio/x-mod 3098#audio/x-fasttracker-module 3099>0 string >\0 Title: "%s" 31001080 string CD81 8-channel Octalyser module sound data 3101!:mime audio/x-mod 3102#audio/x-octalysertracker-module 3103>0 string >\0 Title: "%s" 31041080 string OKTA 8-channel Octalyzer module sound data 3105!:mime audio/x-mod 3106#audio/x-octalysertracker-module 3107>0 string >\0 Title: "%s" 3108# Not good enough. 3109#1082 string CH 3110#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 31111080 string 16CN 16-channel Taketracker module sound data 3112!:mime audio/x-mod 3113#audio/x-taketracker-module 3114>0 string >\0 Title: "%s" 31151080 string 32CN 32-channel Taketracker module sound data 3116!:mime audio/x-mod 3117#audio/x-taketracker-module 3118>0 string >\0 Title: "%s" 3119 3120# TOC sound files -Trevor Johnson <trevor@jpj.net> 3121# 31220 string TOC TOC sound file 3123 3124# sidfiles <pooka@iki.fi> 3125# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 31260 string SIDPLAY\ INFOFILE Sidplay info file 3127 31280 string PSID PlaySID v2.2+ (AMIGA) sidtune 3129>4 beshort >0 w/ header v%d, 3130>14 beshort =1 single song, 3131>14 beshort >1 %d songs, 3132>16 beshort >0 default song: %d 3133>0x16 string >\0 name: "%s" 3134>0x36 string >\0 author: "%s" 3135>0x56 string >\0 copyright: "%s" 3136 31370 string RSID RSID sidtune PlaySID compatible 3138>4 beshort >0 w/ header v%d, 3139>14 beshort =1 single song, 3140>14 beshort >1 %d songs, 3141>16 beshort >0 default song: %d 3142>0x16 string >\0 name: "%s" 3143>0x36 string >\0 author: "%s" 3144>0x56 string >\0 copyright: "%s" 3145 3146# IRCAM sound files - Michael Pruett <michael@68k.org> 3147# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 31480 belong 0x64a30100 IRCAM file (VAX little-endian) 31490 belong 0x0001a364 IRCAM file (VAX big-endian) 31500 belong 0x64a30200 IRCAM file (Sun big-endian) 31510 belong 0x0002a364 IRCAM file (Sun little-endian) 31520 belong 0x64a30300 IRCAM file (MIPS little-endian) 31530 belong 0x0003a364 IRCAM file (MIPS big-endian) 31540 belong 0x64a30400 IRCAM file (NeXT big-endian) 31550 belong 0x64a30400 IRCAM file (NeXT big-endian) 31560 belong 0x0004a364 IRCAM file (NeXT little-endian) 3157 3158# NIST SPHERE <mpruett@sgi.com> 31590 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 3160 3161# Sample Vision <mpruett@sgi.com> 31620 string SOUND\ SAMPLE\ DATA\ Sample Vision file 3163 3164# Audio Visual Research <tonigonenstein@users.sourceforge.net> 31650 string 2BIT Audio Visual Research file, 3166>12 beshort =0 mono, 3167>12 beshort =-1 stereo, 3168>14 beshort x %d bits 3169>16 beshort =0 unsigned, 3170>16 beshort =-1 signed, 3171>22 belong&0x00ffffff x %d Hz, 3172>18 beshort =0 no loop, 3173>18 beshort =-1 loop, 3174>21 ubyte <128 note %d, 3175>22 byte =0 replay 5.485 KHz 3176>22 byte =1 replay 8.084 KHz 3177>22 byte =2 replay 10.971 KHz 3178>22 byte =3 replay 16.168 KHz 3179>22 byte =4 replay 21.942 KHz 3180>22 byte =5 replay 32.336 KHz 3181>22 byte =6 replay 43.885 KHz 3182>22 byte =7 replay 47.261 KHz 3183 3184# SGI SoundTrack <mpruett@sgi.com> 31850 string _SGI_SoundTrack SGI SoundTrack project file 3186# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 31870 string ID3 Audio file with ID3 version 2 3188>3 byte x \b.%d 3189>4 byte x \b.%d 3190>>5 byte &0x80 \b, unsynchronized frames 3191>>5 byte &0x40 \b, extended header 3192>>5 byte &0x20 \b, experimental 3193>>5 byte &0x10 \b, footer present 3194>(6.I+10) indirect x \b, contains: 3195 3196# NSF (NES sound file) magic 31970 string NESM\x1a NES Sound File 3198>14 string >\0 ("%s" by 3199>46 string >\0 %s, copyright 3200>78 string >\0 %s), 3201>5 byte x version %d, 3202>6 byte x %d tracks, 3203>122 byte&0x2 =1 dual PAL/NTSC 3204>122 byte&0x1 =1 PAL 3205>122 byte&0x1 =0 NTSC 3206 3207# Type: SNES SPC700 sound files 3208# From: Josh Triplett <josh@freedesktop.org> 32090 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 3210>&0 string 0.30 \b, version %s 3211>>0x23 byte 0x1B \b, without ID666 tag 3212>>0x23 byte 0x1A \b, with ID666 tag 3213>>>0x2E string >\0 \b, song "%.32s" 3214>>>0x4E string >\0 \b, game "%.32s" 3215 3216# Impulse tracker module (audio/x-it) 32170 string IMPM Impulse Tracker module sound data - 3218!:mime audio/x-mod 3219>4 string >\0 "%s" 3220>40 leshort !0 compatible w/ITv%x 3221>42 leshort !0 created w/ITv%x 3222 3223# Imago Orpheus module (audio/x-imf) 322460 string IM10 Imago Orpheus module sound data - 3225>0 string >\0 "%s" 3226 3227# From <collver1@attbi.com> 3228# These are the /etc/magic entries to decode modules, instruments, and 3229# samples in Impulse Tracker's native format. 3230 32310 string IMPS Impulse Tracker Sample 3232>18 byte &2 16 bit 3233>18 byte ^2 8 bit 3234>18 byte &4 stereo 3235>18 byte ^4 mono 32360 string IMPI Impulse Tracker Instrument 3237>28 leshort !0 ITv%x 3238>30 byte !0 %d samples 3239 3240# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 3241# From <collver1@attbi.com> 32420 string LM8953 Yamaha TX Wave 3243>22 byte 0x49 looped 3244>22 byte 0xC9 non-looped 3245>23 byte 1 33kHz 3246>23 byte 2 50kHz 3247>23 byte 3 16kHz 3248 3249# scream tracker: file(1) magic for Scream Tracker sample files 3250# 3251# From <collver1@attbi.com> 325276 string SCRS Scream Tracker Sample 3253>0 byte 1 sample 3254>0 byte 2 adlib melody 3255>0 byte >2 adlib drum 3256>31 byte &2 stereo 3257>31 byte ^2 mono 3258>31 byte &4 16bit little endian 3259>31 byte ^4 8bit 3260>30 byte 0 unpacked 3261>30 byte 1 packed 3262 3263# audio 3264# From: Cory Dikkers <cdikkers@swbell.net> 32650 string MMD0 MED music file, version 0 32660 string MMD1 OctaMED Pro music file, version 1 32670 string MMD3 OctaMED Soundstudio music file, version 3 32680 string OctaMEDCmpr OctaMED Soundstudio compressed file 32690 string MED MED_Song 32700 string SymM Symphonie SymMOD music file 3271# 32720 string THX AHX version 3273>3 byte =0 1 module data 3274>3 byte =1 2 module data 3275# 32760 string OKTASONG Oktalyzer module data 3277# 32780 string DIGI\ Booster\ module\0 %s 3279>20 byte >0 %c 3280>>21 byte >0 \b%c 3281>>>22 byte >0 \b%c 3282>>>>23 byte >0 \b%c 3283>610 string >\0 \b, "%s" 3284# 32850 string DBM0 DIGI Booster Pro Module 3286>4 byte >0 V%X. 3287>>5 byte x \b%02X 3288>16 string >\0 \b, "%s" 3289# 32900 string FTMN FaceTheMusic module 3291>16 string >\0d \b, "%s" 3292 3293# From: <doj@cubic.org> 2003-06-24 32940 string AMShdr\32 Velvet Studio AMS Module v2.2 32950 string Extreme Extreme Tracker AMS Module v1.3 32960 string DDMF Xtracker DMF Module 3297>4 byte x v%i 3298>0xD string >\0 Title: "%s" 3299>0x2B string >\0 Composer: "%s" 33000 string DSM\32 Dynamic Studio Module DSM 33010 string SONG DigiTrekker DTM Module 33020 string DMDL DigiTrakker MDL Module 33030 string PSM\32 Protracker Studio PSM Module 330444 string PTMF Poly Tracker PTM Module 3305>0 string >\32 Title: "%s" 33060 string MT20 MadTracker 2.0 Module MT2 33070 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 33080 string RTMM RTM Module 33090x426 string MaDoKaN96 XMS Adlib Module 3310>0 string >\0 Composer: "%s" 33110 string AMF AMF Module 3312>4 string >\0 Title: "%s" 33130 string MODINFO1 Open Cubic Player Module Inforation MDZ 33140 string Extended\40Instrument: Fast Tracker II Instrument 3315 3316# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 3317# NOA Nancy Codec file 33180 string \210NOA\015\012\032 NOA Nancy Codec Movie file 3319# Yamaha SMAF format 33200 string MMMD Yamaha SMAF file 3321# Sharp Jisaku Melody format for PDC 33220 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 3323>20 string Ver01.00 Ver. 1.00 3324>>32 byte x , %d tracks 3325 3326# Free lossless audio codec <http://flac.sourceforge.net> 3327# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 33280 string fLaC FLAC audio bitstream data 3329!:mime audio/x-flac 3330>4 byte&0x7f >0 \b, unknown version 3331>4 byte&0x7f 0 \b 3332# some common bits/sample values 3333>>20 beshort&0x1f0 0x030 \b, 4 bit 3334>>20 beshort&0x1f0 0x050 \b, 6 bit 3335>>20 beshort&0x1f0 0x070 \b, 8 bit 3336>>20 beshort&0x1f0 0x0b0 \b, 12 bit 3337>>20 beshort&0x1f0 0x0f0 \b, 16 bit 3338>>20 beshort&0x1f0 0x170 \b, 24 bit 3339>>20 byte&0xe 0x0 \b, mono 3340>>20 byte&0xe 0x2 \b, stereo 3341>>20 byte&0xe 0x4 \b, 3 channels 3342>>20 byte&0xe 0x6 \b, 4 channels 3343>>20 byte&0xe 0x8 \b, 5 channels 3344>>20 byte&0xe 0xa \b, 6 channels 3345>>20 byte&0xe 0xc \b, 7 channels 3346>>20 byte&0xe 0xe \b, 8 channels 3347# some common sample rates 3348>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 3349>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 3350>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 3351>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 3352>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 3353>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 3354>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 3355>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz 3356>>17 belong&0xfffff0 0x01f400 \b, 8 kHz 3357>>17 belong&0xfffff0 0x177000 \b, 96 kHz 3358>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 3359>>21 byte&0xf >0 \b, >4G samples 3360>>21 byte&0xf 0 \b 3361>>>22 belong >0 \b, %u samples 3362>>>22 belong 0 \b, length unknown 3363 3364# (ISDN) VBOX voice message file (Wolfram Kleff) 33650 string VBOX VBOX voice message data 3366 3367# ReBorn Song Files (.rbs) 3368# David J. Singer <doc@deadvirgins.org.uk> 33698 string RB40 RBS Song file 3370>29 string ReBorn created by ReBorn 3371>37 string Propellerhead created by ReBirth 3372 3373# Synthesizer Generator and Kimwitu share their file format 33740 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 3375# Kimwitu++ uses a slightly different magic 33760 string A#S#C#S#S#L#HUB Kimwitu++ data 3377 3378# From "Simon Hosie 33790 string TFMX-SONG TFMX module sound data 3380 3381# Monkey's Audio compressed audio format (.ape) 3382# From danny.milo@gmx.net (Danny Milosavljevic) 3383# New version from Abel Cheung <abel (@) oaka.org> 33840 string MAC\040 Monkey's Audio compressed format 3385!:mime audio/x-ape 3386>4 uleshort >0x0F8B version %d 3387>>(0x08.l) uleshort =1000 with fast compression 3388>>(0x08.l) uleshort =2000 with normal compression 3389>>(0x08.l) uleshort =3000 with high compression 3390>>(0x08.l) uleshort =4000 with extra high compression 3391>>(0x08.l) uleshort =5000 with insane compression 3392>>(0x08.l+18) uleshort =1 \b, mono 3393>>(0x08.l+18) uleshort =2 \b, stereo 3394>>(0x08.l+20) ulelong x \b, sample rate %d 3395>4 uleshort <0x0F8C version %d 3396>>6 uleshort =1000 with fast compression 3397>>6 uleshort =2000 with normal compression 3398>>6 uleshort =3000 with high compression 3399>>6 uleshort =4000 with extra high compression 3400>>6 uleshort =5000 with insane compression 3401>>10 uleshort =1 \b, mono 3402>>10 uleshort =2 \b, stereo 3403>>12 ulelong x \b, sample rate %d 3404 3405# adlib sound files 3406# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu 34070 string RAWADATA RdosPlay RAW 3408 34091068 string RoR AMUSIC Adlib Tracker 3410 34110 string JCH EdLib 3412 34130 string mpu401tr MPU-401 Trakker 3414 34150 string SAdT Surprise! Adlib Tracker 3416>4 byte x Version %d 3417 34180 string XAD! eXotic ADlib 3419 34200 string ofTAZ! eXtra Simple Music 3421 3422# Spectrum 128 tunes (.ay files). 3423# From: Emanuel Haupt <ehaupt@critical.ch> 34240 string ZXAYEMUL Spectrum 128 tune 3425 34260 string \0BONK BONK, 3427#>5 byte x version %d 3428>14 byte x %d channel(s), 3429>15 byte =1 lossless, 3430>15 byte =0 lossy, 3431>16 byte x mid-side 3432 3433384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 3434 3435# format VQF (proprietary codec for sound) 3436# some infos on the header file available at : 3437# http://www.twinvq.org/english/technology_format.html 34380 string TWIN97012000 VQF data 3439>27 short 0 \b, Mono 3440>27 short 1 \b, Stereo 3441>31 short >0 \b, %d kbit/s 3442>35 short >0 \b, %d kHz 3443 3444# Nelson A. de Oliveira (naoliv@gmail.com) 3445# .eqf 34460 string Winamp\ EQ\ library\ file %s 3447# it will match only versions like v<digit>.<digit> 3448# Since I saw only eqf files with version v1.1 I think that it's OK 3449>23 string x \b%.4s 3450# .preset 34510 string [Equalizer\ preset] XMMS equalizer preset 3452# .m3u 34530 search/1 #EXTM3U M3U playlist text 3454# .pls 34550 search/1 [playlist] PLS playlist text 3456# licq.conf 34571 string [licq] LICQ configuration file 3458 3459# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 34600 string ICE! SNDH Atari ST music 34610 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 3462 3463# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 34640 string MP+ Musepack audio 3465!:mime audio/x-musepack 3466>3 byte 255 \b, SV pre8 3467>3 byte&0xF 0x6 \b, SV 6 3468>3 byte&0xF 0x8 \b, SV 8 3469>3 byte&0xF 0x7 \b, SV 7 3470>>3 byte&0xF0 0x0 \b.0 3471>>3 byte&0xF0 0x10 \b.1 3472>>3 byte&0xF0 240 \b.15 3473>>10 byte&0xF0 0x0 \b, no profile 3474>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 3475>>10 byte&0xF0 0x50 \b, quality 0 3476>>10 byte&0xF0 0x60 \b, quality 1 3477>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 3478>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 3479>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 3480>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 3481>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 3482>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 3483>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 3484>>10 byte&0xF0 0xE0 \b, quality 9 3485>>10 byte&0xF0 0xF0 \b, quality 10 3486>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 3487>>27 byte 102 \b, Beta 1.02 3488>>27 byte 104 \b, Beta 1.04 3489>>27 byte 105 \b, Alpha 1.05 3490>>27 byte 106 \b, Beta 1.06 3491>>27 byte 110 \b, Release 1.1 3492>>27 byte 111 \b, Alpha 1.11 3493>>27 byte 112 \b, Beta 1.12 3494>>27 byte 113 \b, Alpha 1.13 3495>>27 byte 114 \b, Beta 1.14 3496>>27 byte 115 \b, Alpha 1.15 3497 3498# IMY 3499# from http://filext.com/detaillist.php?extdetail=IMY 3500# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 3501# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 3502# http://www.wx800.com/msg/download/irda/iMelody.pdf 35030 string BEGIN:IMELODY iMelody Ringtone Format 3504 3505# From: "Mateus Caruccio" <mateus@caruccio.com> 3506# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 35070 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 3508 3509# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 351060 string SONG SoundFX Module sound file 3511 3512# Type: Adaptive Multi-Rate Codec 3513# URL: http://filext.com/detaillist.php?extdetail=AMR 3514# From: Russell Coker <russell@coker.com.au> 35150 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 3516 3517# Type: SuperCollider 3 Synth Definition File Format 3518# From: Mario Lang <mlang@debian.org> 35190 string SCgf SuperCollider3 Synth Definition file, 3520>4 belong x version %d 3521 3522# Type: True Audio Lossless Audio 3523# URL: http://wiki.multimedia.cx/index.php?title=True_Audio 3524# From: Mike Melanson <mike@multimedia.cx> 35250 string TTA1 True Audio Lossless Audio 3526 3527# Type: WavPack Lossless Audio 3528# URL: http://wiki.multimedia.cx/index.php?title=WavPack 3529# From: Mike Melanson <mike@multimedia.cx> 35300 string wvpk WavPack Lossless Audio 3531 3532# From Fabio R. Schmidlin <frs@pop.com.br> 3533# VGM music file 35340 string Vgm\ 3535>9 ubyte >0 VGM Video Game Music dump v 3536>>9 ubyte/16 >0 \b%d 3537>>9 ubyte&0x0F x \b%d 3538>>8 ubyte/16 x \b.%d 3539>>8 ubyte&0x0F >0 \b%d 3540#Get soundchips 3541>>8 ubyte x \b, soundchip(s)= 3542>>0x0C ulelong >0 SN76489, 3543>>0x10 ulelong >0 YM2413, 3544>>0x2C ulelong >0 YM2612, 3545>>0x30 ulelong >0 YM2151, 3546>>0x38 ulelong >0 Sega PCM, 3547>>0x34 ulelong >0xC 3548>>>0x40 ulelong >0 RF5C68, 3549>>0x34 ulelong >0x10 3550>>>0x44 ulelong >0 YM2203, 3551>>0x34 ulelong >0x14 3552>>>0x48 ulelong >0 YM2608, 3553>>0x34 ulelong >0x18 3554>>>0x4C lelong >0 YM2610, 3555>>>0x4C lelong <0 YM2610B, 3556>>0x34 ulelong >0x1C 3557>>>0x50 ulelong >0 YM3812, 3558>>0x34 ulelong >0x20 3559>>>0x54 ulelong >0 YM3526, 3560>>0x34 ulelong >0x24 3561>>>0x58 ulelong >0 Y8950, 3562>>0x34 ulelong >0x28 3563>>>0x5C ulelong >0 YMF262, 3564>>0x34 ulelong >0x2C 3565>>>0x60 ulelong >0 YMF278B, 3566>>0x34 ulelong >0x30 3567>>>0x64 ulelong >0 YMF271, 3568>>0x34 ulelong >0x34 3569>>>0x68 ulelong >0 YMZ280B, 3570>>0x34 ulelong >0x38 3571>>>0x6C ulelong >0 RF5C164, 3572>>0x34 ulelong >0x3C 3573>>>0x70 ulelong >0 PWM, 3574>>0x34 ulelong >0x40 3575>>>0x74 ulelong >0 3576>>>>0x78 ubyte 0x00 AY-3-8910, 3577>>>>0x78 ubyte 0x01 AY-3-8912, 3578>>>>0x78 ubyte 0x02 AY-3-8913, 3579>>>>0x78 ubyte 0x03 AY-3-8930, 3580>>>>0x78 ubyte 0x10 YM2149, 3581>>>>0x78 ubyte 0x11 YM3439, 3582 3583# GVOX Encore file format 3584# Since this is a proprietary file format and there is no publicly available 3585# format specification, this is just based on induction 3586# 35870 string SCOW 3588>4 byte 0xc4 GVOX Encore music, version 5.0 or above 3589>4 byte 0xc2 GVOX Encore music, version < 5.0 3590 35910 string ZBOT 3592>4 byte 0xc5 GVOX Encore music, version < 5.0 3593 3594 3595#---------------------------------------------------------------- 3596# $File$ 3597# basis: file(1) magic for BBx/Pro5-files 3598# Oliver Dammer <dammer@olida.de> 2005/11/07 3599# http://www.basis.com business-basic-files. 3600# 36010 string \074\074bbx\076\076 BBx 3602>7 string \000 indexed file 3603>7 string \001 serial file 3604>7 string \002 keyed file 3605>>13 short 0 (sort) 3606>7 string \004 program 3607>>18 byte x (LEVEL %d) 3608>>>23 string >\000 psaved 3609>7 string \006 mkeyed file 3610>>13 short 0 (sort) 3611>>8 string \000 (mkey) 3612 3613#------------------------------------------------------------------------------ 3614# $File: bflt,v 1.4 2009/09/19 16:28:08 christos Exp $ 3615# bFLT: file(1) magic for BFLT uclinux binary files 3616# 3617# From Philippe De Muyter <phdm@macqel.be> 3618# 36190 string bFLT BFLT executable 3620>4 belong x - version %d 3621>4 belong 4 3622>>36 belong&0x1 0x1 ram 3623>>36 belong&0x2 0x2 gotpic 3624>>36 belong&0x4 0x4 gzip 3625>>36 belong&0x8 0x8 gzdata 3626 3627#------------------------------------------------------------------------------ 3628# $File: apple,v 1.27 2013/03/09 22:36:00 christos Exp $ 3629# blackberry: file(1) magic for BlackBerry file formats 3630# 36315 belong 0 3632>8 belong 010010010 BlackBerry RIM ETP file 3633>>22 string x \b for %s 3634# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 3635# http://ftg.lbl.gov/checkpoint 36360 string C\0\0\0R\0\0\0 BLCR 3637>16 lelong 1 x86 3638>16 lelong 3 alpha 3639>16 lelong 5 x86-64 3640>16 lelong 7 ARM 3641>8 lelong x context data (little endian, version %d) 3642# Uncomment the following only of your "file" program supports "search" 3643#>0 search/1024 VMA\06 for kernel 3644#>>&1 byte x %d. 3645#>>&2 byte x %d. 3646#>>&3 byte x %d 36470 string \0\0\0C\0\0\0R BLCR 3648>16 belong 2 SPARC 3649>16 belong 4 ppc 3650>16 belong 6 ppc64 3651>16 belong 7 ARMEB 3652>16 belong 8 SPARC64 3653>8 belong x context data (big endian, version %d) 3654# Uncomment the following only of your "file" program supports "search" 3655#>0 search/1024 VMA\06 for kernel 3656#>>&1 byte x %d. 3657#>>&2 byte x \b%d. 3658#>>&3 byte x \b%d 3659 3660#------------------------------------------------------------------------------ 3661# $File: blender,v 1.5 2009/09/19 16:28:08 christos Exp $ 3662# blender: file(1) magic for Blender 3D related files 3663# 3664# Native format rule v1.2. For questions use the developers list 3665# http://lists.blender.org/mailman/listinfo/bf-committers 3666# GLOB chunk was moved near start and provides subversion info since 2.42 3667 36680 string =BLENDER Blender3D, 3669>7 string =_ saved as 32-bits 3670>>8 string =v little endian 3671>>>9 byte x with version %c. 3672>>>10 byte x \b%c 3673>>>11 byte x \b%c 3674>>>0x40 string =GLOB \b. 3675>>>>0x58 leshort x \b%.4d 3676>>8 string =V big endian 3677>>>9 byte x with version %c. 3678>>>10 byte x \b%c 3679>>>11 byte x \b%c 3680>>>0x40 string =GLOB \b. 3681>>>>0x58 beshort x \b%.4d 3682>7 string =- saved as 64-bits 3683>>8 string =v little endian 3684>>9 byte x with version %c. 3685>>10 byte x \b%c 3686>>11 byte x \b%c 3687>>0x44 string =GLOB \b. 3688>>>0x60 leshort x \b%.4d 3689>>8 string =V big endian 3690>>>9 byte x with version %c. 3691>>>10 byte x \b%c 3692>>>11 byte x \b%c 3693>>>0x44 string =GLOB \b. 3694>>>>0x60 beshort x \b%.4d 3695 3696# Scripts that run in the embedded Python interpreter 36970 string #!BPY Blender3D BPython script 3698 3699#------------------------------------------------------------------------------ 3700# $File$ 3701# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 3702# 3703# Note that this 0407 conflicts with several other a.out formats... 3704# 3705# XXX - should this be redone with "be" and "le", so that it works on 3706# little-endian machines as well? If so, what's the deal with 3707# "VAX-order" and "VAX-order2"? 3708# 3709#0 long 0407 68K Blit (standalone) executable 3710#0 short 0407 VAX-order2 68K Blit (standalone) executable 37110 short 03401 VAX-order 68K Blit (standalone) executable 37120 long 0406 68k Blit mpx/mux executable 37130 short 0406 VAX-order2 68k Blit mpx/mux executable 37140 short 03001 VAX-order 68k Blit mpx/mux executable 3715# Need more values for WE32 DMD executables. 3716# Note that 0520 is the same as COFF 3717#0 short 0520 tty630 layers executable 3718 3719#------------------------------------------------------------------------------ 3720# $File$ 3721# i80960 b.out objects and archives 3722# 37230 long 0x10d i960 b.out relocatable object 3724>16 long >0 not stripped 3725# 3726# b.out archive (hp-rt on i960) 37270 string =!<bout> b.out archive 3728>8 string __.SYMDEF random library 3729 3730#------------------------------------------------------------------------------ 3731# $File: bsdi,v 1.6 2013/01/09 22:37:24 christos Exp $ 3732# bsdi: file(1) magic for BSD/OS (from BSDI) objects 3733# Some object/executable formats use the same magic numbers as are used 3734# in other OSes; those are handled by entries in aout. 3735# 3736 37370 lelong 0314 386 compact demand paged pure executable 3738>16 lelong >0 not stripped 3739>32 byte 0x6a (uses shared libs) 3740 3741# same as in SunOS 4.x, except for static shared libraries 37420 belong&077777777 0600413 SPARC demand paged 3743>0 byte &0x80 3744>>20 belong <4096 shared library 3745>>20 belong =4096 dynamically linked executable 3746>>20 belong >4096 dynamically linked executable 3747>0 byte ^0x80 executable 3748>16 belong >0 not stripped 3749>36 belong 0xb4100001 (uses shared libs) 3750 37510 belong&077777777 0600410 SPARC pure 3752>0 byte &0x80 dynamically linked executable 3753>0 byte ^0x80 executable 3754>16 belong >0 not stripped 3755>36 belong 0xb4100001 (uses shared libs) 3756 37570 belong&077777777 0600407 SPARC 3758>0 byte &0x80 dynamically linked executable 3759>0 byte ^0x80 executable 3760>16 belong >0 not stripped 3761>36 belong 0xb4100001 (uses shared libs) 3762# Chiasmus is a encryption standard developed by the German Federal 3763# Office for Information Security (Bundesamt fuer Sicherheit in der 3764# Informationstechnik). 3765 3766# Extension: .xia 37670 string XIA1 Chiasmus encrypted data 3768 3769# Extension: .xis 37700 string XIS Chiasmus key 3771 3772#------------------------------------------------------------------------------ 3773# $File$ 3774# BTSnoop: file(1) magic for BTSnoop files 3775# 3776# From <marcel@holtmann.org> 37770 string btsnoop\0 BTSnoop 3778>8 belong x version %d, 3779>12 belong 1001 Unencapsulated HCI 3780>12 belong 1002 HCI UART (H4) 3781>12 belong 1003 HCI BCSP 3782>12 belong 1004 HCI Serial (H5) 3783>>12 belong x type %d 3784 3785#------------------------------------------------------------------------------ 3786# $File$ 3787# c64: file(1) magic for various commodore 64 related files 3788# 3789# From: Dirk Jagdmann <doj@cubic.org> 3790 37910x16500 belong 0x12014100 D64 Image 37920x16500 belong 0x12014180 D71 Image 37930x61800 belong 0x28034400 D81 Image 37940 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 37950 belong 0x43154164 X64 Image 3796 37970 string GCR-1541 GCR Image 3798>8 byte x version: %i 3799>9 byte x tracks: %i 3800 38019 string PSUR ARC archive (c64) 38022 string -LH1- LHA archive (c64) 3803 38040 string C64File PC64 Emulator file 3805>8 string >\0 "%s" 38060 string C64Image PC64 Freezer Image 3807 38080 beshort 0x38CD C64 PCLink Image 38090 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 3810 38110 belong 0xFF424CFF WRAptor packer (c64) 3812 38130 string C64S\x20tape\x20file T64 tape Image 3814>32 leshort x Version:0x%x 3815>36 leshort !0 Entries:%i 3816>40 string x Name:%.24s 3817 38180 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3819>32 leshort x Version:0x%x 3820>36 leshort !0 Entries:%i 3821>40 string x Name:%.24s 3822 38230 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 3824>32 leshort x Version:0x%x 3825>36 leshort !0 Entries:%i 3826>40 string x Name:%.24s 3827 3828#------------------------------------------------------------------------------ 3829# $File: cad,v 1.12 2013/07/04 15:24:37 christos Exp $ 3830# autocad: file(1) magic for cad files 3831# 3832 3833# Microstation DGN/CIT Files (www.bentley.com) 3834# Last updated July 29, 2005 by Lester Hightower 3835# DGN is the default file extension of Microstation/Intergraph CAD files. 3836# CIT is the proprietary raster format (similar to TIFF) used to attach 3837# raster underlays to Microstation DGN (vector) drawings. 3838# 3839# http://www.wotsit.org/search.asp 3840# http://filext.com/detaillist.php?extdetail=DGN 3841# http://filext.com/detaillist.php?extdetail=CIT 3842# 3843# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 3844# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 3845# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 3846# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 38470 string \010\011\376 Microstation 3848>3 string \002 3849>>30 string \026\105 DGNFile 3850>>30 string \034\105 DGNFile 3851>>30 string \073\107 DGNFile 3852>>30 string \073\110 DGNFile 3853>>30 string \106\107 DGNFile 3854>>30 string \110\103 DGNFile 3855>>30 string \120\104 DGNFile 3856>>30 string \172\104 DGNFile 3857>>30 string \172\105 DGNFile 3858>>30 string \172\106 DGNFile 3859>>30 string \234\106 DGNFile 3860>>30 string \273\105 DGNFile 3861>>30 string \306\106 DGNFile 3862>>30 string \310\104 DGNFile 3863>>30 string \341\104 DGNFile 3864>>30 string \372\103 DGNFile 3865>>30 string \372\104 DGNFile 3866>>30 string \372\106 DGNFile 3867>>30 string \376\103 DGNFile 3868>4 string \030\000\000 CITFile 3869>4 string \030\000\003 CITFile 3870 3871# AutoCAD 3872# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg 3873# and http://www.iana.org/assignments/media-types/image/vnd.dwg 38740 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 3875!:mime image/vnd.dwg 38760 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 3877!:mime image/vnd.dwg 38780 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 3879!:mime image/vnd.dwg 38800 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 3881!:mime image/vnd.dwg 38820 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 3883!:mime image/vnd.dwg 38840 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 3885!:mime image/vnd.dwg 38860 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 3887!:mime image/vnd.dwg 38880 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 3889!:mime image/vnd.dwg 38900 string AC1001 DWG AutoDesk AutoCAD Release 2.22 3891!:mime image/vnd.dwg 38920 string AC1002 DWG AutoDesk AutoCAD Release 2.50 3893!:mime image/vnd.dwg 38940 string AC1003 DWG AutoDesk AutoCAD Release 2.60 3895!:mime image/vnd.dwg 38960 string AC1004 DWG AutoDesk AutoCAD Release 9 3897!:mime image/vnd.dwg 38980 string AC1006 DWG AutoDesk AutoCAD Release 10 3899!:mime image/vnd.dwg 39000 string AC1009 DWG AutoDesk AutoCAD Release 11/12 3901!:mime image/vnd.dwg 3902# AutoCAD DWG versions R13/R14 (www.autodesk.com) 3903# Written December 01, 2003 by Lester Hightower 3904# Based on the DWG File Format Specifications at http://www.opendwg.org/ 3905# AutoCad, from Nahuel Greco 3906# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 39070 string AC1012 DWG AutoDesk AutoCAD Release 13 3908!:mime image/vnd.dwg 39090 string AC1014 DWG AutoDesk AutoCAD Release 14 3910!:mime image/vnd.dwg 39110 string AC1015 DWG AutoDesk AutoCAD 2000/2002 3912!:mime image/vnd.dwg 3913 3914# A new version of AutoCAD DWG 3915# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 3916# ICQ 358572321) 3917# From various sources like: 3918# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html 39190 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 3920!:mime image/vnd.dwg 39210 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 3922!:mime image/vnd.dwg 39230 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 3924!:mime image/vnd.dwg 39250 string AC1027 DWG AutoDesk AutoCAD 2013/2014 3926!:mime image/vnd.dwg 3927 3928# KOMPAS 2D drawing from ASCON 3929# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 3930# gathered nor specification 3931# ASCON http://ascon.net/main/ in English, 3932# http://ascon.ru/ main site in Russian 3933# Extension is CDW for drawing and FRW for fragment of drawing 3934# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 3935# ICQ 358572321, http://vkontakte.ru/id16076543) 3936# From: 3937# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 3938# (in russian) and my experiments 39390 string KF 3940>2 belong 0x4E00000C Kompas drawing 12.0 SP1 3941>2 belong 0x4D00000C Kompas drawing 12.0 3942>2 belong 0x3200000B Kompas drawing 11.0 SP1 3943>2 belong 0x3100000B Kompas drawing 11.0 3944>2 belong 0x2310000A Kompas drawing 10.0 SP1 3945>2 belong 0x2110000A Kompas drawing 10.0 3946>2 belong 0x08000009 Kompas drawing 9.0 SP1 3947>2 belong 0x05000009 Kompas drawing 9.0 3948>2 belong 0x33010008 Kompas drawing 8+ 3949>2 belong 0x1A000008 Kompas drawing 8.0 3950>2 belong 0x2C010107 Kompas drawing 7+ 3951>2 belong 0x05000007 Kompas drawing 7.0 3952>2 belong 0x32000006 Kompas drawing 6+ 3953>2 belong 0x09000006 Kompas drawing 6.0 3954>2 belong 0x5C009005 Kompas drawing 5.11R03 3955>2 belong 0x54009005 Kompas drawing 5.11R02 3956>2 belong 0x51009005 Kompas drawing 5.11R01 3957>2 belong 0x22009005 Kompas drawing 5.10R03 3958>2 belong 0x22009005 Kompas drawing 5.10R02 mar 3959>2 belong 0x21009005 Kompas drawing 5.10R02 febr 3960>2 belong 0x19009005 Kompas drawing 5.10R01 3961>2 belong 0xF4008005 Kompas drawing 5.9R01.003 3962>2 belong 0x1C008005 Kompas drawing 5.9R01.002 3963>2 belong 0x11008005 Kompas drawing 5.8R01.003 3964 3965# CAD: file(1) magic for computer aided design files 3966# Phillip Griffith <phillip dot griffith at gmail dot com> 3967# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 3968# 39690 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library 39700 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD 39710 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD 39720 beshort 0x0809 Bentley/Intergraph MicroStation 3973>0x02 byte 0xfe 3974>>0x04 beshort 0x1800 CIT raster CAD 3975 3976# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' 3977#16 beshort 0x3d3d image/x-3ds 3978 3979# MegaCAD 2D/3D drawing (.prt) 3980# http://megacad.de/ 3981# From: Markus Heidelberg <markus.heidelberg@web.de> 39820 string MegaCad23\0 MegaCAD 2D/3D drawing 3983 3984#------------------------------------------------------------------------------ 3985# $File: cafebabe,v 1.17 2015/01/01 17:07:00 christos Exp $ 3986# Cafe Babes unite! 3987# 3988# Since Java bytecode and Mach-O universal binaries have the same magic number, 3989# the test must be performed in the same "magic" sequence to get both right. 3990# The long at offset 4 in a Mach-O universal binary tells the number of 3991# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 3992# version and the short at offset 6 is the JVM major version. Since there are only 3993# only 18 labeled Mach-O architectures at current, and the first released 3994# Java class format was version 43.0, we can safely choose any number 3995# between 18 and 39 to test the number of architectures against 3996# (and use as a hack). Let's not use 18, because the Mach-O people 3997# might add another one or two as time goes by... 3998# 3999### JAVA START ### 40000 belong 0xcafebabe 4001>4 belong >30 compiled Java class data, 4002!:mime application/x-java-applet 4003>>6 beshort x version %d. 4004>>4 beshort x \b%d 4005# Which is which? 4006#>>4 belong 0x032d (Java 1.0) 4007#>>4 belong 0x032d (Java 1.1) 4008>>4 belong 0x002e (Java 1.2) 4009>>4 belong 0x002f (Java 1.3) 4010>>4 belong 0x0030 (Java 1.4) 4011>>4 belong 0x0031 (Java 1.5) 4012>>4 belong 0x0032 (Java 1.6) 4013>>4 belong 0x0033 (Java 1.7) 4014>>4 belong 0x0034 (Java 1.8) 4015 40160 belong 0xcafed00d JAR compressed with pack200, 4017>5 byte x version %d. 4018>4 byte x \b%d 4019!:mime application/x-java-pack200 4020 4021 40220 belong 0xcafed00d JAR compressed with pack200, 4023>5 byte x version %d. 4024>4 byte x \b%d 4025!:mime application/x-java-pack200 4026 4027### JAVA END ### 4028### MACH-O START ### 4029 40300 name mach-o \b [ 4031>0 use mach-o-cpu \b 4032>(8.L) indirect \b: 4033>0 belong x \b] 4034 40350 belong 0xcafebabe 4036>4 belong 1 Mach-O universal binary with 1 architecture: 4037>>8 use mach-o \b 4038>4 belong >1 4039>>4 belong <20 Mach-O universal binary with %d architectures: 4040>>>8 use mach-o \b 4041>>>28 use mach-o \b 4042>>4 belong >2 4043>>>48 use mach-o \b 4044>>4 belong >3 4045>>>68 use mach-o \b 4046 4047### MACH-O END ### 4048 4049#------------------------------------------------------------------------------ 4050# $File: elf,v 1.68 2014/09/19 19:05:57 christos Exp $ 4051# cbor: file(1) magic for CBOR files as defined in RFC 7049 4052 40530 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container 4054!:mime application/cbor 4055>3 ubyte <0x20 (positive integer) 4056>3 ubyte <0x40 4057>>3 ubyte >0x1f (negative integer) 4058>3 ubyte <0x60 4059>>3 ubyte >0x3f (byte string) 4060>3 ubyte <0x80 4061>>3 ubyte >0x5f (text string) 4062>3 ubyte <0xa0 4063>3 ubyte >0x7f (array) 4064>3 ubyte <0xc0 4065>>3 ubyte >0x9f (map) 4066>3 ubyte <0xe0 4067>>3 ubyte >0xbf (tagged) 4068>3 ubyte >0xdf (other) 4069 4070#------------------------------------------------------------------------------ 4071# $File$ 4072# CDDB: file(1) magic for CDDB(tm) format CD text data files 4073# 4074# From <steve@gracenote.com> 4075# 4076# This is the /etc/magic entry to decode datafiles as used by 4077# CDDB-enabled CD player applications. 4078# 4079 40800 search/1/w #\040xmcd CDDB(tm) format CD text data 4081 4082#------------------------------------------------------------------------------ 4083# $File: chord,v 1.4 2009/09/19 16:28:08 christos Exp $ 4084# chord: file(1) magic for Chord music sheet typesetting utility input files 4085# 4086# From Philippe De Muyter <phdm@macqel.be> 4087# File format is actually free, but many distributed files begin with `{title' 4088# 40890 string {title Chord text file 4090 4091# Type: PowerTab file format 4092# URL: http://www.power-tab.net/ 4093# From: Jelmer Vernooij <jelmer@samba.org> 40940 string ptab\003\000 Power-Tab v3 Tablature File 40950 string ptab\004\000 Power-Tab v4 Tablature File 4096 4097#------------------------------------------------------------------------------ 4098# $File$ 4099# cisco: file(1) magic for cisco Systems routers 4100# 4101# Most cisco file-formats are covered by the generic elf code 4102# 4103# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 41040 belong&0xffffff00 0x85011400 cisco IOS microcode 4105>7 string >\0 for '%s' 41060 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 4107>7 string >\0 for '%s' 4108 4109#------------------------------------------------------------------------------ 4110# $File$ 4111# citrus locale declaration 4112# 4113 41140 string RuneCT Citrus locale declaration for LC_CTYPE 4115 4116#------------------------------------------------------------------------------ 4117# $File: c-lang,v 1.18 2013/08/14 13:06:43 christos Exp $ 4118# c-lang: file(1) magic for C and related languages programs 4119# 4120 4121# BCPL 41220 search/8192 "libhdr" BCPL source text 4123!:mime text/x-bcpl 41240 search/8192 "LIBHDR" BCPL source text 4125!:mime text/x-bcpl 4126 4127# C 41280 regex \^#include C source text 4129!:mime text/x-c 41300 regex \^char[\ \t\n]+ C source text 4131!:mime text/x-c 41320 regex \^double[\ \t\n]+ C source text 4133!:mime text/x-c 41340 regex \^extern[\ \t\n]+ C source text 4135!:mime text/x-c 41360 regex \^float[\ \t\n]+ C source text 4137!:mime text/x-c 41380 regex \^struct[\ \t\n]+ C source text 4139!:mime text/x-c 41400 regex \^union[\ \t\n]+ C source text 4141!:mime text/x-c 41420 search/8192 main( C source text 4143!:mime text/x-c 4144 4145# C++ 4146# The strength of these rules is increased so they beat the C rules above 41470 regex \^template[\ \t\n]+ C++ source text 4148!:strength + 5 4149!:mime text/x-c++ 41500 regex \^virtual[\ \t\n]+ C++ source text 4151!:strength + 5 4152!:mime text/x-c++ 41530 regex \^class[\ \t\n]+ C++ source text 4154!:strength + 5 4155!:mime text/x-c++ 41560 regex \^public: C++ source text 4157!:strength + 5 4158!:mime text/x-c++ 41590 regex \^private: C++ source text 4160!:strength + 5 4161!:mime text/x-c++ 4162 4163# From: Mikhail Teterin <mi@aldan.algebra.com> 41640 string cscope cscope reference data 4165>7 string x version %.2s 4166# We skip the path here, because it is often long (so file will 4167# truncate it) and mostly redundant. 4168# The inverted index functionality was added some time between 4169# versions 11 and 15, so look for -q if version is above 14: 4170>7 string >14 4171>>10 search/100 \ -q\ with inverted index 4172>10 search/100 \ -c\ text (non-compressed) 4173 4174#------------------------------------------------------------------------------ 4175# $File: clarion,v 1.4 2009/09/19 16:28:08 christos Exp $ 4176# clarion: file(1) magic for # Clarion Personal/Professional Developer 4177# (v2 and above) 4178# From: Julien Blache <jb@jblache.org> 4179 4180# Database files 4181# signature 41820 leshort 0x3343 Clarion Developer (v2 and above) data file 4183# attributes 4184>2 leshort &0x0001 \b, locked 4185>2 leshort &0x0004 \b, encrypted 4186>2 leshort &0x0008 \b, memo file exists 4187>2 leshort &0x0010 \b, compressed 4188>2 leshort &0x0040 \b, read only 4189# number of records 4190>5 lelong x \b, %d records 4191 4192# Memo files 41930 leshort 0x334d Clarion Developer (v2 and above) memo data 4194 4195# Key/Index files 4196# No magic? :( 4197 4198# Help files 41990 leshort 0x49e0 Clarion Developer (v2 and above) help data 4200 4201#------------------------------------------------------------------------------ 4202# $File: claris,v 1.6 2012/06/20 21:19:05 christos Exp $ 4203# claris: file(1) magic for claris 4204# "H. Nanosecond" <aldomel@ix.netcom.com> 4205# Claris Works a word processor, etc. 4206# Version 3.0 4207 4208# .pct claris works clip art files 4209#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 4210#* 4211#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 4212#null to byte 1000 octal 4213514 string \377\377\377\377\000 4214>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 4215514 string \377\377\377\377\001 4216>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 4217 4218# Claris works files 4219# .cwk 42200 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 4221# .plt 42220 string \020\341\000\000\010\010 Claris Works palette files .plt 4223 4224# .msp a dictionary file I am not sure about this I have only one .msp file 42250 string \002\271\262\000\040\002\000\164 Claris works dictionary 4226 4227# .usp are user dictionary bits 4228# I am not sure about a magic header: 4229#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 4230# soh S p f 8 U D sp ^ S cr nl p o d i 4231#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 4232# a t r i s t sp ^ S cr nl d i v sp # 4233 4234# .mth Thesaurus 4235# starts with \0 but no magic header 4236 4237# .chy Hyphenation file 4238# I am not sure: 000 210 034 000 000 4239 4240# other claris files 4241#./windows/claris/useng.ndx: data 4242#./windows/claris/xtndtran.l32: data 4243#./windows/claris/xtndtran.lst: data 4244#./windows/claris/clworks.lbl: data 4245#./windows/claris/clworks.prf: data 4246#./windows/claris/userd.spl: data 4247 4248#------------------------------------------------------------------------------ 4249# $File: clipper,v 1.6 2009/09/19 16:28:08 christos Exp $ 4250# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 4251# 4252# XXX - what byte order does the Clipper use? 4253# 4254# XXX - what's the "!" stuff: 4255# 4256# >18 short !074000,000000 C1 R1 4257# >18 short !074000,004000 C2 R1 4258# >18 short !074000,010000 C3 R1 4259# >18 short !074000,074000 TEST 4260# 4261# I shall assume it's ANDing the field with the first value and 4262# comparing it with the second, and rewrite it as: 4263# 4264# >18 short&074000 000000 C1 R1 4265# >18 short&074000 004000 C2 R1 4266# >18 short&074000 010000 C3 R1 4267# >18 short&074000 074000 TEST 4268# 4269# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 4270# sort, nor does SunOS 4.x, so either it's something Intergraph added 4271# in CLIX, or something AT&T added in SVR3.2 or later, or something 4272# somebody else thought was a good idea; it's not documented in the 4273# man page for this version of "magic", nor does it appear to be 4274# implemented (at least not after I blew off the bogus code to turn 4275# old-style "&"s into new-style "&"s, which just didn't work at all). 4276# 42770 short 0575 CLIPPER COFF executable (VAX #) 4278>20 short 0407 (impure) 4279>20 short 0410 (5.2 compatible) 4280>20 short 0411 (pure) 4281>20 short 0413 (demand paged) 4282>20 short 0443 (target shared library) 4283>12 long >0 not stripped 4284>22 short >0 - version %d 42850 short 0577 CLIPPER COFF executable 4286>18 short&074000 000000 C1 R1 4287>18 short&074000 004000 C2 R1 4288>18 short&074000 010000 C3 R1 4289>18 short&074000 074000 TEST 4290>20 short 0407 (impure) 4291>20 short 0410 (pure) 4292>20 short 0411 (separate I&D) 4293>20 short 0413 (paged) 4294>20 short 0443 (target shared library) 4295>12 long >0 not stripped 4296>22 short >0 - version %d 4297>48 long&01 01 alignment trap enabled 4298>52 byte 1 -Ctnc 4299>52 byte 2 -Ctsw 4300>52 byte 3 -Ctpw 4301>52 byte 4 -Ctcb 4302>53 byte 1 -Cdnc 4303>53 byte 2 -Cdsw 4304>53 byte 3 -Cdpw 4305>53 byte 4 -Cdcb 4306>54 byte 1 -Csnc 4307>54 byte 2 -Cssw 4308>54 byte 3 -Cspw 4309>54 byte 4 -Cscb 43104 string pipe CLIPPER instruction trace 43114 string prof CLIPPER instruction profile 4312 4313#------------------------------------------------------------------------------ 4314# $File: commands,v 1.50 2014/05/30 16:48:44 christos Exp $ 4315# commands: file(1) magic for various shells and interpreters 4316# 4317#0 string/w : shell archive or script for antique kernel text 43180 string/wt #!\ /bin/sh POSIX shell script text executable 4319!:mime text/x-shellscript 43200 string/wb #!\ /bin/sh POSIX shell script executable (binary data) 4321!:mime text/x-shellscript 4322 43230 string/wt #!\ /bin/csh C shell script text executable 4324!:mime text/x-shellscript 4325 4326# korn shell magic, sent by George Wu, gwu@clyde.att.com 43270 string/wt #!\ /bin/ksh Korn shell script text executable 4328!:mime text/x-shellscript 43290 string/wb #!\ /bin/ksh Korn shell script executable (binary data) 4330!:mime text/x-shellscript 4331 43320 string/wt #!\ /bin/tcsh Tenex C shell script text executable 4333!:mime text/x-shellscript 43340 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 4335!:mime text/x-shellscript 43360 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 4337!:mime text/x-shellscript 43380 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 4339!:mime text/x-shellscript 4340 4341# 4342# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 43430 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 4344!:mime text/x-shellscript 43450 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 4346!:mime text/x-shellscript 43470 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 4348!:mime text/x-shellscript 43490 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 4350!:mime text/x-shellscript 43510 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 4352!:mime text/x-shellscript 43530 string/wt #!\ /bin/nawk new awk script text executable 4354!:mime text/x-nawk 43550 string/wt #!\ /usr/bin/nawk new awk script text executable 4356!:mime text/x-nawk 43570 string/wt #!\ /usr/local/bin/nawk new awk script text executable 4358!:mime text/x-nawk 43590 string/wt #!\ /bin/gawk GNU awk script text executable 4360!:mime text/x-gawk 43610 string/wt #!\ /usr/bin/gawk GNU awk script text executable 4362!:mime text/x-gawk 43630 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 4364!:mime text/x-gawk 4365# 43660 string/wt #!\ /bin/awk awk script text executable 4367!:mime text/x-awk 43680 string/wt #!\ /usr/bin/awk awk script text executable 4369!:mime text/x-awk 43700 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk or perl script text 4371 4372# AT&T Bell Labs' Plan 9 shell 43730 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 4374 4375# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 43760 string/wt #!\ /bin/bash Bourne-Again shell script text executable 4377!:mime text/x-shellscript 43780 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data) 4379!:mime text/x-shellscript 43800 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 4381!:mime text/x-shellscript 43820 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data) 4383!:mime text/x-shellscript 43840 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 4385!:mime text/x-shellscript 43860 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data) 4387!:mime text/x-shellscript 43880 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 4389!:mime text/x-shellscript 43900 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data) 4391!:mime text/x-shellscript 4392 4393# PHP scripts 4394# Ulf Harnhammar <ulfh@update.uu.se> 43950 search/1/c =<?php PHP script text 4396!:strength + 10 4397!:mime text/x-php 43980 search/1 =<?\n PHP script text 4399!:mime text/x-php 44000 search/1 =<?\r PHP script text 4401!:mime text/x-php 44020 search/1/w #!\ /usr/local/bin/php PHP script text executable 4403!:strength + 10 4404!:mime text/x-php 44050 search/1/w #!\ /usr/bin/php PHP script text executable 4406!:strength + 10 4407!:mime text/x-php 4408# Smarty compiled template, http://www.smarty.net/ 4409# Elan Ruusamae <glen@delfi.ee> 44100 string =<?php\ /*\ Smarty\ version Smarty compiled template 4411>24 regex [0-9.]+ \b, version %s 4412!:mime text/x-php 4413 44140 string Zend\x00 PHP script Zend Optimizer data 4415 44160 string/t $! DCL command file 4417 4418# Type: Pdmenu 4419# URL: http://packages.debian.org/pdmenu 4420# From: Edward Betts <edward@debian.org> 44210 string #!/usr/bin/pdmenu Pdmenu configuration file text 4422 4423#---------------------------------------------------------------------------- 4424# $File$ 4425# communication 4426 4427# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 4428# It is used for conformance testing of communication protocols. 4429# Added by W. Borgert <debacle@debian.org>. 44300 string $Suite TTCN Abstract Test Suite 4431>&1 string $SuiteId 4432>>&1 string >\n %s 4433>&2 string $SuiteId 4434>>&1 string >\n %s 4435>&3 string $SuiteId 4436>>&1 string >\n %s 4437 4438# MSC (message sequence charts) are a formal description technique, 4439# described in ITU-T Z.120, mainly used for communication protocols. 4440# Added by W. Borgert <debacle@debian.org>. 44410 string mscdocument Message Sequence Chart (document) 44420 string msc Message Sequence Chart (chart) 44430 string submsc Message Sequence Chart (subchart) 4444#------------------------------------------------------------------------------ 4445# $File: compress,v 1.61 2014/09/12 20:57:45 christos Exp $ 4446# compress: file(1) magic for pure-compression formats (no archives) 4447# 4448# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 4449# 4450# Formats for various forms of compressed data 4451# Formats for "compress" proper have been moved into "compress.c", 4452# because it tries to uncompress it to figure out what's inside. 4453 4454# standard unix compress 44550 string \037\235 compress'd data 4456!:mime application/x-compress 4457!:apple LZIVZIVU 4458>2 byte&0x80 >0 block compressed 4459>2 byte&0x1f x %d bits 4460 4461# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 4462# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 4463# * Original filename is only at offset 10 if "extra field" absent 4464# * Produce shorter output - notably, only report compression methods 4465# other than 8 ("deflate", the only method defined in RFC 1952). 44660 string \037\213 gzip compressed data 4467!:mime application/x-gzip 4468!:strength * 2 4469>2 byte <8 \b, reserved method 4470>2 byte >8 \b, unknown method 4471>3 byte &0x01 \b, ASCII 4472>3 byte &0x02 \b, has CRC 4473>3 byte &0x04 \b, extra field 4474>3 byte&0xC =0x08 4475>>10 string x \b, was "%s" 4476>3 byte &0x10 \b, has comment 4477>3 byte &0x20 \b, encrypted 4478>4 ledate >0 \b, last modified: %s 4479>8 byte 2 \b, max compression 4480>8 byte 4 \b, max speed 4481>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 4482>9 byte =0x01 \b, from Amiga 4483>9 byte =0x02 \b, from VMS 4484>9 byte =0x03 \b, from Unix 4485>9 byte =0x04 \b, from VM/CMS 4486>9 byte =0x05 \b, from Atari 4487>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 4488>9 byte =0x07 \b, from MacOS 4489>9 byte =0x08 \b, from Z-System 4490>9 byte =0x09 \b, from CP/M 4491>9 byte =0x0A \b, from TOPS/20 4492>9 byte =0x0B \b, from NTFS filesystem (NT) 4493>9 byte =0x0C \b, from QDOS 4494>9 byte =0x0D \b, from Acorn RISCOS 4495 4496# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 44970 string \037\036 packed data 4498!:mime application/octet-stream 4499>2 belong >1 \b, %d characters originally 4500>2 belong =1 \b, %d character originally 4501# 4502# This magic number is byte-order-independent. 45030 short 0x1f1f old packed data 4504!:mime application/octet-stream 4505 4506# XXX - why *two* entries for "compacted data", one of which is 4507# byte-order independent, and one of which is byte-order dependent? 4508# 45090 short 0x1fff compacted data 4510!:mime application/octet-stream 4511# This string is valid for SunOS (BE) and a matching "short" is listed 4512# in the Ultrix (LE) magic file. 45130 string \377\037 compacted data 4514!:mime application/octet-stream 45150 short 0145405 huf output 4516!:mime application/octet-stream 4517 4518# bzip2 45190 string BZh bzip2 compressed data 4520!:mime application/x-bzip2 4521>3 byte >47 \b, block size = %c00k 4522 4523# lzip 45240 string LZIP lzip compressed data 4525!:mime application/x-lzip 4526>4 byte x \b, version: %d 4527 4528# squeeze and crunch 4529# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 45300 beshort 0x76FF squeezed data, 4531>4 string x original name %s 45320 beshort 0x76FE crunched data, 4533>2 string x original name %s 45340 beshort 0x76FD LZH compressed data, 4535>2 string x original name %s 4536 4537# Freeze 45380 string \037\237 frozen file 2.1 45390 string \037\236 frozen file 1.0 (or gzip 0.5) 4540 4541# SCO compress -H (LZH) 45420 string \037\240 SCO compress -H (LZH) data 4543 4544# European GSM 06.10 is a provisional standard for full-rate speech 4545# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 4546# excitation/long term prediction) coding at 13 kbit/s. 4547# 4548# There's only a magic nibble (4 bits); that nibble repeats every 33 4549# bytes. This isn't suited for use, but maybe we can use it someday. 4550# 4551# This will cause very short GSM files to be declared as data and 4552# mismatches to be declared as data too! 4553#0 byte&0xF0 0xd0 data 4554#>33 byte&0xF0 0xd0 4555#>66 byte&0xF0 0xd0 4556#>99 byte&0xF0 0xd0 4557#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 4558 4559# bzip a block-sorting file compressor 4560# by Julian Seward <sewardj@cs.man.ac.uk> and others 4561# 4562#0 string BZ bzip compressed data 4563#>2 byte x \b, version: %c 4564#>3 string =1 \b, compression block size 100k 4565#>3 string =2 \b, compression block size 200k 4566#>3 string =3 \b, compression block size 300k 4567#>3 string =4 \b, compression block size 400k 4568#>3 string =5 \b, compression block size 500k 4569#>3 string =6 \b, compression block size 600k 4570#>3 string =7 \b, compression block size 700k 4571#>3 string =8 \b, compression block size 800k 4572#>3 string =9 \b, compression block size 900k 4573 4574# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 45750 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 4576>9 beshort <0x0940 4577>>9 byte&0xf0 =0x00 - version 0. 4578>>9 beshort&0x0fff x \b%03x, 4579>>13 byte 1 LZO1X-1, 4580>>13 byte 2 LZO1X-1(15), 4581>>13 byte 3 LZO1X-999, 4582## >>22 bedate >0 last modified: %s, 4583>>14 byte =0x00 os: MS-DOS 4584>>14 byte =0x01 os: Amiga 4585>>14 byte =0x02 os: VMS 4586>>14 byte =0x03 os: Unix 4587>>14 byte =0x05 os: Atari 4588>>14 byte =0x06 os: OS/2 4589>>14 byte =0x07 os: MacOS 4590>>14 byte =0x0A os: Tops/20 4591>>14 byte =0x0B os: WinNT 4592>>14 byte =0x0E os: Win32 4593>9 beshort >0x0939 4594>>9 byte&0xf0 =0x00 - version 0. 4595>>9 byte&0xf0 =0x10 - version 1. 4596>>9 byte&0xf0 =0x20 - version 2. 4597>>9 beshort&0x0fff x \b%03x, 4598>>15 byte 1 LZO1X-1, 4599>>15 byte 2 LZO1X-1(15), 4600>>15 byte 3 LZO1X-999, 4601## >>25 bedate >0 last modified: %s, 4602>>17 byte =0x00 os: MS-DOS 4603>>17 byte =0x01 os: Amiga 4604>>17 byte =0x02 os: VMS 4605>>17 byte =0x03 os: Unix 4606>>17 byte =0x05 os: Atari 4607>>17 byte =0x06 os: OS/2 4608>>17 byte =0x07 os: MacOS 4609>>17 byte =0x0A os: Tops/20 4610>>17 byte =0x0B os: WinNT 4611>>17 byte =0x0E os: Win32 4612 4613# 4.3BSD-Quasijarus Strong Compression 4614# http://minnie.tuhs.org/Quasijarus/compress.html 46150 string \037\241 Quasijarus strong compressed data 4616 4617# From: Cory Dikkers <cdikkers@swbell.net> 46180 string XPKF Amiga xpkf.library compressed data 46190 string PP11 Power Packer 1.1 compressed data 46200 string PP20 Power Packer 2.0 compressed data, 4621>4 belong 0x09090909 fast compression 4622>4 belong 0x090A0A0A mediocre compression 4623>4 belong 0x090A0B0B good compression 4624>4 belong 0x090A0C0C very good compression 4625>4 belong 0x090A0C0D best compression 4626 4627# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 4628# http://www.7-zip.org or DOC/7zFormat.txt 4629# 46300 string 7z\274\257\047\034 7-zip archive data, 4631>6 byte x version %d 4632>7 byte x \b.%d 4633!:mime application/x-7z-compressed 4634 4635# Type: LZMA 46360 lelong&0xffffff =0x5d 4637>12 leshort 0xff LZMA compressed data, 4638!:mime application/x-lzma 4639>>5 lequad =0xffffffffffffffff streamed 4640>>5 lequad !0xffffffffffffffff non-streamed, size %lld 4641>12 leshort 0 LZMA compressed data, 4642>>5 lequad =0xffffffffffffffff streamed 4643>>5 lequad !0xffffffffffffffff non-streamed, size %lld 4644 4645# http://tukaani.org/xz/xz-file-format.txt 46460 ustring \xFD7zXZ\x00 XZ compressed data 4647!:mime application/x-xz 4648 4649# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 46500 string LRZI LRZIP compressed data 4651>4 byte x - version %d 4652>5 byte x \b.%d 4653!:mime application/x-lrzip 4654 4655# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 46560 lelong 0x184d2204 LZ4 compressed data (v1.4+) 4657!:mime application/x-lz4 4658# Added by osm0sis@xda-developers.com 46590 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3) 4660!:mime application/x-lz4 46610 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9) 4662!:mime application/x-lz4 4663 4664# AFX compressed files (Wolfram Kleff) 46652 string -afx- AFX compressed file data 4666 4667# Supplementary magic data for the file(1) command to support 4668# rzip(1). The format is described in magic(5). 4669# 4670# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 4671# this file. 4672# 46730 string RZIP rzip compressed data 4674>4 byte x - version %d 4675>5 byte x \b.%d 4676>6 belong x (%d bytes) 4677 46780 string ArC\x01 FreeArc archive <http://freearc.org> 4679 4680# Type: DACT compressed files 46810 long 0x444354C3 DACT compressed data 4682>4 byte >-1 (version %i. 4683>5 byte >-1 %i. 4684>6 byte >-1 %i) 4685>7 long >0 , original size: %i bytes 4686>15 long >30 , block size: %i bytes 4687 4688# Valve Pack (VPK) files 46890 lelong 0x55aa1234 Valve Pak file 4690>0x4 lelong x \b, version %u 4691>0x8 lelong x \b, %u entries 4692 4693# Snappy framing format 4694# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 46950 string \377\006\0\0sNaPpY snappy framed data 4696!:mime application/x-snappy-framed 4697 4698# qpress, http://www.quicklz.com/ 46990 string qpress10 qpress compressed data 4700!:mime application/x-qpress 4701 4702# Zlib https://www.ietf.org/rfc/rfc6713.txt 47030 beshort%31 =0 4704>0 byte&0xf =8 4705>>0 byte&0x80 =0 zlib compressed data 4706!:mime application/zlib 4707 4708#------------------------------------------------------------------------------ 4709# $File: console,v 1.18 2010/09/20 19:19:17 rrt Exp $ 4710# Console game magic 4711# Toby Deshane <hac@shoelace.digivill.net> 4712# ines: file(1) magic for Marat's iNES Nintendo Entertainment System 4713# ROM dump format 4714 47150 string NES\032 iNES ROM dump, 4716>4 byte x %dx16k PRG 4717>5 byte x \b, %dx8k CHR 4718>6 byte&0x01 =0x1 \b, [Vert.] 4719>6 byte&0x01 =0x0 \b, [Horiz.] 4720>6 byte&0x02 =0x2 \b, [SRAM] 4721>6 byte&0x04 =0x4 \b, [Trainer] 4722>6 byte&0x04 =0x8 \b, [4-Scr] 4723 4724#------------------------------------------------------------------------------ 4725# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 4726# 47270x104 belong 0xCEED6666 Gameboy ROM: 4728>0x134 string >\0 "%.16s" 4729>0x146 byte 0x03 \b,[SGB] 4730>0x147 byte 0x00 \b, [ROM ONLY] 4731>0x147 byte 0x01 \b, [ROM+MBC1] 4732>0x147 byte 0x02 \b, [ROM+MBC1+RAM] 4733>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT] 4734>0x147 byte 0x05 \b, [ROM+MBC2] 4735>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY] 4736>0x147 byte 0x08 \b, [ROM+RAM] 4737>0x147 byte 0x09 \b, [ROM+RAM+BATTERY] 4738>0x147 byte 0x0B \b, [ROM+MMM01] 4739>0x147 byte 0x0C \b, [ROM+MMM01+SRAM] 4740>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT] 4741>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT] 4742>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT] 4743>0x147 byte 0x11 \b, [ROM+MBC3] 4744>0x147 byte 0x12 \b, [ROM+MBC3+RAM] 4745>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT] 4746>0x147 byte 0x19 \b, [ROM+MBC5] 4747>0x147 byte 0x1A \b, [ROM+MBC5+RAM] 4748>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT] 4749>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE] 4750>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM] 4751>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT] 4752>0x147 byte 0x1F \b, [Pocket Camera] 4753>0x147 byte 0xFD \b, [Bandai TAMA5] 4754>0x147 byte 0xFE \b, [Hudson HuC-3] 4755>0x147 byte 0xFF \b, [Hudson HuC-1] 4756 4757>0x148 byte 0 \b, ROM: 256Kbit 4758>0x148 byte 1 \b, ROM: 512Kbit 4759>0x148 byte 2 \b, ROM: 1Mbit 4760>0x148 byte 3 \b, ROM: 2Mbit 4761>0x148 byte 4 \b, ROM: 4Mbit 4762>0x148 byte 5 \b, ROM: 8Mbit 4763>0x148 byte 6 \b, ROM: 16Mbit 4764>0x148 byte 0x52 \b, ROM: 9Mbit 4765>0x148 byte 0x53 \b, ROM: 10Mbit 4766>0x148 byte 0x54 \b, ROM: 12Mbit 4767 4768>0x149 byte 1 \b, RAM: 16Kbit 4769>0x149 byte 2 \b, RAM: 64Kbit 4770>0x149 byte 3 \b, RAM: 128Kbit 4771>0x149 byte 4 \b, RAM: 1Mbit 4772 4773#>0x14e long x \b, CRC: %x 4774 4775#------------------------------------------------------------------------------ 4776# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format 4777# 47780x100 string SEGA Sega MegaDrive/Genesis raw ROM dump 4779>0x120 string >\0 Name: "%.16s" 4780>0x110 string >\0 %.16s 4781>0x1B0 string RA with SRAM 4782 4783#------------------------------------------------------------------------------ 4784# genesis: file(1) magic for the Super MegaDrive ROM dump format 4785# 47860x280 string EAGN Super MagicDrive ROM dump 4787>0 byte x %dx16k blocks 4788>2 byte 0 \b, last in series or standalone 4789>2 byte >0 \b, split ROM 4790>8 byte 0xAA 4791>9 byte 0xBB 4792 4793#------------------------------------------------------------------------------ 4794# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format 4795# 47960x280 string EAMG Super MagicDrive ROM dump 4797>0 byte x %dx16k blocks 4798>2 byte x \b, last in series or standalone 4799>8 byte 0xAA 4800>9 byte 0xBB 4801 4802#------------------------------------------------------------------------------ 4803# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps 4804# 4805# Does not detect all images. Very preliminary guesswork. Need more data 4806# on format. 4807# 4808# FIXME: need a little more info...;P 4809# 4810#0 byte 0xF3 4811#>1 byte 0xED Sega Master System/Game Gear ROM dump 4812#>1 byte 0x31 Sega Master System/Game Gear ROM dump 4813#>1 byte 0xDB Sega Master System/Game Gear ROM dump 4814#>1 byte 0xAF Sega Master System/Game Gear ROM dump 4815#>1 byte 0xC3 Sega Master System/Game Gear ROM dump 4816 4817#------------------------------------------------------------------------------ 4818# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 4819# 48200 belong 0x21068028 Sega Dreamcast VMU game image 48210 string LCDi Dream Animator file 4822 4823#------------------------------------------------------------------------------ 4824# v64: file(1) uncertain magic for the V64 format N64 ROM dumps 4825# 48260 belong 0x37804012 V64 Nintendo 64 ROM dump 4827 4828# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 4829# Nintendo .nds 4830192 string \044\377\256Qi\232 Nintendo DS Game ROM Image 4831# Nintendo .gba 48320 string \056\000\000\352$\377\256Qi Nintendo Game Boy Advance ROM Image 4833 4834#------------------------------------------------------------------------------ 4835# msx: file(1) magic for MSX game cartridge dumps 4836# Too simple - MPi 4837#0 beshort 0x4142 MSX game cartridge dump 4838 4839#------------------------------------------------------------------------------ 4840# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 48410 string PS-X\ EXE Sony Playstation executable 4842# Area: 4843>113 string x (%s) 4844 4845#------------------------------------------------------------------------------ 4846# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 48470 string XBEH XBE, Microsoft Xbox executable 4848# probabilistic checks whether signed or not 4849>0x0004 ulelong =0x0 4850>>&2 ulelong =0x0 4851>>>&2 ulelong =0x0 \b, not signed 4852>0x0004 ulelong >0 4853>>&2 ulelong >0 4854>>>&2 ulelong >0 \b, signed 4855# expect base address of 0x10000 4856>0x0104 ulelong =0x10000 4857>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 4858>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 4859>>>(0x0118-0x0FF60) ulelong >0 (regions: 4860>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA 4861>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan 4862>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World 4863>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer 4864>>>(0x0118-0x0FF60) ulelong >0 \b) 4865 4866# -------------------------------- 4867# Microsoft Xbox data file formats 48680 string XIP0 XIP, Microsoft Xbox data 48690 string XTF0 XTF, Microsoft Xbox data 4870 4871# Atari Lynx cartridge dump (EXE/BLL header) 4872# From: "Stefan A. Haubenthal" <polluks@web.de> 4873 4874# Double-check that the image type matches too, 0x8008 conflicts with 4875# 8 character OMF-86 object file headers. 48760 beshort 0x8008 4877>6 string BS93 Lynx homebrew cartridge 4878>>2 beshort x \b, RAM start $%04x 4879>6 string LYNX Lynx cartridge 4880>>2 beshort x \b, RAM start $%04x 4881 4882# Opera file system that is used on the 3DO console 4883# From: Serge van den Boom <svdb@stack.nl> 48840 string \x01ZZZZZ\x01 3DO "Opera" file system 4885 4886# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 48870 string GBS Nintendo Gameboy Music/Audio Data 488812 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 4889 4890# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 48910 string PPF30 Playstation Patch File version 3.0 4892>5 byte 0 \b, PPF 1.0 patch 4893>5 byte 1 \b, PPF 2.0 patch 4894>5 byte 2 \b, PPF 3.0 patch 4895>>56 byte 0 \b, Imagetype BIN (any) 4896>>56 byte 1 \b, Imagetype GI (PrimoDVD) 4897>>57 byte 0 \b, Blockcheck disabled 4898>>57 byte 1 \b, Blockcheck enabled 4899>>58 byte 0 \b, Undo data not available 4900>>58 byte 1 \b, Undo data available 4901>6 string x \b, description: %s 4902 49030 string PPF20 Playstation Patch File version 2.0 4904>5 byte 0 \b, PPF 1.0 patch 4905>5 byte 1 \b, PPF 2.0 patch 4906>>56 lelong >0 \b, size of file to patch %d 4907>6 string x \b, description: %s 4908 49090 string PPF10 Playstation Patch File version 1.0 4910>5 byte 0 \b, Simple Encoding 4911>6 string x \b, description: %s 4912 4913# From: Daniel Dawson <ddawson@icehouse.net> 4914# SNES9x .smv "movie" file format. 49150 string SMV\x1A SNES9x input recording 4916>0x4 lelong x \b, version %d 4917# version 4 is latest so far 4918>0x4 lelong <5 4919>>0x8 ledate x \b, recorded at %s 4920>>0xc lelong >0 \b, rerecorded %d times 4921>>0x10 lelong x \b, %d frames long 4922>>0x14 byte >0 \b, data for controller(s): 4923>>>0x14 byte &0x1 #1 4924>>>0x14 byte &0x2 #2 4925>>>0x14 byte &0x4 #3 4926>>>0x14 byte &0x8 #4 4927>>>0x14 byte &0x10 #5 4928>>0x15 byte ^0x1 \b, begins from snapshot 4929>>0x15 byte &0x1 \b, begins from reset 4930>>0x15 byte ^0x2 \b, NTSC standard 4931>>0x15 byte &0x2 \b, PAL standard 4932>>0x17 byte &0x1 \b, settings: 4933# WIP1Timing not used as of version 4 4934>>>0x4 lelong <4 4935>>>>0x17 byte &0x2 WIP1Timing 4936>>>0x17 byte &0x4 Left+Right 4937>>>0x17 byte &0x8 VolumeEnvX 4938>>>0x17 byte &0x10 FakeMute 4939>>>0x17 byte &0x20 SyncSound 4940# New flag as of version 4 4941>>>0x4 lelong >3 4942>>>>0x17 byte &0x80 NoCPUShutdown 4943>>0x4 lelong <4 4944>>>0x18 lelong >0x23 4945>>>>0x20 leshort !0 4946>>>>>0x20 lestring16 x \b, metadata: "%s" 4947>>0x4 lelong >3 4948>>>0x24 byte >0 \b, port 1: 4949>>>>0x24 byte 1 joypad 4950>>>>0x24 byte 2 mouse 4951>>>>0x24 byte 3 SuperScope 4952>>>>0x24 byte 4 Justifier 4953>>>>0x24 byte 5 multitap 4954>>>0x24 byte >0 \b, port 2: 4955>>>>0x25 byte 1 joypad 4956>>>>0x25 byte 2 mouse 4957>>>>0x25 byte 3 SuperScope 4958>>>>0x25 byte 4 Justifier 4959>>>>0x25 byte 5 multitap 4960>>>0x18 lelong >0x43 4961>>>>0x40 leshort !0 4962>>>>>0x40 lestring16 x \b, metadata: "%s" 4963>>0x17 byte &0x40 \b, ROM: 4964>>>(0x18.l-26) lelong x CRC32 0x%08x 4965>>>(0x18.l-23) string x "%s" 4966 4967# Type: scummVM savegame files 4968# From: Sven Hartge <debian@ds9.argh.org> 49690 string SCVM ScummVM savegame 4970>12 string >\0 "%s" 4971 4972#------------------------------------------------------------------------------ 4973# $File: convex,v 1.7 2009/09/19 16:28:08 christos Exp $ 4974# convex: file(1) magic for Convex boxes 4975# 4976# Convexes are big-endian. 4977# 4978# /*\ 4979# * Below are the magic numbers and tests added for Convex. 4980# * Added at beginning, because they are expected to be used most. 4981# \*/ 49820 belong 0507 Convex old-style object 4983>16 belong >0 not stripped 49840 belong 0513 Convex old-style demand paged executable 4985>16 belong >0 not stripped 49860 belong 0515 Convex old-style pre-paged executable 4987>16 belong >0 not stripped 49880 belong 0517 Convex old-style pre-paged, non-swapped executable 4989>16 belong >0 not stripped 49900 belong 0x011257 Core file 4991# 4992# The following are a series of dump format magic numbers. Each one 4993# corresponds to a drastically different dump format. The first on is 4994# the original dump format on a 4.1 BSD or earlier file system. The 4995# second marks the change between the 4.1 file system and the 4.2 file 4996# system. The Third marks the changing of the block size from 1K 4997# to 2K to be compatible with an IDC file system. The fourth indicates 4998# a dump that is dependent on Convex Storage Manager, because data in 4999# secondary storage is not physically contained within the dump. 5000# The restore program uses these number to determine how the data is 5001# to be extracted. 5002# 500324 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 500424 belong =60014 dump format, Convex Storage Manager by-reference dump 5005# 5006# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 5007# If there is no `=' sign, assume just checking for whether the bit is set? 5008# 50090 belong 0601 Convex SOFF 5010>88 belong&0x000f0000 =0x00000000 c1 5011>88 belong &0x00010000 c2 5012>88 belong &0x00020000 c2mp 5013>88 belong &0x00040000 parallel 5014>88 belong &0x00080000 intrinsic 5015>88 belong &0x00000001 demand paged 5016>88 belong &0x00000002 pre-paged 5017>88 belong &0x00000004 non-swapped 5018>88 belong &0x00000008 POSIX 5019# 5020>84 belong &0x80000000 executable 5021>84 belong &0x40000000 object 5022>84 belong&0x20000000 =0 not stripped 5023>84 belong&0x18000000 =0x00000000 native fpmode 5024>84 belong&0x18000000 =0x10000000 ieee fpmode 5025>84 belong&0x18000000 =0x18000000 undefined fpmode 5026# 50270 belong 0605 Convex SOFF core 5028# 50290 belong 0607 Convex SOFF checkpoint 5030>88 belong&0x000f0000 =0x00000000 c1 5031>88 belong &0x00010000 c2 5032>88 belong &0x00020000 c2mp 5033>88 belong &0x00040000 parallel 5034>88 belong &0x00080000 intrinsic 5035>88 belong &0x00000008 POSIX 5036# 5037>84 belong&0x18000000 =0x00000000 native fpmode 5038>84 belong&0x18000000 =0x10000000 ieee fpmode 5039>84 belong&0x18000000 =0x18000000 undefined fpmode 5040 5041#------------------------------------------------------------------------------ 5042# $File$ 5043# cracklib: file (1) magic for cracklib v2.7 5044 50450 lelong 0x70775631 Cracklib password index, little endian 5046>4 long >0 (%i words) 5047>4 long 0 ("64-bit") 5048>>8 long >-1 (%i words) 50490 belong 0x70775631 Cracklib password index, big endian 5050>4 belong >-1 (%i words) 5051# really bellong 0x0000000070775631 50520 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 5053>12 belong >0 (%i words) 5054 5055# ---------------------------------------------------------------------------- 5056# $File$ 5057# ctags: file (1) magic for Exuberant Ctags files 5058# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 50590 search/1 =!_TAG Exuberant Ctags tag file text 5060 5061#-------------------------------------------------------------- 5062# ctf: file(1) magic for CTF (Common Trace Format) trace files 5063# 5064# Specs. available here: <http://www.efficios.com/ctf> 5065#-------------------------------------------------------------- 5066 5067# CTF trace data 50680 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 50690 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 5070 5071# CTF metadata (packetized) 50720 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 5073>35 byte x \b, v%d 5074>36 byte x \b.%d 50750 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 5076>35 byte x \b, v%d 5077>36 byte x \b.%d 5078 5079# CTF metadata (plain text) 50800 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 5081!:strength + 5 # this is to make sure we beat C 5082>&0 regex [0-9]+\.[0-9]+ \b, v%s 5083 5084#------------------------------------------------------------------------------ 5085# $File: cubemaps,v 1.0 2011/12/22 09:01:05 christos Exp $ 5086# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 5087# 50880 string ACMP Map file for the AssaultCube FPS game 50890 string CUBE Map file for cube and cube2 engine games 50900 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 5091 5092#------------------------------------------------------------------------------ 5093# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $ 5094# Cups: file(1) magic for the cups raster file format 5095# From: Laurent Martelli <martellilaurent@gmail.com> 5096# http://www.cups.org/documentation.php/spec-raster.html 5097# 5098 50990 name cups-le 5100>280 lelong x \b, %d 5101>284 lelong x \bx%d dpi 5102>376 lelong x \b, %dx 5103>380 lelong x \b%d pixels 5104>388 lelong x %d bits/color 5105>392 lelong x %d bits/pixel 5106>400 lelong 0 ColorOrder=Chunky 5107>400 lelong 1 ColorOrder=Banded 5108>400 lelong 2 ColorOrder=Planar 5109>404 lelong 0 ColorSpace=gray 5110>404 lelong 1 ColorSpace=RGB 5111>404 lelong 2 ColorSpace=RGBA 5112>404 lelong 3 ColorSpace=black 5113>404 lelong 4 ColorSpace=CMY 5114>404 lelong 5 ColorSpace=YMC 5115>404 lelong 6 ColorSpace=CMYK 5116>404 lelong 7 ColorSpace=YMCK 5117>404 lelong 8 ColorSpace=KCMY 5118>404 lelong 9 ColorSpace=KCMYcm 5119>404 lelong 10 ColorSpace=GMCK 5120>404 lelong 11 ColorSpace=GMCS 5121>404 lelong 12 ColorSpace=WHITE 5122>404 lelong 13 ColorSpace=GOLD 5123>404 lelong 14 ColorSpace=SILVER 5124>404 lelong 15 ColorSpace=CIE XYZ 5125>404 lelong 16 ColorSpace=CIE Lab 5126>404 lelong 17 ColorSpace=RGBW 5127>404 lelong 18 ColorSpace=sGray 5128>404 lelong 19 ColorSpace=sRGB 5129>404 lelong 20 ColorSpace=AdobeRGB 5130 5131# Cups Raster image format, Big Endian 51320 string RaS 5133>3 string t Cups Raster version 1, Big Endian 5134>3 string 2 Cups Raster version 2, Big Endian 5135>3 string 3 Cups Raster version 3, Big Endian 5136!:mime application/vnd.cups-raster 5137>0 use ^cups-le 5138 5139 5140# Cups Raster image format, Little Endian 51411 string SaR 5142>0 string t Cups Raster version 1, Little Endian 5143>0 string 2 Cups Raster version 2, Little Endian 5144>0 string 3 Cups Raster version 3, Little Endian 5145!:mime application/vnd.cups-raster 5146>0 use cups-le 5147 5148#------------------------------------------------------------------------------ 5149# $File$ 5150# dact: file(1) magic for DACT compressed files 5151# 51520 long 0x444354C3 DACT compressed data 5153>4 byte >-1 (version %i. 5154>5 byte >-1 $BS%i. 5155>6 byte >-1 $BS%i) 5156>7 long >0 $BS, original size: %i bytes 5157>15 long >30 $BS, block size: %i bytes 5158 5159#------------------------------------------------------------------------------ 5160# $File: database,v 1.42 2014/08/19 14:18:04 christos Exp $ 5161# database: file(1) magic for various databases 5162# 5163# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 5164# 5165# 5166# GDBM magic numbers 5167# Will be maintained as part of the GDBM distribution in the future. 5168# <downsj@teeny.org> 51690 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 5170!:mime application/x-gdbm 51710 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 5172!:mime application/x-gdbm 51730 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 5174!:mime application/x-gdbm 51750 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 5176!:mime application/x-gdbm 51770 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 5178!:mime application/x-gdbm 51790 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 5180!:mime application/x-gdbm 51810 string GDBM GNU dbm 2.x database 5182!:mime application/x-gdbm 5183# 5184# Berkeley DB 5185# 5186# Ian Darwin's file /etc/magic files: big/little-endian version. 5187# 5188# Hash 1.85/1.86 databases store metadata in network byte order. 5189# Btree 1.85/1.86 databases store the metadata in host byte order. 5190# Hash and Btree 2.X and later databases store the metadata in host byte order. 5191 51920 long 0x00061561 Berkeley DB 5193!:mime application/x-dbm 5194>8 belong 4321 5195>>4 belong >2 1.86 5196>>4 belong <3 1.85 5197>>4 belong >0 (Hash, version %d, native byte-order) 5198>8 belong 1234 5199>>4 belong >2 1.86 5200>>4 belong <3 1.85 5201>>4 belong >0 (Hash, version %d, little-endian) 5202 52030 belong 0x00061561 Berkeley DB 5204>8 belong 4321 5205>>4 belong >2 1.86 5206>>4 belong <3 1.85 5207>>4 belong >0 (Hash, version %d, big-endian) 5208>8 belong 1234 5209>>4 belong >2 1.86 5210>>4 belong <3 1.85 5211>>4 belong >0 (Hash, version %d, native byte-order) 5212 52130 long 0x00053162 Berkeley DB 1.85/1.86 5214>4 long >0 (Btree, version %d, native byte-order) 52150 belong 0x00053162 Berkeley DB 1.85/1.86 5216>4 belong >0 (Btree, version %d, big-endian) 52170 lelong 0x00053162 Berkeley DB 1.85/1.86 5218>4 lelong >0 (Btree, version %d, little-endian) 5219 522012 long 0x00061561 Berkeley DB 5221>16 long >0 (Hash, version %d, native byte-order) 522212 belong 0x00061561 Berkeley DB 5223>16 belong >0 (Hash, version %d, big-endian) 522412 lelong 0x00061561 Berkeley DB 5225>16 lelong >0 (Hash, version %d, little-endian) 5226 522712 long 0x00053162 Berkeley DB 5228>16 long >0 (Btree, version %d, native byte-order) 522912 belong 0x00053162 Berkeley DB 5230>16 belong >0 (Btree, version %d, big-endian) 523112 lelong 0x00053162 Berkeley DB 5232>16 lelong >0 (Btree, version %d, little-endian) 5233 523412 long 0x00042253 Berkeley DB 5235>16 long >0 (Queue, version %d, native byte-order) 523612 belong 0x00042253 Berkeley DB 5237>16 belong >0 (Queue, version %d, big-endian) 523812 lelong 0x00042253 Berkeley DB 5239>16 lelong >0 (Queue, version %d, little-endian) 5240 5241# From Max Bowsher. 524212 long 0x00040988 Berkeley DB 5243>16 long >0 (Log, version %d, native byte-order) 524412 belong 0x00040988 Berkeley DB 5245>16 belong >0 (Log, version %d, big-endian) 524612 lelong 0x00040988 Berkeley DB 5247>16 lelong >0 (Log, version %d, little-endian) 5248 5249# 5250# 5251# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 52520 string/b RRD\0 RRDTool DB 5253>4 string/b x version %s 5254 5255>>10 short !0 16bit aligned 5256>>>10 bedouble 8.642135e+130 big-endian 5257>>>>18 short x 32bit long (m68k) 5258 5259>>10 short 0 5260>>>12 long !0 32bit aligned 5261>>>>12 bedouble 8.642135e+130 big-endian 5262>>>>>20 long 0 64bit long 5263>>>>>20 long !0 32bit long 5264>>>>12 ledouble 8.642135e+130 little-endian 5265>>>>>24 long 0 64bit long 5266>>>>>24 long !0 32bit long (i386) 5267>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 5268>>>>>24 short !0 32bit long (arm) 5269 5270>>8 quad 0 64bit aligned 5271>>>16 bedouble 8.642135e+130 big-endian 5272>>>>24 long 0 64bit long (s390x) 5273>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 5274>>>16 ledouble 8.642135e+130 little-endian 5275>>>>28 long 0 64bit long (alpha/amd64/ia64) 5276>>>>28 long !0 32bit long (armel/mipsel) 5277 5278#---------------------------------------------------------------------- 5279# ROOT: file(1) magic for ROOT databases 5280# 52810 string root\0 ROOT file 5282>4 belong x Version %d 5283>33 belong x (Compression: %d) 5284 5285# XXX: Weak magic. 5286# Alex Ott <ott@jet.msk.su> 5287## Paradox file formats 5288#2 leshort 0x0800 Paradox 5289#>0x39 byte 3 v. 3.0 5290#>0x39 byte 4 v. 3.5 5291#>0x39 byte 9 v. 4.x 5292#>0x39 byte 10 v. 5.x 5293#>0x39 byte 11 v. 5.x 5294#>0x39 byte 12 v. 7.x 5295#>>0x04 byte 0 indexed .DB data file 5296#>>0x04 byte 1 primary index .PX file 5297#>>0x04 byte 2 non-indexed .DB data file 5298#>>0x04 byte 3 non-incrementing secondary index .Xnn file 5299#>>0x04 byte 4 secondary index .Ynn file 5300#>>0x04 byte 5 incrementing secondary index .Xnn file 5301#>>0x04 byte 6 non-incrementing secondary index .XGn file 5302#>>0x04 byte 7 secondary index .YGn file 5303#>>>0x04 byte 8 incrementing secondary index .XGn file 5304 5305## XBase database files 5306# updated by Joerg Jenderek at Feb 2013 5307# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 5308# http://www.clicketyclick.dk/databases/xbase/format/dbf.html 5309# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 5310# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 53110 ubelong&0x0000FFFF <0x00000C20 5312# skip Infocom game Z-machine 5313>2 ubyte >0 5314# skip Androids *.xml 5315>>3 ubyte >0 5316>>>3 ubyte <32 5317# 1 < version VV 5318>>>>0 ubyte >1 5319# skip HELP.CA3 by test for reserved byte ( NULL ) 5320>>>>>27 ubyte 0 5321# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 5322#>>>>>30 ubeshort x 30NULL?%x 5323# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 5324>>>>>>24 ubelong&0xffFFFFff >0x01302000 5325# .DBF or .MDX 5326>>>>>>24 ubelong&0xffFFFFff <0x01302001 5327# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 5328>>>>>>>24 ubelong&0xffFFFFff =0 5329# test for 2 reserved NULL bytes,transaction and encryption byte flag 5330>>>>>>>>12 ubelong&0xFFFFfEfE 0 5331# test for MDX flag 5332>>>>>>>>>28 ubyte x 5333>>>>>>>>>28 ubyte&0xf8 0 5334# header size >= 32 5335>>>>>>>>>>8 uleshort >31 5336# skip PIC15736.PCX by test for language driver name or field name 5337>>>>>>>>>>>32 ubyte >0 5338#!:mime application/x-dbf; charset=unknown-8bit ?? 5339#!:mime application/x-dbase 5340>>>>>>>>>>>>0 use xbase-type 5341# database file 5342>>>>>>>>>>>>0 ubyte x \b DBF 5343>>>>>>>>>>>>4 lelong 0 \b, no records 5344>>>>>>>>>>>>4 lelong >0 \b, %d record 5345# plural s appended 5346>>>>>>>>>>>>>4 lelong >1 \bs 5347# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 5348# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 5349>>>>>>>>>>>>10 uleshort x * %d 5350# file size = records * record size + header size 5351>>>>>>>>>>>>1 ubyte x \b, update-date 5352>>>>>>>>>>>>1 use xbase-date 5353# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 5354#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 5355# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 5356>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 5357#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 5358>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 5359>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 5360>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 5361# 1st record offset + 1 = header size 5362>>>>>>>>>>>>8 uleshort >0 5363>>>>>>>>>>>>(8.s+1) ubyte >0 5364>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 5365>>>>>>>>>>>>>(8.s+1) ubyte >0 5366>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 5367# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) 5368>>>>>>>24 ubelong&0x0133f7ff >0 5369# test for reserved NULL byte 5370>>>>>>>>47 ubyte 0 5371# test for valid TAG key format (0x10 or 0) 5372>>>>>>>>>559 ubyte&0xeF 0 5373# test MM <= 12 5374>>>>>>>>>>45 ubeshort <0x0C20 5375>>>>>>>>>>>45 ubyte >0 5376>>>>>>>>>>>>46 ubyte <32 5377>>>>>>>>>>>>>46 ubyte >0 5378#!:mime application/x-mdx 5379>>>>>>>>>>>>>>0 use xbase-type 5380>>>>>>>>>>>>>>0 ubyte x \b MDX 5381>>>>>>>>>>>>>>1 ubyte x \b, creation-date 5382>>>>>>>>>>>>>>1 use xbase-date 5383>>>>>>>>>>>>>>44 ubyte x \b, update-date 5384>>>>>>>>>>>>>>44 use xbase-date 5385# No.of tags in use (1,2,5,12) 5386>>>>>>>>>>>>>>28 uleshort x \b, %d 5387# No. of entries in tag (0x30) 5388>>>>>>>>>>>>>>25 ubyte x \b/%d tags 5389# Length of tag 5390>>>>>>>>>>>>>>26 ubyte x * %d 5391# 1st tag name_ 5392>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 5393# 2nd tag name 5394#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 5395# 5396# Print the xBase names of different version variants 53970 name xbase-type 5398>0 ubyte <2 5399# 1 < version 5400>0 ubyte >1 5401>>0 ubyte 0x02 FoxBase 5402# FoxBase+/dBaseIII+, no memo 5403>>0 ubyte 0x03 FoxBase+/dBase III 5404!:mime application/x-dbf 5405# dBASE IV no memo file 5406>>0 ubyte 0x04 dBase IV 5407!:mime application/x-dbf 5408# dBASE V no memo file 5409>>0 ubyte 0x05 dBase V 5410!:mime application/x-dbf 5411>>0 ubyte 0x30 Visual FoxPro 5412!:mime application/x-dbf 5413>>0 ubyte 0x31 Visual FoxPro, autoincrement 5414!:mime application/x-dbf 5415# Visual FoxPro, with field type Varchar or Varbinary 5416>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 5417!:mime application/x-dbf 5418# dBASE IV SQL, no memo;dbv memo var size (Flagship) 5419>>0 ubyte 0x43 dBase IV, with SQL table 5420!:mime application/x-dbf 5421# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5422#>>0 ubyte 0x62 dBase IV, with SQL table 5423#!:mime application/x-dbf 5424# dBASE IV, with memo!! 5425>>0 ubyte 0x7b dBase IV, with memo 5426!:mime application/x-dbf 5427# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5428#>>0 ubyte 0x82 dBase IV, with SQL system 5429#!:mime application/x-dbf 5430# FoxBase+/dBaseIII+ with memo .DBT! 5431>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 5432!:mime application/x-dbf 5433# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 5434>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 5435!:mime application/x-dbf 5436# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5437#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 5438#!:mime application/x-dbf 5439# dBASE IV with memo! 5440>>0 ubyte 0x8B dBase IV, with memo .DBT 5441!:mime application/x-dbf 5442# dBase IV with SQL Table,no memo? 5443>>0 ubyte 0x8E dBase IV, with SQL table 5444!:mime application/x-dbf 5445# .dbv and .dbt memo (Flagship)? 5446>>0 ubyte 0xB3 Flagship 5447# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5448#>>0 ubyte 0xCA dBase IV with memo .DBT 5449#!:mime application/x-dbf 5450# dBASE IV with SQL table, with memo .DBT 5451>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 5452!:mime application/x-dbf 5453# HiPer-Six format;Clipper SIX, with SMT memo file 5454>>0 ubyte 0xE5 Clipper SIX with memo 5455!:mime application/x-dbf 5456# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5457#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 5458#!:mime application/x-dbf 5459>>0 ubyte 0xF5 FoxPro with memo 5460!:mime application/x-dbf 5461# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 5462#>>0 ubyte 0xFA FoxPro 2.x, with memo 5463#!:mime application/x-dbf 5464# unknown version (should not happen) 5465>>0 default x xBase 5466!:mime application/x-dbf 5467>>>0 ubyte x (0x%x) 5468# flags in version byte 5469# DBT flag (with dBASE III memo .DBT)!! 5470# >>0 ubyte&0x80 >0 DBT_FLAG=%x 5471# memo flag ?? 5472# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 5473# SQL flag ?? 5474# >>0 ubyte&0x70 >0 SQL_FLAG=%x 5475# test and print the date of xBase .DBF .MDX 54760 name xbase-date 5477# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 5478>0 ubelong x 5479>1 ubyte <13 5480>>1 ubyte >0 5481>>>2 ubyte >0 5482>>>>2 ubyte <32 5483>>>>>0 ubyte x 5484# YY is interpreted as 20YY or 19YY 5485>>>>>>0 ubyte <100 \b %.2d 5486# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 5487>>>>>>0 ubyte >99 \b %d 5488>>>>>1 ubyte x \b-%d 5489>>>>>2 ubyte x \b-%d 5490 5491# dBase memo files .DBT or .FPT 5492# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 549316 ubyte <4 5494>16 ubyte !2 5495>>16 ubyte !1 5496# next free block index is positive 5497>>>0 ulelong >0 5498# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 5499>>>>17 ubelong&0xFFfdFE00 0x00000000 5500# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 5501>>>>>20 ubelong&0xFF01209B 0x00000000 5502# dBASE III 5503>>>>>>16 ubyte 3 5504# dBASE III DBT 5505>>>>>>>0 use dbase3-memo-print 5506# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 5507>>>>>>16 ubyte 0 5508# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 5509>>>>>>>20 uleshort 0 5510# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 5511>>>>>>>>8 ulong =0 5512>>>>>>>>>6 ubeshort >0 5513# skip emacs.PIF 5514>>>>>>>>>>4 ushort 0 5515>>>>>>>>>>>0 use foxpro-memo-print 5516# dBASE III DBT , garbage 5517>>>>>>>>>6 ubeshort 0 5518# skip MM*DD*.bin by test for for reserved NULL byte 5519>>>>>>>>>>510 ubeshort 0 5520# skip TK-DOS11.img image by looking for memo text 5521>>>>>>>>>>>512 ubelong <0xfeffff03 5522# skip EFI executables by looking for memo text 5523>>>>>>>>>>>>512 ubelong >0x1F202020 5524>>>>>>>>>>>>>513 ubyte >0 5525# unusual dBASE III DBT like adressen.dbt 5526>>>>>>>>>>>>>>0 use dbase3-memo-print 5527# dBASE III DBT like angest.dbt, or garbage PCX DBF 5528>>>>>>>>8 ubelong !0 5529# skip PCX and some DBF by test for for reserved NULL bytes 5530>>>>>>>>>510 ubeshort 0 5531# skip some DBF by test of invalid version 5532>>>>>>>>>>0 ubyte >5 5533>>>>>>>>>>>0 ubyte <48 5534>>>>>>>>>>>>0 use dbase3-memo-print 5535# dBASE IV DBT with positive block size 5536>>>>>>>20 uleshort >0 5537>>>>>>>>0 use dbase4-memo-print 5538 5539# Print the information of dBase III DBT memo file 55400 name dbase3-memo-print 5541>0 ubyte x dBase III DBT 5542# instead 3 as version number 0 for unusual examples like biblio.dbt 5543>16 ubyte !3 \b, version number %u 5544# Number of next available block for appending data 5545#>0 lelong =0 \b, next free block index %u 5546>0 lelong !0 \b, next free block index %u 5547# no positiv block length 5548#>20 uleshort =0 \b, block length %u 5549>20 uleshort !0 \b, block length %u 5550# dBase III memo field terminated by \032\032 5551>512 string >\0 \b, 1st item "%s" 5552# Print the information of dBase IV DBT memo file 55530 name dbase4-memo-print 5554>0 lelong x dBase IV DBT 5555# 8 character shorted main name of coresponding dBASE IV DBF file 5556>8 ubelong >0x20000000 5557# skip unusual like for angest.dbt 5558>>20 uleshort >0 5559>>>8 string >\0 \b of %-.8s.DBF 5560# value 0 implies 512 as size 5561#>4 ulelong =0 \b, blocks size %u 5562# size of blocks not reliable like 0x2020204C in angest.dbt 5563>4 ulelong !0 5564>>4 ulelong&0x0000003f 0 \b, blocks size %u 5565# dBase IV DBT with positive block length (found 512 , 1024) 5566>20 uleshort >0 \b, block length %u 5567# next available block 5568#>0 lelong =0 \b, next free block index %u 5569>0 lelong !0 \b, next free block index %u 5570>20 uleshort >0 5571>>(20.s) ubelong x 5572>>>&-4 use dbase4-memofield-print 5573# unusual dBase IV DBT without block length (implies 512 as length) 5574>20 uleshort =0 5575>>512 ubelong x 5576>>>&-4 use dbase4-memofield-print 5577# Print the information of dBase IV memo field 55780 name dbase4-memofield-print 5579# free dBase IV memo field 5580>0 ubelong !0xFFFF0800 5581>>0 lelong x \b, next free block %u 5582>>4 lelong x \b, next used block %u 5583# used dBase IV memo field 5584>0 ubelong =0xFFFF0800 5585# length of memo field 5586>>4 lelong x \b, field length %d 5587>>>8 string >\0 \b, 1st used item "%s" 5588# Print the information of FoxPro FPT memo file 55890 name foxpro-memo-print 5590>0 belong x FoxPro FPT 5591# Size of blocks for FoxPro ( 64,256 ) 5592>6 ubeshort x \b, blocks size %u 5593# next available block 5594#>0 belong =0 \b, next free block index %u 5595>0 belong !0 \b, next free block index %u 5596# field type ( 0~picture, 1~memo, 2~object ) 5597>512 ubelong <3 \b, field type %u 5598# length of memo field 5599>512 ubelong 1 5600>>516 belong >0 \b, field length %d 5601>>>520 string >\0 \b, 1st item "%s" 5602 5603# TODO: 5604# DBASE index file *.NDX 5605# DBASE Compound Index file *.CDX 5606# dBASE IV Printer Driver *.PRF 5607## End of XBase database stuff 5608 5609# MS Access database 56104 string Standard\ Jet\ DB Microsoft Access Database 5611!:mime application/x-msaccess 56124 string Standard\ ACE\ DB Microsoft Access Database 5613!:mime application/x-msaccess 5614 5615# TDB database from Samba et al - Martin Pool <mbp@samba.org> 56160 string TDB\ file TDB database 5617>32 lelong 0x2601196D version 6, little-endian 5618>>36 lelong x hash size %d bytes 5619 5620# SE Linux policy database 56210 lelong 0xf97cff8c SE Linux policy 5622>16 lelong x v%d 5623>20 lelong 1 MLS 5624>24 lelong x %d symbols 5625>28 lelong x %d ocons 5626 5627# ICE authority file data (Wolfram Kleff) 56282 string ICE ICE authority data 5629 5630# X11 Xauthority file (Wolfram Kleff) 563110 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 563211 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 563312 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 563413 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 563514 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 563615 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 563716 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 563817 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 563918 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 5640 5641# From: Maxime Henrion <mux@FreeBSD.org> 5642# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 56430 string PGDMP PostgreSQL custom database dump 5644>5 byte x - v%d 5645>6 byte x \b.%d 5646>5 beshort <0x101 \b-0 5647>5 beshort >0x100 5648>>7 byte x \b-%d 5649 5650# Type: Advanced Data Format (ADF) database 5651# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 5652# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 56530 string @(#)ADF\ Database CGNS Advanced Data Format 5654 5655# Tokyo Cabinet magic data 5656# http://tokyocabinet.sourceforge.net/index.html 56570 string ToKyO\ CaBiNeT\n Tokyo Cabinet 5658>14 string x \b (%s) 5659>32 byte 0 \b, Hash 5660!:mime application/x-tokyocabinet-hash 5661>32 byte 1 \b, B+ tree 5662!:mime application/x-tokyocabinet-btree 5663>32 byte 2 \b, Fixed-length 5664!:mime application/x-tokyocabinet-fixed 5665>32 byte 3 \b, Table 5666!:mime application/x-tokyocabinet-table 5667>33 byte &1 \b, [open] 5668>33 byte &2 \b, [fatal] 5669>34 byte x \b, apow=%d 5670>35 byte x \b, fpow=%d 5671>36 byte &0x01 \b, [large] 5672>36 byte &0x02 \b, [deflate] 5673>36 byte &0x04 \b, [bzip] 5674>36 byte &0x08 \b, [tcbs] 5675>36 byte &0x10 \b, [excodec] 5676>40 lequad x \b, bnum=%lld 5677>48 lequad x \b, rnum=%lld 5678>56 lequad x \b, fsiz=%lld 5679 5680# Type: QDBM Quick Database Manager 5681# From: Benoit Sibaud <bsibaud@april.org> 56820 string \\[depot\\]\n\f Quick Database Manager, little endian 56830 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 5684 5685# Type: TokyoCabinet database 5686# URL: http://tokyocabinet.sourceforge.net/ 5687# From: Benoit Sibaud <bsibaud@april.org> 56880 string ToKyO\ CaBiNeT\n TokyoCabinet database 5689>14 string x (version %s) 5690 5691# From: Stephane Blondon http://www.yaal.fr 5692# Database file for Zope (done by FileStorage) 56930 string FS21 Zope Object Database File Storage (data) 5694# Cache file for the database of Zope (done by ClientStorage) 56950 string ZEC3 Zope Object Database Client Cache File (data) 5696 5697# IDA (Interactive Disassembler) database 56980 string IDA1 IDA (Interactive Disassembler) database 5699 5700#------------------------------------------------------------------------------ 5701# $File$ 5702# diamond: file(1) magic for Diamond system 5703# 5704# ... diamond is a multi-media mail and electronic conferencing system.... 5705# 5706# XXX - I think it was either renamed Slate, or replaced by Slate.... 5707# 5708# The full deal is too long... 5709#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 57100 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 5711 5712#------------------------------------------------------------------------------ 5713# $File: diff,v 1.13 2012/06/16 14:43:36 christos Exp $ 5714# diff: file(1) magic for diff(1) output 5715# 57160 search/1 diff\ diff output text 5717!:mime text/x-diff 57180 search/1 ***\ diff output text 5719!:mime text/x-diff 57200 search/1 Only\ in\ diff output text 5721!:mime text/x-diff 57220 search/1 Common\ subdirectories:\ diff output text 5723!:mime text/x-diff 5724 57250 search/1 Index: RCS/CVS diff output text 5726!:mime text/x-diff 5727 5728# bsdiff: file(1) magic for bsdiff(1) output 57290 string/b BSDIFF40 bsdiff(1) patch file 5730 5731 5732# unified diff 57330 search/4096 ---\ 5734>&0 search/1024 \n 5735>>&0 search/1 +++\ 5736>>>&0 search/1024 \n 5737>>>>&0 search/1 @@ unified diff output text 5738!:mime text/x-diff 5739!:strength + 90 5740 5741# librsync -- the library for network deltas 5742# 5743# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 5744# this file. 5745# 57460 belong 0x72730236 rdiff network-delta data 5747 57480 belong 0x72730136 rdiff network-delta signature data 5749>4 belong x (block length=%d, 5750>8 belong x signature strength=%d) 5751 5752#------------------------------------------------------------------------------ 5753# $File: digital,v 1.10 2011/05/03 01:44:17 christos Exp $ 5754# Digital UNIX - Info 5755# 57560 string =!<arch>\n________64E Alpha archive 5757>22 string X -- out of date 5758# 5759 57600 leshort 0603 5761>24 leshort 0410 COFF format alpha pure 5762>24 leshort 0413 COFF format alpha demand paged 5763>>22 leshort&030000 !020000 executable 5764>>22 leshort&020000 !0 dynamically linked 5765>>16 lelong !0 not stripped 5766>>16 lelong 0 stripped 5767>>27 byte x - version %d 5768>>26 byte x \b.%d 5769>>28 byte x \b-%d 5770>24 leshort 0407 COFF format alpha object 5771>>22 leshort&030000 020000 shared library 5772>>27 byte x - version %d 5773>>26 byte x \b.%d 5774>>28 byte x \b-%d 5775 5776# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 5777# 5778# The actual magic number is just "Core", followed by a 2-byte version 5779# number; however, treating any file that begins with "Core" as a Digital 5780# UNIX core dump file may produce too many false hits, so we include one 5781# byte of the version number as well; DU 5.0 appears only to be up to 5782# version 2. 5783# 57840 string Core\001 Alpha COFF format core dump (Digital UNIX) 5785>24 string >\0 \b, from '%s' 57860 string Core\002 Alpha COFF format core dump (Digital UNIX) 5787>24 string >\0 \b, from '%s' 5788# 5789# The next is incomplete, we could tell more about this format, 5790# but its not worth it. 57910 leshort 0x188 Alpha compressed COFF 57920 leshort 0x18f Alpha u-code object 5793# 5794# 5795# Some other interesting Digital formats, 57960 string \377\377\177 ddis/ddif 57970 string \377\377\174 ddis/dots archive 57980 string \377\377\176 ddis/dtif table data 57990 string \033c\033 LN03 output 58000 long 04553207 X image 5801# 58020 string =!<PDF>!\n profiling data file 5803# 5804# Locale data tables (MIPS and Alpha). 5805# 58060 short 0x0501 locale data table 5807>6 short 0x24 for MIPS 5808>6 short 0x40 for Alpha 5809 5810#------------------------------------------------------------------------------ 5811# $File: dolby,v 1.6 2012/10/31 13:39:42 christos Exp $ 5812# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 5813# from http://www.atsc.org/standards/a_52a.pdf 5814# corrections, additions, etc. are always welcome! 5815# 5816# syncword 58170 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 5818# Proposed audio/ac3 RFC/4184 5819!:mime audio/vnd.dolby.dd-raw 5820# fscod 5821>4 byte&0xc0 = 0x00 48 kHz, 5822>4 byte&0xc0 = 0x40 44.1 kHz, 5823>4 byte&0xc0 = 0x80 32 kHz, 5824# is this one used for 96 kHz? 5825>4 byte&0xc0 = 0xc0 reserved frequency, 5826# 5827>5 byte&0x07 = 0x00 \b, complete main (CM) 5828>5 byte&0x07 = 0x01 \b, music and effects (ME) 5829>5 byte&0x07 = 0x02 \b, visually impaired (VI) 5830>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 5831>5 byte&0x07 = 0x04 \b, dialogue (D) 5832>5 byte&0x07 = 0x05 \b, commentary (C) 5833>5 byte&0x07 = 0x06 \b, emergency (E) 5834>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 5835>5 beshort&0x07e0 >0x0720 \b, karaoke 5836# acmod 5837>6 byte&0xe0 = 0x00 1+1 front, 5838>>6 byte&0x10 = 0x10 LFE on, 5839>6 byte&0xe0 = 0x20 1 front/0 rear, 5840>>6 byte&0x10 = 0x10 LFE on, 5841>6 byte&0xe0 = 0x40 2 front/0 rear, 5842# dsurmod (for stereo only) 5843>>6 byte&0x18 = 0x00 Dolby Surround not indicated 5844>>6 byte&0x18 = 0x08 not Dolby Surround encoded 5845>>6 byte&0x18 = 0x10 Dolby Surround encoded 5846>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 5847>>6 byte&0x04 = 0x04 LFE on, 5848>6 byte&0xe0 = 0x60 3 front/0 rear, 5849>>6 byte&0x04 = 0x04 LFE on, 5850>6 byte&0xe0 = 0x80 2 front/1 rear, 5851>>6 byte&0x04 = 0x04 LFE on, 5852>6 byte&0xe0 = 0xa0 3 front/1 rear, 5853>>6 byte&0x01 = 0x01 LFE on, 5854>6 byte&0xe0 = 0xc0 2 front/2 rear, 5855>>6 byte&0x04 = 0x04 LFE on, 5856>6 byte&0xe0 = 0xe0 3 front/2 rear, 5857>>6 byte&0x01 = 0x01 LFE on, 5858# 5859>4 byte&0x3e = 0x00 \b, 32 kbit/s 5860>4 byte&0x3e = 0x02 \b, 40 kbit/s 5861>4 byte&0x3e = 0x04 \b, 48 kbit/s 5862>4 byte&0x3e = 0x06 \b, 56 kbit/s 5863>4 byte&0x3e = 0x08 \b, 64 kbit/s 5864>4 byte&0x3e = 0x0a \b, 80 kbit/s 5865>4 byte&0x3e = 0x0c \b, 96 kbit/s 5866>4 byte&0x3e = 0x0e \b, 112 kbit/s 5867>4 byte&0x3e = 0x10 \b, 128 kbit/s 5868>4 byte&0x3e = 0x12 \b, 160 kbit/s 5869>4 byte&0x3e = 0x14 \b, 192 kbit/s 5870>4 byte&0x3e = 0x16 \b, 224 kbit/s 5871>4 byte&0x3e = 0x18 \b, 256 kbit/s 5872>4 byte&0x3e = 0x1a \b, 320 kbit/s 5873>4 byte&0x3e = 0x1c \b, 384 kbit/s 5874>4 byte&0x3e = 0x1e \b, 448 kbit/s 5875>4 byte&0x3e = 0x20 \b, 512 kbit/s 5876>4 byte&0x3e = 0x22 \b, 576 kbit/s 5877>4 byte&0x3e = 0x24 \b, 640 kbit/s 5878 5879#------------------------------------------------------------------------------ 5880# $File: dump,v 1.12 2012/11/01 04:26:40 christos Exp $ 5881# dump: file(1) magic for dump file format--for new and old dump filesystems 5882# 5883# We specify both byte orders in order to recognize byte-swapped dumps. 5884# 58850 name new-dump-be 5886>4 bedate x Previous dump %s, 5887>8 bedate x This dump %s, 5888>12 belong >0 Volume %d, 5889>692 belong 0 Level zero, type: 5890>692 belong >0 Level %d, type: 5891>0 belong 1 tape header, 5892>0 belong 2 beginning of file record, 5893>0 belong 3 map of inodes on tape, 5894>0 belong 4 continuation of file record, 5895>0 belong 5 end of volume, 5896>0 belong 6 map of inodes deleted, 5897>0 belong 7 end of medium (for floppy), 5898>676 string >\0 Label %s, 5899>696 string >\0 Filesystem %s, 5900>760 string >\0 Device %s, 5901>824 string >\0 Host %s, 5902>888 belong >0 Flags %x 5903 59040 name old-dump-be 5905#>4 bedate x Previous dump %s, 5906#>8 bedate x This dump %s, 5907>12 belong >0 Volume %d, 5908>692 belong 0 Level zero, type: 5909>692 belong >0 Level %d, type: 5910>0 belong 1 tape header, 5911>0 belong 2 beginning of file record, 5912>0 belong 3 map of inodes on tape, 5913>0 belong 4 continuation of file record, 5914>0 belong 5 end of volume, 5915>0 belong 6 map of inodes deleted, 5916>0 belong 7 end of medium (for floppy), 5917>676 string >\0 Label %s, 5918>696 string >\0 Filesystem %s, 5919>760 string >\0 Device %s, 5920>824 string >\0 Host %s, 5921>888 belong >0 Flags %x 5922 59230 name ufs2-dump-be 5924>896 beqdate x Previous dump %s, 5925>904 beqdate x This dump %s, 5926>12 belong >0 Volume %d, 5927>692 belong 0 Level zero, type: 5928>692 belong >0 Level %d, type: 5929>0 belong 1 tape header, 5930>0 belong 2 beginning of file record, 5931>0 belong 3 map of inodes on tape, 5932>0 belong 4 continuation of file record, 5933>0 belong 5 end of volume, 5934>0 belong 6 map of inodes deleted, 5935>0 belong 7 end of medium (for floppy), 5936>676 string >\0 Label %s, 5937>696 string >\0 Filesystem %s, 5938>760 string >\0 Device %s, 5939>824 string >\0 Host %s, 5940>888 belong >0 Flags %x 5941 594224 belong 60012 new-fs dump file (big endian), 5943>0 use new-dump-be 5944 594524 belong 60011 old-fs dump file (big endian), 5946>0 use old-dump-be 5947 594824 lelong 60012 new-fs dump file (little endian), 5949>0 use \^new-dump-be 5950 595124 lelong 60011 old-fs dump file (little endian), 5952>0 use \^old-dump-be 5953 5954 595524 belong 0x19540119 new-fs dump file (ufs2, big endian), 5956>0 use ufs2-dump-be 5957 595824 lelong 0x19540119 new-fs dump file (ufs2, little endian), 5959>0 use \^ufs2-dump-be 5960 596118 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 5962>2 medate x Previous dump %s, 5963>6 medate x This dump %s, 5964>10 leshort >0 Volume %d, 5965>0 leshort 1 tape header. 5966>0 leshort 2 beginning of file record. 5967>0 leshort 3 map of inodes on tape. 5968>0 leshort 4 continuation of file record. 5969>0 leshort 5 end of volume. 5970>0 leshort 6 map of inodes deleted. 5971>0 leshort 7 end of medium (for floppy). 5972 5973#------------------------------------------------------------------------------ 5974# $File: dyadic,v 1.5 2010/09/20 18:55:20 rrt Exp $ 5975# Dyadic: file(1) magic for Dyalog APL. 5976# 5977# updated by Joerg Jenderek at Oct 2013 5978# http://en.wikipedia.org/wiki/Dyalog_APL 5979# http://www.dyalog.com/ 5980# .DXV Dyalog APL External Variable 5981# .DIN Dyalog APL Input Table 5982# .DOT Dyalog APL Output Table 5983# .DFT Dyalog APL Format File 59840 ubeshort&0xFF60 0xaa00 5985# skip biblio.dbt 5986>1 byte !4 5987# real Dyalog APL have non zero version numbers like 7.3 or 13.4 5988>>2 ubeshort >0x0000 Dyalog APL 5989>>>1 byte 0x00 aplcore 5990#>>>1 byte 0x00 incomplete workspace 5991# *.DCF Dyalog APL Component File 5992>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed 5993#>>>1 byte 0x01 component file 5994>>>1 byte 0x02 external variable exclusive 5995#>>>1 byte 0x02 external variable 5996# *.DWS Dyalog APL Workspace 5997>>>1 byte 0x03 workspace 5998>>>>7 byte&0x28 0x00 32-bit 5999>>>>7 byte&0x28 0x20 64-bit 6000>>>>7 byte&0x0c 0x00 classic 6001>>>>7 byte&0x0c 0x04 unicode 6002>>>>7 byte&0x88 0x00 big-endian 6003>>>>7 byte&0x88 0x80 little-endian 6004>>>1 byte 0x06 external variable shared 6005# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File 6006>>>1 byte 0x07 session 6007>>>1 byte 0x08 mapped file 32-bit 6008>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed 6009>>>1 byte 0x0a mapped file 64-bit 6010>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 6011>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 6012>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed 6013>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed 6014>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed 6015>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed 6016>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed 6017>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed 6018>>>1 byte 0x13 component file 32-bit non-journaled checksummed 6019>>>1 byte 0x14 component file 64-bit non-journaled checksummed 6020>>>1 byte 0x80 DDB 6021>>>2 byte x version %d 6022>>>3 byte x \b.%d 6023#>>>2 byte x type %d 6024#>>>3 byte x subtype %d 6025 6026# *.DXF Dyalog APL Transfer File 60270 short 0x6060 Dyalog APL transfer 6028 6029#------------------------------------------------------------------------------ 6030# $File$ 6031# ebml: file(1) magic for various Extensible Binary Meta Language 6032# http://www.matroska.org/technical/specs/index.html#track 60330 belong 0x1a45dfa3 EBML file 6034>4 search/b/100 \102\202 6035>>&1 string x \b, creator %.8s 6036 6037#------------------------------------------------------------------------------ 6038# $File$ 6039# T602 editor documents 6040# by David Necas <yeti@physics.muni.cz> 60410 string @CT\ T602 document data, 6042>4 string 0 Kamenicky 6043>4 string 1 CP 852 6044>4 string 2 KOI8-CS 6045>4 string >2 unknown encoding 6046 6047# Vi IMproved Encrypted file 6048# by David Necas <yeti@physics.muni.cz> 60490 string VimCrypt~ Vim encrypted file data 6050# Vi IMproved Swap file 6051# by Sven Wegener <swegener@gentoo.org> 60520 string b0VIM\ Vim swap file 6053>&0 string >\0 \b, version %s 6054 6055#------------------------------------------------------------------------------ 6056# $File: efi,v 1.4 2009/09/19 16:28:09 christos Exp $ 6057# efi: file(1) magic for Universal EFI binaries 6058 60590 lelong 0x0ef1fab9 6060>4 lelong 1 Universal EFI binary with 1 architecture 6061>>&0 lelong 7 \b, i386 6062>>&0 lelong 0x01000007 \b, x86_64 6063>4 lelong 2 Universal EFI binary with 2 architectures 6064>>&0 lelong 7 \b, i386 6065>>&0 lelong 0x01000007 \b, x86_64 6066>>&20 lelong 7 \b, i386 6067>>&20 lelong 0x01000007 \b, x86_64 6068>4 lelong >2 Universal EFI binary with %d architectures 6069 6070#------------------------------------------------------------------------------ 6071# $File: elf,v 1.67 2014/06/12 13:52:48 christos Exp $ 6072# elf: file(1) magic for ELF executables 6073# 6074# We have to check the byte order flag to see what byte order all the 6075# other stuff in the header is in. 6076# 6077# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 6078# 6079# Created by: unknown 6080# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 6081# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 6082# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 6083# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 6084# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 6085 60860 name elf-le 6087>16 leshort 0 no file type, 6088!:mime application/octet-stream 6089>16 leshort 1 relocatable, 6090!:mime application/x-object 6091>16 leshort 2 executable, 6092!:mime application/x-executable 6093>16 leshort 3 shared object, 6094!:mime application/x-sharedlib 6095>16 leshort 4 core file 6096!:mime application/x-coredump 6097# Core file detection is not reliable. 6098#>>>(0x38+0xcc) string >\0 of '%s' 6099#>>>(0x38+0x10) lelong >0 (signal %d), 6100>16 leshort &0xff00 processor-specific, 6101>18 clear x 6102>18 leshort 0 no machine, 6103>18 leshort 1 AT&T WE32100, 6104>18 leshort 2 SPARC, 6105>18 leshort 3 Intel 80386, 6106>18 leshort 4 Motorola m68k, 6107>>4 byte 1 6108>>>36 lelong &0x01000000 68000, 6109>>>36 lelong &0x00810000 CPU32, 6110>>>36 lelong 0 68020, 6111>18 leshort 5 Motorola m88k, 6112>18 leshort 6 Intel 80486, 6113>18 leshort 7 Intel 80860, 6114# The official e_machine number for MIPS is now #8, regardless of endianness. 6115# The second number (#10) will be deprecated later. For now, we still 6116# say something if #10 is encountered, but only gory details for #8. 6117>18 leshort 8 MIPS, 6118>>4 byte 1 6119>>>36 lelong &0x20 N32 6120>18 leshort 10 MIPS, 6121>>4 byte 1 6122>>>36 lelong &0x20 N32 6123>18 leshort 8 6124# only for 32-bit 6125>>4 byte 1 6126>>>36 lelong&0xf0000000 0x00000000 MIPS-I 6127>>>36 lelong&0xf0000000 0x10000000 MIPS-II 6128>>>36 lelong&0xf0000000 0x20000000 MIPS-III 6129>>>36 lelong&0xf0000000 0x30000000 MIPS-IV 6130>>>36 lelong&0xf0000000 0x40000000 MIPS-V 6131>>>36 lelong&0xf0000000 0x50000000 MIPS32 6132>>>36 lelong&0xf0000000 0x60000000 MIPS64 6133>>>36 lelong&0xf0000000 0x70000000 MIPS32 rel2 6134>>>36 lelong&0xf0000000 0x80000000 MIPS64 rel2 6135# only for 64-bit 6136>>4 byte 2 6137>>>48 lelong&0xf0000000 0x00000000 MIPS-I 6138>>>48 lelong&0xf0000000 0x10000000 MIPS-II 6139>>>48 lelong&0xf0000000 0x20000000 MIPS-III 6140>>>48 lelong&0xf0000000 0x30000000 MIPS-IV 6141>>>48 lelong&0xf0000000 0x40000000 MIPS-V 6142>>>48 lelong&0xf0000000 0x50000000 MIPS32 6143>>>48 lelong&0xf0000000 0x60000000 MIPS64 6144>>>48 lelong&0xf0000000 0x70000000 MIPS32 rel2 6145>>>48 lelong&0xf0000000 0x80000000 MIPS64 rel2 6146>18 leshort 9 Amdahl, 6147>18 leshort 10 MIPS (deprecated), 6148>18 leshort 11 RS6000, 6149>18 leshort 15 PA-RISC, 6150# only for 32-bit 6151>>4 byte 1 6152>>>38 leshort 0x0214 2.0 6153>>>36 leshort &0x0008 (LP64) 6154# only for 64-bit 6155>>4 byte 2 6156>>>50 leshort 0x0214 2.0 6157>>>48 leshort &0x0008 (LP64) 6158>18 leshort 16 nCUBE, 6159>18 leshort 17 Fujitsu VPP500, 6160>18 leshort 18 SPARC32PLUS, 6161# only for 32-bit 6162>>4 byte 1 6163>>>36 lelong&0xffff00 0x000100 V8+ Required, 6164>>>36 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 6165>>>36 lelong&0xffff00 0x000400 HaL R1 Extensions Required, 6166>>>36 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 6167>18 leshort 19 Intel 80960, 6168>18 leshort 20 PowerPC or cisco 4500, 6169>18 leshort 21 64-bit PowerPC or cisco 7500, 6170>18 leshort 22 IBM S/390, 6171>18 leshort 23 Cell SPU, 6172>18 leshort 24 cisco SVIP, 6173>18 leshort 25 cisco 7200, 6174>18 leshort 36 NEC V800 or cisco 12000, 6175>18 leshort 37 Fujitsu FR20, 6176>18 leshort 38 TRW RH-32, 6177>18 leshort 39 Motorola RCE, 6178>18 leshort 40 ARM, 6179>>4 byte 1 6180>>>36 lelong&0xff000000 0x04000000 EABI4 6181>>>36 lelong&0xff000000 0x05000000 EABI5 6182>>>36 lelong &0x00800000 BE8 6183>>>36 lelong &0x00400000 LE8 6184>18 leshort 41 Alpha, 6185>18 leshort 42 Renesas SH, 6186>18 leshort 43 SPARC V9, 6187>>4 byte 2 6188>>>48 lelong&0xffff00 0x000200 Sun UltraSPARC1 Extensions Required, 6189>>>48 lelong&0xffff00 0x000400 HaL R1 Extensions Required, 6190>>>48 lelong&0xffff00 0x000800 Sun UltraSPARC3 Extensions Required, 6191>>>48 lelong&0x3 0 total store ordering, 6192>>>48 lelong&0x3 1 partial store ordering, 6193>>>48 lelong&0x3 2 relaxed memory ordering, 6194>18 leshort 44 Siemens Tricore Embedded Processor, 6195>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 6196>18 leshort 46 Renesas H8/300, 6197>18 leshort 47 Renesas H8/300H, 6198>18 leshort 48 Renesas H8S, 6199>18 leshort 49 Renesas H8/500, 6200>18 leshort 50 IA-64, 6201>18 leshort 51 Stanford MIPS-X, 6202>18 leshort 52 Motorola Coldfire, 6203>18 leshort 53 Motorola M68HC12, 6204>18 leshort 54 Fujitsu MMA, 6205>18 leshort 55 Siemens PCP, 6206>18 leshort 56 Sony nCPU, 6207>18 leshort 57 Denso NDR1, 6208>18 leshort 58 Start*Core, 6209>18 leshort 59 Toyota ME16, 6210>18 leshort 60 ST100, 6211>18 leshort 61 Tinyj emb., 6212>18 leshort 62 x86-64, 6213>18 leshort 63 Sony DSP, 6214>18 leshort 64 DEC PDP-10, 6215>18 leshort 65 DEC PDP-11, 6216>18 leshort 66 FX66, 6217>18 leshort 67 ST9+ 8/16 bit, 6218>18 leshort 68 ST7 8 bit, 6219>18 leshort 69 MC68HC16, 6220>18 leshort 70 MC68HC11, 6221>18 leshort 71 MC68HC08, 6222>18 leshort 72 MC68HC05, 6223>18 leshort 73 SGI SVx or Cray NV1, 6224>18 leshort 74 ST19 8 bit, 6225>18 leshort 75 Digital VAX, 6226>18 leshort 76 Axis cris, 6227>18 leshort 77 Infineon 32-bit embedded, 6228>18 leshort 78 Element 14 64-bit DSP, 6229>18 leshort 79 LSI Logic 16-bit DSP, 6230>18 leshort 80 MMIX, 6231>18 leshort 81 Harvard machine-independent, 6232>18 leshort 82 SiTera Prism, 6233>18 leshort 83 Atmel AVR 8-bit, 6234>18 leshort 84 Fujitsu FR30, 6235>18 leshort 85 Mitsubishi D10V, 6236>18 leshort 86 Mitsubishi D30V, 6237>18 leshort 87 NEC v850, 6238>18 leshort 88 Renesas M32R, 6239>18 leshort 89 Matsushita MN10300, 6240>18 leshort 90 Matsushita MN10200, 6241>18 leshort 91 picoJava, 6242>18 leshort 92 OpenRISC, 6243>18 leshort 93 ARC Cores Tangent-A5, 6244>18 leshort 94 Tensilica Xtensa, 6245>18 leshort 95 Alphamosaic VideoCore, 6246>18 leshort 96 Thompson Multimedia, 6247>18 leshort 97 NatSemi 32k, 6248>18 leshort 98 Tenor Network TPC, 6249>18 leshort 99 Trebia SNP 1000, 6250>18 leshort 100 STMicroelectronics ST200, 6251>18 leshort 101 Ubicom IP2022, 6252>18 leshort 102 MAX Processor, 6253>18 leshort 103 NatSemi CompactRISC, 6254>18 leshort 104 Fujitsu F2MC16, 6255>18 leshort 105 TI msp430, 6256>18 leshort 106 Analog Devices Blackfin, 6257>18 leshort 107 S1C33 Family of Seiko Epson, 6258>18 leshort 108 Sharp embedded, 6259>18 leshort 109 Arca RISC, 6260>18 leshort 110 PKU-Unity Ltd., 6261>18 leshort 111 eXcess: 16/32/64-bit, 6262>18 leshort 112 Icera Deep Execution Processor, 6263>18 leshort 113 Altera Nios II, 6264>18 leshort 114 NatSemi CRX, 6265>18 leshort 115 Motorola XGATE, 6266>18 leshort 116 Infineon C16x/XC16x, 6267>18 leshort 117 Renesas M16C series, 6268>18 leshort 118 Microchip dsPIC30F, 6269>18 leshort 119 Freescale RISC core, 6270>18 leshort 120 Renesas M32C series, 6271>18 leshort 131 Altium TSK3000 core, 6272>18 leshort 132 Freescale RS08, 6273>18 leshort 134 Cyan Technology eCOG2, 6274>18 leshort 135 Sunplus S+core7 RISC, 6275>18 leshort 136 New Japan Radio (NJR) 24-bit DSP, 6276>18 leshort 137 Broadcom VideoCore III, 6277>18 leshort 138 LatticeMico32, 6278>18 leshort 139 Seiko Epson C17 family, 6279>18 leshort 140 TI TMS320C6000 DSP family, 6280>18 leshort 141 TI TMS320C2000 DSP family, 6281>18 leshort 142 TI TMS320C55x DSP family, 6282>18 leshort 160 STMicroelectronics 64bit VLIW DSP, 6283>18 leshort 161 Cypress M8C, 6284>18 leshort 162 Renesas R32C series, 6285>18 leshort 163 NXP TriMedia family, 6286>18 leshort 164 QUALCOMM DSP6, 6287>18 leshort 165 Intel 8051 and variants, 6288>18 leshort 166 STMicroelectronics STxP7x family, 6289>18 leshort 167 Andes embedded RISC, 6290>18 leshort 168 Cyan eCOG1X family, 6291>18 leshort 169 Dallas MAXQ30, 6292>18 leshort 170 New Japan Radio (NJR) 16-bit DSP, 6293>18 leshort 171 M2000 Reconfigurable RISC, 6294>18 leshort 172 Cray NV2 vector architecture, 6295>18 leshort 173 Renesas RX family, 6296>18 leshort 174 META, 6297>18 leshort 175 MCST Elbrus, 6298>18 leshort 176 Cyan Technology eCOG16 family, 6299>18 leshort 177 NatSemi CompactRISC, 6300>18 leshort 178 Freescale Extended Time Processing Unit, 6301>18 leshort 179 Infineon SLE9X, 6302>18 leshort 180 Intel L1OM, 6303>18 leshort 181 Intel K1OM, 6304>18 leshort 183 ARM aarch64, 6305>18 leshort 185 Atmel 32-bit family, 6306>18 leshort 186 STMicroeletronics STM8 8-bit, 6307>18 leshort 187 Tilera TILE64, 6308>18 leshort 188 Tilera TILEPro, 6309>18 leshort 189 Xilinx MicroBlaze 32-bit RISC, 6310>18 leshort 190 NVIDIA CUDA architecture, 6311>18 leshort 191 Tilera TILE-Gx, 6312>18 leshort 197 Renesas RL78 family, 6313>18 leshort 199 Renesas 78K0R, 6314>18 leshort 200 Freescale 56800EX, 6315>18 leshort 201 Beyond BA1, 6316>18 leshort 202 Beyond BA2, 6317>18 leshort 203 XMOS xCORE, 6318>18 leshort 204 Microchip 8-bit PIC(r), 6319>18 leshort 210 KM211 KM32, 6320>18 leshort 211 KM211 KMX32, 6321>18 leshort 212 KM211 KMX16, 6322>18 leshort 213 KM211 KMX8, 6323>18 leshort 214 KM211 KVARC, 6324>18 leshort 215 Paneve CDP, 6325>18 leshort 216 Cognitive Smart Memory, 6326>18 leshort 217 iCelero CoolEngine, 6327>18 leshort 218 Nanoradio Optimized RISC, 6328>18 leshort 243 UCB RISC-V, 6329>18 leshort 0x1057 AVR (unofficial), 6330>18 leshort 0x1059 MSP430 (unofficial), 6331>18 leshort 0x1223 Adapteva Epiphany (unofficial), 6332>18 leshort 0x2530 Morpho MT (unofficial), 6333>18 leshort 0x3330 FR30 (unofficial), 6334>18 leshort 0x3426 OpenRISC (obsolete), 6335>18 leshort 0x4688 Infineon C166 (unofficial), 6336>18 leshort 0x5441 Cygnus FRV (unofficial), 6337>18 leshort 0x5aa5 DLX (unofficial), 6338>18 leshort 0x7650 Cygnus D10V (unofficial), 6339>18 leshort 0x7676 Cygnus D30V (unofficial), 6340>18 leshort 0x8217 Ubicom IP2xxx (unofficial), 6341>18 leshort 0x8472 OpenRISC (obsolete), 6342>18 leshort 0x9025 Cygnus PowerPC (unofficial), 6343>18 leshort 0x9026 Alpha (unofficial), 6344>18 leshort 0x9041 Cygnus M32R (unofficial), 6345>18 leshort 0x9080 Cygnus V850 (unofficial), 6346>18 leshort 0xa390 IBM S/390 (obsolete), 6347>18 leshort 0xabc7 Old Xtensa (unofficial), 6348>18 leshort 0xad45 xstormy16 (unofficial), 6349>18 leshort 0xbaab Old MicroBlaze (unofficial),, 6350>18 leshort 0xbeef Cygnus MN10300 (unofficial), 6351>18 leshort 0xdead Cygnus MN10200 (unofficial), 6352>18 leshort 0xf00d Toshiba MeP (unofficial), 6353>18 leshort 0xfeb0 Renesas M32C (unofficial), 6354>18 leshort 0xfeba Vitesse IQ2000 (unofficial), 6355>18 leshort 0xfebb NIOS (unofficial), 6356>18 leshort 0xfeed Moxie (unofficial), 6357>18 default x 6358>>18 leshort x *unknown arch 0x%x* 6359>20 lelong 0 invalid version 6360>20 lelong 1 version 1 6361 63620 string \177ELF ELF 6363!:strength *2 6364>4 byte 0 invalid class 6365>4 byte 1 32-bit 6366>4 byte 2 64-bit 6367>5 byte 0 invalid byte order 6368>5 byte 1 LSB 6369>>0 use elf-le 6370>5 byte 2 MSB 6371>>0 use \^elf-le 6372# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed 6373# like proper ELF, but extracting the string had bad results. 6374>4 byte <0x80 6375>>8 string >\0 (%s) 6376>8 string \0 6377>>7 byte 0 (SYSV) 6378>>7 byte 1 (HP-UX) 6379>>7 byte 2 (NetBSD) 6380>>7 byte 3 (GNU/Linux) 6381>>7 byte 4 (GNU/Hurd) 6382>>7 byte 5 (86Open) 6383>>7 byte 6 (Solaris) 6384>>7 byte 7 (Monterey) 6385>>7 byte 8 (IRIX) 6386>>7 byte 9 (FreeBSD) 6387>>7 byte 10 (Tru64) 6388>>7 byte 11 (Novell Modesto) 6389>>7 byte 12 (OpenBSD) 6390>8 string \2 6391>>7 byte 13 (OpenVMS) 6392>>7 byte 97 (ARM) 6393>>7 byte 255 (embedded) 6394 6395#------------------------------------------------------------------------------ 6396# $File: encore,v 1.6 2009/09/19 16:28:09 christos Exp $ 6397# encore: file(1) magic for Encore machines 6398# 6399# XXX - needs to have the byte order specified (NS32K was little-endian, 6400# dunno whether they run the 88K in little-endian mode or not). 6401# 64020 short 0x154 Encore 6403>20 short 0x107 executable 6404>20 short 0x108 pure executable 6405>20 short 0x10b demand-paged executable 6406>20 short 0x10f unsupported executable 6407>12 long >0 not stripped 6408>22 short >0 - version %d 6409>22 short 0 - 6410#>4 date x stamp %s 64110 short 0x155 Encore unsupported executable 6412>12 long >0 not stripped 6413>22 short >0 - version %d 6414>22 short 0 - 6415#>4 date x stamp %s 6416 6417#------------------------------------------------------------------------------ 6418# $File: epoc,v 1.8 2012/06/16 14:43:36 christos Exp $ 6419# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 6420# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 6421# Useful information for improving this file can be found at: 6422# http://software.frodo.looijaard.name/psiconv/formats/Index.html 6423#------------------------------------------------------------------------------ 64240 lelong 0x10000037 Psion Series 5 6425>4 lelong 0x10000039 font file 6426>4 lelong 0x1000003A printer driver 6427>4 lelong 0x1000003B clipboard 6428>4 lelong 0x10000042 multi-bitmap image 6429!:mime image/x-epoc-mbm 6430>4 lelong 0x1000006A application information file 6431>4 lelong 0x1000006D 6432>>8 lelong 0x1000007D Sketch image 6433!:mime image/x-epoc-sketch 6434>>8 lelong 0x1000007E voice note 6435>>8 lelong 0x1000007F Word file 6436!:mime application/x-epoc-word 6437>>8 lelong 0x10000085 OPL program (TextEd) 6438!:mime application/x-epoc-opl 6439>>8 lelong 0x10000087 Comms settings 6440>>8 lelong 0x10000088 Sheet file 6441!:mime application/x-epoc-sheet 6442>>8 lelong 0x100001C4 EasyFax initialisation file 6443>4 lelong 0x10000073 OPO module 6444!:mime application/x-epoc-opo 6445>4 lelong 0x10000074 OPL application 6446!:mime application/x-epoc-app 6447>4 lelong 0x1000008A exported multi-bitmap image 6448>4 lelong 0x1000016D 6449>>8 lelong 0x10000087 Comms names 6450 64510 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 6452 64530 lelong 0x10000050 Psion Series 5 6454>4 lelong 0x1000006D database 6455>>8 lelong 0x10000084 Agenda file 6456!:mime application/x-epoc-agenda 6457>>8 lelong 0x10000086 Data file 6458!:mime application/x-epoc-data 6459>>8 lelong 0x10000CEA Jotter file 6460!:mime application/x-epoc-jotter 6461>4 lelong 0x100000E4 ini file 6462 64630 lelong 0x10000079 Psion Series 5 binary: 6464>4 lelong 0x00000000 DLL 6465>4 lelong 0x10000049 comms hardware library 6466>4 lelong 0x1000004A comms protocol library 6467>4 lelong 0x1000005D OPX 6468>4 lelong 0x1000006C application 6469>4 lelong 0x1000008D DLL 6470>4 lelong 0x100000AC logical device driver 6471>4 lelong 0x100000AD physical device driver 6472>4 lelong 0x100000E5 file transfer protocol 6473>4 lelong 0x100000E5 file transfer protocol 6474>4 lelong 0x10000140 printer definition 6475>4 lelong 0x10000141 printer definition 6476 64770 lelong 0x1000007A Psion Series 5 executable 6478 6479#------------------------------------------------------------------------------ 6480# $File: erlang,v 1.5 2009/09/19 16:28:09 christos Exp $ 6481# erlang: file(1) magic for Erlang JAM and BEAM files 6482# URL: http://www.erlang.org/faq/x779.html#AEN812 6483 6484# OTP R3-R4 64850 string \0177BEAM! Old Erlang BEAM file 6486>6 short >0 - version %d 6487 6488# OTP R5 and onwards 64890 string FOR1 6490>8 string BEAM Erlang BEAM file 6491 6492# 4.2 version may have a copyright notice! 64934 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 649479 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 6495 64964 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 6497 64980 bequad 0x0000000000ABCDEF Erlang DETS file 6499 6500#------------------------------------------------------------------------------ 6501# $File$ 6502# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 6503# Based on info from 6504# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 65050 belong 9994 ESRI Shapefile 6506>4 belong =0 6507>8 belong =0 6508>12 belong =0 6509>16 belong =0 6510>20 belong =0 6511>28 lelong x version %d 6512>24 belong x length %d 6513>32 lelong =0 type Null Shape 6514>32 lelong =1 type Point 6515>32 lelong =3 type PolyLine 6516>32 lelong =5 type Polygon 6517>32 lelong =8 type MultiPoint 6518>32 lelong =11 type PointZ 6519>32 lelong =13 type PolyLineZ 6520>32 lelong =15 type PolygonZ 6521>32 lelong =18 type MultiPointZ 6522>32 lelong =21 type PointM 6523>32 lelong =23 type PolyLineM 6524>32 lelong =25 type PolygonM 6525>32 lelong =28 type MultiPointM 6526>32 lelong =31 type MultiPatch 6527 6528#------------------------------------------------------------------------------ 6529# $File$ 6530# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 6531# From Roger Leigh <roger@whinlatter.uklinux.net> 65320 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 65330 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 65340 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 6535 6536#------------------------------------------------------------------------------ 6537# $File: filesystems,v 1.108 2015/01/01 17:43:47 christos Exp $ 6538# filesystems: file(1) magic for different filesystems 6539# 65400 name partid 6541>0 ubyte 0x00 Unused 6542>0 ubyte 0x01 12-bit FAT 6543>0 ubyte 0x02 XENIX / 6544>0 ubyte 0x03 XENIX /usr 6545>0 ubyte 0x04 16-bit FAT, less than 32M 6546>0 ubyte 0x05 extended partition 6547>0 ubyte 0x06 16-bit FAT, more than 32M 6548>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 6549>0 ubyte 0x08 AIX or os, or etc. 6550>0 ubyte 0x09 AIX boot partition or Coherent 6551>0 ubyte 0x0a O/2 boot manager or Coherent swap 6552>0 ubyte 0x0b 32-bit FAT 6553>0 ubyte 0x0c 32-bit FAT, LBA-mapped 6554>0 ubyte 0x0d 7XXX, LBA-mapped 6555>0 ubyte 0x0e 16-bit FAT, LBA-mapped 6556>0 ubyte 0x0f extended partition, LBA-mapped 6557>0 ubyte 0x10 OPUS 6558>0 ubyte 0x11 OS/2 DOS 12-bit FAT 6559>0 ubyte 0x12 Compaq diagnostics 6560>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 6561>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 6562>0 ubyte 0x17 OS/2 hidden IFS 6563>0 ubyte 0x18 AST Windows swapfile 6564>0 ubyte 0x19 Willowtech Photon coS 6565>0 ubyte 0x1b hidden win95 fat 32 6566>0 ubyte 0x1c hidden win95 fat 32 lba 6567>0 ubyte 0x1d hidden win95 fat 16 lba 6568>0 ubyte 0x20 Willowsoft OFS1 6569>0 ubyte 0x21 reserved 6570>0 ubyte 0x23 reserved 6571>0 ubyte 0x24 NEC DOS 6572>0 ubyte 0x26 reserved 6573>0 ubyte 0x31 reserved 6574>0 ubyte 0x32 Alien Internet Services NOS 6575>0 ubyte 0x33 reserved 6576>0 ubyte 0x34 reserved 6577>0 ubyte 0x35 JFS on OS2 6578>0 ubyte 0x36 reserved 6579>0 ubyte 0x38 Theos 6580>0 ubyte 0x39 Plan 9, or Theos spanned 6581>0 ubyte 0x3a Theos ver 4 4gb partition 6582>0 ubyte 0x3b Theos ve 4 extended partition 6583>0 ubyte 0x3c PartitionMagic recovery 6584>0 ubyte 0x3d Hidden Netware 6585>0 ubyte 0x40 VENIX 286 or LynxOS 6586>0 ubyte 0x41 PReP 6587>0 ubyte 0x42 linux swap sharing DRDOS disk 6588>0 ubyte 0x43 linux sharing DRDOS disk 6589>0 ubyte 0x44 GoBack change utility 6590>0 ubyte 0x45 Boot US Boot manager 6591>0 ubyte 0x46 EUMEL/Elan or Ergos 3 6592>0 ubyte 0x47 EUMEL/Elan or Ergos 3 6593>0 ubyte 0x48 EUMEL/Elan or Ergos 3 6594>0 ubyte 0x4a ALFX/THIN filesystem for DOS 6595>0 ubyte 0x4c Oberon partition 6596>0 ubyte 0x4d QNX4.x 6597>0 ubyte 0x4e QNX4.x 2nd part 6598>0 ubyte 0x4f QNX4.x 3rd part 6599>0 ubyte 0x50 DM (disk manager) 6600>0 ubyte 0x51 DM6 Aux1 (or Novell) 6601>0 ubyte 0x52 CP/M or Microport SysV/AT 6602>0 ubyte 0x53 DM6 Aux3 6603>0 ubyte 0x54 DM6 DDO 6604>0 ubyte 0x55 EZ-Drive (disk manager) 6605>0 ubyte 0x56 Golden Bow (disk manager) 6606>0 ubyte 0x57 Drive PRO 6607>0 ubyte 0x5c Priam Edisk (disk manager) 6608>0 ubyte 0x61 SpeedStor 6609>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 6610>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 6611>0 ubyte 0x65 Novell Netware 3.xx 6612>0 ubyte 0x66 Novell 386 Netware 6613>0 ubyte 0x67 Novell 6614>0 ubyte 0x68 Novell 6615>0 ubyte 0x69 Novell 6616>0 ubyte 0x70 DiskSecure Multi-Boot 6617>0 ubyte 0x71 reserved 6618>0 ubyte 0x73 reserved 6619>0 ubyte 0x74 reserved 6620>0 ubyte 0x75 PC/IX 6621>0 ubyte 0x76 reserved 6622>0 ubyte 0x77 M2FS/M2CS partition 6623>0 ubyte 0x78 XOSL boot loader filesystem 6624>0 ubyte 0x80 MINIX until 1.4a 6625>0 ubyte 0x81 MINIX since 1.4b 6626>0 ubyte 0x82 Linux swap or Solaris 6627>0 ubyte 0x83 Linux native 6628>0 ubyte 0x84 OS/2 hidden C: drive 6629>0 ubyte 0x85 Linux extended partition 6630>0 ubyte 0x86 NT FAT volume set 6631>0 ubyte 0x87 NTFS volume set or HPFS mirrored 6632>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 6633>0 ubyte 0x8b Legacy Fault tolerant FAT32 6634>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 6635>0 ubyte 0x8d Hidden free FDISK FAT12 6636>0 ubyte 0x8e Linux Logical Volume Manager 6637>0 ubyte 0x90 Hidden free FDISK FAT16 6638>0 ubyte 0x91 Hidden free FDISK DOS EXT 6639>0 ubyte 0x92 Hidden free FDISK FAT16 Big 6640>0 ubyte 0x93 Amoeba filesystem 6641>0 ubyte 0x94 Amoeba bad block table 6642>0 ubyte 0x95 MIT EXOPC native partitions 6643>0 ubyte 0x97 Hidden free FDISK FAT32 6644>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 6645>0 ubyte 0x99 Mylex EISA SCSI 6646>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 6647>0 ubyte 0x9b Hidden free FDISK EXT LBA 6648>0 ubyte 0x9f BSDI? 6649>0 ubyte 0xa0 IBM Thinkpad hibernation 6650>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 6651>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 6652>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 6653>0 ubyte 0xa5 386BSD partition type 6654>0 ubyte 0xa6 OpenBSD partition type 6655>0 ubyte 0xa7 NeXTSTEP 486 6656>0 ubyte 0xa8 Apple UFS 6657>0 ubyte 0xa9 NetBSD partition type 6658>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 6659>0 ubyte 0xab Apple Boot 6660>0 ubyte 0xae SHAG OS filesystem 6661>0 ubyte 0xaf Apple HFS 6662>0 ubyte 0xb0 BootStar Dummy 6663>0 ubyte 0xb1 reserved 6664>0 ubyte 0xb3 reserved 6665>0 ubyte 0xb4 reserved 6666>0 ubyte 0xb6 reserved 6667>0 ubyte 0xb7 BSDI BSD/386 filesystem 6668>0 ubyte 0xb8 BSDI BSD/386 swap 6669>0 ubyte 0xbb Boot Wizard Hidden 6670>0 ubyte 0xbe Solaris 8 partition type 6671>0 ubyte 0xbf Solaris partition type 6672>0 ubyte 0xc0 CTOS 6673>0 ubyte 0xc1 DRDOS/sec (FAT-12) 6674>0 ubyte 0xc2 Hidden Linux 6675>0 ubyte 0xc3 Hidden Linux swap 6676>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 6677>0 ubyte 0xc5 DRDOS/sec (EXT) 6678>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 6679>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 6680>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 6681>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 6682>0 ubyte 0xca Reserved for DR-DOS 8.0+ 6683>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 6684>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 6685>0 ubyte 0xcd CTOS Memdump 6686>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 6687>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 6688>0 ubyte 0xd0 REAL/32 secure big partition 6689>0 ubyte 0xd1 Old Multiuser DOS FAT12 6690>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 6691>0 ubyte 0xd5 Old Multiuser DOS Extended 6692>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 6693>0 ubyte 0xd8 CP/M 86 6694>0 ubyte 0xdb CP/M or Concurrent CP/M 6695>0 ubyte 0xdd Hidden CTOS Memdump 6696>0 ubyte 0xde Dell PowerEdge Server utilities 6697>0 ubyte 0xdf DG/UX virtual disk manager 6698>0 ubyte 0xe0 STMicroelectronics ST AVFS 6699>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 6700>0 ubyte 0xe3 DOS R/O or Storage Dimensions 6701>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 6702>0 ubyte 0xe5 reserved 6703>0 ubyte 0xe6 reserved 6704>0 ubyte 0xeb BeOS 6705>0 ubyte 0xee GPT Protective MBR 6706>0 ubyte 0xef EFI system partition 6707>0 ubyte 0xf0 Linux PA-RISC boot loader 6708>0 ubyte 0xf1 SpeedStor or Storage Dimensions 6709>0 ubyte 0xf2 DOS 3.3+ Secondary 6710>0 ubyte 0xf3 reserved 6711>0 ubyte 0xf4 SpeedStor large partition 6712>0 ubyte 0xf5 Prologue multi-volumen partition 6713>0 ubyte 0xf6 reserved 6714>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 6715>0 ubyte 0xfa Bochs x86 emulator 6716>0 ubyte 0xfb VMware File System 6717>0 ubyte 0xfc VMware Swap 6718>0 ubyte 0xfd Linux RAID partition persistent sb 6719>0 ubyte 0xfe LANstep or IBM PS/2 IML 6720>0 ubyte 0xff Xenix Bad Block Table 6721 67220 string \366\366\366\366 PC formatted floppy with no filesystem 6723# Sun disk labels 6724# From /usr/include/sun/dklabel.h: 67250774 beshort 0xdabe 6726# modified by Joerg Jenderek, because original test 6727# succeeds for Cabinet archive dao360.dl_ with negative blocks 6728>0770 long >0 Sun disk label 6729>>0 string x '%s 6730>>>31 string >\0 \b%s 6731>>>>63 string >\0 \b%s 6732>>>>>95 string >\0 \b%s 6733>>0 string x \b' 6734>>0734 short >0 %d rpm, 6735>>0736 short >0 %d phys cys, 6736>>0740 short >0 %d alts/cyl, 6737>>0746 short >0 %d interleave, 6738>>0750 short >0 %d data cyls, 6739>>0752 short >0 %d alt cyls, 6740>>0754 short >0 %d heads/partition, 6741>>0756 short >0 %d sectors/track, 6742>>0764 long >0 start cyl %d, 6743>>0770 long x %d blocks 6744# Is there a boot block written 1 sector in? 6745>512 belong&077777777 0600407 \b, boot block present 6746 6747# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 6748# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 67490 string SBMBAKUP_ Smart Boot Manager backup file 6750>9 string x \b, version %-5.5s 6751>>14 string =_ 6752>>>15 string x %-.1s 6753>>>>16 string =_ \b. 6754>>>>>17 string x \b%-.1s 6755>>>>>>18 string =_ \b. 6756>>>>>>>19 string x \b%-.1s 6757>>>22 ubyte 0 6758>>>>21 ubyte x \b, from drive 0x%x 6759>>>22 ubyte >0 6760>>>>21 string x \b, from drive %s 6761>>>535 search/17 \x55\xAA 6762>>>>&-512 indirect x \b; contains 6763 6764# updated by Joerg Jenderek at Nov 2012 6765# DOS Emulator image is 128 byte, null right padded header + harddisc image 67660 string DOSEMU\0 6767>0x27E leshort 0xAA55 6768#offset is 128 6769>>19 ubyte 128 6770>>>(19.b-1) ubyte 0x0 DOS Emulator image 6771>>>>7 ulelong >0 \b, %u heads 6772>>>>11 ulelong >0 \b, %d sectors/track 6773>>>>15 ulelong >0 \b, %d cylinders 6774>>>>128 indirect x \b; contains 6775 6776# added by Joerg Jenderek at Nov 2012 6777# http://www.thenakedpc.com/articles/v04/08/0408-05.html 6778# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 67790 string PNCIHISK\0 Norton Utilities disc image data 6780# real x86 boot sector with jump instruction 6781>509 search/1026 \x55\xAA\xeb 6782>>&-1 indirect x \b; contains 6783# http://file-extension.net/seeker/file_extension_dat 67840 string PNCIUNDO Norton Disk Doctor UnDo file 6785# 6786 6787# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 6788# for any allowed sector sizes 678930 search/481 \x55\xAA 6790# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 6791# DOS BPB information (70) and after DOS floppy (120) like in previous file version 6792!:strength +65 6793# for sector sizes < 512 Bytes 6794>11 uleshort <512 6795>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 6796# for sector sizes with 512 or more Bytes 6797>0x1FE leshort 0xAA55 DOS/MBR boot sector 6798 6799# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 6800# only for sector sizes with 512 or more Bytes 68010x1FE leshort 0xAA55 DOS/MBR boot sector 6802# 6803# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 6804!:strength +65 6805>2 string OSBS OS/BS MBR 6806# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ 6807# and http://en.wikipedia.org/wiki/Master_Boot_Record 6808# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 6809# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 6810>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 6811# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 6812# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 6813>>8 ubequad 0x8bf45007501ffbfc 6814# http://thestarman.pcministry.com/asm/mbr/200MBR.htm 6815>>>0x16 ubyte 0xF3 \b,DOS 2 6816>>>>219 regex Author\ -\ Author: 6817# found "David Litton" , "A Pehrsson " 6818>>>>>&0 string x "%s" 6819>>>0x16 ubyte 0xF2 6820# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 6821# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 6822>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 6823# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 6824>>>>0x22 default x \b,D0S version 3.3-7.0 6825# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 6826# where nn is string offset varying for different languages 6827# "Invalid partition table" nn=0x8b for english version 6828>>>>>(0x49.b) string Invalid\ partition\ table english 6829>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 6830>>>>>(0x49.b) string Table\ de\ partition\ invalide french 6831>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 6832>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 6833>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 6834>>>>>0x49 ubyte >0 at offset 0x%x 6835>>>>>>(0x49.b) string >\0 "%s" 6836# "Error loading operating system" nn=0xa3 for english version 6837# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 6838# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 6839# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 6840# "Error al cargar sistema operativo" nn=0xa8 for spanish version 6841# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 6842>>>>>0x74 ubyte >0 at offset 0x%x 6843>>>>>>(0x74.b) string >\0 "%s" 6844# "Missing operating system" nn=0xc2 for english version 6845# "Betriebssystem fehlt" nn=0xcd for german version 6846# "Syst\212me d'exploitation absent" nn=0xd2 for french version 6847# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 6848# "Falta sistema operativo" nn=0xca for spanish version 6849# "Sistema operativo mancante" nn=0xe2 for italian version 6850>>>>>0x79 ubyte >0 at offset 0x%x 6851>>>>>>(0x79.b) string >\0 "%s" 6852# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 6853# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 6854>>8 ubequad 0x5007501ffcbe1b7c 6855# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 6856>>>24 ubequad 0xf3a4cbbebe07b104 9M 6857# "Invalid partition table" nn=0x10F for english version 6858# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 6859# "Table de partition erron\202e" nn=0x10F for french version 6860# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 6861>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 6862>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 6863>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 6864>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 6865>>>>0x3C ubyte x at offset 0x%x+0xFF 6866>>>>(0x3C.b+0x0FF) string >\0 "%s" 6867# "Error loading operating system" nn=0x127 for english version 6868# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 6869# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 6870# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 6871>>>>0xBD ubyte x at offset 0x1%x 6872>>>>(0xBD.b+0x100) string >\0 "%s" 6873# "Missing operating system" nn=0x146 for english version 6874# "Betriebssystem fehlt" nn=0x151 for german version 6875# "Syst\212me d'exploitation manquant" nn=0x15e for french version 6876# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 6877>>>>0xA9 ubyte x at offset 0x1%x 6878>>>>(0xA9.b+0x100) string >\0 "%s" 6879# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 6880# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 6881>>>24 ubequad 0xf3a4cbbdbe07b104 XP 6882# where xxyyzz are lower bits from offsets of error messages varying for different languages 6883>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 6884>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 6885# "Invalid partition table" xx=0x12C for english version 6886# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 6887>>>>0x1b5 ubyte >0 at offset 0x1%x 6888>>>>(0x1b5.b+0x100) string >\0 "%s" 6889# "Error loading operating system" yy=0x144 for english version 6890# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 6891>>>>0x1b6 ubyte >0 at offset 0x1%x 6892>>>>(0x1b6.b+0x100) string >\0 "%s" 6893# "Missing operating system" zz=0x163 for english version 6894# "Betriebssystem nicht vorhanden" zz=0x16e for german version 6895>>>>0x1b7 ubyte >0 at offset 0x1%x 6896>>>>(0x1b7.b+0x100) string >\0 "%s" 6897# Microsoft Windows Vista or 7 6898# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 6899>>8 ubequad 0xc08ed8be007cbf00 6900# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 6901# assembler instructions: jnz 0729;cmp ebx,"TCPA" 6902>>>0xEC ubequad 0x753b6681fb544350 Vista 6903# where xxyyzz are lower bits from offsets of error messages varying for different languages 6904>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 6905#>>>>0x1B4 ubelong&0x00FFFFFF ? german 6906# "Invalid partition table" xx=0x162 for english version 6907# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 6908>>>>0x1b5 ubyte >0 at offset 0x1%x 6909>>>>(0x1b5.b+0x100) string >\0 "%s" 6910# "Error loading operating system" yy=0x17a for english version 6911# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 6912>>>>0x1b6 ubyte >0 at offset 0x1%x 6913>>>>(0x1b6.b+0x100) string >\0 "%s" 6914# "Missing operating system" zz=0x199 for english version 6915# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 6916>>>>0x1b7 ubyte >0 at offset 0x1%x 6917>>>>(0x1b7.b+0x100) string >\0 "%s" 6918# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 6919# assembler instructions: cmp ebx,"TCPA";cmp 6920>>>0xEC ubequad 0x6681fb5443504175 Windows 7 6921# where xxyyzz are lower bits from offsets of error messages varying for different languages 6922>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 6923#>>>>0x1B4 ubelong&0x00FFFFFF ? german 6924# "Invalid partition table" xx=0x163 for english version 6925# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 6926>>>>0x1b5 ubyte >0 at offset 0x1%x 6927>>>>(0x1b5.b+0x100) string >\0 "%s" 6928# "Error loading operating system" yy=0x17b for english version 6929# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 6930>>>>0x1b6 ubyte >0 at offset 0x1%x 6931>>>>(0x1b6.b+0x100) string >\0 "%s" 6932# "Missing operating system" zz=0x19a for english version 6933# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 6934>>>>0x1b7 ubyte >0 at offset 0x1%x 6935>>>>(0x1b7.b+0x100) string >\0 "%s" 6936# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 6937# http://en.wikipedia.org/wiki/MBR_disk_signature#ID 6938>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 6939# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm 6940>>0xDA uleshort 0 6941>>>0xDC ulelong >0 \b, created 6942# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 6943>>>>0xDC ubyte x with driveID 0x%x 6944# hours, minutes and seconds 6945>>>>0xDf ubyte x at %x 6946>>>>0xDe ubyte x \b:%x 6947>>>>0xDd ubyte x \b:%x 6948# special case for Microsoft MS-DOS 3.21 spanish 6949# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 6950>0 ubequad 0xfab830008ed0bc00 6951# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 6952>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 6953# Microsoft MBR IPL end 6954 6955# dr-dos with some upper-, lowercase variants 6956>0x9D string Invalid\ partition\ table$ 6957>>181 string No\ Operating\ System$ 6958>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 6959>0x9D string Invalid\ partition\ table$ 6960>>181 string No\ operating\ system$ 6961>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 6962>342 string Invalid\ partition\ table$ 6963>>366 string No\ operating\ system$ 6964>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 6965>295 string NEWLDR\0 6966>>302 string Bad\ PT\ $ 6967>>>310 string No\ OS\ $ 6968>>>>317 string OS\ load\ err$ 6969>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 6970>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 6971>>>>>>>387 string Copyright\ (c)\ 1984,1998 6972>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 6973# 6974# tests for different MS-DOS Master Boot Records (MBR) moved and merged 6975# 6976#>0x145 string Default:\ F \b, FREE-DOS MBR 6977#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 6978>0x145 search/7 Default:\ F \b, FREE-DOS MBR 6979#>>313 string F0\ .\ .\ . 6980#>>>322 string disk\ 1 6981#>>>>382 string FAT3 6982>64 string no\ active\ partition\ found 6983>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 6984# Ranish Partition Manager http://www.ranish.com/part/ 6985>387 search/4 \0\ Error!\r 6986>>378 search/7 Virus! 6987>>>397 search/4 Booting\ 6988>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 6989>>>>>416 string Writing\ changes... \b2.37 6990>>>>>>438 ubyte x \b,0x%x dots 6991>>>>>>440 ubyte >0 \b,virus check 6992>>>>>>441 ubyte >0 \b,partition %c 6993#2.38,2.42,2.44 6994>>>>>416 string !Writing\ changes... \b 6995>>>>>>418 ubyte 1 \bvirus check, 6996>>>>>>419 ubyte x \b0x%x seconds 6997>>>>>>420 ubyte&0x0F >0 \b,partition 6998>>>>>>>420 ubyte&0x0F <5 \b %x 6999>>>>>>>420 ubyte&0x0F 0Xf \b ask 7000>>>>>420 ubyte x \b) 7001# 7002# SYSLINUX MBR moved 7003# http://www.acronis.de/ 7004>362 string MBR\ Error\ \0\r 7005>>376 string ress\ any\ key\ to\ 7006>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 7007# added by Joerg Jenderek 7008# http://www.visopsys.org/ 7009# http://partitionlogic.org.uk/ 7010>309 string No\ bootable\ partition\ found\r 7011>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 7012>349 string No\ bootable\ partition\ found\r 7013>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 7014# bootloader, bootmanager 7015>0x40 string SBML 7016# label with 11 characters of FAT 12 bit filesystem 7017>>43 string SMART\ BTMGR 7018>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 7019# OEM-ID not always "SBM" 7020#>>>>3 strings SBM 7021>>>>6 string >\0 \b, version %s 7022>382 string XOSLLOADXCF \b, eXtended Operating System Loader 7023>6 string LILO \b, LInux i386 boot LOader 7024>>120 string LILO \b, version 22.3.4 SuSe 7025>>172 string LILO \b, version 22.5.8 Debian 7026# updated by Joerg Jenderek at Oct 2008 7027# variables according to grub-0.97/stage1/stage1.S or 7028# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 7029# usual values are marked with comments to get only informations of strange GRUB loaders 7030>342 search/60 \0Geom\0 7031#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 7032>>0x41 ubyte <2 7033>>>0x3E ubyte >2 \b; GRand Unified Bootloader 7034# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 7035>>>>0x3E ubyte x \b, stage1 version 0x%x 7036#If it is 0xFF, use a drive passed by BIOS 7037>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 7038# in most case 0,1,0x2e for GRUB 0.5.95 7039>>>>0x41 ubyte >0 \b, LBA flag 0x%x 7040>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 7041#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 7042>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 7043#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 7044>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 7045>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 7046#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 7047>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 7048>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 7049>>>>>394 string stage1 \b, GRUB version 0.5.95 7050>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 7051>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 7052>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 7053>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 7054>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 7055>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 7056>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 7057>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 7058# unknown version 7059>>>343 string Geom\0Read\0\ Error\0 7060>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 7061>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 7062>>>>374 string GRUB\ \0 \b, GRUB version n.m 7063# SYSLINUX bootloader moved 7064>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 7065# http://www.bcdwb.de/bcdw/index_e.htm 7066>3 string BCDL 7067>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 7068# mbr partition table entries updated by Joerg Jenderek at Sep 2013 7069# skip Norton Utilities disc image data 7070>3 string !IHISK 7071# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; 7072>>0 belong !0xb8c0078e 7073# not Linux kernel 7074>>>514 string !HdrS 7075# not BeOS 7076>>>>422 string !Be\ Boot\ Loader 7077>>>>>32769 string CD001 7078>>>>>>0 use cdrom 7079# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 7080>>>>>0 ubelong&0xFD000000 =0xE9000000 7081# AdvanceMAME mbr 7082>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 7083>>>>>>>446 use partition-table 7084# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 7085>>>>>0 ubelong&0xFD000000 !0xE9000000 7086# skip FSInfosector 7087>>>>>>0 string !RRaA 7088# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 7089# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 7090>>>>>>>0 ubequad !0xfa660fb64610668b 7091# skip 13rd sector of MS x86 bootloader 7092>>>>>>>>0 ubequad !0x660fb64610668b4e 7093# skip sector starting with DOS new line 7094>>>>>>>>>0 string !\r\n 7095# allowed active flag 0,80h-FFh 7096>>>>>>>>>>446 ubyte 0 7097>>>>>>>>>>>446 use partition-table 7098>>>>>>>>>>446 ubyte >0x7F 7099>>>>>>>>>>>446 use partition-table 7100# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 7101# mbr partition table entries end 7102# http://www.acronis.de/ 7103#FAT label=ACRONIS\ SZ 7104#OEM-ID=BOOTWIZ0 7105>442 string Non-system\ disk,\ 7106>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 7107# updated by Joerg Jenderek at Nov 2012, Sep 2013 7108# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 7109# display 1 space 7110>>>447 ubyte x \b 7111>>>477 use DOS-filename 7112# 7113>185 string FDBOOT\ Version\ 7114>>204 string \rNo\ Systemdisk.\ 7115>>>220 string Booting\ from\ harddisk.\n\r 7116>>>245 string Cannot\ load\ from\ harddisk.\n\r 7117>>>>273 string Insert\ Systemdisk\ 7118>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 7119>>>>>>200 string >\0 \b, version %-3s 7120>242 string Bootsector\ from\ C.H.\ Hochst\204 7121# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 7122# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 7123# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 7124>242 search/127 Bootsector\ from\ C.H.\ Hochst 7125>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 7126# followed by variants with point,CR-NL or NL-CR 7127>>>208 search/261 Cannot\ load\ from\ harddisk. 7128# followed by variants CR-NL or NL-CR 7129>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 7130# followed by variants with point,CR-NL or NL-CR 7131>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 7132# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 7133>>>>>>&0 string x \b, version %-4.4s 7134>(1.b+2) ubyte 0xe 7135>>(1.b+3) ubyte 0x1f 7136>>>(1.b+4) ubyte 0xbe 7137# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 7138>>>>(1.b+5) ubyte&0xd3 0x53 7139>>>>>(1.b+6) ubyte 0x7c 7140# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 7141>>>>>>(1.b+7) ubyte 0xac 7142>>>>>>>(1.b+8) ubyte 0x22 7143>>>>>>>>(1.b+9) ubyte 0xc0 7144>>>>>>>>>(1.b+10) ubyte 0x74 7145>>>>>>>>>>(1.b+11) ubyte 0x0b 7146>>>>>>>>>>>(1.b+12) ubyte 0x56 7147>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 7148# FAT1X version 7149>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 7150>>>>>>>>>>>>>>0x5b string >\0 "%-s" 7151# FAT32 version 7152>>>>>>>>>>>>>(1.b+5) ubyte 0x77 7153>>>>>>>>>>>>>>0x77 string >\0 "%-s" 7154>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 7155#>>244 string from\ dosemu-freedos-*-bin.tgz\r 7156#>>>170 string Sorry,\ could\ not\ load\ an\ 7157#>>>>195 string operating\ system.\r\n 7158# 7159>103 string This\ is\ not\ a\ bootable\ disk.\ 7160>>132 string Please\ insert\ a\ bootable\ 7161>>>157 string floppy\ and\r\n 7162>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 7163# 7164>66 string Solaris\ Boot\ Sector 7165>>99 string Incomplete\ MDBoot\ load. 7166>>>89 string Version \b, Sun Solaris Bootloader 7167>>>>97 byte x version %c 7168# 7169>408 string OS/2\ !!\ SYS01475\r\0 7170>>429 string OS/2\ !!\ SYS02025\r\0 7171>>>450 string OS/2\ !!\ SYS02027\r\0 7172>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 7173# 7174>409 string OS/2\ !!\ SYS01475\r\0 7175>>430 string OS/2\ !!\ SYS02025\r\0 7176>>>451 string OS/2\ !!\ SYS02027\r\0 7177>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 7178>112 string This\ disk\ is\ not\ bootable\r 7179>>142 string If\ you\ wish\ to\ make\ it\ bootable 7180>>>176 string run\ the\ DOS\ program\ SYS\ 7181>>>200 string after\ the\r 7182>>>>216 string system\ has\ been\ loaded\r\n 7183>>>>>242 string Please\ insert\ a\ DOS\ diskette\ 7184>>>>>271 string into\r\n\ the\ drive\ and\ 7185>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 7186# XP 7187>430 string NTLDR\ is\ missing\xFF\r\n 7188>>449 string Disk\ error\xFF\r\n 7189>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 7190# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 7191>>>>417 ubyte&0xDF >0 7192>>>>>417 string x %-.5s 7193>>>>>>422 ubyte&0xDF >0 7194>>>>>>>422 string x \b%-.3s 7195>>>>>425 ubyte&0xDF >0 7196>>>>>>425 string >\ \b.%-.3s 7197# 7198>>>>371 ubyte >0x20 7199>>>>>368 ubyte&0xDF >0 7200>>>>>>368 string x %-.5s 7201>>>>>>>373 ubyte&0xDF >0 7202>>>>>>>>373 string x \b%-.3s 7203>>>>>>376 ubyte&0xDF >0 7204>>>>>>>376 string x \b.%-.3s 7205# 7206>430 string NTLDR\ nicht\ gefunden\xFF\r\n 7207>>453 string Datentr\204gerfehler\xFF\r\n 7208>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 7209>>>>417 ubyte&0xDF >0 7210>>>>>417 string x %-.5s 7211>>>>>>422 ubyte&0xDF >0 7212>>>>>>>422 string x \b%-.3s 7213>>>>>425 ubyte&0xDF >0 7214>>>>>>425 string >\ \b.%-.3s 7215# offset variant 7216>>>>379 string \0 7217>>>>>368 ubyte&0xDF >0 7218>>>>>>368 string x %-.5s 7219>>>>>>>373 ubyte&0xDF >0 7220>>>>>>>>373 string x \b%-.3s 7221# 7222>430 string NTLDR\ fehlt\xFF\r\n 7223>>444 string Datentr\204gerfehler\xFF\r\n 7224>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 7225>>>>417 ubyte&0xDF >0 7226>>>>>417 string x %-.5s 7227>>>>>>422 ubyte&0xDF >0 7228>>>>>>>422 string x \b%-.3s 7229>>>>>425 ubyte&0xDF >0 7230>>>>>>425 string >\ \b.%-.3s 7231# variant 7232>>>>371 ubyte >0x20 7233>>>>>368 ubyte&0xDF >0 7234>>>>>>368 string x %-.5s 7235>>>>>>>373 ubyte&0xDF >0 7236>>>>>>>>373 string x \b%-.3s 7237>>>>>>376 ubyte&0xDF >0 7238>>>>>>>376 string x \b.%-.3s 7239# 7240>430 string NTLDR\ fehlt\xFF\r\n 7241>>444 string Medienfehler\xFF\r\n 7242>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 7243>>>>371 ubyte >0x20 7244>>>>>368 ubyte&0xDF >0 7245>>>>>>368 string x %-.5s 7246>>>>>>>373 ubyte&0xDF >0 7247>>>>>>>>373 string x \b%-.3s 7248>>>>>>376 ubyte&0xDF >0 7249>>>>>>>376 string x \b.%-.3s 7250# variant 7251>>>>417 ubyte&0xDF >0 7252>>>>>417 string x %-.5s 7253>>>>>>422 ubyte&0xDF >0 7254>>>>>>>422 string x \b%-.3s 7255>>>>>425 ubyte&0xDF >0 7256>>>>>>425 string >\ \b.%-.3s 7257# 7258>430 string Datentr\204ger\ entfernen\xFF\r\n 7259>>454 string Medienfehler\xFF\r\n 7260>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 7261>>>>379 string \0 7262>>>>>368 ubyte&0xDF >0 7263>>>>>>368 string x %-.5s 7264>>>>>>>373 ubyte&0xDF >0 7265>>>>>>>>373 string x \b%-.3s 7266>>>>>>376 ubyte&0xDF >0 7267>>>>>>>376 string x \b.%-.3s 7268# variant 7269>>>>417 ubyte&0xDF >0 7270>>>>>417 string x %-.5s 7271>>>>>>422 ubyte&0xDF >0 7272>>>>>>>422 string x \b%-.3s 7273>>>>>425 ubyte&0xDF >0 7274>>>>>>425 string >\ \b.%-.3s 7275# 7276 7277#>3 string NTFS\ \ \ \ 7278>389 string Fehler\ beim\ Lesen\ 7279>>407 string des\ Datentr\204gers 7280>>>426 string NTLDR\ fehlt 7281>>>>440 string NTLDR\ ist\ komprimiert 7282>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 7283#>3 string NTFS\ \ \ \ 7284>313 string A\ disk\ read\ error\ occurred.\r 7285>>345 string A\ kernel\ file\ is\ missing\ 7286>>>370 string from\ the\ disk.\r 7287>>>>484 string NTLDR\ is\ compressed 7288>>>>>429 string Insert\ a\ system\ diskette\ 7289>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 7290# DOS loader variants different languages,offsets 7291>472 ubyte&0xDF >0 7292>>389 string Invalid\ system\ disk\xFF\r\n 7293>>>411 string Disk\ I/O\ error 7294>>>>428 string Replace\ the\ disk,\ and\ 7295>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 7296#IO.SYS 7297>>>>>>472 ubyte&0xDF >0 7298>>>>>>>472 string x \b %-.2s 7299>>>>>>>>474 ubyte&0xDF >0 7300>>>>>>>>>474 string x \b%-.5s 7301>>>>>>>>>>479 ubyte&0xDF >0 7302>>>>>>>>>>>479 string x \b%-.1s 7303>>>>>>>480 ubyte&0xDF >0 7304>>>>>>>>480 string x \b.%-.3s 7305#MSDOS.SYS 7306>>>>>>>483 ubyte&0xDF >0 \b+ 7307>>>>>>>>483 string x \b%-.5s 7308>>>>>>>>>488 ubyte&0xDF >0 7309>>>>>>>>>>488 string x \b%-.3s 7310>>>>>>>>491 ubyte&0xDF >0 7311>>>>>>>>>491 string x \b.%-.3s 7312# 7313>>390 string Invalid\ system\ disk\xFF\r\n 7314>>>412 string Disk\ I/O\ error\xFF\r\n 7315>>>>429 string Replace\ the\ disk,\ and\ 7316>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 7317>>388 string Ungueltiges\ System\ \xFF\r\n 7318>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 7319>>>>427 string Datentraeger\ wechseln\ und\ 7320>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 7321#WINBOOT.SYS only not spaces (0xDF) 7322>>>>>>497 ubyte&0xDF >0 7323>>>>>>>497 string x %-.5s 7324>>>>>>>>502 ubyte&0xDF >0 7325>>>>>>>>>502 string x \b%-.1s 7326>>>>>>>>>>503 ubyte&0xDF >0 7327>>>>>>>>>>>503 string x \b%-.1s 7328>>>>>>>>>>>>504 ubyte&0xDF >0 7329>>>>>>>>>>>>>504 string x \b%-.1s 7330>>>>>>505 ubyte&0xDF >0 7331>>>>>>>505 string x \b.%-.3s 7332#IO.SYS 7333>>>>>>472 ubyte&0xDF >0 or 7334>>>>>>>472 string x \b %-.2s 7335>>>>>>>>474 ubyte&0xDF >0 7336>>>>>>>>>474 string x \b%-.5s 7337>>>>>>>>>>479 ubyte&0xDF >0 7338>>>>>>>>>>>479 string x \b%-.1s 7339>>>>>>>480 ubyte&0xDF >0 7340>>>>>>>>480 string x \b.%-.3s 7341#MSDOS.SYS 7342>>>>>>>483 ubyte&0xDF >0 \b+ 7343>>>>>>>>483 string x \b%-.5s 7344>>>>>>>>>488 ubyte&0xDF >0 7345>>>>>>>>>>488 string x \b%-.3s 7346>>>>>>>>491 ubyte&0xDF >0 7347>>>>>>>>>491 string x \b.%-.3s 7348# 7349>>390 string Ungueltiges\ System\ \xFF\r\n 7350>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 7351>>>>429 string Datentraeger\ wechseln\ und\ 7352>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 7353#WINBOOT.SYS only not spaces (0xDF) 7354>>>>>>497 ubyte&0xDF >0 7355>>>>>>>497 string x %-.7s 7356>>>>>>>>504 ubyte&0xDF >0 7357>>>>>>>>>504 string x \b%-.1s 7358>>>>>>505 ubyte&0xDF >0 7359>>>>>>>505 string x \b.%-.3s 7360#IO.SYS 7361>>>>>>472 ubyte&0xDF >0 or 7362>>>>>>>472 string x \b %-.2s 7363>>>>>>>>474 ubyte&0xDF >0 7364>>>>>>>>>474 string x \b%-.6s 7365>>>>>>>480 ubyte&0xDF >0 7366>>>>>>>>480 string x \b.%-.3s 7367#MSDOS.SYS 7368>>>>>>>483 ubyte&0xDF >0 \b+ 7369>>>>>>>>483 string x \b%-.5s 7370>>>>>>>>>488 ubyte&0xDF >0 7371>>>>>>>>>>488 string x \b%-.3s 7372>>>>>>>>491 ubyte&0xDF >0 7373>>>>>>>>>491 string x \b.%-.3s 7374# 7375>>389 string Ungueltiges\ System\ \xFF\r\n 7376>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 7377>>>>428 string Datentraeger\ wechseln\ und\ 7378>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 7379# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 7380>>>>>>472 string x %-.2s 7381>>>>>>>474 ubyte&0xDF >0 7382>>>>>>>>474 string x \b%-.5s 7383>>>>>>>>479 ubyte&0xDF >0 7384>>>>>>>>>479 string x \b%-.1s 7385>>>>>>480 ubyte&0xDF >0 7386>>>>>>>480 string x \b.%-.3s 7387>>>>>>483 ubyte&0xDF >0 \b+ 7388>>>>>>>483 string x \b%-.5s 7389>>>>>>>488 ubyte&0xDF >0 7390>>>>>>>>488 string x \b%-.2s 7391>>>>>>>>490 ubyte&0xDF >0 7392>>>>>>>>>490 string x \b%-.1s 7393>>>>>>>491 ubyte&0xDF >0 7394>>>>>>>>491 string x \b.%-.3s 7395>479 ubyte&0xDF >0 7396>>416 string Kein\ System\ oder\ 7397>>>433 string Laufwerksfehler 7398>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 7399#IO.SYS 7400>>>>>479 string x \b %-.2s 7401>>>>>>481 ubyte&0xDF >0 7402>>>>>>>481 string x \b%-.6s 7403>>>>>487 ubyte&0xDF >0 7404>>>>>>487 string x \b.%-.3s 7405#MSDOS.SYS 7406>>>>>>490 ubyte&0xDF >0 \b+ 7407>>>>>>>490 string x \b%-.5s 7408>>>>>>>>495 ubyte&0xDF >0 7409>>>>>>>>>495 string x \b%-.3s 7410>>>>>>>498 ubyte&0xDF >0 7411>>>>>>>>498 string x \b.%-.3s 7412# 7413>376 search/41 Non-System\ disk\ or\ 7414>>395 search/41 disk\ error\r 7415>>>407 search/41 Replace\ and\ 7416>>>>419 search/41 press\ \b, 7417>>>>419 search/41 strike\ \b, old 7418>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 7419#449 Disk\ Boot\ failure\r MS 3.21 7420#466 Boot\ Failure\r MS 3.30 7421>>>>>468 search/18 \0 7422#IO.SYS,IBMBIO.COM 7423>>>>>>&0 string x \b %-.2s 7424>>>>>>>&-20 ubyte&0xDF >0 7425>>>>>>>>&-1 string x \b%-.4s 7426>>>>>>>>>&-16 ubyte&0xDF >0 7427>>>>>>>>>>&-1 string x \b%-.2s 7428>>>>>>&8 ubyte&0xDF >0 \b. 7429>>>>>>>&-1 string x \b%-.3s 7430#MSDOS.SYS,IBMDOS.COM 7431>>>>>>&11 ubyte&0xDF >0 \b+ 7432>>>>>>>&-1 string x \b%-.5s 7433>>>>>>>>&-6 ubyte&0xDF >0 7434>>>>>>>>>&-1 string x \b%-.1s 7435>>>>>>>>>>&-5 ubyte&0xDF >0 7436>>>>>>>>>>>&-1 string x \b%-.2s 7437>>>>>>>&7 ubyte&0xDF >0 \b. 7438>>>>>>>>&-1 string x \b%-.3s 7439>441 string Cannot\ load\ from\ harddisk.\n\r 7440>>469 string Insert\ Systemdisk\ 7441>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 7442#>43 string \224R-LOADER\ \ SYS =label 7443>54 string SYS 7444>>324 string VASKK 7445>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 7446# 7447>98 string Press\ a\ key\ to\ retry\0\r 7448>>120 string Cannot\ find\ file\ \0\r 7449>>>139 string Disk\ read\ error\0\r 7450>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 7451#DRBIOS.SYS 7452>>>>>44 ubyte&0xDF >0 7453>>>>>>44 string x \b %-.6s 7454>>>>>>>50 ubyte&0xDF >0 7455>>>>>>>>50 string x \b%-.2s 7456>>>>>>52 ubyte&0xDF >0 7457>>>>>>>52 string x \b.%-.3s 7458# 7459>70 string IBMBIO\ \ COM 7460>>472 string Cannot\ load\ DOS!\ 7461>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 7462>>471 string Cannot\ load\ DOS\ 7463>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 7464#?? 7465>444 string KERNEL\ \ SYS 7466>>314 string BOOT\ error! \b, FREE-DOS Bootloader 7467>499 string KERNEL\ \ SYS 7468>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 7469>449 string KERNEL\ \ SYS 7470>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 7471# 7472>449 string Loading\ FreeDOS 7473>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 7474>>>497 ubyte&0xDF >0 7475>>>>497 string x \b %-.6s 7476>>>>>503 ubyte&0xDF >0 7477>>>>>>503 string x \b%-.1s 7478>>>>>>>504 ubyte&0xDF >0 7479>>>>>>>>504 string x \b%-.1s 7480>>>>505 ubyte&0xDF >0 7481>>>>>505 string x \b.%-.3s 7482# 7483>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 7484# 7485>125 string Loading\ FreeDOS...\r 7486>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 7487>>>441 ubyte&0xDF >0 7488>>>>441 string x \b %-.6s 7489>>>>>447 ubyte&0xDF >0 7490>>>>>>447 string x \b%-.1s 7491>>>>>>>448 ubyte&0xDF >0 7492>>>>>>>>448 string x \b%-.1s 7493>>>>449 ubyte&0xDF >0 7494>>>>>449 string x \b.%-.3s 7495>124 string FreeDOS\0 7496>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 7497# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 7498>>>497 ubyte&0xDF >0 7499>>>>497 string x \b %-.6s 7500>>>>>503 ubyte&0xDF >0 7501>>>>>>503 string x \b%-.1s 7502>>>>>>>504 ubyte&0xDF >0 7503>>>>>>>>504 string x \b%-.1s 7504>>>>505 ubyte&0xDF >0 7505>>>>>505 string x \b.%-.3s 7506>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 7507>>>497 ubyte&0xDF >0 7508>>>>497 string x \b %-.6s 7509>>>>>503 ubyte&0xDF >0 7510>>>>>>503 string x \b%-.1s 7511>>>>>>>504 ubyte&0xDF >0 7512>>>>>>>>504 string x \b%-.1s 7513>>>>505 ubyte&0xDF >0 7514>>>>>505 string x \b.%-.3s 7515>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 7516>>>497 ubyte&0xDF >0 7517>>>>497 string x \b %-.6s 7518>>>>>503 ubyte&0xDF >0 7519>>>>>>503 string x \b%-.1s 7520>>>>>>>504 ubyte&0xDF >0 7521>>>>>>>>504 string x \b%-.1s 7522>>>>505 ubyte&0xDF >0 7523>>>>>505 string x \b.%-.3s 7524>336 string Error!\ 7525>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 7526>>>497 ubyte&0xDF >0 7527>>>>497 string x \b %-.6s 7528>>>>>503 ubyte&0xDF >0 7529>>>>>>503 string x \b%-.1s 7530>>>>>>>504 ubyte&0xDF >0 7531>>>>>>>>504 string x \b%-.1s 7532>>>>505 ubyte&0xDF >0 7533>>>>>505 string x \b.%-.3s 7534# added by Joerg Jenderek 7535# http://www.visopsys.org/ 7536# http://partitionlogic.org.uk/ 7537# OEM-ID=Visopsys 7538>478 ulelong 0 7539>>(1.b+326) string I/O\ Error\ reading\ 7540>>>(1.b+344) string Visopsys\ loader\r 7541>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 7542# http://alexfru.chat.ru/epm.html#bootprog 7543>494 ubyte >0x4D 7544>>495 string >E 7545>>>495 string <S 7546#OEM-ID is not reliable 7547>>>>3 string BootProg 7548# It just looks for a program file name at the root directory 7549# and loads corresponding file with following execution. 7550# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 7551>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 7552>>>>>499 use DOS-filename 7553#If the boot sector fails to read any other sector, 7554#it prints a very short message ("RE") to the screen and hangs the computer. 7555#If the boot sector fails to find needed program in the root directory, 7556#it also hangs with another message ("NF"). 7557>>>>>492 string RENF \b, FAT (12 bit) 7558>>>>>495 string RENF \b, FAT (16 bit) 7559#If the boot sector fails to read any other sector, 7560#it prints a very short message ("RE") to the screen and hangs the computer. 7561# x86 bootloader end 7562 7563# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 7564# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 7565>0 string RRaA 7566>>0x1E4 string rrAa \b, FSInfosector 7567#>>0x1FC uleshort =0 SHOULD BE ZERO 7568>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 7569>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 7570 7571# updated by Joerg Jenderek at Sep 2007 7572>3 ubyte 0 7573#no active flag 7574>>446 ubyte 0 7575# partition 1 not empty 7576>>>450 ubyte >0 7577# partitions 3,4 empty 7578>>>>482 ubyte 0 7579>>>>>498 ubyte 0 7580# partition 2 ID=0,5,15 7581>>>>>>466 ubyte <0x10 7582>>>>>>>466 ubyte 0x05 \b, extended partition table 7583>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 7584>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 7585 7586# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 7587 7588>0x200 lelong 0x82564557 \b, BSD disklabel 7589 7590# by Joerg Jenderek at Apr 2013 7591# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 7592# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 75930 name DOS-filename 7594# space=0x20 (00100000b) means empty 7595>0 ubyte&0xDF >0 7596>>0 ubyte x \b%c 7597>>>1 ubyte&0xDF >0 7598>>>>1 ubyte x \b%c 7599>>>>>2 ubyte&0xDF >0 7600>>>>>>2 ubyte x \b%c 7601>>>>>>>3 ubyte&0xDF >0 7602>>>>>>>>3 ubyte x \b%c 7603>>>>>>>>>4 ubyte&0xDF >0 7604>>>>>>>>>>4 ubyte x \b%c 7605>>>>>>>>>>>5 ubyte&0xDF >0 7606>>>>>>>>>>>>5 ubyte x \b%c 7607>>>>>>>>>>>>>6 ubyte&0xDF >0 7608>>>>>>>>>>>>>>6 ubyte x \b%c 7609>>>>>>>>>>>>>>>7 ubyte&0xDF >0 7610>>>>>>>>>>>>>>>>7 ubyte x \b%c 7611# DOS filename extension 7612>>8 ubyte&0xDF >0 \b. 7613>>>8 ubyte x \b%c 7614>>>>9 ubyte&0xDF >0 7615>>>>>9 ubyte x \b%c 7616>>>>>>10 ubyte&0xDF >0 7617>>>>>>>10 ubyte x \b%c 7618# Print 2 following DOS filenames from directory entry form 7619# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 76200 name 2xDOS-filename 7621# display 1 space 7622>0 ubyte x \b 7623>0 use DOS-filename 7624>11 ubyte x \b+ 7625>11 use DOS-filename 7626 7627# http://en.wikipedia.org/wiki/Master_boot_record#PTE 7628# display standard partition table 76290 name partition-table 7630#>0 ubyte x PARTITION-TABLE 7631# test and display 1st til 4th partition table entry 7632>0 use partition-entry-test 7633>16 use partition-entry-test 7634>32 use partition-entry-test 7635>48 use partition-entry-test 7636# test for entry of partition table 76370 name partition-entry-test 7638# partition type ID > 0 7639>4 ubyte >0 7640# active flag 0 7641>>0 ubyte 0 7642>>>0 use partition-entry 7643# active flag 0x80, 0x81, ... 7644>>0 ubyte >0x7F 7645>>>0 use partition-entry 7646# Print entry of partition table 76470 name partition-entry 7648# partition type ID > 0 7649>4 ubyte >0 \b; partition 7650>>64 leshort 0xAA55 1 7651>>48 leshort 0xAA55 2 7652>>32 leshort 0xAA55 3 7653>>16 leshort 0xAA55 4 7654>>4 ubyte x : ID=0x%x 7655>>0 ubyte&0x80 0x80 \b, active 7656>>0 ubyte >0x80 0x%x 7657>>1 ubyte x \b, start-CHS ( 7658>>1 use partition-chs 7659>>5 ubyte x \b), end-CHS ( 7660>>5 use partition-chs 7661>>8 ulelong x \b), startsector %u 7662>>12 ulelong x \b, %u sectors 7663# Print cylinder,head,sector (CHS) of partition entry 76640 name partition-chs 7665# cylinder 7666>1 ubyte x \b0x 7667>1 ubyte&0xC0 0x40 \b1 7668>1 ubyte&0xC0 0x80 \b2 7669>1 ubyte&0xC0 0xC0 \b3 7670>2 ubyte x \b%x 7671# head 7672>0 ubyte x \b,%u 7673# sector 7674>1 ubyte&0x3F x \b,%u 7675 7676# FATX 76770 string FATX FATX filesystem data 7678 7679# romfs filesystems - Juan Cespedes <cespedes@debian.org> 76800 string -rom1fs- romfs filesystem, version 1 7681>8 belong x %d bytes, 7682>16 string x named %s. 7683 7684# netboot image - Juan Cespedes <cespedes@debian.org> 76850 lelong 0x1b031336L Netboot image, 7686>4 lelong&0xFFFFFF00 0 7687>>4 lelong&0x100 0x000 mode 2 7688>>4 lelong&0x100 0x100 mode 3 7689>4 lelong&0xFFFFFF00 !0 unknown mode 7690 76910x18b string OS/2 OS/2 Boot Manager 7692 7693# updated by Joerg Jenderek at Oct 2008 and Sep 2012 7694# http://syslinux.zytor.com/iso.php 7695# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 7696# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 76970 ulequad&0x909000007cc0eafa 0x909000007c40eafa 7698>631 search/689 ISOLINUX\ isolinux Loader 7699>>&0 string x (version %-4.4s) 7700# http://syslinux.zytor.com/pxe.php 7701# assembler instructions: jmp 7C05 77020 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 7703# assembler instructions: pushfd;pushad 77040 ulelong 0x60669c66 pxelinux loader 7705# assembler instructions: jmp 05 77060 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 7707# http://syslinux.zytor.com/wiki/index.php/SYSLINUX 77080 string LDLINUX\ SYS\ SYSLINUX loader 7709>12 string x (older version %-4.4s) 77100 string \r\nSYSLINUX\ SYSLINUX loader 7711>11 string x (version %-4.4s) 7712# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 7713# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 77140 ulelong&0x80909bEB 0x009018EB 7715# OEM-ID not always "SYSLINUX" 7716>434 search/47 Boot\ failed 7717# followed by \r\n\0 or :\ 7718>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 7719>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 7720>459 search/30 Boot\ error\r\n\0 7721>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 7722# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 7723# assembler instructions: mov di,0600h;mov cx,0100h 772416 search/4 \xbf\x00\x06\xb9\x00\x01 7725# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 7726!:strength +36 7727>94 search/249 Missing\ operating\ system 7728# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 7729# skip Ranish MBR 7730>>408 search/4 HD1/\0 7731>>408 default x 7732>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 7733# followed by "ing " or space 7734>>>>292 search/98 error 7735>>>>>&0 string \r (version 3.35 or older) 7736>>>>>&0 string .\r (version 3.52 or newer) 7737>>>>>&0 default x (version 3.36-3.51 ) 7738>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 7739>>156 search/10 \0Boot\ partition\ not\ found\r\n 7740>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 7741>>174 search/10 \0Missing\ OS\r\n 7742>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 7743# SYSLINUX END 7744 7745# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 7746# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 77470 ubequad 0x31c08ed0bc007c8e 7748# mbr_bootsel magic before partition table not reliable with small ipl fragments 7749#>444 uleshort 0xb5e1 7750>0004 uleshort x 7751# ERRorTeXT 7752>>181 search/166 Error\ \0\r\n NetBSD mbr 7753# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 7754>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 7755# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 7756>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 7757# BOOT_EXTENDED definitions contains assembler instructions: 7758# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 7759>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 7760# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 7761>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 7762# not TERSE_ERROR 7763>>>196 search/106 No\ active\ partition\0 7764>>>>&0 string Disk\ read\ error\0 7765>>>>>&0 string No\ operating\ system\0 \b,verbose 7766# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 7767>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 7768# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 7769>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 7770# assembler instructions: movw nametab,bx 7771>>>0x26 search/21 \xBB\x94\x07 7772# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 7773>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 7774>>>>>181 search/166 Error\ \0 7775# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 7776>>>>>>&3 string x \b,"%s" 7777>>>446 use partition-table 7778# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 7779# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 7780# assembler instructions: jmp short 0x58;nop;ASCII 77810 ubequad&0xeb58908000000000 0xeb58900000000000 7782# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 7783>(1.b+2) ubequad 0xfa31c08ed88ec08e 7784# Error messages at end of code 7785>>376 string No\ operating\ system\r\n\0 7786>>>398 string Disk\ error\r\n\0FDD\0HDD\0 7787>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 7788 7789# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ 7790# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 7791# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 7792# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 77930 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 7794# pointer to the data starting with Neil Turton signature string 7795>(0x1BC.s) string NDTmbr 7796>>&-14 string 1234F\0 Turton mbr ( 7797# parameters also viewed by install-mbr --list 7798>>>(0x1BC.s+7) ubyte x \b%u<= 7799>>>(0x1BC.s+9) ubyte x \bVersion<=%u 7800#>>>(0x1BC.s+8) ubyte x asm_flag_%x 7801>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 7802# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode 7803>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 7804#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 7805#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 7806#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 7807#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 7808# for older versions 7809>>>(0x1BC.s+9) ubyte <2 7810#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 7811>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 7812# floppy A: or B: 7813>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 7814>>>>(0x1BC.s+13) ubyte >1 7815# 1st hard disc 7816#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 7817# not 1st hard disc 7818>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 7819# for version >= 2 maximal timeout can be 65534 7820>>>(0x1BC.s+9) ubyte >1 7821#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 7822>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 7823# floppy A: or B: 7824>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 7825>>>>(0x1BC.s+14) ubyte >1 7826# 1st hard disc 7827#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 7828# not 1st hard disc 7829>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 7830>>>0 ubyte x \b) 7831 7832# added by Joerg Jenderek 7833# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 7834# grub-1.94/kern/i386/pc/startup.S 7835# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 7836# usual values are marked with comments to get only informations of strange GRUB loaders 78370x200 uleshort 0x70EA 7838# found only version 3.{1,2} 7839>0x206 ubeshort >0x0300 7840# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 7841>>0x212 ubyte >0x29 7842>>>0x213 ubyte >0x29 7843# not iso9660_stage1_5 7844#>>>0 ulelong&0x00BE5652 0x00BE5652 7845>>>>0x213 ubyte >0x29 GRand Unified Bootloader 7846# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 7847>>>>0x217 ubyte 0xFF stage1_5 7848>>>>0x217 ubyte <0xFF stage2 7849>>>>0x206 ubyte x \b version %u 7850>>>>0x207 ubyte x \b.%u 7851# module_size for 1.94 7852>>>>0x208 ulelong <0xffffff \b, installed partition %u 7853#>>>>0x208 ulelong =0xffffff \b, %lu (default) 7854>>>>0x208 ulelong >0xffffff \b, installed partition %u 7855# GRUB 0.5.95 unofficial 7856>>>>0x20C ulelong&0x2E300000 0x2E300000 7857# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 7858>>>>>0x20C ubyte x \b, identifier 0x%x 7859#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 7860>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 7861# GRUB version as string 7862>>>>>0x20E string >\0 \b, GRUB version %-s 7863# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 7864>>>>>>0x215 ulong 0xffffffff 7865>>>>>>>0x219 string >\0 \b, configuration file %-s 7866>>>>>>0x215 ulong !0xffffffff 7867>>>>>>>0x215 string >\0 \b, configuration file %-s 7868# newer GRUB versions 7869>>>>0x20C ulelong&0x2E300000 !0x2E300000 7870##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 7871>>>>>0x20C ulelong >0 \b, saved entry %d 7872# for 1.94 contains kernel image size 7873# for 0.93,0.94,0.96,0.97 7874# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 7875>>>>>0x210 ubyte x \b, identifier 0x%x 7876# The flag for LBA forcing is in most cases 0 7877#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 7878>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 7879# GRUB version as string 7880>>>>>0x212 string >\0 \b, GRUB version %-s 7881# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 7882>>>>>0x217 ulong 0xffffffff 7883>>>>>>0x21b string >\0 \b, configuration file %-s 7884>>>>>0x217 ulong !0xffffffff 7885>>>>>>0x217 string >\0 \b, configuration file %-s 7886 7887# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 7888# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 7889# over BIOS parameter block (BPB) 7890# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 7891# older drives may use Near JuMP instruction E9 xx xx 7892# minimal short forward jump found 0x29 for bootloaders or 0x0 7893# maximal short forward jump is 0x7f 7894# OEM-ID is empty or contain readable bytes 78950 ulelong&0x804000E9 0x000000E9 7896!:strength +60 7897# mtools-3.9.8/msdos.h 7898# usual values are marked with comments to get only informations of strange FAT systems 7899# valid sectorsize must be a power of 2 from 32 to 32768 7900>11 uleshort&0x001f 0 7901>>11 uleshort <32769 7902>>>11 uleshort >31 7903>>>>21 ubyte&0xf0 0xF0 7904>>>>>0 ubyte 0xEB DOS/MBR boot sector 7905>>>>>>1 ubyte x \b, code offset 0x%x+2 7906>>>>>0 ubyte 0xE9 7907>>>>>>1 uleshort x \b, code offset 0x%x+3 7908>>>>>3 string >\0 \b, OEM-ID "%-.8s" 7909#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 7910>>>>>>8 string IHC \b cached by Windows 9M 7911>>>>>11 uleshort >512 \b, Bytes/sector %u 7912#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 7913>>>>>11 uleshort <512 \b, Bytes/sector %u 7914>>>>>13 ubyte >1 \b, sectors/cluster %u 7915#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 7916# for lazy FAT32 implementation like Transcend digital photo frame PF830 7917>>>>>82 string/c fat32 7918>>>>>>14 uleshort !32 \b, reserved sectors %u 7919#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 7920>>>>>82 string/c !fat32 7921>>>>>>14 uleshort >1 \b, reserved sectors %u 7922#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 7923#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 7924>>>>>16 ubyte >2 \b, FATs %u 7925#>>>>>16 ubyte =2 \b, FATs %u (usual) 7926>>>>>16 ubyte =1 \b, FAT %u 7927>>>>>16 ubyte >0 7928>>>>>17 uleshort >0 \b, root entries %u 7929#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 7930>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 7931#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 7932>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 7933#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 7934>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 7935>>>>>22 uleshort >0 \b, sectors/FAT %u 7936#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 7937>>>>>24 uleshort x \b, sectors/track %u 7938>>>>>26 ubyte >2 \b, heads %u 7939#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 7940>>>>>26 ubyte =1 \b, heads %u 7941# valid only for sector sizes with more then 32 Bytes 7942>>>>>11 uleshort >32 7943# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 7944# skip for values 2,2Ah,70h,73h,DFh 7945# and continue for extended boot signature values 0,28h,29h,80h 7946>>>>>>38 ubyte&0x56 =0 7947>>>>>>>28 ulelong >0 \b, hidden sectors %u 7948#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 7949>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 7950#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 7951# FAT<32 bit specific 7952>>>>>>>82 string/c !fat32 7953#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 7954#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 7955>>>>>>>>36 ubyte !0x80 7956>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 7957# VGA-copy CRC or 7958# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 7959>>>>>>>>37 ubyte >0 \b, reserved 0x%x 7960#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 7961# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others 7962>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 7963>>>>>>>>38 ubyte&0xFE =0x28 7964>>>>>>>>>39 ulelong x \b, serial number 0x%x 7965>>>>>>>>38 ubyte =0x29 7966>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 7967>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 7968>>>>>>>>>43 string =NO\ NAME \b, unlabeled 7969# there exist some old floppies without word FAT at offset 54 7970# a word like "FATnm " is only a hint for a FAT size on nm-bits 7971# Normally the number of clusters is calculated by the values of BPP. 7972# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 7973# otherwise FAT is 16 bit. 7974# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 7975>>>>>82 string/c !fat32 7976>>>>>>54 string FAT12 \b, FAT (12 bit) 7977>>>>>>54 string FAT16 \b, FAT (16 bit) 7978>>>>>>54 default x 7979# determinate FAT bit size by media descriptor 7980# small floppies implies FAT12 7981>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 7982# with media descriptor F0h floppy or maybe superfloppy with FAT16 7983>>>>>>>21 ubyte =0xF0 7984# superfloppy (many sectors) implies FAT16 7985>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 7986# no superfloppy with media descriptor F0h implies FAT12 7987>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 7988# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 7989>>>>>>>21 ubyte =0xF8 7990# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 7991>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 7992# hard disc with FAT12 or FAT16 7993>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 7994# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 7995>>>>>>>21 ubyte =0xFA 7996# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 7997>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 7998# RAM disc with FAT12 or FAT16 or Tandy hard disc 7999>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 8000# others are floppy 8001>>>>>>>21 default x \b, FAT (12 bit by descriptor) 8002# FAT32 bit specific 8003>>>>>82 string/c fat32 \b, FAT (32 bit) 8004>>>>>>36 ulelong x \b, sectors/FAT %u 8005# http://technet.microsoft.com/en-us/library/cc977221.aspx 8006>>>>>>40 uleshort >0 \b, extension flags 0x%x 8007#>>>>>>40 uleshort =0 \b, extension flags %hu 8008>>>>>>42 uleshort >0 \b, fsVersion %u 8009#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 8010>>>>>>44 ulelong >2 \b, rootdir cluster %u 8011#>>>>>>44 ulelong =2 \b, rootdir cluster %u 8012#>>>>>>44 ulelong =1 \b, rootdir cluster %u 8013>>>>>>48 uleshort >1 \b, infoSector %u 8014#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 8015>>>>>>48 uleshort <1 \b, infoSector %u 8016# 0 or 0xFFFF instead of usual 6 means no backup sector 8017>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 8018>>>>>>50 uleshort =0 \b, no Backup boot sector 8019#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 8020>>>>>>50 default x 8021>>>>>>>50 uleshort x \b, Backup boot sector %u 8022# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 8023>>>>>>52 ulelong >0 \b, reserved1 0x%x 8024>>>>>>56 ulelong >0 \b, reserved2 0x%x 8025>>>>>>60 ulelong >0 \b, reserved3 0x%x 8026# same structure as FAT1X 8027#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 8028#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 8029>>>>>>64 ubyte !0x80 8030>>>>>>>64 ubyte >0 \b, physical drive 0x%x 8031# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 8032>>>>>>65 ubyte >0 \b, reserved 0x%x 8033>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 8034>>>>>>66 ubyte =0x29 8035>>>>>>>67 ulelong x \b, serial number 0x%x 8036>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 8037>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 8038>>>>>>>71 string =NO\ NAME \b, unlabeled 8039# additional tests for floppy image added by Joerg Jenderek 8040# no fixed disk 8041>>>>>21 ubyte !0xF8 8042# floppy media with 12 bit FAT 8043>>>>>>54 string !FAT16 8044# test for FAT after bootsector 8045>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 8046# floppy image 8047!:mime application/x-ima 8048# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 8049# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 8050# 0 FATs 8051>>>>>16 ubyte =0 8052# 0 root entries 8053>>>>>>17 uleshort =0 8054# 0 DOS sectors 8055>>>>>>>19 uleshort =0 8056# 0 sectors/FAT 8057# dos < 4.0 BootSector value found is 0x80 8058#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 8059>>>>>>>>22 uleshort =0 \b; NTFS 8060>>>>>>>>>24 uleshort >0 \b, sectors/track %u 8061>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 8062>>>>>>>>>40 ulequad >0 \b, sectors %lld 8063>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 8064>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 8065# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 8066# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 8067>>>>>>>>>64 lelong <256 8068>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 8069>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 8070# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 8071# Values 128 to 255 represent index block sizes of 2^(256-N) byte 8072>>>>>>>>>68 ulelong <256 8073>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 8074#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 8075>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 8076>>>>>>>>>72 ulequad x \b, serial number 0%llx 8077>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 8078#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 8079>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 8080>>>>>>>>>>&-92 indirect x \b; contains 8081# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 8082# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 8083# unused assembler instructions JMP y2;NOP;NOP 80840x056 ulelong&0xFFFF0FFF 0x909002EB 8085# unicode loadername terminated by CTRL-D 8086>(0.s*2) ulelong&0xFFFFFF00 0x00040000 8087# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 8088>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s 8089>>0x12 string $ 8090>>>0x0c lestring16 x \b%-2.2s 8091### DOS,NTFS boot sectors end 8092 80939564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 8094>8404 string x last mounted on %s, 8095#>9504 ledate x last checked at %s, 8096>8224 ledate x last written at %s, 8097>8401 byte x clean flag %d, 8098>8228 lelong x number of blocks %d, 8099>8232 lelong x number of data blocks %d, 8100>8236 lelong x number of cylinder groups %d, 8101>8240 lelong x block size %d, 8102>8244 lelong x fragment size %d, 8103>8252 lelong x minimum percentage of free blocks %d, 8104>8256 lelong x rotational delay %dms, 8105>8260 lelong x disk rotational speed %drps, 8106>8320 lelong 0 TIME optimization 8107>8320 lelong 1 SPACE optimization 8108 810942332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 8110>&-1164 string x last mounted on %s, 8111>&-696 string >\0 volume name %s, 8112>&-304 leqldate x last written at %s, 8113>&-1167 byte x clean flag %d, 8114>&-1168 byte x readonly flag %d, 8115>&-296 lequad x number of blocks %lld, 8116>&-288 lequad x number of data blocks %lld, 8117>&-1332 lelong x number of cylinder groups %d, 8118>&-1328 lelong x block size %d, 8119>&-1324 lelong x fragment size %d, 8120>&-180 lelong x average file size %d, 8121>&-176 lelong x average number of files in dir %d, 8122>&-272 lequad x pending blocks to free %lld, 8123>&-264 lelong x pending inodes to free %d, 8124>&-664 lequad x system-wide uuid %0llx, 8125>&-1316 lelong x minimum percentage of free blocks %d, 8126>&-1248 lelong 0 TIME optimization 8127>&-1248 lelong 1 SPACE optimization 8128 812966908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 8130>&-1164 string x last mounted on %s, 8131>&-696 string >\0 volume name %s, 8132>&-304 leqldate x last written at %s, 8133>&-1167 byte x clean flag %d, 8134>&-1168 byte x readonly flag %d, 8135>&-296 lequad x number of blocks %lld, 8136>&-288 lequad x number of data blocks %lld, 8137>&-1332 lelong x number of cylinder groups %d, 8138>&-1328 lelong x block size %d, 8139>&-1324 lelong x fragment size %d, 8140>&-180 lelong x average file size %d, 8141>&-176 lelong x average number of files in dir %d, 8142>&-272 lequad x pending blocks to free %lld, 8143>&-264 lelong x pending inodes to free %d, 8144>&-664 lequad x system-wide uuid %0llx, 8145>&-1316 lelong x minimum percentage of free blocks %d, 8146>&-1248 lelong 0 TIME optimization 8147>&-1248 lelong 1 SPACE optimization 8148 81499564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 8150>7168 belong 0x4c41424c Apple UFS Volume 8151>>7186 string x named %s, 8152>>7176 belong x volume label version %d, 8153>>7180 bedate x created on %s, 8154>8404 string x last mounted on %s, 8155#>9504 bedate x last checked at %s, 8156>8224 bedate x last written at %s, 8157>8401 byte x clean flag %d, 8158>8228 belong x number of blocks %d, 8159>8232 belong x number of data blocks %d, 8160>8236 belong x number of cylinder groups %d, 8161>8240 belong x block size %d, 8162>8244 belong x fragment size %d, 8163>8252 belong x minimum percentage of free blocks %d, 8164>8256 belong x rotational delay %dms, 8165>8260 belong x disk rotational speed %drps, 8166>8320 belong 0 TIME optimization 8167>8320 belong 1 SPACE optimization 8168 816942332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 8170>&-1164 string x last mounted on %s, 8171>&-696 string >\0 volume name %s, 8172>&-304 beqldate x last written at %s, 8173>&-1167 byte x clean flag %d, 8174>&-1168 byte x readonly flag %d, 8175>&-296 bequad x number of blocks %lld, 8176>&-288 bequad x number of data blocks %lld, 8177>&-1332 belong x number of cylinder groups %d, 8178>&-1328 belong x block size %d, 8179>&-1324 belong x fragment size %d, 8180>&-180 belong x average file size %d, 8181>&-176 belong x average number of files in dir %d, 8182>&-272 bequad x pending blocks to free %lld, 8183>&-264 belong x pending inodes to free %d, 8184>&-664 bequad x system-wide uuid %0llx, 8185>&-1316 belong x minimum percentage of free blocks %d, 8186>&-1248 belong 0 TIME optimization 8187>&-1248 belong 1 SPACE optimization 8188 818966908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 8190>&-1164 string x last mounted on %s, 8191>&-696 string >\0 volume name %s, 8192>&-304 beqldate x last written at %s, 8193>&-1167 byte x clean flag %d, 8194>&-1168 byte x readonly flag %d, 8195>&-296 bequad x number of blocks %lld, 8196>&-288 bequad x number of data blocks %lld, 8197>&-1332 belong x number of cylinder groups %d, 8198>&-1328 belong x block size %d, 8199>&-1324 belong x fragment size %d, 8200>&-180 belong x average file size %d, 8201>&-176 belong x average number of files in dir %d, 8202>&-272 bequad x pending blocks to free %lld, 8203>&-264 belong x pending inodes to free %d, 8204>&-664 bequad x system-wide uuid %0llx, 8205>&-1316 belong x minimum percentage of free blocks %d, 8206>&-1248 belong 0 TIME optimization 8207>&-1248 belong 1 SPACE optimization 8208 8209# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 8210# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 8211# volume label and UUID Russell Coker 8212# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 82130x438 leshort 0xEF53 Linux 8214>0x44c lelong x rev %d 8215>0x43e leshort x \b.%d 8216# No journal? ext2 8217>0x45c lelong ^0x0000004 ext2 filesystem data 8218>>0x43a leshort ^0x0000001 (mounted or unclean) 8219# Has a journal? ext3 or ext4 8220>0x45c lelong &0x0000004 8221# and small INCOMPAT? 8222>>0x460 lelong <0x0000040 8223# and small RO_COMPAT? 8224>>>0x464 lelong <0x0000008 ext3 filesystem data 8225# else large RO_COMPAT? 8226>>>0x464 lelong >0x0000007 ext4 filesystem data 8227# else large INCOMPAT? 8228>>0x460 lelong >0x000003f ext4 filesystem data 8229>0x468 belong x \b, UUID=%08x 8230>0x46c beshort x \b-%04x 8231>0x46e beshort x \b-%04x 8232>0x470 beshort x \b-%04x 8233>0x472 belong x \b-%08x 8234>0x476 beshort x \b%04x 8235>0x478 string >0 \b, volume name "%s" 8236# General flags for any ext* fs 8237>0x460 lelong &0x0000004 (needs journal recovery) 8238>0x43a leshort &0x0000002 (errors) 8239# INCOMPAT flags 8240>0x460 lelong &0x0000001 (compressed) 8241#>0x460 lelong &0x0000002 (filetype) 8242#>0x460 lelong &0x0000010 (meta bg) 8243>0x460 lelong &0x0000040 (extents) 8244>0x460 lelong &0x0000080 (64bit) 8245#>0x460 lelong &0x0000100 (mmp) 8246#>0x460 lelong &0x0000200 (flex bg) 8247# RO_INCOMPAT flags 8248#>0x464 lelong &0x0000001 (sparse super) 8249>0x464 lelong &0x0000002 (large files) 8250>0x464 lelong &0x0000008 (huge files) 8251#>0x464 lelong &0x0000010 (gdt checksum) 8252#>0x464 lelong &0x0000020 (many subdirs) 8253#>0x463 lelong &0x0000040 (extra isize) 8254 8255# Minix filesystems - Juan Cespedes <cespedes@debian.org> 82560x410 leshort 0x137f 8257!:strength / 2 8258>0x402 beshort < 100 8259>0x402 beshort > -1 Minix filesystem, V1, %d zones 8260>0x1e string minix \b, bootable 82610x410 beshort 0x137f 8262!:strength / 2 8263>0x402 beshort < 100 8264>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 8265>0x1e string minix \b, bootable 82660x410 leshort 0x138f 8267!:strength / 2 8268>0x402 beshort < 100 8269>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 8270>0x1e string minix \b, bootable 82710x410 beshort 0x138f 8272!:strength / 2 8273>0x402 beshort < 100 8274>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 8275>0x1e string minix \b, bootable 82760x410 leshort 0x2468 8277>0x402 beshort < 100 8278>>0x402 beshort > -1 Minix filesystem, V2, %d zones 8279>0x1e string minix \b, bootable 82800x410 beshort 0x2468 8281>0x402 beshort < 100 8282>0x402 beshort > -1 Minix filesystem, V2 (big endian), %d zones 8283>0x1e string minix \b, bootable 8284 82850x410 leshort 0x2478 8286>0x402 beshort < 100 8287>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 8288>0x1e string minix \b, bootable 82890x410 leshort 0x2478 8290>0x402 beshort < 100 8291>0x402 beshort > -1 Minix filesystem, V2, 30 char names, %d zones 8292>0x1e string minix \b, bootable 82930x410 beshort 0x2478 8294>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian), %d zones 8295>0x1e string minix \b, bootable 82960x410 leshort 0x4d5a 8297>0x402 beshort !0 Minix filesystem, V3, %d zones 8298>0x1e string minix \b, bootable 8299 8300# SGI disk labels - Nathan Scott <nathans@debian.org> 83010 belong 0x0BE5A941 SGI disk label (volume header) 8302 8303# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 83040 belong 0x58465342 SGI XFS filesystem data 8305>0x4 belong x (blksz %d, 8306>0x68 beshort x inosz %d, 8307>0x64 beshort ^0x2004 v1 dirs) 8308>0x64 beshort &0x2004 v2 dirs) 8309 8310############################################################################ 8311# Minix-ST kernel floppy 83120x800 belong 0x46fc2700 Atari-ST Minix kernel image 8313# http://en.wikipedia.org/wiki/BIOS_parameter_block 8314# floppies with valid BPB and any instruction at beginning 8315>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 8316>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 8317 8318############################################################################ 8319# Hmmm, is this a better way of detecting _standard_ floppy images ? 832019 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 8321>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 832219 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 8323>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 832419 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 8325>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 8326 832719 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 8328>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 832919 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 8330>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 8331 833219 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 833319 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 8334# | | | | | 8335# | | | | heads 8336# | | | sectors/track 8337# | | sectors/FAT 8338# | media descriptor 8339# BPB: sectors 8340 8341# Valid media descriptor bytes for MS-DOS: 8342# 8343# Byte Capacity Media Size and Type 8344# ------------------------------------------------- 8345# 8346# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 8347# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 8348# F9 720K 3.5-inch, 2-sided, 9-sector 8349# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 8350# FD 360K 5.25-inch, 2-sided, 9-sector 8351# FF 320K 5.25-inch, 2-sided, 8-sector 8352# FC 180K 5.25-inch, 1-sided, 9-sector 8353# FE 160K 5.25-inch, 1-sided, 8-sector 8354# FE 250K 8-inch, 1-sided, single-density 8355# FD 500K 8-inch, 2-sided, single-density 8356# FE 1.2 MB 8-inch, 2-sided, double-density 8357# F8 ----- Fixed disk 8358# 8359# FC xxxK Apricot 70x1x9 boot disk. 8360# 8361# Originally a bitmap: 8362# xxxxxxx0 Not two sided 8363# xxxxxxx1 Double sided 8364# xxxxxx0x Not 8 SPT 8365# xxxxxx1x 8 SPT 8366# xxxxx0xx Not Removable drive 8367# xxxxx1xx Removable drive 8368# 11111xxx Must be one. 8369# 8370# But now it's rather random: 8371# 111111xx Low density disk 8372# 00 SS, Not 8 SPT 8373# 01 DS, Not 8 SPT 8374# 10 SS, 8 SPT 8375# 11 DS, 8 SPT 8376# 8377# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 8378# 11110000 High density 3 1/2 floppy disk 8379# 11111000 Hard disk any format 8380# 8381 8382# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 8383# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 8384# Too Weak. 8385#512 ubelong&0xE0ffff00 0xE0ffff00 8386# without valid Media descriptor in place of BPB, cases with are done at other places 8387#>21 ubyte <0xE5 floppy with old FAT filesystem 8388# but valid Media descriptor at begin of FAT 8389#>>512 ubyte =0xed 720k 8390#>>512 ubyte =0xf0 1440k 8391#>>512 ubyte =0xf8 720k 8392#>>512 ubyte =0xf9 1220k 8393#>>512 ubyte =0xfa 320k 8394#>>512 ubyte =0xfb 640k 8395#>>512 ubyte =0xfc 180k 8396# look like an an old DOS directory entry 8397#>>>0xA0E ubequad 0 8398#>>>>0xA00 ubequad !0 8399#!:mime application/x-ima 8400#>>512 ubyte =0xfd 8401# look for 2nd FAT at different location to distinguish between 360k and 500k 8402#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 8403#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 8404#>>>0xA0E ubequad 0 8405#!:mime application/x-ima 8406#>>512 ubyte =0xfe 8407#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 8408#>>>>0x60E ubequad 0 8409#>>>>>0x600 ubequad !0 8410#!:mime application/x-ima 8411#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 8412#>>512 ubyte =0xff 320k 8413#>>>0x60E ubequad 0 8414#>>>>0x600 ubequad !0 8415#!:mime application/x-ima 8416#>>512 ubyte x \b, Media descriptor 0x%x 8417# without x86 jump instruction 8418#>>0 ulelong&0x804000E9 !0x000000E9 8419# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 8420#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 8421# IOSYS.COM+MSDOS.COM 8422#>>>>0xc4 use 2xDOS-filename 8423#>>0 ulelong&0x804000E9 =0x000000E9 8424# only x86 short jump instruction found 8425#>>>0 ubyte =0xEB 8426#>>>>1 ubyte x \b, code offset 0x%x+2 8427# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm 8428# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 8429#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 8430# ibmbio.com+ibmdos.com 8431#>>>>>0x176 use DOS-filename 8432#>>>>>0x181 ubyte x \b+ 8433#>>>>>0x182 use DOS-filename 8434# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm 8435# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 8436#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 8437# ibmbio.com+ibmdos.com 8438#>>>>>0x18b use DOS-filename 8439#>>>>>0x196 ubyte x \b+ 8440#>>>>>0x197 use DOS-filename 8441# http://en.wikipedia.org/wiki/Zenith_Data_Systems 8442# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 8443#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 8444# IO.SYS+MSDOS.SYS 8445#>>>>>0x20 use 2xDOS-filename 8446# http://en.wikipedia.org/wiki/Corona_Data_Systems 8447# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 8448#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 8449# IO.SYS+MSDOS.SYS 8450#>>>>>0x69 use 2xDOS-filename 8451# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 8452#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 8453# defect IO.SYS+MSDOS.SYS ? 8454#>>>>>0x162 use 2xDOS-filename 8455 84560 name cdrom 8457>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 8458!:mime application/x-iso9660-image 8459>38913 string NSR0 UDF filesystem data 8460!:mime application/x-iso9660-image 8461>>38917 string 1 (version 1.0) 8462>>38917 string 2 (version 1.5) 8463>>38917 string 3 (version 2.0) 8464>>38917 byte >0x33 (unknown version, ID 0x%X) 8465>>38917 byte <0x31 (unknown version, ID 0x%X) 8466>0x1FE leshort 0xAA55 (DOS/MBR boot sector) 8467# "application id" which appears to be used as a volume label 8468>32808 string/T >\0 '%s' 8469>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 847037633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 8471!:mime application/x-iso9660-image 847232777 string CDROM High Sierra CD-ROM filesystem data 8473 8474# CDROM Filesystems 8475# https://en.wikipedia.org/wiki/ISO_9660 8476# Modified for UDF by gerardo.cacciari@gmail.com 847732769 string CD001 8478# mime line at that position does not work 8479# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 8480!:strength -11 8481# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 8482# does not work 8483#!:strength +33 8484>0 use cdrom 8485 8486# .cso files 84870 string CISO Compressed ISO CD image 8488 8489# cramfs filesystem - russell@coker.com.au 84900 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 8491>4 lelong x size %u 8492>8 lelong &1 version #2 8493>8 lelong &2 sorted_dirs 8494>8 lelong &4 hole_support 8495>32 lelong x CRC 0x%x, 8496>36 lelong x edition %u, 8497>40 lelong x %u blocks, 8498>44 lelong x %u files 8499 85000 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 8501>4 belong x size %u 8502>8 belong &1 version #2 8503>8 belong &2 sorted_dirs 8504>8 belong &4 hole_support 8505>32 belong x CRC 0x%x, 8506>36 belong x edition %u, 8507>40 belong x %u blocks, 8508>44 belong x %u files 8509 8510# reiserfs - russell@coker.com.au 85110x10034 string ReIsErFs ReiserFS V3.5 85120x10034 string ReIsEr2Fs ReiserFS V3.6 85130x10034 string ReIsEr3Fs ReiserFS V3.6.19 8514>0x1002c leshort x block size %d 8515>0x10032 leshort &2 (mounted or unclean) 8516>0x10000 lelong x num blocks %d 8517>0x10040 lelong 1 tea hash 8518>0x10040 lelong 2 yura hash 8519>0x10040 lelong 3 r5 hash 8520 8521# JFFS - russell@coker.com.au 85220 lelong 0x34383931 Linux Journalled Flash File system, little endian 85230 belong 0x34383931 Linux Journalled Flash File system, big endian 8524 8525# EST flat binary format (which isn't, but anyway) 8526# From: Mark Brown <broonie@sirena.org.uk> 85270 string ESTFBINR EST flat binary 8528 8529# Aculab VoIP firmware 8530# From: Mark Brown <broonie@sirena.org.uk> 85310 string VoIP\ Startup\ and Aculab VoIP firmware 8532>35 string x format %s 8533 8534# From: Mark Brown <broonie@sirena.org.uk> [old] 8535# From: Behan Webster <behanw@websterwood.com> 85360 belong 0x27051956 u-boot legacy uImage, 8537>32 string x %s, 8538>28 byte 0 Invalid os/ 8539>28 byte 1 OpenBSD/ 8540>28 byte 2 NetBSD/ 8541>28 byte 3 FreeBSD/ 8542>28 byte 4 4.4BSD/ 8543>28 byte 5 Linux/ 8544>28 byte 6 SVR4/ 8545>28 byte 7 Esix/ 8546>28 byte 8 Solaris/ 8547>28 byte 9 Irix/ 8548>28 byte 10 SCO/ 8549>28 byte 11 Dell/ 8550>28 byte 12 NCR/ 8551>28 byte 13 LynxOS/ 8552>28 byte 14 VxWorks/ 8553>28 byte 15 pSOS/ 8554>28 byte 16 QNX/ 8555>28 byte 17 Firmware/ 8556>28 byte 18 RTEMS/ 8557>28 byte 19 ARTOS/ 8558>28 byte 20 Unity OS/ 8559>28 byte 21 INTEGRITY/ 8560>29 byte 0 \bInvalid CPU, 8561>29 byte 1 \bAlpha, 8562>29 byte 2 \bARM, 8563>29 byte 3 \bIntel x86, 8564>29 byte 4 \bIA64, 8565>29 byte 5 \bMIPS, 8566>29 byte 6 \bMIPS 64-bit, 8567>29 byte 7 \bPowerPC, 8568>29 byte 8 \bIBM S390, 8569>29 byte 9 \bSuperH, 8570>29 byte 10 \bSparc, 8571>29 byte 11 \bSparc 64-bit, 8572>29 byte 12 \bM68K, 8573>29 byte 13 \bNios-32, 8574>29 byte 14 \bMicroBlaze, 8575>29 byte 15 \bNios-II, 8576>29 byte 16 \bBlackfin, 8577>29 byte 17 \bAVR32, 8578>29 byte 18 \bSTMicroelectronics ST200, 8579>30 byte 0 Invalid Image 8580>30 byte 1 Standalone Program 8581>30 byte 2 OS Kernel Image 8582>30 byte 3 RAMDisk Image 8583>30 byte 4 Multi-File Image 8584>30 byte 5 Firmware Image 8585>30 byte 6 Script File 8586>30 byte 7 Filesystem Image (any type) 8587>30 byte 8 Binary Flat Device Tree BLOB 8588>31 byte 0 (Not compressed), 8589>31 byte 1 (gzip), 8590>31 byte 2 (bzip2), 8591>31 byte 3 (lzma), 8592>12 belong x %d bytes, 8593>8 bedate x %s, 8594>16 belong x Load Address: 0x%08X, 8595>20 belong x Entry Point: 0x%08X, 8596>4 belong x Header CRC: 0x%08X, 8597>24 belong x Data CRC: 0x%08X 8598 8599# JFFS2 file system 86000 leshort 0x1984 Linux old jffs2 filesystem data little endian 86010 leshort 0x1985 Linux jffs2 filesystem data little endian 8602 8603# Squashfs 86040 string sqsh Squashfs filesystem, big endian, 8605>28 beshort x version %d. 8606>30 beshort x \b%d, 8607>28 beshort <3 8608>>8 belong x %d bytes, 8609>28 beshort >2 8610>>28 beshort <4 8611>>>63 bequad x %lld bytes, 8612>>28 beshort >3 8613>>>40 bequad x %lld bytes, 8614#>>67 belong x %d bytes, 8615>4 belong x %d inodes, 8616>28 beshort <2 8617>>32 beshort x blocksize: %d bytes, 8618>28 beshort >1 8619>>28 beshort <4 8620>>>51 belong x blocksize: %d bytes, 8621>>28 beshort >3 8622>>>12 belong x blocksize: %d bytes, 8623>28 beshort <4 8624>>39 bedate x created: %s 8625>28 beshort >3 8626>>8 bedate x created: %s 86270 string hsqs Squashfs filesystem, little endian, 8628>28 leshort x version %d. 8629>30 leshort x \b%d, 8630>28 leshort <3 8631>>8 lelong x %d bytes, 8632>28 leshort >2 8633>>28 leshort <4 8634>>>63 lequad x %lld bytes, 8635>>28 leshort >3 8636>>>40 lequad x %lld bytes, 8637#>>63 lelong x %d bytes, 8638>4 lelong x %d inodes, 8639>28 leshort <2 8640>>32 leshort x blocksize: %d bytes, 8641>28 leshort >1 8642>>28 leshort <4 8643>>>51 lelong x blocksize: %d bytes, 8644>>28 leshort >3 8645>>>12 lelong x blocksize: %d bytes, 8646>28 leshort <4 8647>>39 ledate x created: %s 8648>28 leshort >3 8649>>8 ledate x created: %s 8650 8651# AFS Dump Magic 8652# From: Ty Sarna <tsarna@sarna.org> 86530 string \x01\xb3\xa1\x13\x22 AFS Dump 8654>&0 belong x (v%d) 8655>>&0 byte 0x76 8656>>>&0 belong x Vol %d, 8657>>>>&0 byte 0x6e 8658>>>>>&0 string x %s 8659>>>>>>&1 byte 0x74 8660>>>>>>>&0 beshort 2 8661>>>>>>>>&4 bedate x on: %s 8662>>>>>>>>&0 bedate =0 full dump 8663>>>>>>>>&0 bedate !0 incremental since: %s 8664 8665#---------------------------------------------------------- 8666#delta ISO Daniel Novotny (dnovotny@redhat.com) 86670 string DISO Delta ISO data 8668!:strength +50 8669>4 belong x version %d 8670 8671# VMS backup savesets - gerardo.cacciari@gmail.com 8672# 86734 string \x01\x00\x01\x00\x01\x00 8674>(0.s+16) string \x01\x01 8675>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 8676>>>40 lelong x (block size %d, 8677>>>49 string >\0 original name '%s', 8678>>>2 short 1024 VAX generated) 8679>>>2 short 2048 AXP generated) 8680>>>2 short 4096 I64 generated) 8681 8682# Summary: Oracle Clustered Filesystem 8683# Created by: Aaron Botsis <redhat@digitalmafia.org> 86848 string OracleCFS Oracle Clustered Filesystem, 8685>4 long x rev %d 8686>0 long x \b.%d, 8687>560 string x label: %.64s, 8688>136 string x mountpoint: %.128s 8689 8690# Summary: Oracle ASM tagged volume 8691# Created by: Aaron Botsis <redhat@digitalmafia.org> 869232 string ORCLDISK Oracle ASM Volume, 8693>40 string x Disk Name: %0.12s 869432 string ORCLCLRD Oracle ASM Volume (cleared), 8695>40 string x Disk Name: %0.12s 8696 8697# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 86988 string OracleCFS Oracle Clustered Filesystem, 8699>4 long x rev %d 8700>0 long x \b.%d, 8701>560 string x label: %.64s, 8702>136 string x mountpoint: %.128s 8703 8704# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 870532 string ORCLDISK Oracle ASM Volume, 8706>40 string x Disk Name: %0.12s 870732 string ORCLCLRD Oracle ASM Volume (cleared), 8708>40 string x Disk Name: %0.12s 8709 8710# Compaq/HP RILOE floppy image 8711# From: Dirk Jagdmann <doj@cubic.org> 87120 string CPQRFBLO Compaq/HP RILOE floppy image 8713 8714#------------------------------------------------------------------------------ 8715# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 8716# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 8717# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 8718# 87191008 string DECFILE11 Files-11 On-Disk Structure 8720>525 byte x (ODS-%d); 8721>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 8722>1017 string B 8723>>525 byte 2 VAX/VMS or OpenVMS file system; 8724>>525 byte 5 OpenVMS Alpha or Itanium file system; 8725>984 string x volume label is '%-12.12s' 8726 8727# From: Thomas Klausner <wiz@NetBSD.org> 8728# http://filext.com/file-extension/DAA 8729# describes the daa file format. The magic would be: 87300 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 8731 8732# From Albert Cahalan <acahalan@gmail.com> 8733# really le32 operation,destination,payloadsize (but quite predictable) 8734# 01 00 00 00 00 00 00 c0 00 02 00 00 87350 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 8736 8737# From Eric Sandeen 8738# GFS2 87390x10000 belong 0x01161970 8740>0x10018 belong 0x0000051d GFS1 Filesystem 8741>>0x10024 belong x (blocksize %d, 8742>>0x10060 string >\0 lockproto %s) 8743>0x10018 belong 0x00000709 GFS2 Filesystem 8744>>0x10024 belong x (blocksize %d, 8745>>0x10060 string >\0 lockproto %s) 8746 8747# BTRFS 87480x10040 string _BHRfS_M BTRFS Filesystem 8749>0x1012b string >\0 (label "%s", 8750>0x10090 lelong x sectorsize %d, 8751>0x10094 lelong x nodesize %d, 8752>0x10098 lelong x leafsize %d) 8753 8754 8755# dvdisaster's .ecc 8756# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 87570 string *dvdisaster* dvdisaster error correction file 8758 8759# xfs metadump image 8760# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 8761# but can we do the << ? For now it's always 512 (0x200) anyway. 87620 string XFSM 8763>0x200 string XFSB XFS filesystem metadump image 8764 8765# Type: CROM filesystem 8766# From: Werner Fink <werner@suse.de> 87670 string CROMFS CROMFS 8768>6 string >\0 \b version %2.2s, 8769>8 ulequad >0 \b block data at %lld, 8770>16 ulequad >0 \b fblock table at %lld, 8771>24 ulequad >0 \b inode table at %lld, 8772>32 ulequad >0 \b root at %lld, 8773>40 ulelong >0 \b fblock size = %d, 8774>44 ulelong >0 \b block size = %d, 8775>48 ulequad >0 \b bytes = %lld 8776 8777# Type: xfs metadump image 8778# From: Daniel Novotny <dnovotny@redhat.com> 8779# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 8780# but can we do the << ? For now it's always 512 (0x200) anyway. 87810 string XFSM 8782>0x200 string XFSB XFS filesystem metadump image 8783 8784# Type: delta ISO 8785# From: Daniel Novotny <dnovotny@redhat.com> 87860 string DISO Delta ISO data, 8787>4 belong x version %d 8788 8789# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 8790# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 8791# From: Adam Buchbinder <adam.buchbinder@gmail.com> 87920x8000 string JFS1 8793# Because it's text-only magic, check a binary value (version) to be sure. 8794# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 8795# mountable. 8796>&0 lelong <3 JFS2 filesystem image 8797# Label is followed by a UUID; we have to limit string length to avoid 8798# appending the UUID in the case of a 16-byte label. 8799>>&144 regex [\x20-\x7E]{1,16} (label "%s") 8800>>&0 lequad x \b, %lld blocks 8801>>&8 lelong x \b, blocksize %d 8802>>&32 lelong&0x00000006 >0 (dirty) 8803>>&36 lelong >0 (compressed) 8804 8805# LFS 88060 lelong 0x070162 LFS filesystem image 8807>4 lelong 1 version 1, 8808>>8 lelong x \b blocks %u, 8809>>12 lelong x \b blocks per segment %u, 8810>4 lelong 2 version 2, 8811>>8 lelong x \b fragments %u, 8812>>12 lelong x \b bytes per segment %u, 8813>16 lelong x \b disk blocks %u, 8814>20 lelong x \b block size %u, 8815>24 lelong x \b fragment size %u, 8816>28 lelong x \b fragments per block %u, 8817>32 lelong x \b start for free list %u, 8818>36 lelong x \b number of free blocks %d, 8819>40 lelong x \b number of files %u, 8820>44 lelong x \b blocks available for writing %d, 8821>48 lelong x \b inodes in cache %d, 8822>52 lelong x \b inode file disk address 0x%x, 8823>56 lelong x \b inode file inode number %u, 8824>60 lelong x \b address of last segment written 0x%x, 8825>64 lelong x \b address of next segment to write 0x%x, 8826>68 lelong x \b address of current segment written 0x%x 8827 88280 string td\000 floppy image data (TeleDisk, compressed) 88290 string TD\000 floppy image data (TeleDisk) 8830 88310 string CQ\024 floppy image data (CopyQM, 8832>16 leshort x %d sectors, 8833>18 leshort x %d heads.) 8834 88350 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 8836 88370 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 88380 beshort 0xAA59 floppy image data (IBM SaveDskF) 88390 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 8840 88410 string \074CPM_Disk\076 disk image data (YAZE) 8842 8843# ReFS 8844# Richard W.M. Jones <rjones@redhat.com> 88450 string \0\0\0ReFS\0 ReFS filesystem image 8846 8847# EFW encase image file format: 8848# Gregoire Passault 8849# http://www.forensicswiki.org/wiki/Encase_image_file_format 88500 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 8851 8852# UBIfs 8853# Linux kernel sources: fs/ubifs/ubifs-media.h 88540 lelong 0x06101831 8855>0x16 leshort 0 UBIfs image 8856>0x08 lequad x \b, sequence number %llu 8857>0x10 leshort x \b, length %u 8858>0x04 lelong x \b, CRC 0x%08x 8859 88600 lelong 0x23494255 8861>0x04 leshort <2 8862>0x05 string \0\0\0 8863>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 8864>0x04 leshort x UBI image, version %u 8865 8866# NEC PC-88 2D disk image 8867# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 88680x20 ulelong&0xFFFFFEFF 0x2A0 8869>0x10 string \0\0\0\0\0\0\0\0\0\0 8870>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 8871>>>0x1A ubyte&0xEF 0 8872>>>>0x1B ubyte&0x8F 0 8873>>>>>0x1B ubyte&70 <0x40 8874>>>>>>0x1C ulelong >0x21 8875>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 8876>>>>>>>>0x1B ubyte 0 \b, media=2D 8877>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 8878>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 8879>>>>>>>>0x1B ubyte 0x30 \b, media=1D 8880>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 8881>>>>>>>>0x1A ubyte 0x10 \b, write-protected 8882 8883#------------------------------------------------------------------------------ 8884# $File: flash,v 1.10 2014/03/06 16:07:24 christos Exp $ 8885# flash: file(1) magic for Macromedia Flash file format 8886# 8887# See 8888# 8889# http://www.macromedia.com/software/flash/open/ 8890# http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ 8891# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 8892# 8893 88940 name swf-details 8895>0 string F Macromedia Flash data 8896!:mime application/x-shockwave-flash 8897>0 string C Macromedia Flash data (compressed) 8898!:mime application/x-shockwave-flash 8899>0 string Z Macromedia Flash data (lzma compressed) 8900!:mime application/x-shockwave-flash 8901>3 byte x \b, version %d 8902 89031 string WS 8904>4 lelong !0 8905>>3 byte 255 Suspicious 8906>>>0 use swf-details 8907 8908>>3 ubyte <32 8909>>>3 ubyte !0 8910>>>>0 use swf-details 8911 8912# From: Cal Peake <cp@absolutedigital.net> 89130 string FLV\x01 Macromedia Flash Video 8914!:mime video/x-flv 8915 8916# 8917# Yosu Gomez 89180 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 89190 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 8920# From Dave Wilson 89210 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 8922 8923#------------------------------------------------------------------------------ 8924# $File: fonts,v 1.26 2013/03/09 22:36:00 christos Exp $ 8925# fonts: file(1) magic for font data 8926# 89270 search/1 FONT ASCII vfont text 89280 short 0436 Berkeley vfont data 89290 short 017001 byte-swapped Berkeley vfont data 8930 8931# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 89320 string %!PS-AdobeFont-1. PostScript Type 1 font text 8933>20 string >\0 (%s) 89346 string %!PS-AdobeFont-1. PostScript Type 1 font program data 89350 string %!FontType1 PostScript Type 1 font program data 89366 string %!FontType1 PostScript Type 1 font program data 89370 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 8938 8939# X11 font files in SNF (Server Natural Format) format 8940# updated by Joerg Jenderek at Feb 2013 8941# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 89420 belong 00000004 X11 SNF font data, MSB first 8943#>104 belong 00000004 X11 SNF font data, MSB first 8944!:mime application/x-font-sfn 8945# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 89460 lelong 00000004 8947>104 lelong 00000004 X11 SNF font data, LSB first 8948!:mime application/x-font-sfn 8949 8950# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 89510 search/1 STARTFONT\ X11 BDF font text 8952 8953# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 8954# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 89550 string \001fcp X11 Portable Compiled Font data 8956>12 byte 0x02 \b, LSB first 8957>12 byte 0x0a \b, MSB first 89580 string D1.0\015 X11 Speedo font data 8959 8960#------------------------------------------------------------------------------ 8961# FIGlet fonts and controlfiles 8962# From figmagic supplied with Figlet version 2.2 8963# "David E. O'Brien" <obrien@FreeBSD.ORG> 89640 string flf FIGlet font 8965>3 string >2a version %-2.2s 89660 string flc FIGlet controlfile 8967>3 string >2a version %-2.2s 8968 8969# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 8970# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 89710 belong 0x14025919 libGrx font data, 8972>8 leshort x %dx 8973>10 leshort x \b%d 8974>40 string x %s 8975# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 89760 belong 0xff464f4e DOS code page font data collection 89777 belong 0x00454741 DOS code page font data 89787 belong 0x00564944 DOS code page font data (from Linux?) 89794098 string DOSFONT DOSFONT2 encrypted font data 8980 8981# downloadable fonts for browser (prints type) anthon@mnt.org 89820 string PFR1 PFR1 font 8983>102 string >0 \b: %s 8984 8985# True Type fonts 89860 string \000\001\000\000\000 TrueType font data 8987!:mime application/x-font-ttf 8988 89890 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 89900 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 8991 8992# TrueType/OpenType font collections (.ttc) 8993# http://www.microsoft.com/typography/otspec/otff.htm 89940 string ttcf TrueType font collection data 8995>4 belong 0x00010000 \b, 1.0 8996>>8 belong >0 \b, %d fonts 8997>4 belong 0x00020000 \b, 2.0 8998>>8 belong >0 \b, %d fonts 8999# 0x44454947 = 'DSIG' 9000>>>16 belong 0x44534947 \b, digitally signed 9001 9002# Opentype font data from Avi Bercovich 90030 string OTTO OpenType font data 9004!:mime application/vnd.ms-opentype 9005 9006# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 90070 string SplineFontDB: Spline Font Database 9008!:mime application/vnd.font-fontforge-sfd 9009>14 string x version %s 9010 9011# EOT 901234 string LP Embedded OpenType (EOT) 9013!:mime application/vnd.ms-fontobject 9014 9015# Web Open Font Format (.woff) 9016# http://www.w3.org/TR/WOFF/ 90170 string wOFF Web Open Font Format 9018>4 belong x \b, flavor %d 9019>8 belong x \b, length %d 9020>20 beshort x \b, version %d 9021>22 beshort x \b.%d 9022 9023#------------------------------------------------------------------------------ 9024# $File: fortran,v 1.7 2012/06/21 01:55:02 christos Exp $ 9025# FORTRAN source 90260 regex/100l \^[Cc][\ \t] FORTRAN program 9027!:mime text/x-fortran 9028!:strength - 5 9029 9030#------------------------------------------------------------------------------ 9031# $File$ 9032# frame: file(1) magic for FrameMaker files 9033# 9034# This stuff came on a FrameMaker demo tape, most of which is 9035# copyright, but this file is "published" as witness the following: 9036# 9037# Note that this is the Framemaker Maker Interchange Format, not the 9038# Normal format which would be application/vnd.framemaker. 9039# 90400 string \<MakerFile FrameMaker document 9041!:mime application/x-mif 9042>11 string 5.5 (5.5 9043>11 string 5.0 (5.0 9044>11 string 4.0 (4.0 9045>11 string 3.0 (3.0 9046>11 string 2.0 (2.0 9047>11 string 1.0 (1.0 9048>14 byte x %c) 90490 string \<MIFFile FrameMaker MIF (ASCII) file 9050!:mime application/x-mif 9051>9 string 4.0 (4.0) 9052>9 string 3.0 (3.0) 9053>9 string 2.0 (2.0) 9054>9 string 1.0 (1.x) 90550 search/1 \<MakerDictionary FrameMaker Dictionary text 9056!:mime application/x-mif 9057>17 string 3.0 (3.0) 9058>17 string 2.0 (2.0) 9059>17 string 1.0 (1.x) 90600 string \<MakerScreenFont FrameMaker Font file 9061!:mime application/x-mif 9062>17 string 1.01 (%s) 90630 string \<MML FrameMaker MML file 9064!:mime application/x-mif 90650 string \<BookFile FrameMaker Book file 9066!:mime application/x-mif 9067>10 string 3.0 (3.0 9068>10 string 2.0 (2.0 9069>10 string 1.0 (1.0 9070>13 byte x %c) 9071# XXX - this book entry should be verified, if you find one, uncomment this 9072#0 string \<Book\ FrameMaker Book (ASCII) file 9073#!:mime application/x-mif 9074#>6 string 3.0 (3.0) 9075#>6 string 2.0 (2.0) 9076#>6 string 1.0 (1.0) 90770 string \<Maker Intermediate Print File FrameMaker IPL file 9078!:mime application/x-mif 9079 9080#------------------------------------------------------------------------------ 9081# $File$ 9082# freebsd: file(1) magic for FreeBSD objects 9083# 9084# All new-style FreeBSD magic numbers are in host byte order (i.e., 9085# little-endian on x86). 9086# 9087# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 9088# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 9089# schemes for distinguishing between executable images, shared libraries, 9090# and object files. 9091# 9092# FreeBSD says: 9093# 9094# Regardless of whether it's pure, demand-paged, or none of the 9095# above: 9096# 9097# if the entry point is < 4096, then it's a shared library if 9098# the "has run-time loader information" bit is set, and is 9099# position-independent if the "is position-independent" bit 9100# is set; 9101# 9102# if the entry point is >= 4096 (or >4095, same thing), then it's 9103# an executable, and is dynamically-linked if the "has run-time 9104# loader information" bit is set. 9105# 9106# On x86, NetBSD says: 9107# 9108# If it's neither pure nor demand-paged: 9109# 9110# if it has the "has run-time loader information" bit set, it's 9111# a dynamically-linked executable; 9112# 9113# if it doesn't have that bit set, then: 9114# 9115# if it has the "is position-independent" bit set, it's 9116# position-independent; 9117# 9118# if the entry point is non-zero, it's an executable, otherwise 9119# it's an object file. 9120# 9121# If it's pure: 9122# 9123# if it has the "has run-time loader information" bit set, it's 9124# a dynamically-linked executable, otherwise it's just an 9125# executable. 9126# 9127# If it's demand-paged: 9128# 9129# if it has the "has run-time loader information" bit set, 9130# then: 9131# 9132# if the entry point is < 4096, it's a shared library; 9133# 9134# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 9135# it's a dynamically-linked executable); 9136# 9137# if it doesn't have the "has run-time loader information" bit 9138# set, then it's just an executable. 9139# 9140# (On non-x86, NetBSD does much the same thing, except that it uses 9141# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 9142# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 9143# had 8K pages; dunno about MIPS.) 9144# 9145# I suspect the two will differ only in perverse and uninteresting cases 9146# ("shared" libraries that aren't demand-paged and whose pages probably 9147# won't actually be shared, executables with entry points <4096). 9148# 9149# I leave it to those more familiar with FreeBSD and NetBSD to figure out 9150# what the right answer is (although using ">4095", FreeBSD-style, is 9151# probably better than separately checking for "=4096" and ">4096", 9152# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 9153# executables using the NetBSD technique.) 9154# 91550 lelong&0377777777 041400407 FreeBSD/i386 9156>20 lelong <4096 9157>>3 byte&0xC0 &0x80 shared library 9158>>3 byte&0xC0 0x40 PIC object 9159>>3 byte&0xC0 0x00 object 9160>20 lelong >4095 9161>>3 byte&0x80 0x80 dynamically linked executable 9162>>3 byte&0x80 0x00 executable 9163>16 lelong >0 not stripped 9164 91650 lelong&0377777777 041400410 FreeBSD/i386 pure 9166>20 lelong <4096 9167>>3 byte&0xC0 &0x80 shared library 9168>>3 byte&0xC0 0x40 PIC object 9169>>3 byte&0xC0 0x00 object 9170>20 lelong >4095 9171>>3 byte&0x80 0x80 dynamically linked executable 9172>>3 byte&0x80 0x00 executable 9173>16 lelong >0 not stripped 9174 91750 lelong&0377777777 041400413 FreeBSD/i386 demand paged 9176>20 lelong <4096 9177>>3 byte&0xC0 &0x80 shared library 9178>>3 byte&0xC0 0x40 PIC object 9179>>3 byte&0xC0 0x00 object 9180>20 lelong >4095 9181>>3 byte&0x80 0x80 dynamically linked executable 9182>>3 byte&0x80 0x00 executable 9183>16 lelong >0 not stripped 9184 91850 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 9186>20 lelong <4096 9187>>3 byte&0xC0 &0x80 shared library 9188>>3 byte&0xC0 0x40 PIC object 9189>>3 byte&0xC0 0x00 object 9190>20 lelong >4095 9191>>3 byte&0x80 0x80 dynamically linked executable 9192>>3 byte&0x80 0x00 executable 9193>16 lelong >0 not stripped 9194 9195# XXX gross hack to identify core files 9196# cores start with a struct tss; we take advantage of the following: 9197# byte 7: highest byte of the kernel stack pointer, always 0xfe 9198# 8/9: kernel (ring 0) ss value, always 0x0010 9199# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 9200# 28: low order byte of the current PTD entry, always 0 since the 9201# PTD is page-aligned 9202# 92037 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 9204>1039 string >\0 from '%s' 9205 9206# /var/run/ld.so.hints 9207# What are you laughing about? 92080 lelong 011421044151 ld.so hints file (Little Endian 9209>4 lelong >0 \b, version %d) 9210>4 belong <1 \b) 92110 belong 011421044151 ld.so hints file (Big Endian 9212>4 belong >0 \b, version %d) 9213>4 belong <1 \b) 9214 9215# 9216# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 9217# 92180 string SCRSHOT_ scrshot(1) screenshot, 9219>8 byte x version %d, 9220>9 byte 2 %d bytes in header, 9221>>10 byte x %d chars wide by 9222>>11 byte x %d chars high 9223 9224#------------------------------------------------------------------------------ 9225# $File: fsav,v 1.12 2013/03/23 14:15:30 christos Exp $ 9226# fsav: file(1) magic for datafellows fsav virus definition files 9227# Anthon van der Neut (anthon@mnt.org) 9228 9229# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 92300 beshort 0x1575 fsav macro virus signatures 9231>8 leshort >0 (%d- 9232>11 byte >0 \b%02d- 9233>10 byte >0 \b%02d) 9234# ftp://ftp.f-prot.com/pub/sign.zip 9235#10 ubyte <12 9236#>9 ubyte <32 9237#>>8 ubyte 0x0a 9238#>>>12 ubyte 0x07 9239#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 9240#>>>>10 byte 0 \b01- 9241#>>>>10 byte 1 \b02- 9242#>>>>10 byte 2 \b03- 9243#>>>>10 byte 3 \b04- 9244#>>>>10 byte 4 \b05- 9245#>>>>10 byte 5 \b06- 9246#>>>>10 byte 6 \b07- 9247#>>>>10 byte 7 \b08- 9248#>>>>10 byte 8 \b09- 9249#>>>>10 byte 9 \b10- 9250#>>>>10 byte 10 \b11- 9251#>>>>10 byte 11 \b12- 9252#>>>>9 ubyte >0 \b%02d) 9253# ftp://ftp.f-prot.com/pub/sign2.zip 9254#0 ubyte 0x62 9255#>1 ubyte 0xF5 9256#>>2 ubyte 0x1 9257#>>>3 ubyte 0x1 9258#>>>>4 ubyte 0x0e 9259#>>>>>13 ubyte >0 fsav virus signatures 9260#>>>>>>11 ubyte x size 0x%02x 9261#>>>>>>12 ubyte x \b%02x 9262#>>>>>>13 ubyte x \b%02x bytes 9263 9264# Joerg Jenderek: joerg dot jenderek at web dot de 9265# http://www.clamav.net/doc/latest/html/node45.html 9266# .cvd files start with a 512 bytes colon separated header 9267# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 9268# + gzipped tarball files 92690 string ClamAV-VDB: 9270>11 string >\0 Clam AntiVirus database %-.23s 9271>>34 string : 9272>>>35 string !: \b, version 9273>>>>35 string x \b%-.1s 9274>>>>>36 string !: 9275>>>>>>36 string x \b%-.1s 9276>>>>>>>37 string !: 9277>>>>>>>>37 string x \b%-.1s 9278>>>>>>>>>38 string !: 9279>>>>>>>>>>38 string x \b%-.1s 9280>512 string \037\213 \b, gzipped 9281>769 string ustar\0 \b, tarred 9282 9283# Type: Grisoft AVG AntiVirus 9284# From: David Newgas <david@newgas.net> 92850 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 9286 92870 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 9288>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 9289 9290#------------------------------------------------------------------------------ 9291# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 9292# fusecompress: file(1) magic for fusecompress 92930 string \037\135\211 FuseCompress(ed) data 9294>3 byte 0x00 (none format) 9295>3 byte 0x01 (bz2 format) 9296>3 byte 0x02 (gz format) 9297>3 byte 0x03 (lzo format) 9298>3 byte 0x04 (xor format) 9299>3 byte >0x04 (unknown format) 9300>4 long x uncompressed size: %d 9301 9302#------------------------------------------------------------------------------ 9303# $File: games,v 1.13 2012/02/13 22:50:50 christos Exp $ 9304# games: file(1) for games 9305 9306# Fabio Bonelli <fabiobonelli@libero.it> 9307# Quake II - III data files 93080 string IDP2 Quake II 3D Model file, 9309>20 long x %u skin(s), 9310>8 long x (%u x 9311>12 long x %u), 9312>40 long x %u frame(s), 9313>16 long x Frame size %u bytes, 9314>24 long x %u vertices/frame, 9315>28 long x %u texture coordinates, 9316>32 long x %u triangles/frame 9317 93180 string IBSP Quake 9319>4 long 0x26 II Map file (BSP) 9320>4 long 0x2E III Map file (BSP) 9321 93220 string IDS2 Quake II SP2 sprite file 9323 9324#--------------------------------------------------------------------------- 9325# Doom and Quake 9326# submitted by Nicolas Patrois 9327 93280 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 9329# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 9330 933124 string LxD\ 203 Linuxdoom save 9332>0 string x , name=%s 9333>44 string x , world=%s 9334 9335# Quake 9336 93370 string PACK Quake I or II world or extension 9338>8 lelong >0 \b, %d entries 9339 9340#0 string -1\x0a Quake I demo 9341#>30 string x version %.4s 9342#>61 string x level %s 9343 9344#0 string 5\x0a Quake I save 9345 9346# The levels 9347 9348# Quake 1 9349 93500 string 5\x0aIntroduction Quake I save: start Introduction 93510 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 93520 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 93530 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 93540 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 93550 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 93560 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 93570 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 93580 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 93590 string 5\x0athe_Installation Quake I save: e2m1 The installation 93600 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 93610 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 93620 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 93630 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 93640 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 93650 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 93660 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 93670 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 93680 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 93690 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 93700 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 93710 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 93720 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 93730 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 93740 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 93750 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 93760 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 93770 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 93780 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 93790 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 93800 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 93810 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 9382 9383# Quake DeathMatch levels 9384 93850 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 93860 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 93870 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 93880 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 93890 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 93900 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 9391 9392# Scourge of Armagon 9393 93940 string 5\x0aCommand_HQ Quake I save: start Command HQ 93950 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 93960 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 93970 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 93980 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 93990 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 94000 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 94010 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 94020 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 94030 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 94040 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 94050 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 94060 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 94070 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 94080 string 5\x0aLimbo Quake I save: hip3m3 Limbo 94090 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 94100 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 94110 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 9412 9413# Malice 9414 94150 string 5\x0aThe_Academy Quake I save: start The academy 94160 string 5\x0aThe_Lab Quake I save: d1 The lab 94170 string 5\x0aArea_33 Quake I save: d1b Area 33 94180 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 94190 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 94200 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 94210 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 94220 string 5\x0aArea44 Quake I save: d1c Area 44 94230 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 94240 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 94250 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 94260 string 5\x0aThe_Flood Quake I save: d5 The flood 94270 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 94280 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 94290 string 5\x0aThe_Foundry Quake I save: d7b The foundry 94300 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 94310 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 94320 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 94330 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 94340 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 94350 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 9436 9437# Malice DeathMatch levels 9438 94390 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 94400 string 5\x0aSub_Station Quake I save: ddm2 Sub station 94410 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 94420 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 94430 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 94440 string 5\x0aDOMINO Quake I save: ddm6 Domino 94450 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 9446 9447 94480 string MComprHD MAME CHD compressed hard disk image, 9449>12 belong x version %u 9450 9451# doom - submitted by Jon Dowland 9452 94530 string =IWAD doom main IWAD data 9454>4 lelong x containing %d lumps 94550 string =PWAD doom patch PWAD data 9456>4 lelong x containing %d lumps 9457 9458# Build engine group files (Duke Nukem, Shadow Warrior, ...) 9459# Extension: .grp 9460# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 94610 string KenSilverman Build engine group file 9462>12 lelong x containing %d files 9463 9464# Summary: Warcraft 3 save 9465# Extension: .w3g 9466# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 94670 string Warcraft\ III\ recorded\ game %s 9468 9469 9470# Summary: Warcraft 3 map 9471# Extension: .w3m 9472# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 94730 string HM3W Warcraft III map file 9474 9475 9476# Summary: SGF Smart Game Format 9477# Extension: .sgf 9478# Reference: http://www.red-bean.com/sgf/ 9479# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 9480# Modified by (1): Abel Cheung (regex, more game format) 9481# FIXME: Some games don't have GM (game type) 94820 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 9483>2 search/0x200/b GM[ 9484>>&0 string 1] (Go) 9485>>&0 string 2] (Othello) 9486>>&0 string 3] (chess) 9487>>&0 string 4] (Gomoku+Renju) 9488>>&0 string 5] (Nine Men's Morris) 9489>>&0 string 6] (Backgammon) 9490>>&0 string 7] (Chinese chess) 9491>>&0 string 8] (Shogi) 9492>>&0 string 9] (Lines of Action) 9493>>&0 string 10] (Ataxx) 9494>>&0 string 11] (Hex) 9495>>&0 string 12] (Jungle) 9496>>&0 string 13] (Neutron) 9497>>&0 string 14] (Philosopher's Football) 9498>>&0 string 15] (Quadrature) 9499>>&0 string 16] (Trax) 9500>>&0 string 17] (Tantrix) 9501>>&0 string 18] (Amazons) 9502>>&0 string 19] (Octi) 9503>>&0 string 20] (Gess) 9504>>&0 string 21] (Twixt) 9505>>&0 string 22] (Zertz) 9506>>&0 string 23] (Plateau) 9507>>&0 string 24] (Yinsh) 9508>>&0 string 25] (Punct) 9509>>&0 string 26] (Gobblet) 9510>>&0 string 27] (hive) 9511>>&0 string 28] (Exxit) 9512>>&0 string 29] (Hnefatal) 9513>>&0 string 30] (Kuba) 9514>>&0 string 31] (Tripples) 9515>>&0 string 32] (Chase) 9516>>&0 string 33] (Tumbling Down) 9517>>&0 string 34] (Sahara) 9518>>&0 string 35] (Byte) 9519>>&0 string 36] (Focus) 9520>>&0 string 37] (Dvonn) 9521>>&0 string 38] (Tamsk) 9522>>&0 string 39] (Gipf) 9523>>&0 string 40] (Kropki) 9524 9525############################################## 9526# NetImmerse/Gamebryo game engine entries 9527 9528# Summary: Gamebryo game engine file 9529# Extension: .nif, .kf 9530# Created by: Abel Cheung <abelcheung@gmail.com> 95310 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 9532>&0 regex [0-9a-z.]+ \b, version %s 9533 9534# Summary: Gamebryo game engine file 9535# Extension: .kfm 9536# Created by: Abel Cheung <abelcheung@gmail.com> 95370 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 9538>&0 regex [0-9a-z.]+ \b, version %s 9539 9540# Summary: NetImmerse game engine file 9541# Extension .nif 9542# Created by: Abel Cheung <abelcheung@gmail.com> 95430 string NetImmerse\ File\ Format,\ Versio 9544>&0 string n\ NetImmerse game engine file 9545>>&0 regex [0-9a-z.]+ \b, version %s 9546 9547# Type: SGF Smart Game Format 9548# URL: http://www.red-bean.com/sgf/ 9549# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 95502 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 9551>2 regex/c GM\\[1\\] - Go Game 9552>2 regex/c GM\\[6\\] - BackGammon Game 9553>2 regex/c GM\\[11\\] - Hex Game 9554>2 regex/c GM\\[18\\] - Amazons Game 9555>2 regex/c GM\\[19\\] - Octi Game 9556>2 regex/c GM\\[20\\] - Gess Game 9557>2 regex/c GM\\[21\\] - twix Game 9558 9559# Epic Games/Unreal Engine Package 9560# 95610 lelong 0x9E2A83C1 Unreal Engine Package, 9562>4 leshort x version: %i 9563>12 lelong !0 \b, names: %i 9564>28 lelong !0 \b, imports: %i 9565>20 lelong !0 \b, exports: %i 9566 9567#------------------------------------------------------------------------------ 9568# $File$ 9569# gcc: file(1) magic for GCC special files 9570# 95710 string gpch GCC precompiled header 9572 9573# The version field is annoying. It's 3 characters, not zero-terminated. 9574>5 byte x (version %c 9575>6 byte x \b%c 9576>7 byte x \b%c) 9577 9578# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 9579>4 byte 67 for C 9580>4 byte 111 for Objective C 9581>4 byte 43 for C++ 9582>4 byte 79 for Objective C++ 9583 9584#------------------------------------------------------------------------------ 9585# $File: geo,v 1.2 2013/01/02 15:27:53 christos Exp $ 9586# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 9587 9588###################################################################### 9589# 9590# Acoustic Doppler Current Profilers (ADCP) 9591# 9592###################################################################### 9593 95940 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 9595 9596###################################################################### 9597# 9598# Metadata 9599# 9600###################################################################### 9601 96020 string Identification_Information FGDC ASCII metadata 9603 9604###################################################################### 9605# 9606# Seimsic / Subbottom 9607# 9608###################################################################### 9609 9610# Knudsen subbottom chirp profiler - Binary File Format: B9 9611# KEB D409-03167 V1.75 Huffman 96120 string KEB\ Knudsen seismic KEL binary (KEB) - 9613>4 regex [-A-Z0-9]* Software: %s 9614>>&1 regex V[0-9]*\.[0-9]* version %s 9615 9616###################################################################### 9617# 9618# LIDAR - Laser altimetry or bathy 9619# 9620###################################################################### 9621 9622 9623# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 96240 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 9625>4 regex [0-9]*\.[0-9]* version %s 9626 96270 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 9628>3 byte x version %d . 9629>4 byte x %d 9630 9631 9632###################################################################### 9633# 9634# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 9635# 9636###################################################################### 9637 9638# GeoAcoustics - GeoSwath Plus 96394 beshort 0x2002 GeoSwath RDF 96400 string Start:- GeoSwatch auf text file 9641 9642# Seabeam 2100 9643# mbsystem code mb41 96440 string SB2100 SeaBeam 2100 multibeam sonar 96450 string SB2100DR SeaBeam 2100 DR multibeam sonar 96460 string SB2100PR SeaBeam 2100 PR multibeam sonar 9647 9648# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 9649# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 96500 string $HSF XSE multibeam 9651 9652# mb121 http://www.saic.com/maritime/gsf/ 96538 string GSF-v SAIC generic sensor format (GSF) sonar data, 9654>&0 regex [0-9]*\.[0-9]* version %s 9655 9656# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 9657# mb161 96589 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 9659 9660# MBSystem processing caches the mbinfo output 96611 string Swath\ Data\ File: mbsystem info cache 9662 9663# Caris John Hughes Clark format 96640 string HDCS Caris multibeam sonar related data 96651 string Start/Stop\ parameter\ header: Caris ASCII project summary 9666 9667###################################################################### 9668# 9669# Visualization and 3D modeling 9670# 9671###################################################################### 9672 9673# IVS - IVS3d.com Tagged Data Represetation 96740 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 9675 9676# http://www.ecma-international.org/publications/standards/Ecma-363.htm 9677# 3D in PDFs 96780 string U3D ECMA-363, Universal 3D 9679 9680###################################################################### 9681# 9682# Support files 9683# 9684###################################################################### 9685 9686# https://midas.psi.ch/elog/ 96870 string $@MID@$ elog journal entry 9688 9689# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm 96900 string DSBB Surfer 6 binary grid file 9691>4 leshort x \b, %d 9692>6 leshort x \bx%d 9693>8 ledouble x \b, minx=%g 9694>16 ledouble x \b, maxx=%g 9695>24 ledouble x \b, miny=%g 9696>32 ledouble x \b, maxy=%g 9697>40 ledouble x \b, minz=%g 9698>48 ledouble x \b, maxz=%g 9699 9700 9701#------------------------------------------------------------------------------ 9702# $File$ 9703# GEOS files (Vidar Madsen, vidar@gimp.org) 9704# semi-commonly used in embedded and handheld systems. 97050 belong 0xc745c153 GEOS 9706>40 byte 1 executable 9707>40 byte 2 VMFile 9708>40 byte 3 binary 9709>40 byte 4 directory label 9710>40 byte <1 unknown 9711>40 byte >4 unknown 9712>4 string >\0 \b, name "%s" 9713#>44 short x \b, version %d 9714#>46 short x \b.%d 9715#>48 short x \b, rev %d 9716#>50 short x \b.%d 9717#>52 short x \b, proto %d 9718#>54 short x \br%d 9719#>168 string >\0 \b, copyright "%s" 9720 9721#------------------------------------------------------------------------------ 9722# $File: gimp,v 1.8 2013/12/21 14:29:45 christos Exp $ 9723# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 9724# by Federico Mena <federico@nuclecu.unam.mx> 9725 97260 string/t GIMP\ Gradient GIMP gradient data 9727 9728# GIMP palette (.gpl) 9729# From: Markus Heidelberg <markus.heidelberg@web.de> 97300 string/t GIMP\ Palette GIMP palette data 9731 9732#------------------------------------------------------------------------------ 9733# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 9734# by Spencer Kimball and Peter Mattis 9735# ('Bucky' LaDieu, nega@vt.edu) 9736 97370 string gimp\ xcf GIMP XCF image data, 9738!:mime image/x-xcf 9739>9 string file version 0, 9740>9 string v version 9741>>10 string >\0 %s, 9742>14 belong x %u x 9743>18 belong x %u, 9744>22 belong 0 RGB Color 9745>22 belong 1 Greyscale 9746>22 belong 2 Indexed Color 9747>22 belong >2 Unknown Image Type. 9748 9749#------------------------------------------------------------------------------ 9750# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 9751# by Spencer Kimball and Peter Mattis 9752# ('Bucky' LaDieu, nega@vt.edu) 9753 975420 string GPAT GIMP pattern data, 9755>24 string x %s 9756 9757#------------------------------------------------------------------------------ 9758# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 9759# by Spencer Kimball and Peter Mattis 9760# ('Bucky' LaDieu, nega@vt.edu) 9761 976220 string GIMP GIMP brush data 9763 9764# GIMP Curves File 9765# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 97660 string #\040GIMP\040Curves\040File GIMP curve file 9767 9768#------------------------------------------------------------------------------ 9769# $File: gnome,v 1.4 2014/04/28 12:04:50 christos Exp $ 9770# GNOME related files 9771 9772# Contributed by Josh Triplett 9773# FIXME: Could be simplified if pstring supported two-byte counts 97740 string GnomeKeyring\n\r\0\n GNOME keyring 9775>&0 ubyte 0 \b, major version 0 9776>>&0 ubyte 0 \b, minor version 0 9777>>>&0 ubyte 0 \b, crypto type 0 (AES) 9778>>>&0 ubyte >0 \b, crypto type %u (unknown) 9779>>>&1 ubyte 0 \b, hash type 0 (MD5) 9780>>>&1 ubyte >0 \b, hash type %u (unknown) 9781>>>&2 ubelong 0xFFFFFFFF \b, name NULL 9782>>>&2 ubelong !0xFFFFFFFF 9783>>>>&-4 ubelong >255 \b, name too long for file's pstring type 9784>>>>&-4 ubelong <256 9785>>>>>&-1 pstring x \b, name "%s" 9786>>>>>>&0 ubeqdate x \b, last modified %s 9787>>>>>>&8 ubeqdate x \b, created %s 9788>>>>>>&16 ubelong &1 9789>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 9790>>>>>>&16 ubelong ^1 \b, not locked if idle 9791>>>>>>&24 ubelong x \b, hash iterations %u 9792>>>>>>&28 ubequad x \b, salt %llu 9793>>>>>>&52 ubelong x \b, %u item(s) 9794 9795# From: Alex Beregszaszi <alex@fsn.hu> 97964 string gtktalog GNOME Catalogue (gtktalog) 9797>13 string >\0 version %s 9798 9799# Summary: GStreamer binary registry 9800# Extension: .bin 9801# Submitted by: Josh Triplett <josh@joshtriplett.org> 98020 belong 0xc0def00d GStreamer binary registry 9803>4 string x \b, version %s 9804 9805# GVariant Database file 9806# By Elan Ruusamae <glen@delfi.ee> 9807# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 9808# It's always "GVariant", it's byte swapped on incompatible archs 9809# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 9810# file_builder_serialise() 9811# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 98120 string GVariant GVariant Database file, 9813# version is never filled. probably future extension 9814>8 lelong x version %d 9815# not sure are these usable, so commented out 9816#>>16 lelong x start %d, 9817#>>>20 lelong x end %d 9818 9819# G-IR database made by gobject-introspect toolset, 9820# http://live.gnome.org/GObjectIntrospection 98210 string GOBJ\nMETADATA\r\n\032 G-IR binary database 9822>16 byte x \b, v%d 9823>17 byte x \b.%d 9824>20 leshort x \b, %d entries 9825>22 leshort x \b/%d local 9826 9827#------------------------------------------------------------------------------ 9828# $File: gnu,v 1.14 2012/10/03 23:38:12 christos Exp $ 9829# gnu: file(1) magic for various GNU tools 9830# 9831# GNU nlsutils message catalog file format 9832# 9833# GNU message catalog (.mo and .gmo files) 9834 98350 string \336\22\4\225 GNU message catalog (little endian), 9836>6 leshort x revision %d. 9837>4 leshort >0 \b%d, 9838>>8 lelong x %d messages, 9839>>36 lelong x %d sysdep messages 9840>4 leshort =0 \b%d, 9841>>8 lelong x %d messages 9842 98430 string \225\4\22\336 GNU message catalog (big endian), 9844>4 beshort x revision %d. 9845>6 beshort >0 \b%d, 9846>>8 belong x %d messages, 9847>>36 belong x %d sysdep messages 9848>6 beshort =0 \b%d, 9849>>8 belong x %d messages 9850 9851 9852# GnuPG 9853# The format is very similar to pgp 98540 string \001gpg GPG key trust database 9855>4 byte x version %d 9856# Note: magic.mime had 0x8501 for the next line instead of 0x8502 98570 beshort 0x8502 GPG encrypted data 9858!:mime text/PGP # encoding: data 9859 9860# This magic is not particularly good, as the keyrings don't have true 9861# magic. Nevertheless, it covers many keyrings. 98620 beshort 0x9901 GPG key public ring 9863!:mime application/x-gnupg-keyring 9864 9865# Symmetric encryption 98660 leshort 0x0d8c 9867>4 leshort 0x0203 9868>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 9869>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 9870>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 9871>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 9872>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 9873>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 9874>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 9875>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 9876>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 9877>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 9878 9879 9880# GnuPG Keybox file 9881# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 9882# From: Philipp Hahn <hahn@univention.de> 98830 belong 32 9884>4 byte 1 9885>>8 string KBXf GPG keybox database 9886>>>5 byte 1 version %d 9887>>>16 bedate x \b, created-at %s 9888>>>20 bedate x \b, last-maintained %s 9889 9890 9891# Gnumeric spreadsheet 9892# This entry is only semi-helpful, as Gnumeric compresses its files, so 9893# they will ordinarily reported as "compressed", but at least -z helps 989439 string =<gmr:Workbook Gnumeric spreadsheet 9895 9896# From: James Youngman <jay@gnu.org> 9897# gnu find magic 98980 string \0LOCATE GNU findutils locate database data 9899>7 string >\0 \b, format %s 9900>7 string 02 \b (frcode) 9901 9902# Files produced by GNU gettext 99030 long 0xDE120495 GNU-format message catalog data 99040 long 0x950412DE GNU-format message catalog data 9905 9906# gettext message catalogue 99070 regex \^msgid\ GNU gettext message catalogue text 9908!:mime text/x-po 9909 9910#------------------------------------------------------------------------------ 9911# $File$ 9912# gnumeric: file(1) magic for Gnumeric spreadsheet 9913# This entry is only semi-helpful, as Gnumeric compresses its files, so 9914# they will ordinarily reported as "compressed", but at least -z helps 991539 string =<gmr:Workbook Gnumeric spreadsheet 9916!:mime application/x-gnumeric 9917 9918#------------------------------------------------------------------------------ 9919# $File: gpt,v 1.2 2014/04/28 12:04:50 christos Exp $ 9920# 9921# GPT Partition table patterns. 9922# Author: Rogier Goossens (goossens.rogier@gmail.com) 9923# Note that a GPT-formatted disk must contain an MBR as well. 9924# 9925 9926# The initial segment (up to >>>>>>>>422) was copied from the X86 9927# partition table code (aka MBR). 9928# This is kept separate, so that MBR partitions are not reported as well. 9929# (use -k if you do want them as well) 9930 9931# First, detect the MBR partiton table 9932# If more than one GPT protective MBR partition exists, don't print anything 9933# (the other MBR detection code will then just print the MBR partition table) 99340x1FE leshort 0xAA55 9935>3 string !MS 9936>>3 string !SYSLINUX 9937>>>3 string !MTOOL 9938>>>>3 string !NEWLDR 9939>>>>>5 string !DOS 9940# not FAT (32 bit) 9941>>>>>>82 string !FAT32 9942#not Linux kernel 9943>>>>>>>514 string !HdrS 9944#not BeOS 9945>>>>>>>>422 string !Be\ Boot\ Loader 9946# GPT with protective MBR entry in partition 1 (only) 9947>>>>>>>>>450 ubyte 0xee 9948>>>>>>>>>>466 ubyte !0xee 9949>>>>>>>>>>>482 ubyte !0xee 9950>>>>>>>>>>>>498 ubyte !0xee 9951#>>>>>>>>>>>>>446 use gpt-mbr-partition 9952>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 9953>>>>>>>>>>>>>>0 use gpt-mbr-type 9954>>>>>>>>>>>>>>&-8 use gpt-table 9955>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 9956>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 9957>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 9958>>>>>>>>>>>>>>>0 use gpt-mbr-type 9959>>>>>>>>>>>>>>>&-8 use gpt-table 9960>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 9961>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 9962>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 9963>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9964>>>>>>>>>>>>>>>>&-8 use gpt-table 9965>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 9966>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 9967>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 9968>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9969>>>>>>>>>>>>>>>>>&-8 use gpt-table 9970>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 9971>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 9972>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 9973>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9974>>>>>>>>>>>>>>>>>>&-8 use gpt-table 9975>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 9976# GPT with protective MBR entry in partition 2 (only) 9977>>>>>>>>>450 ubyte !0xee 9978>>>>>>>>>>466 ubyte 0xee 9979>>>>>>>>>>>482 ubyte !0xee 9980>>>>>>>>>>>>498 ubyte !0xee 9981#>>>>>>>>>>>>>462 use gpt-mbr-partition 9982>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 9983>>>>>>>>>>>>>>0 use gpt-mbr-type 9984>>>>>>>>>>>>>>&-8 use gpt-table 9985>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 9986>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 9987>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 9988>>>>>>>>>>>>>>>0 use gpt-mbr-type 9989>>>>>>>>>>>>>>>&-8 use gpt-table 9990>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 9991>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 9992>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 9993>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9994>>>>>>>>>>>>>>>>&-8 use gpt-table 9995>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 9996>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 9997>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 9998>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 9999>>>>>>>>>>>>>>>>>&-8 use gpt-table 10000>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 10001>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 10002>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 10003>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 10004>>>>>>>>>>>>>>>>>>&-8 use gpt-table 10005>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 10006# GPT with protective MBR entry in partition 3 (only) 10007>>>>>>>>>450 ubyte !0xee 10008>>>>>>>>>>466 ubyte !0xee 10009>>>>>>>>>>>482 ubyte 0xee 10010>>>>>>>>>>>>498 ubyte !0xee 10011#>>>>>>>>>>>>>478 use gpt-mbr-partition 10012>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 10013>>>>>>>>>>>>>>0 use gpt-mbr-type 10014>>>>>>>>>>>>>>&-8 use gpt-table 10015>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 10016>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 10017>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 10018>>>>>>>>>>>>>>>0 use gpt-mbr-type 10019>>>>>>>>>>>>>>>&-8 use gpt-table 10020>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 10021>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 10022>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 10023>>>>>>>>>>>>>>>>0 use gpt-mbr-type 10024>>>>>>>>>>>>>>>>&-8 use gpt-table 10025>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 10026>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 10027>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 10028>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 10029>>>>>>>>>>>>>>>>>&-8 use gpt-table 10030>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 10031>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 10032>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 10033>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 10034>>>>>>>>>>>>>>>>>>&-8 use gpt-table 10035>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 10036# GPT with protective MBR entry in partition 4 (only) 10037>>>>>>>>>450 ubyte !0xee 10038>>>>>>>>>>466 ubyte !0xee 10039>>>>>>>>>>>482 ubyte !0xee 10040>>>>>>>>>>>>498 ubyte 0xee 10041#>>>>>>>>>>>>>494 use gpt-mbr-partition 10042>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 10043>>>>>>>>>>>>>>0 use gpt-mbr-type 10044>>>>>>>>>>>>>>&-8 use gpt-table 10045>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 10046>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 10047>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 10048>>>>>>>>>>>>>>>0 use gpt-mbr-type 10049>>>>>>>>>>>>>>>&-8 use gpt-table 10050>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 10051>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 10052>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 10053>>>>>>>>>>>>>>>>0 use gpt-mbr-type 10054>>>>>>>>>>>>>>>>&-8 use gpt-table 10055>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 10056>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 10057>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 10058>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 10059>>>>>>>>>>>>>>>>>&-8 use gpt-table 10060>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 10061>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 10062>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 10063>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 10064>>>>>>>>>>>>>>>>>>&-8 use gpt-table 10065>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 10066 10067# The following code does GPT detection and processing, including 10068# sector size detection. 10069# It has to be duplicated above because the top-level pattern 10070# (i.e. not called using 'use') must print *something* for file 10071# to count it as a match. Text only printed in named patterns is 10072# not counted, and causes file to continue, and try and match 10073# other patterns. 10074# 10075# Unfortunately, when assuming sector sizes >=16k, if the sector size 10076# happens to be 512 instead, we may find confusing data after the GPT 10077# table... If the GPT table has less than 128 entries, this may even 10078# happen for assumed sector sizes as small as 4k 10079# This could be solved by checking for the presence of the backup GPT 10080# header as well, but that makes the logic extremely complex 10081##0 name gpt-mbr-partition 10082##>(8.l*8192) string EFI\ PART 10083##>>(8.l*8192) use gpt-mbr-type 10084##>>&-8 use gpt-table 10085##>>0 ubyte x of 8192 bytes 10086##>(8.l*8192) string !EFI\ PART 10087##>>(8.l*4096) string EFI\ PART GPT partition table 10088##>>>0 use gpt-mbr-type 10089##>>>&-8 use gpt-table 10090##>>>0 ubyte x of 4096 bytes 10091##>>(8.l*4096) string !EFI\ PART 10092##>>>(8.l*2048) string EFI\ PART GPT partition table 10093##>>>>0 use gpt-mbr-type 10094##>>>>&-8 use gpt-table 10095##>>>>0 ubyte x of 2048 bytes 10096##>>>(8.l*2048) string !EFI\ PART 10097##>>>>(8.l*1024) string EFI\ PART GPT partition table 10098##>>>>>0 use gpt-mbr-type 10099##>>>>>&-8 use gpt-table 10100##>>>>>0 ubyte x of 1024 bytes 10101##>>>>(8.l*1024) string !EFI\ PART 10102##>>>>>(8.l*512) string EFI\ PART GPT partition table 10103##>>>>>>0 use gpt-mbr-type 10104##>>>>>>&-8 use gpt-table 10105##>>>>>>0 ubyte x of 512 bytes 10106 10107# Print details of MBR type for a GPT-disk 10108# Calling code ensures that there is only one 0xee partition. 101090 name gpt-mbr-type 10110# GPT with protective MBR entry in partition 1 10111>450 ubyte 0xee 10112>>454 ulelong 1 10113>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 10114>>454 ulelong !1 \b (nonstandard: not at LBA 1) 10115# GPT with protective MBR entry in partition 2 10116>466 ubyte 0xee 10117>>470 ulelong 1 10118>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 10119>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 10120>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 10121>>470 ulelong !1 \b (nonstandard: not at LBA 1) 10122# GPT with protective MBR entry in partition 3 10123>482 ubyte 0xee 10124>>486 ulelong 1 10125>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 10126>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 10127>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 10128>>486 ulelong !1 \b (nonstandard: not at LBA 1) 10129# GPT with protective MBR entry in partition 4 10130>498 ubyte 0xee 10131>>502 ulelong 1 10132>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 10133>>502 ulelong !1 \b (nonstandard: not at LBA 1) 10134 10135# Print the information from a GPT partition table structure 101360 name gpt-table 10137>10 uleshort x \b, version %u 10138>8 uleshort x \b.%u 10139>56 ulelong x \b, GUID: %08x 10140>60 uleshort x \b-%04x 10141>62 uleshort x \b-%04x 10142>64 ubeshort x \b-%04x 10143>66 ubeshort x \b-%04x 10144>68 ubelong x \b%08x 10145#>80 uleshort x \b, %d partition entries 10146>32 ulequad+1 x \b, disk size: %lld sectors 10147 10148# In case a GPT data-structure is at LBA 0, report it as well 10149# This covers systems which are not GPT-aware, and which show 10150# and allow access to the protective partition. This code will 10151# detect the contents of such a partition. 101520 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 10153>0 use gpt-table 10154>0 ubyte x (sector size unknown) 10155 10156 10157 10158#------------------------------------------------------------------------------ 10159# $File$ 10160# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 10161# 10162# ACE/gr binary 101630 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 10164>39 byte >0 - version %c 10165# ACE/gr ascii 101660 string #\ xvgr\ parameter\ file ACE/gr ascii file 101670 string #\ xmgr\ parameter\ file ACE/gr ascii file 101680 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 10169# Grace projects 101700 string #\ Grace\ project\ file Grace project file 10171>23 string @version\ (version 10172>>32 byte >0 %c 10173>>33 string >\0 \b.%.2s 10174>>35 string >\0 \b.%.2s) 10175# ACE/gr fit description files 101760 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 10177# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 10178 10179#------------------------------------------------------------------------------ 10180# $File: graphviz,v 1.7 2009/09/19 16:28:09 christos Exp $ 10181# graphviz: file(1) magic for http://www.graphviz.org/ 10182 10183# FIXME: These patterns match too generally. For example, the first 10184# line matches a LaTeX file containing the word "graph" (with a { 10185# following later) and the second line matches this file. 10186#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 10187#!:mime text/vnd.graphviz 10188#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 10189#!:mime text/vnd.graphviz 10190 10191#------------------------------------------------------------------------------ 10192# $File$ 10193# gringotts: file(1) magic for Gringotts 10194# http://devel.pluto.linux.it/projects/Gringotts/ 10195# author: Germano Rizzo <mano@pluto.linux.it> 10196#GRG3????Y 101970 string GRG Gringotts data file 10198#file format 1 10199>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 10200#file format 2 10201>3 string 2 v.2, MCRYPT S2K, 10202>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 10203>>8 byte&0x70 0x10 SERPENT crypt, 10204>>8 byte&0x70 0x20 TWOFISH crypt, 10205>>8 byte&0x70 0x30 CAST-256 crypt, 10206>>8 byte&0x70 0x40 SAFER+ crypt, 10207>>8 byte&0x70 0x50 LOKI97 crypt, 10208>>8 byte&0x70 0x60 3DES crypt, 10209>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 10210>>8 byte&0x08 0x00 SHA1 hash, 10211>>8 byte&0x08 0x08 RIPEMD-160 hash, 10212>>8 byte&0x04 0x00 ZLib 10213>>8 byte&0x04 0x04 BZip2 10214>>8 byte&0x03 0x00 lvl.0 10215>>8 byte&0x03 0x01 lvl.3 10216>>8 byte&0x03 0x02 lvl.6 10217>>8 byte&0x03 0x03 lvl.9 10218#file format 3 10219>3 string 3 v.3, OpenPGP S2K, 10220>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 10221>>8 byte&0x70 0x10 SERPENT crypt, 10222>>8 byte&0x70 0x20 TWOFISH crypt, 10223>>8 byte&0x70 0x30 CAST-256 crypt, 10224>>8 byte&0x70 0x40 SAFER+ crypt, 10225>>8 byte&0x70 0x50 LOKI97 crypt, 10226>>8 byte&0x70 0x60 3DES crypt, 10227>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 10228>>8 byte&0x08 0x00 SHA1 hash, 10229>>8 byte&0x08 0x08 RIPEMD-160 hash, 10230>>8 byte&0x04 0x00 ZLib 10231>>8 byte&0x04 0x04 BZip2 10232>>8 byte&0x03 0x00 lvl.0 10233>>8 byte&0x03 0x01 lvl.3 10234>>8 byte&0x03 0x02 lvl.6 10235>>8 byte&0x03 0x03 lvl.9 10236#file format >3 10237>3 string >3 v.%.1s (unknown details) 10238 10239#------------------------------------------------------------------------------ 10240# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 10241# Guile file magic from <dalepsmith@gmail.com> 10242# http://www.gnu.org/s/guile/ 10243# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 10244 102450 string GOOF---- Guile Object 10246>8 string LE \b, little endian 10247>8 string BE \b, big endian 10248>11 string 4 \b, 32bit 10249>11 string 8 \b, 64bit 10250>13 regex .\.. \b, bytecode v%s 10251 10252#------------------------------------------------------------------------------ 10253# $File: hitachi-sh,v 1.5 2009/09/19 16:28:09 christos Exp $ 10254# hitach-sh: file(1) magic for Hitachi Super-H 10255# 10256# Super-H COFF 10257# 10258# below test line conflicts with 2nd NTFS filesystem sector 102590 beshort 0x0500 Hitachi SH big-endian COFF 10260# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 10261#0 ubelong&0xFFFFNMPQ 0x0500NMPQ Hitachi SH big-endian COFF 10262>18 beshort&0x0002 =0x0000 object 10263>18 beshort&0x0002 =0x0002 executable 10264>18 beshort&0x0008 =0x0008 \b, stripped 10265>18 beshort&0x0008 =0x0000 \b, not stripped 10266# 102670 leshort 0x0550 Hitachi SH little-endian COFF 10268>18 leshort&0x0002 =0x0000 object 10269>18 leshort&0x0002 =0x0002 executable 10270>18 leshort&0x0008 =0x0008 \b, stripped 10271>18 leshort&0x0008 =0x0000 \b, not stripped 10272 10273 10274#------------------------------------------------------------------------------ 10275# $File: hp,v 1.23 2009/09/19 16:28:09 christos Exp $ 10276# hp: file(1) magic for Hewlett Packard machines (see also "printer") 10277# 10278# XXX - somebody should figure out whether any byte order needs to be 10279# applied to the "TML" stuff; I'm assuming the Apollo stuff is 10280# big-endian as it was mostly 68K-based. 10281# 10282# I think the 500 series was the old stack-based machines, running a 10283# UNIX environment atop the "SUN kernel"; dunno whether it was 10284# big-endian or little-endian. 10285# 10286# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 10287# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 10288# HP magic is useful for reference, but using "long" magic is a better 10289# practice in order to avoid collisions. 10290# 10291# Guy Harris (guy@netapp.com): some additions to this list came from 10292# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 10293# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 10294# "/etc/magic", though, except for the "archive file relocatable library" 10295# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 10296# used in executables, or have they just not yet updated "/etc/magic" 10297# completely? 10298# 10299# 0 beshort 200 hp200 (68010) BSD binary 10300# 0 beshort 300 hp300 (68020+68881) BSD binary 10301# 0 beshort 0x20c hp200/300 HP-UX binary 10302# 0 beshort 0x20d hp400 (68030) HP-UX binary 10303# 0 beshort 0x20e hp400 (68040?) HP-UX binary 10304# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 10305# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 10306# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 10307# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 10308 10309# 10310# The "misc" stuff needs a byte order; the archives look suspiciously 10311# like the old 177545 archives (0xff65 = 0177545). 10312# 10313#### Old Apollo stuff 103140 beshort 0627 Apollo m68k COFF executable 10315>18 beshort ^040000 not stripped 10316>22 beshort >0 - version %d 103170 beshort 0624 apollo a88k COFF executable 10318>18 beshort ^040000 not stripped 10319>22 beshort >0 - version %d 103200 long 01203604016 TML 0123 byte-order format 103210 long 01702407010 TML 1032 byte-order format 103220 long 01003405017 TML 2301 byte-order format 103230 long 01602007412 TML 3210 byte-order format 10324#### PA-RISC 1.1 103250 belong 0x02100106 PA-RISC1.1 relocatable object 103260 belong 0x02100107 PA-RISC1.1 executable 10327>168 belong &0x00000004 dynamically linked 10328>(144) belong 0x054ef630 dynamically linked 10329>96 belong >0 - not stripped 10330 103310 belong 0x02100108 PA-RISC1.1 shared executable 10332>168 belong&0x4 0x4 dynamically linked 10333>(144) belong 0x054ef630 dynamically linked 10334>96 belong >0 - not stripped 10335 103360 belong 0x0210010b PA-RISC1.1 demand-load executable 10337>168 belong&0x4 0x4 dynamically linked 10338>(144) belong 0x054ef630 dynamically linked 10339>96 belong >0 - not stripped 10340 103410 belong 0x0210010e PA-RISC1.1 shared library 10342>96 belong >0 - not stripped 10343 103440 belong 0x0210010d PA-RISC1.1 dynamic load library 10345>96 belong >0 - not stripped 10346 10347#### PA-RISC 2.0 103480 belong 0x02140106 PA-RISC2.0 relocatable object 10349 103500 belong 0x02140107 PA-RISC2.0 executable 10351>168 belong &0x00000004 dynamically linked 10352>(144) belong 0x054ef630 dynamically linked 10353>96 belong >0 - not stripped 10354 103550 belong 0x02140108 PA-RISC2.0 shared executable 10356>168 belong &0x00000004 dynamically linked 10357>(144) belong 0x054ef630 dynamically linked 10358>96 belong >0 - not stripped 10359 103600 belong 0x0214010b PA-RISC2.0 demand-load executable 10361>168 belong &0x00000004 dynamically linked 10362>(144) belong 0x054ef630 dynamically linked 10363>96 belong >0 - not stripped 10364 103650 belong 0x0214010e PA-RISC2.0 shared library 10366>96 belong >0 - not stripped 10367 103680 belong 0x0214010d PA-RISC2.0 dynamic load library 10369>96 belong >0 - not stripped 10370 10371#### 800 103720 belong 0x020b0106 PA-RISC1.0 relocatable object 10373 103740 belong 0x020b0107 PA-RISC1.0 executable 10375>168 belong&0x4 0x4 dynamically linked 10376>(144) belong 0x054ef630 dynamically linked 10377>96 belong >0 - not stripped 10378 103790 belong 0x020b0108 PA-RISC1.0 shared executable 10380>168 belong&0x4 0x4 dynamically linked 10381>(144) belong 0x054ef630 dynamically linked 10382>96 belong >0 - not stripped 10383 103840 belong 0x020b010b PA-RISC1.0 demand-load executable 10385>168 belong&0x4 0x4 dynamically linked 10386>(144) belong 0x054ef630 dynamically linked 10387>96 belong >0 - not stripped 10388 103890 belong 0x020b010e PA-RISC1.0 shared library 10390>96 belong >0 - not stripped 10391 103920 belong 0x020b010d PA-RISC1.0 dynamic load library 10393>96 belong >0 - not stripped 10394 103950 belong 0x213c6172 archive file 10396>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 10397>68 belong 0x02100619 - PA-RISC1.1 relocatable library 10398>68 belong 0x02110619 - PA-RISC1.2 relocatable library 10399>68 belong 0x02140619 - PA-RISC2.0 relocatable library 10400 10401#### 500 104020 long 0x02080106 HP s500 relocatable executable 10403>16 long >0 - version %d 10404 104050 long 0x02080107 HP s500 executable 10406>16 long >0 - version %d 10407 104080 long 0x02080108 HP s500 pure executable 10409>16 long >0 - version %d 10410 10411#### 200 104120 belong 0x020c0108 HP s200 pure executable 10413>4 beshort >0 - version %d 10414>8 belong &0x80000000 save fp regs 10415>8 belong &0x40000000 dynamically linked 10416>8 belong &0x20000000 debuggable 10417>36 belong >0 not stripped 10418 104190 belong 0x020c0107 HP s200 executable 10420>4 beshort >0 - version %d 10421>8 belong &0x80000000 save fp regs 10422>8 belong &0x40000000 dynamically linked 10423>8 belong &0x20000000 debuggable 10424>36 belong >0 not stripped 10425 104260 belong 0x020c010b HP s200 demand-load executable 10427>4 beshort >0 - version %d 10428>8 belong &0x80000000 save fp regs 10429>8 belong &0x40000000 dynamically linked 10430>8 belong &0x20000000 debuggable 10431>36 belong >0 not stripped 10432 104330 belong 0x020c0106 HP s200 relocatable executable 10434>4 beshort >0 - version %d 10435>6 beshort >0 - highwater %d 10436>8 belong &0x80000000 save fp regs 10437>8 belong &0x20000000 debuggable 10438>8 belong &0x10000000 PIC 10439 104400 belong 0x020a0108 HP s200 (2.x release) pure executable 10441>4 beshort >0 - version %d 10442>36 belong >0 not stripped 10443 104440 belong 0x020a0107 HP s200 (2.x release) executable 10445>4 beshort >0 - version %d 10446>36 belong >0 not stripped 10447 104480 belong 0x020c010e HP s200 shared library 10449>4 beshort >0 - version %d 10450>6 beshort >0 - highwater %d 10451>36 belong >0 not stripped 10452 104530 belong 0x020c010d HP s200 dynamic load library 10454>4 beshort >0 - version %d 10455>6 beshort >0 - highwater %d 10456>36 belong >0 not stripped 10457 10458#### MISC 104590 long 0x0000ff65 HP old archive 104600 long 0x020aff65 HP s200 old archive 104610 long 0x020cff65 HP s200 old archive 104620 long 0x0208ff65 HP s500 old archive 10463 104640 long 0x015821a6 HP core file 10465 104660 long 0x4da7eee8 HP-WINDOWS font 10467>8 byte >0 - version %d 104680 string Bitmapfile HP Bitmapfile 10469 104700 string IMGfile CIS compimg HP Bitmapfile 10471# XXX - see "lif" 10472#0 short 0x8000 lif file 104730 long 0x020c010c compiled Lisp 10474 104750 string msgcat01 HP NLS message catalog, 10476>8 long >0 %d messages 10477 10478# Summary: HP-48/49 calculator 10479# Created by: phk@data.fls.dk 10480# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 10481# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 104820 string HPHP HP 10483>4 string 48 48 binary 10484>4 string 49 49 binary 10485>7 byte >64 - Rev %c 10486>8 leshort 0x2911 (ADR) 10487>8 leshort 0x2933 (REAL) 10488>8 leshort 0x2955 (LREAL) 10489>8 leshort 0x2977 (COMPLX) 10490>8 leshort 0x299d (LCOMPLX) 10491>8 leshort 0x29bf (CHAR) 10492>8 leshort 0x29e8 (ARRAY) 10493>8 leshort 0x2a0a (LNKARRAY) 10494>8 leshort 0x2a2c (STRING) 10495>8 leshort 0x2a4e (HXS) 10496>8 leshort 0x2a74 (LIST) 10497>8 leshort 0x2a96 (DIR) 10498>8 leshort 0x2ab8 (ALG) 10499>8 leshort 0x2ada (UNIT) 10500>8 leshort 0x2afc (TAGGED) 10501>8 leshort 0x2b1e (GROB) 10502>8 leshort 0x2b40 (LIB) 10503>8 leshort 0x2b62 (BACKUP) 10504>8 leshort 0x2b88 (LIBDATA) 10505>8 leshort 0x2d9d (PROG) 10506>8 leshort 0x2dcc (CODE) 10507>8 leshort 0x2e48 (GNAME) 10508>8 leshort 0x2e6d (LNAME) 10509>8 leshort 0x2e92 (XLIB) 10510 105110 string %%HP: HP text 10512>6 string T(0) - T(0) 10513>6 string T(1) - T(1) 10514>6 string T(2) - T(2) 10515>6 string T(3) - T(3) 10516>10 string A(D) A(D) 10517>10 string A(R) A(R) 10518>10 string A(G) A(G) 10519>14 string F(.) F(.); 10520>14 string F(,) F(,); 10521 10522 10523# Summary: HP-38/39 calculator 10524# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 105250 string HP3 10526>3 string 8 HP 38 10527>3 string 9 HP 39 10528>4 string Bin binary 10529>4 string Asc ASCII 10530>7 string A (Directory List) 10531>7 string B (Zaplet) 10532>7 string C (Note) 10533>7 string D (Program) 10534>7 string E (Variable) 10535>7 string F (List) 10536>7 string G (Matrix) 10537>7 string H (Library) 10538>7 string I (Target List) 10539>7 string J (ASCII Vector specification) 10540>7 string K (wildcard) 10541 10542# Summary: HP-38/39 calculator 10543# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 105440 string HP3 10545>3 string 8 HP 38 10546>3 string 9 HP 39 10547>4 string Bin binary 10548>4 string Asc ASCII 10549>7 string A (Directory List) 10550>7 string B (Zaplet) 10551>7 string C (Note) 10552>7 string D (Program) 10553>7 string E (Variable) 10554>7 string F (List) 10555>7 string G (Matrix) 10556>7 string H (Library) 10557>7 string I (Target List) 10558>7 string J (ASCII Vector specification) 10559>7 string K (wildcard) 10560 10561# hpBSD magic numbers 105620 beshort 200 hp200 (68010) BSD 10563>2 beshort 0407 impure binary 10564>2 beshort 0410 read-only binary 10565>2 beshort 0413 demand paged binary 105660 beshort 300 hp300 (68020+68881) BSD 10567>2 beshort 0407 impure binary 10568>2 beshort 0410 read-only binary 10569>2 beshort 0413 demand paged binary 10570# 10571# From David Gero <dgero@nortelnetworks.com> 10572# HP-UX 10.20 core file format from /usr/include/sys/core.h 10573# Unfortunately, HP-UX uses corehead blocks without specifying the order 10574# There are four we care about: 10575# CORE_KERNEL, which starts with the string "HP-UX" 10576# CORE_EXEC, which contains the name of the command 10577# CORE_PROC, which contains the signal number that caused the core dump 10578# CORE_FORMAT, which contains the version of the core file format (== 1) 10579# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 10580# but we include all 6 variations of the order of the first 3, and 10581# assume that PROC will always be last 10582# Order 1: KERNEL, EXEC, FORMAT, PROC 105830x10 string HP-UX 10584>0 belong 2 10585>>0xC belong 0x3C 10586>>>0x4C belong 0x100 10587>>>>0x58 belong 0x44 10588>>>>>0xA0 belong 1 10589>>>>>>0xAC belong 4 10590>>>>>>>0xB0 belong 1 10591>>>>>>>>0xB4 belong 4 core file 10592>>>>>>>>>0x90 string >\0 from '%s' 10593>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10594>>>>>>>>>0xC4 belong 4 - received SIGILL 10595>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10596>>>>>>>>>0xC4 belong 6 - received SIGABRT 10597>>>>>>>>>0xC4 belong 7 - received SIGEMT 10598>>>>>>>>>0xC4 belong 8 - received SIGFPE 10599>>>>>>>>>0xC4 belong 10 - received SIGBUS 10600>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10601>>>>>>>>>0xC4 belong 12 - received SIGSYS 10602>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10603>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10604# Order 2: KERNEL, FORMAT, EXEC, PROC 10605>>>0x4C belong 1 10606>>>>0x58 belong 4 10607>>>>>0x5C belong 1 10608>>>>>>0x60 belong 0x100 10609>>>>>>>0x6C belong 0x44 10610>>>>>>>>0xB4 belong 4 core file 10611>>>>>>>>>0xA4 string >\0 from '%s' 10612>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10613>>>>>>>>>0xC4 belong 4 - received SIGILL 10614>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10615>>>>>>>>>0xC4 belong 6 - received SIGABRT 10616>>>>>>>>>0xC4 belong 7 - received SIGEMT 10617>>>>>>>>>0xC4 belong 8 - received SIGFPE 10618>>>>>>>>>0xC4 belong 10 - received SIGBUS 10619>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10620>>>>>>>>>0xC4 belong 12 - received SIGSYS 10621>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10622>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10623# Order 3: FORMAT, KERNEL, EXEC, PROC 106240x24 string HP-UX 10625>0 belong 1 10626>>0xC belong 4 10627>>>0x10 belong 1 10628>>>>0x14 belong 2 10629>>>>>0x20 belong 0x3C 10630>>>>>>0x60 belong 0x100 10631>>>>>>>0x6C belong 0x44 10632>>>>>>>>0xB4 belong 4 core file 10633>>>>>>>>>0xA4 string >\0 from '%s' 10634>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10635>>>>>>>>>0xC4 belong 4 - received SIGILL 10636>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10637>>>>>>>>>0xC4 belong 6 - received SIGABRT 10638>>>>>>>>>0xC4 belong 7 - received SIGEMT 10639>>>>>>>>>0xC4 belong 8 - received SIGFPE 10640>>>>>>>>>0xC4 belong 10 - received SIGBUS 10641>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10642>>>>>>>>>0xC4 belong 12 - received SIGSYS 10643>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10644>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10645# Order 4: EXEC, KERNEL, FORMAT, PROC 106460x64 string HP-UX 10647>0 belong 0x100 10648>>0xC belong 0x44 10649>>>0x54 belong 2 10650>>>>0x60 belong 0x3C 10651>>>>>0xA0 belong 1 10652>>>>>>0xAC belong 4 10653>>>>>>>0xB0 belong 1 10654>>>>>>>>0xB4 belong 4 core file 10655>>>>>>>>>0x44 string >\0 from '%s' 10656>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10657>>>>>>>>>0xC4 belong 4 - received SIGILL 10658>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10659>>>>>>>>>0xC4 belong 6 - received SIGABRT 10660>>>>>>>>>0xC4 belong 7 - received SIGEMT 10661>>>>>>>>>0xC4 belong 8 - received SIGFPE 10662>>>>>>>>>0xC4 belong 10 - received SIGBUS 10663>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10664>>>>>>>>>0xC4 belong 12 - received SIGSYS 10665>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10666>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10667# Order 5: FORMAT, EXEC, KERNEL, PROC 106680x78 string HP-UX 10669>0 belong 1 10670>>0xC belong 4 10671>>>0x10 belong 1 10672>>>>0x14 belong 0x100 10673>>>>>0x20 belong 0x44 10674>>>>>>0x68 belong 2 10675>>>>>>>0x74 belong 0x3C 10676>>>>>>>>0xB4 belong 4 core file 10677>>>>>>>>>0x58 string >\0 from '%s' 10678>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10679>>>>>>>>>0xC4 belong 4 - received SIGILL 10680>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10681>>>>>>>>>0xC4 belong 6 - received SIGABRT 10682>>>>>>>>>0xC4 belong 7 - received SIGEMT 10683>>>>>>>>>0xC4 belong 8 - received SIGFPE 10684>>>>>>>>>0xC4 belong 10 - received SIGBUS 10685>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10686>>>>>>>>>0xC4 belong 12 - received SIGSYS 10687>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10688>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10689# Order 6: EXEC, FORMAT, KERNEL, PROC 10690>0 belong 0x100 10691>>0xC belong 0x44 10692>>>0x54 belong 1 10693>>>>0x60 belong 4 10694>>>>>0x64 belong 1 10695>>>>>>0x68 belong 2 10696>>>>>>>0x74 belong 0x2C 10697>>>>>>>>0xB4 belong 4 core file 10698>>>>>>>>>0x44 string >\0 from '%s' 10699>>>>>>>>>0xC4 belong 3 - received SIGQUIT 10700>>>>>>>>>0xC4 belong 4 - received SIGILL 10701>>>>>>>>>0xC4 belong 5 - received SIGTRAP 10702>>>>>>>>>0xC4 belong 6 - received SIGABRT 10703>>>>>>>>>0xC4 belong 7 - received SIGEMT 10704>>>>>>>>>0xC4 belong 8 - received SIGFPE 10705>>>>>>>>>0xC4 belong 10 - received SIGBUS 10706>>>>>>>>>0xC4 belong 11 - received SIGSEGV 10707>>>>>>>>>0xC4 belong 12 - received SIGSYS 10708>>>>>>>>>0xC4 belong 33 - received SIGXCPU 10709>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 10710 10711 10712 10713#------------------------------------------------------------------------------ 10714# $File$ 10715# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 10716# Magic too short! 10717#0 string HU Human68k 10718#>68 string LZX LZX compressed 10719#>>72 string >\0 (version %s) 10720#>(8.L+74) string LZX LZX compressed 10721#>>(8.L+78) string >\0 (version %s) 10722#>60 belong >0 binded 10723#>(8.L+66) string #HUPAIR hupair 10724#>0 string HU X executable 10725#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 10726#>4 belong >0 - base address 0x%x 10727#>28 belong >0 not stripped 10728#>32 belong >0 with debug information 10729#0 beshort 0x601a Human68k Z executable 10730#0 beshort 0x6000 Human68k object file 10731#0 belong 0xd1000000 Human68k ar binary archive 10732#0 belong 0xd1010000 Human68k ar ascii archive 10733#0 beshort 0x0068 Human68k lib archive 10734#4 string LZX Human68k LZX compressed 10735#>8 string >\0 (version %s) 10736#>4 string LZX R executable 10737#2 string #HUPAIR Human68k hupair R executable 10738 10739#------------------------------------------------------------------------------ 10740# $File: ibm370,v 1.8 2009/09/19 16:28:09 christos Exp $ 10741# ibm370: file(1) magic for IBM 370 and compatibles. 10742# 10743# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 10744# What the heck *is* "USS/370"? 10745# AIX 4.1's "/etc/magic" has 10746# 10747# 0 short 0535 370 sysV executable 10748# >12 long >0 not stripped 10749# >22 short >0 - version %d 10750# >30 long >0 - 5.2 format 10751# 0 short 0530 370 sysV pure executable 10752# >12 long >0 not stripped 10753# >22 short >0 - version %d 10754# >30 long >0 - 5.2 format 10755# 10756# instead of the "USS/370" versions of the same magic numbers. 10757# 107580 beshort 0537 370 XA sysV executable 10759>12 belong >0 not stripped 10760>22 beshort >0 - version %d 10761>30 belong >0 - 5.2 format 107620 beshort 0532 370 XA sysV pure executable 10763>12 belong >0 not stripped 10764>22 beshort >0 - version %d 10765>30 belong >0 - 5.2 format 107660 beshort 054001 370 sysV pure executable 10767>12 belong >0 not stripped 107680 beshort 055001 370 XA sysV pure executable 10769>12 belong >0 not stripped 107700 beshort 056401 370 sysV executable 10771>12 belong >0 not stripped 107720 beshort 057401 370 XA sysV executable 10773>12 belong >0 not stripped 107740 beshort 0531 SVR2 executable (Amdahl-UTS) 10775>12 belong >0 not stripped 10776>24 belong >0 - version %d 107770 beshort 0534 SVR2 pure executable (Amdahl-UTS) 10778>12 belong >0 not stripped 10779>24 belong >0 - version %d 107800 beshort 0530 SVR2 pure executable (USS/370) 10781>12 belong >0 not stripped 10782>24 belong >0 - version %d 107830 beshort 0535 SVR2 executable (USS/370) 10784>12 belong >0 not stripped 10785>24 belong >0 - version %d 10786 10787#------------------------------------------------------------------------------ 10788# $File: ibm6000,v 1.11 2013/01/08 20:13:01 christos Exp $ 10789# ibm6000: file(1) magic for RS/6000 and the RT PC. 10790# 107910 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 10792>12 belong >0 not stripped 10793# Breaks sun4 statically linked execs. 10794#0 beshort 0x0103 executable (RT Version 2) or obj module 10795#>2 byte 0x50 pure 10796#>28 belong >0 not stripped 10797#>6 beshort >0 - version %ld 107980 beshort 0x0104 shared library 107990 beshort 0x0105 ctab data 108000 beshort 0xfe04 structured file 108010 string 0xabcdef AIX message catalog 108020 belong 0x000001f9 AIX compiled message catalog 108030 string \<aiaff> archive 108040 string \<bigaf> archive (big format) 10805 108060 beshort 0x01f7 64-bit XCOFF executable or object module 10807>20 belong 0 not stripped 10808# GRR: this test is still too general as it catches also many FATs of DOS filesystems 108094 belong &0x0feeddb0 10810# real core dump could not be 32-bit and 64-bit together 10811>7 byte&0x03 !3 AIX core file 10812>>1 byte &0x01 fulldump 10813>>7 byte &0x01 32-bit 10814>>>0x6e0 string >\0 \b, %s 10815>>7 byte &0x02 64-bit 10816>>>0x524 string >\0 \b, %s 10817 10818#------------------------------------------------------------------------------ 10819# $File$ 10820# icc: file(1) magic for International Color Consortium file formats 10821 10822# 10823# Color profiles as per the ICC's "Image technology colour management - 10824# Architecture, profile format, and data structure" specification. 10825# See 10826# 10827# http://www.color.org/specification/ICC1v43_2010-12.pdf 10828# 10829# for Specification ICC.1:2010 (Profile version 4.3.0.0). 10830# 10831# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 10832# bytes 40 to 43 "may be used to identify the primary platform/operating 10833# system framework for which the profile was created". 10834# 10835# There are other fields that might be worth dumping as well. 10836# 10837 10838# This appears to be what's used for Apple ColorSync profiles. 10839# Instead of adding that, Apple just changed the generic "acsp" entry 10840# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 10841# Management System, ICC Profile". 10842# Yes, it's "APPL", not "AAPL"; see the spec. 1084336 string acspAPPL ColorSync ICC Profile 10844!:mime application/vnd.iccprofile 10845 10846# Microsoft ICM color profile 1084736 string acspMSFT Microsoft ICM Color Profile 10848!:mime application/vnd.iccprofile 10849 10850# Yes, that's a blank after "SGI". 1085136 string acspSGI\ SGI ICC Profile 10852!:mime application/vnd.iccprofile 10853 10854# XXX - is this what's used for the Sun KCMS or not? The standard file 10855# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 10856# and there *is* an identified "primary platform" value of SUNW. 1085736 string acspSUNW Sun KCMS ICC Profile 10858!:mime application/vnd.iccprofile 10859 10860# Any other profile. 10861# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 10862# and use "acsp" for everything else and dump the "primary platform" 10863# string in those cases? 1086436 string acsp ICC Profile 10865!:mime application/vnd.iccprofile 10866 10867 10868 10869#------------------------------------------------------------------------------ 10870# $File: iff,v 1.12 2009/09/19 16:28:09 christos Exp $ 10871# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 10872# 10873# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 10874# Arts for file interchange. It has also been used by Apple, SGI, and 10875# especially Commodore-Amiga. 10876# 10877# IFF files begin with an 8 byte FORM header, followed by a 4 character 10878# FORM type, which is followed by the first chunk in the FORM. 10879 108800 string FORM IFF data 10881#>4 belong x \b, FORM is %d bytes long 10882# audio formats 10883>8 string AIFF \b, AIFF audio 10884!:mime audio/x-aiff 10885>8 string AIFC \b, AIFF-C compressed audio 10886!:mime audio/x-aiff 10887>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 10888!:mime audio/x-aiff 10889>8 string 16SV \b, 16SV 16-bit sampled sound voice 10890>8 string SAMP \b, SAMP sampled audio 10891>8 string MAUD \b, MAUD MacroSystem audio 10892>8 string SMUS \b, SMUS simple music 10893>8 string CMUS \b, CMUS complex music 10894# image formats 10895>8 string ILBMBMHD \b, ILBM interleaved image 10896>>20 beshort x \b, %d x 10897>>22 beshort x %d 10898>8 string RGBN \b, RGBN 12-bit RGB image 10899>8 string RGB8 \b, RGB8 24-bit RGB image 10900>8 string DEEP \b, DEEP TVPaint/XiPaint image 10901>8 string DR2D \b, DR2D 2-D object 10902>8 string TDDD \b, TDDD 3-D rendering 10903>8 string LWOB \b, LWOB 3-D object 10904>8 string LWO2 \b, LWO2 3-D object, v2 10905>8 string LWLO \b, LWLO 3-D layered object 10906>8 string REAL \b, REAL Real3D rendering 10907>8 string MC4D \b, MC4D MaxonCinema4D rendering 10908>8 string ANIM \b, ANIM animation 10909>8 string YAFA \b, YAFA animation 10910>8 string SSA\ \b, SSA super smooth animation 10911>8 string ACBM \b, ACBM continuous image 10912>8 string FAXX \b, FAXX fax image 10913# other formats 10914>8 string FTXT \b, FTXT formatted text 10915>8 string CTLG \b, CTLG message catalog 10916>8 string PREF \b, PREF preferences 10917>8 string DTYP \b, DTYP datatype description 10918>8 string PTCH \b, PTCH binary patch 10919>8 string AMFF \b, AMFF AmigaMetaFile format 10920>8 string WZRD \b, WZRD StormWIZARD resource 10921>8 string DOC\ \b, DOC desktop publishing document 10922>8 string WVQA \b, Westwood Studios VQA Multimedia, 10923>>24 leshort x %d video frames, 10924>>26 leshort x %d x 10925>>28 leshort x %d 10926>8 string MOVE \b, Wing Commander III Video 10927>>12 string _PC_ \b, PC version 10928>>12 string 3DO_ \b, 3DO version 10929 10930# These go at the end of the iff rules 10931# 10932# I don't see why these might collide with anything else. 10933# 10934# Interactive Fiction related formats 10935# 10936>8 string IFRS \b, Blorb Interactive Fiction 10937>>24 string Exec with executable chunk 10938>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 10939 10940#------------------------------------------------------------------------------ 10941# $File: images,v 1.105 2015/02/14 17:30:03 christos Exp $ 10942# images: file(1) magic for image formats (see also "iff", and "c-lang" for 10943# XPM bitmaps) 10944# 10945# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 10946# additions by janl@ifi.uio.no as well as others. Jan also suggested 10947# merging several one- and two-line files into here. 10948# 10949# little magic: PCX (first byte is 0x0a) 10950 10951# Targa - matches `povray', `ppmtotga' and `xv' outputs 10952# by Philippe De Muyter <phdm@macqel.be> 10953# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 10954# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 10955# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 10956# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 10957# `tgatoppm' recognizes a superset (Index may be anything) 109581 belong&0xfff7ffff 0x01010000 Targa image data - Map 10959!:strength + 2 10960>2 byte&8 8 - RLE 10961>12 leshort >0 %d x 10962>14 leshort >0 %d 109631 belong&0xfff7ffff 0x00020000 Targa image data - RGB 10964!:strength + 2 10965>2 byte&8 8 - RLE 10966>12 leshort >0 %d x 10967>14 leshort >0 %d 109681 belong&0xfff7ffff 0x00030000 Targa image data - Mono 10969!:strength + 2 10970>2 byte&8 8 - RLE 10971>12 leshort >0 %d x 10972>14 leshort >0 %d 10973 10974# PBMPLUS images 10975# The next byte following the magic is always whitespace. 10976# strength is changed to try these patterns before "x86 boot sector" 109770 name netpbm 10978>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm PPM image data 10979>>&0 regex =[0-9]{1,50} \b, size = %s x 10980>>>&0 regex =[0-9]{1,50} \b %s 10981 109820 search/1 P1 10983>0 use netpbm 10984>>0 string x \b, bitmap 10985!:strength + 45 10986!:mime image/x-portable-bitmap 10987 109880 search/1 P2 10989>0 use netpbm 10990>>0 string x \b, greymap 10991!:strength + 45 10992!:mime image/x-portable-greymap 10993 109940 search/1 P3 10995>0 use netpbm 10996>>0 string x \b, pixmap 10997!:strength + 45 10998!:mime image/x-portable-pixmap 10999 11000 110010 string P4 11002>0 use netpbm 11003>>0 string x \b, rawbits, bitmap 11004!:strength + 45 11005!:mime image/x-portable-bitmap 11006 110070 string P5 11008>0 use netpbm 11009>>0 string x \b, rawbits, greymap 11010!:strength + 45 11011!:mime image/x-portable-greymap 11012 110130 string P6 11014>0 use netpbm 11015>>0 string x \b, rawbits, pixmap 11016!:strength + 45 11017!:mime image/x-portable-pixmap 11018 110190 string P7 Netpbm PAM image file 11020!:mime image/x-portable-pixmap 11021 11022# From: bryanh@giraffe-data.com (Bryan Henderson) 110230 string \117\072 Solitaire Image Recorder format 11024>4 string \013 MGI Type 11 11025>4 string \021 MGI Type 17 110260 string .MDA MicroDesign data 11027>21 byte 48 version 2 11028>21 byte 51 version 3 110290 string .MDP MicroDesign page data 11030>21 byte 48 version 2 11031>21 byte 51 version 3 11032 11033# NIFF (Navy Interchange File Format, a modification of TIFF) images 11034# [GRR: this *must* go before TIFF] 110350 string IIN1 NIFF image data 11036!:mime image/x-niff 11037 11038# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 11039# (CIFF) file. These are apparently all little-endian. 11040# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11041# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 110420 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 11043!:mime image/x-canon-crw 11044>16 leshort x \b, version %d. 11045>14 leshort x \b%d 11046 11047# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 11048# number. Put this above the TIFF test to make sure we detect them. 11049# These are apparently all little-endian. 11050# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11051# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 110520 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 11053!:mime image/x-canon-cr2 11054>10 byte x \b, version %d. 11055>11 byte x \b%d 11056 11057# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 11058# The second word of TIFF files is the TIFF version number, 42, which has 11059# never changed. The TIFF specification recommends testing for it. 110600 string MM\x00\x2a TIFF image data, big-endian 11061!:mime image/tiff 11062>(4.L) use \^tiff_ifd 110630 string II\x2a\x00 TIFF image data, little-endian 11064!:mime image/tiff 11065>(4.l) use tiff_ifd 11066 110670 name tiff_ifd 11068>0 leshort x \b, direntries=%d 11069>2 use tiff_entry 11070 110710 name tiff_entry 11072# NewSubFileType 11073>0 leshort 0xfe 11074>>12 use tiff_entry 11075>0 leshort 0x100 11076>>4 lelong 1 11077>>>12 use tiff_entry 11078>>>8 leshort x \b, width=%d 11079>0 leshort 0x101 11080>>4 lelong 1 11081>>>8 leshort x \b, height=%d 11082>>>12 use tiff_entry 11083>0 leshort 0x102 11084>>8 leshort x \b, bps=%d 11085>>12 use tiff_entry 11086>0 leshort 0x103 11087>>4 lelong 1 \b, compression= 11088>>>8 leshort 1 \bnone 11089>>>8 leshort 2 \bhuffman 11090>>>8 leshort 3 \bbi-level group 3 11091>>>8 leshort 4 \bbi-level group 4 11092>>>8 leshort 5 \bLZW 11093>>>8 leshort 6 \bJPEG (old) 11094>>>8 leshort 7 \bJPEG 11095>>>8 leshort 8 \bdeflate 11096>>>8 leshort 9 \bJBIG, ITU-T T.85 11097>>>8 leshort 0xa \bJBIG, ITU-T T.43 11098>>>8 leshort 0x7ffe \bNeXT RLE 2-bit 11099>>>8 leshort 0x8005 \bPackBits (Macintosh RLE) 11100>>>8 leshort 0x8029 \bThunderscan RLE 11101>>>8 leshort 0x807f \bRasterPadding (CT or MP) 11102>>>8 leshort 0x8080 \bRLE (Line Work) 11103>>>8 leshort 0x8081 \bRLE (High-Res Cont-Tone) 11104>>>8 leshort 0x8082 \bRLE (Binary Line Work) 11105>>>8 leshort 0x80b2 \bDeflate (PKZIP) 11106>>>8 leshort 0x80b3 \bKodak DCS 11107>>>8 leshort 0x8765 \bJBIG 11108>>>8 leshort 0x8798 \bJPEG2000 11109>>>8 leshort 0x8799 \bNikon NEF Compressed 11110>>>8 default x 11111>>>>8 leshort x \b(unknown 0x%x) 11112>>>12 use tiff_entry 11113>0 leshort 0x106 \b, PhotometricIntepretation= 11114>>8 clear x 11115>>8 leshort 0 \bWhiteIsZero 11116>>8 leshort 1 \bBlackIsZero 11117>>8 leshort 2 \bRGB 11118>>8 leshort 3 \bRGB Palette 11119>>8 leshort 4 \bTransparency Mask 11120>>8 leshort 5 \bCMYK 11121>>8 leshort 6 \bYCbCr 11122>>8 leshort 8 \bCIELab 11123>>8 default x 11124>>>8 leshort x \b(unknown=0x%x) 11125>>12 use tiff_entry 11126# FillOrder 11127>0 leshort 0x10a 11128>>4 lelong 1 11129>>>12 use tiff_entry 11130# DocumentName 11131>0 leshort 0x10d 11132>>(8.l) string x \b, name=%s 11133>>>12 use tiff_entry 11134# ImageDescription 11135>0 leshort 0x10e 11136>>(8.l) string x \b, description=%s 11137>>>12 use tiff_entry 11138# Make 11139>0 leshort 0x10f 11140>>(8.l) string x \b, manufacturer=%s 11141>>>12 use tiff_entry 11142# Model 11143>0 leshort 0x110 11144>>(8.l) string x \b, model=%s 11145>>>12 use tiff_entry 11146# StripOffsets 11147>0 leshort 0x111 11148>>12 use tiff_entry 11149# Orientation 11150>0 leshort 0x112 \b, orientation= 11151>>8 leshort 1 \bupper-left 11152>>8 leshort 3 \blower-right 11153>>8 leshort 6 \bupper-right 11154>>8 leshort 8 \blower-left 11155>>8 leshort 9 \bundefined 11156>>8 default x 11157>>>8 leshort x \b[*%d*] 11158>>12 use tiff_entry 11159# XResolution 11160>0 leshort 0x11a 11161>>8 lelong x \b, xresolution=%d 11162>>12 use tiff_entry 11163# YResolution 11164>0 leshort 0x11b 11165>>8 lelong x \b, yresolution=%d 11166>>12 use tiff_entry 11167# ResolutionUnit 11168>0 leshort 0x128 11169>>8 leshort x \b, resolutionunit=%d 11170>>12 use tiff_entry 11171# Software 11172>0 leshort 0x131 11173>>(8.l) string x \b, software=%s 11174>>12 use tiff_entry 11175# Datetime 11176>0 leshort 0x132 11177>>(8.l) string x \b, datetime=%s 11178>>12 use tiff_entry 11179# HostComputer 11180>0 leshort 0x13c 11181>>(8.l) string x \b, hostcomputer=%s 11182>>12 use tiff_entry 11183# WhitePoint 11184>0 leshort 0x13e 11185>>12 use tiff_entry 11186# PrimaryChromaticities 11187>0 leshort 0x13f 11188>>12 use tiff_entry 11189# YCbCrCoefficients 11190>0 leshort 0x211 11191>>12 use tiff_entry 11192# YCbCrPositioning 11193>0 leshort 0x213 11194>>12 use tiff_entry 11195# ReferenceBlackWhite 11196>0 leshort 0x214 11197>>12 use tiff_entry 11198# Copyright 11199>0 leshort 0x8298 11200>>(8.l) string x \b, copyright=%s 11201>>12 use tiff_entry 11202# ExifOffset 11203>0 leshort 0x8769 11204>>12 use tiff_entry 11205# GPS IFD 11206>0 leshort 0x8825 \b, GPS-Data 11207>>12 use tiff_entry 11208 11209#>0 leshort x \b, unknown=0x%x 11210#>>12 use tiff_entry 11211 112120 string MM\x00\x2b Big TIFF image data, big-endian 11213!:mime image/tiff 112140 string II\x2b\x00 Big TIFF image data, little-endian 11215!:mime image/tiff 11216 11217# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 11218# (Greg Roelofs, newt@uchicago.edu) 11219# (Albert Cahalan, acahalan@cs.uml.edu) 11220# 11221# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... 11222# 112230 string \x89PNG\x0d\x0a\x1a\x0a PNG image data 11224!:mime image/png 11225>16 belong x \b, %d x 11226>20 belong x %d, 11227>24 byte x %d-bit 11228>25 byte 0 grayscale, 11229>25 byte 2 \b/color RGB, 11230>25 byte 3 colormap, 11231>25 byte 4 gray+alpha, 11232>25 byte 6 \b/color RGBA, 11233#>26 byte 0 deflate/32K, 11234>28 byte 0 non-interlaced 11235>28 byte 1 interlaced 11236 11237# possible GIF replacements; none yet released! 11238# (Greg Roelofs, newt@uchicago.edu) 11239# 11240# GRR 950115: this was mine ("Zip GIF"): 112410 string GIF94z ZIF image (GIF+deflate alpha) 11242!:mime image/x-unknown 11243# 11244# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 11245# 112460 string FGF95a FGF image (GIF+deflate beta) 11247!:mime image/x-unknown 11248# 11249# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 11250# (best; not yet implemented): 11251# 112520 string PBF PBF image (deflate compression) 11253!:mime image/x-unknown 11254 11255# GIF 112560 string GIF8 GIF image data 11257!:mime image/gif 11258!:apple 8BIMGIFf 11259>4 string 7a \b, version 8%s, 11260>4 string 9a \b, version 8%s, 11261>6 leshort >0 %d x 11262>8 leshort >0 %d 11263#>10 byte &0x80 color mapped, 11264#>10 byte&0x07 =0x00 2 colors 11265#>10 byte&0x07 =0x01 4 colors 11266#>10 byte&0x07 =0x02 8 colors 11267#>10 byte&0x07 =0x03 16 colors 11268#>10 byte&0x07 =0x04 32 colors 11269#>10 byte&0x07 =0x05 64 colors 11270#>10 byte&0x07 =0x06 128 colors 11271#>10 byte&0x07 =0x07 256 colors 11272 11273# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 11274# 1 plane, no encoding. 112750 string \361\0\100\273 CMU window manager raster image data 11276>4 lelong >0 %d x 11277>8 lelong >0 %d, 11278>12 lelong >0 %d-bit 11279 11280# Magick Image File Format 112810 string id=ImageMagick MIFF image data 11282 11283# Artisan 112840 long 1123028772 Artisan image data 11285>4 long 1 \b, rectangular 24-bit 11286>4 long 2 \b, rectangular 8-bit with colormap 11287>4 long 3 \b, rectangular 32-bit (24-bit with matte) 11288 11289# FIG (Facility for Interactive Generation of figures), an object-based format 112900 search/1 #FIG FIG image text 11291>5 string x \b, version %.3s 11292 11293# PHIGS 112940 string ARF_BEGARF PHIGS clear text archive 112950 string @(#)SunPHIGS SunPHIGS 11296# version number follows, in the form m.n 11297>40 string SunBin binary 11298>32 string archive archive 11299 11300# GKS (Graphics Kernel System) 113010 string GKSM GKS Metafile 11302>24 string SunGKS \b, SunGKS 11303 11304# CGM image files 113050 string BEGMF clear text Computer Graphics Metafile 11306 11307# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 113080 string yz MGR bitmap, modern format, 8-bit aligned 113090 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 113100 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 113110 string yx MGR bitmap, modern format, squeezed 11312 11313# Fuzzy Bitmap (FBM) images 113140 string %bitmap\0 FBM image data 11315>30 long 0x31 \b, mono 11316>30 long 0x33 \b, color 11317 11318# facsimile data 113191 string PC\ Research,\ Inc group 3 fax data 11320>29 byte 0 \b, normal resolution (204x98 DPI) 11321>29 byte 1 \b, fine resolution (204x196 DPI) 11322# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 113230 string Sfff structured fax file 11324 11325# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 11326# most files with the extension .EPA and some with .BMP 113270 string \x11\x06 Award BIOS Logo, 136 x 84 11328!:mime image/x-award-bioslogo 113290 string \x11\x09 Award BIOS Logo, 136 x 126 11330!:mime image/x-award-bioslogo 11331#0 string \x07\x1f BIOS Logo corrupted? 11332# http://www.blackfiveservices.co.uk/awbmtools.shtml 11333# http://biosgfx.narod.ru/v3/ 11334# http://biosgfx.narod.ru/abr-2/ 113350 string AWBM 11336>4 leshort <1981 Award BIOS bitmap 11337!:mime image/x-award-bmp 11338# image width is a multiple of 4 11339>>4 leshort&0x0003 0 11340>>>4 leshort x \b, %d 11341>>>6 leshort x x %d 11342>>4 leshort&0x0003 >0 \b, 11343>>>4 leshort&0x0003 =1 11344>>>>4 leshort x %d+3 11345>>>4 leshort&0x0003 =2 11346>>>>4 leshort x %d+2 11347>>>4 leshort&0x0003 =3 11348>>>>4 leshort x %d+1 11349>>>6 leshort x x %d 11350# at offset 8 starts imagedata followed by "RGB " marker 11351 11352# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 11353# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 11354# 28bitmap_information_header.29 113550 string BM 11356>14 leshort 12 PC bitmap, OS/2 1.x format 11357!:mime image/x-ms-bmp 11358>>18 leshort x \b, %d x 11359>>20 leshort x %d 11360>14 leshort 64 PC bitmap, OS/2 2.x format 11361!:mime image/x-ms-bmp 11362>>18 leshort x \b, %d x 11363>>20 leshort x %d 11364>14 leshort 40 PC bitmap, Windows 3.x format 11365!:mime image/x-ms-bmp 11366>>18 lelong x \b, %d x 11367>>22 lelong x %d x 11368>>28 leshort x %d 11369>14 leshort 124 PC bitmap, Windows 98/2000 and newer format 11370!:mime image/x-ms-bmp 11371>>18 lelong x \b, %d x 11372>>22 lelong x %d x 11373>>28 leshort x %d 11374>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format 11375!:mime image/x-ms-bmp 11376>>18 lelong x \b, %d x 11377>>22 lelong x %d x 11378>>28 leshort x %d 11379>14 leshort 128 PC bitmap, Windows NT/2000 format 11380!:mime image/x-ms-bmp 11381>>18 lelong x \b, %d x 11382>>22 lelong x %d x 11383>>28 leshort x %d 11384# Too simple - MPi 11385#0 string IC PC icon data 11386#0 string PI PC pointer image data 11387#0 string CI PC color icon data 11388#0 string CP PC color pointer image data 11389# Conflicts with other entries [BABYL] 11390#0 string BA PC bitmap array data 11391 11392# XPM icons (Greg Roelofs, newt@uchicago.edu) 113930 search/1 /*\ XPM\ */ X pixmap image text 11394!:mime image/x-xpmi 11395 11396# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 113970 leshort 0xcc52 RLE image data, 11398>6 leshort x %d x 11399>8 leshort x %d 11400>2 leshort >0 \b, lower left corner: %d 11401>4 leshort >0 \b, lower right corner: %d 11402>10 byte&0x1 =0x1 \b, clear first 11403>10 byte&0x2 =0x2 \b, no background 11404>10 byte&0x4 =0x4 \b, alpha channel 11405>10 byte&0x8 =0x8 \b, comment 11406>11 byte >0 \b, %d color channels 11407>12 byte >0 \b, %d bits per pixel 11408>13 byte >0 \b, %d color map channels 11409 11410# image file format (Robert Potter, potter@cs.rochester.edu) 114110 string Imagefile\ version- iff image data 11412# this adds the whole header (inc. version number), informative but longish 11413>10 string >\0 %s 11414 11415# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 114160 belong 0x59a66a95 Sun raster image data 11417>4 belong >0 \b, %d x 11418>8 belong >0 %d, 11419>12 belong >0 %d-bit, 11420#>16 belong >0 %d bytes long, 11421>20 belong 0 old format, 11422#>20 belong 1 standard, 11423>20 belong 2 compressed, 11424>20 belong 3 RGB, 11425>20 belong 4 TIFF, 11426>20 belong 5 IFF, 11427>20 belong 0xffff reserved for testing, 11428>24 belong 0 no colormap 11429>24 belong 1 RGB colormap 11430>24 belong 2 raw colormap 11431#>28 belong >0 colormap is %d bytes long 11432 11433# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 11434# 11435# See 11436# http://reality.sgi.com/grafica/sgiimage.html 11437# 114380 beshort 474 SGI image data 11439#>2 byte 0 \b, verbatim 11440>2 byte 1 \b, RLE 11441#>3 byte 1 \b, normal precision 11442>3 byte 2 \b, high precision 11443>4 beshort x \b, %d-D 11444>6 beshort x \b, %d x 11445>8 beshort x %d 11446>10 beshort x \b, %d channel 11447>10 beshort !1 \bs 11448>80 string >0 \b, "%s" 11449 114500 string IT01 FIT image data 11451>4 belong x \b, %d x 11452>8 belong x %d x 11453>12 belong x %d 11454# 114550 string IT02 FIT image data 11456>4 belong x \b, %d x 11457>8 belong x %d x 11458>12 belong x %d 11459# 114602048 string PCD_IPI Kodak Photo CD image pack file 11461>0xe02 byte&0x03 0x00 , landscape mode 11462>0xe02 byte&0x03 0x01 , portrait mode 11463>0xe02 byte&0x03 0x02 , landscape mode 11464>0xe02 byte&0x03 0x03 , portrait mode 114650 string PCD_OPA Kodak Photo CD overview pack file 11466 11467# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 11468# FITS is the Flexible Image Transport System, the de facto standard for 11469# data and image transfer, storage, etc., for the astronomical community. 11470# (FITS floating point formats are big-endian.) 114710 string SIMPLE\ \ = FITS image data 11472>109 string 8 \b, 8-bit, character or unsigned binary integer 11473>108 string 16 \b, 16-bit, two's complement binary integer 11474>107 string \ 32 \b, 32-bit, two's complement binary integer 11475>107 string -32 \b, 32-bit, floating point, single precision 11476>107 string -64 \b, 64-bit, floating point, double precision 11477 11478# other images 114790 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 11480 11481# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 11482# stuff. 11483# 114840 beshort 0x1010 PEX Binary Archive 11485 11486# DICOM medical imaging data 11487128 string DICM DICOM medical imaging data 11488!:mime application/dicom 11489 11490# XWD - X Window Dump file. 11491# As described in /usr/X11R6/include/X11/XWDFile.h 11492# used by the xwd program. 11493# Bradford Castalia, idaeim, 1/01 11494# updated by Adam Buchbinder, 2/09 11495# The following assumes version 7 of the format; the first long is the length 11496# of the header, which is at least 25 4-byte longs, and the one at offset 8 11497# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 11498# which is a maximum of 32. 114990 belong >100 11500>8 belong <3 11501>>12 belong <33 11502>>>4 belong 7 XWD X Window Dump image data 11503!:mime image/x-xwindowdump 11504>>>>100 string >\0 \b, "%s" 11505>>>>16 belong x \b, %dx 11506>>>>20 belong x \b%dx 11507>>>>12 belong x \b%d 11508 11509# PDS - Planetary Data System 11510# These files use Parameter Value Language in the header section. 11511# Unfortunately, there is no certain magic, but the following 11512# strings have been found to be most likely. 115130 string NJPL1I00 PDS (JPL) image data 115142 string NJPL1I PDS (JPL) image data 115150 string CCSD3ZF PDS (CCSD) image data 115162 string CCSD3Z PDS (CCSD) image data 115170 string PDS_ PDS image data 115180 string LBLSIZE= PDS (VICAR) image data 11519 11520# pM8x: ATARI STAD compressed bitmap format 11521# 11522# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 11523# p M 8 5/6 xx yy zz data... 11524# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 11525# bytes either run horizontally (pM85) or vertically (pM86). yy is the 11526# most frequent byte, xx and zz are runlength escape codes, where xx is 11527# used for runs of yy. 11528# 115290 string pM85 Atari ST STAD bitmap image data (hor) 11530>5 byte 0x00 (white background) 11531>5 byte 0xFF (black background) 115320 string pM86 Atari ST STAD bitmap image data (vert) 11533>5 byte 0x00 (white background) 11534>5 byte 0xFF (black background) 11535 11536# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 11537# http://www.atarimax.com/jindroush.atari.org/afmtatr.html 115380 leshort 0x0296 Atari ATR image 11539 11540# XXX: 11541# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 11542# magic. 11543# SGI RICE image file <mpruett@sgi.com> 11544#0 beshort 0x5249 RICE image 11545#>2 beshort x v%d 11546#>4 beshort x (%d x 11547#>6 beshort x %d) 11548#>8 beshort 0 8 bit 11549#>8 beshort 1 10 bit 11550#>8 beshort 2 12 bit 11551#>8 beshort 3 13 bit 11552#>10 beshort 0 4:2:2 11553#>10 beshort 1 4:2:2:4 11554#>10 beshort 2 4:4:4 11555#>10 beshort 3 4:4:4:4 11556#>12 beshort 1 RGB 11557#>12 beshort 2 CCIR601 11558#>12 beshort 3 RP175 11559#>12 beshort 4 YUV 11560 11561# PCX image files 11562# From: Dan Fandrich <dan@coneharvesters.com> 11563# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX 11564# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 11565# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 11566# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 115670 ubelong&0xffF8fe00 0x0a000000 11568# for PCX bit depth > 0 11569>3 ubyte >0 11570# test for valid versions 11571>>1 ubyte <6 11572>>>1 ubyte !1 PCX 11573!:mime image/x-pcx 11574#!:mime image/pcx 11575>>>>1 ubyte 0 ver. 2.5 image data 11576>>>>1 ubyte 2 ver. 2.8 image data, with palette 11577>>>>1 ubyte 3 ver. 2.8 image data, without palette 11578>>>>1 ubyte 4 for Windows image data 11579>>>>1 ubyte 5 ver. 3.0 image data 11580>>>>4 uleshort x bounding box [%d, 11581>>>>6 uleshort x %d] - 11582>>>>8 uleshort x [%d, 11583>>>>10 uleshort x %d], 11584>>>>65 ubyte >1 %d planes each of 11585>>>>3 ubyte x %d-bit 11586>>>>68 byte 1 colour, 11587>>>>68 byte 2 grayscale, 11588# this should not happen 11589>>>>68 default x image, 11590>>>>12 leshort >0 %d x 11591>>>>>14 uleshort x %d dpi, 11592>>>>2 byte 0 uncompressed 11593>>>>2 byte 1 RLE compressed 11594 11595# Adobe Photoshop 11596# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 115970 string 8BPS Adobe Photoshop Image 11598!:mime image/vnd.adobe.photoshop 11599>4 beshort 2 (PSB) 11600>18 belong x \b, %d x 11601>14 belong x %d, 11602>24 beshort 0 bitmap 11603>24 beshort 1 grayscale 11604>>12 beshort 2 with alpha 11605>24 beshort 2 indexed 11606>24 beshort 3 RGB 11607>>12 beshort 4 \bA 11608>24 beshort 4 CMYK 11609>>12 beshort 5 \bA 11610>24 beshort 7 multichannel 11611>24 beshort 8 duotone 11612>24 beshort 9 lab 11613>12 beshort > 1 11614>>12 beshort x \b, %dx 11615>12 beshort 1 \b, 11616>22 beshort x %d-bit channel 11617>12 beshort > 1 \bs 11618 11619# XV thumbnail indicator (ThMO) 116200 string P7\ 332 XV thumbnail image data 11621 11622# NITF is defined by United States MIL-STD-2500A 116230 string NITF National Imagery Transmission Format 11624>25 string >\0 dated %.14s 11625 11626# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 11627# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de> 11628# See http://fileformats.archiveteam.org/wiki/GEM_Raster 11629# For variations, also see: 11630# http://www.seasip.info/Gem/ff_img.html (Ventura) 11631# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) 11632# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) 11633# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) 116340 beshort 0x0001 11635>2 beshort 0x0008 GEM Image data 11636>>0 use gem_info 11637>2 beshort 0x0009 GEM Image data (Ventura) 11638>>0 use gem_info 1163916 string XIMG\0 GEM XIMG Image data 11640>0 use gem_info 1164116 string STTT\0\x10 GEM STTT Image data 11642>0 use gem_info 1164316 string TIMG\0 GEM TIMG Image data 11644>0 use gem_info 11645 116460 name gem_info 11647>12 beshort x %d x 11648>14 beshort x %d, 11649>4 beshort x %d planes, 11650>8 beshort x %d x 11651>10 beshort x %d pixelsize 11652 11653# GEM Metafile (Wolfram Kleff) 116540 lelong 0x0018FFFF GEM Metafile data 11655>4 leshort x version %d 11656 11657# 11658# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 11659# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 11660# 116610 string \0\nSMJPEG SMJPEG 11662>8 belong x %d.x data 11663# According to the specification you could find any number of _TXT 11664# headers here, but I can't think of any way of handling that. None of 11665# the SMJPEG files I tried it on used this feature. Even if such a 11666# file is encountered the output should still be reasonable. 11667>16 string _SND \b, 11668>>24 beshort >0 %d Hz 11669>>26 byte 8 8-bit 11670>>26 byte 16 16-bit 11671>>28 string NONE uncompressed 11672# >>28 string APCM ADPCM compressed 11673>>27 byte 1 mono 11674>>28 byte 2 stereo 11675# Help! Isn't there any way to avoid writing this part twice? 11676>>32 string _VID \b, 11677# >>>48 string JFIF JPEG 11678>>>40 belong >0 %d frames 11679>>>44 beshort >0 (%d x 11680>>>46 beshort >0 %d) 11681>16 string _VID \b, 11682# >>32 string JFIF JPEG 11683>>24 belong >0 %d frames 11684>>28 beshort >0 (%d x 11685>>30 beshort >0 %d) 11686 116870 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 11688 11689# "thumbnail file" (icon) 11690# descended from "xv", but in use by other applications as well (Wolfram Kleff) 116910 string P7\ 332 XV "thumbnail file" (icon) data 11692 11693# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 116940 string KiSS KISS/GS 11695>4 byte 16 color 11696>>5 byte x %d bit 11697>>8 leshort x %d colors 11698>>10 leshort x %d groups 11699>4 byte 32 cell 11700>>5 byte x %d bit 11701>>8 leshort x %d x 11702>>10 leshort x %d 11703>>12 leshort x +%d 11704>>14 leshort x +%d 11705 11706# Webshots (www.webshots.com), by John Harrison 117070 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 11708 11709# Hercules DASD image files 11710# From Jan Jaeger <jj@septa.nl> 117110 string CKD_P370 Hercules CKD DASD image file 11712>8 long x \b, %d heads per cylinder 11713>12 long x \b, track size %d bytes 11714>16 byte x \b, device type 33%2.2X 11715 117160 string CKD_C370 Hercules compressed CKD DASD image file 11717>8 long x \b, %d heads per cylinder 11718>12 long x \b, track size %d bytes 11719>16 byte x \b, device type 33%2.2X 11720 117210 string CKD_S370 Hercules CKD DASD shadow file 11722>8 long x \b, %d heads per cylinder 11723>12 long x \b, track size %d bytes 11724>16 byte x \b, device type 33%2.2X 11725 11726# Squeak images and programs - etoffi@softhome.net 117270 string \146\031\0\0 Squeak image data 117280 search/1 'From\040Squeak Squeak program text 11729 11730# partimage: file(1) magic for PartImage files (experimental, incomplete) 11731# Author: Hans-Joachim Baader <hjb@pro-linux.de> 117320 string PaRtImAgE-VoLuMe PartImage 11733>0x0020 string 0.6.1 file version %s 11734>>0x0060 lelong >-1 volume %d 11735#>>0x0064 8 byte identifier 11736#>>0x007c reserved 11737>>0x0200 string >\0 type %s 11738>>0x1400 string >\0 device %s, 11739>>0x1600 string >\0 original filename %s, 11740# Some fields omitted 11741>>0x2744 lelong 0 not compressed 11742>>0x2744 lelong 1 gzip compressed 11743>>0x2744 lelong 2 bzip2 compressed 11744>>0x2744 lelong >2 compressed with unknown algorithm 11745>0x0020 string >0.6.1 file version %s 11746>0x0020 string <0.6.1 file version %s 11747 11748# DCX is multi-page PCX, using a simple header of up to 1024 11749# offsets for the respective PCX components. 11750# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 117510 lelong 987654321 DCX multi-page PCX image data 11752 11753# Simon Walton <simonw@matteworld.com> 11754# Kodak Cineon format for scanned negatives 11755# http://www.kodak.com/US/en/motion/support/dlad/ 117560 lelong 0xd75f2a80 Cineon image data 11757>200 belong >0 \b, %d x 11758>204 belong >0 %d 11759 11760 11761# Bio-Rad .PIC is an image format used by microscope control systems 11762# and related image processing software used by biologists. 11763# From: Vebjorn Ljosa <vebjorn@ljosa.com> 11764# BOOL values are two-byte integers; use them to rule out false positives. 11765# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 11766# Samples: http://www.loci.wisc.edu/software/sample-data 1176714 leshort <2 11768>62 leshort <2 11769>>54 leshort 12345 Bio-Rad .PIC Image File 11770>>>0 leshort >0 %d x 11771>>>2 leshort >0 %d, 11772>>>4 leshort =1 1 image in file 11773>>>4 leshort >1 %d images in file 11774 11775# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 11776# The description of *.mrw format can be found at 11777# http://www.dalibor.cz/minolta/raw_file_format.htm 117780 string \000MRM Minolta Dimage camera raw image data 11779 11780# Summary: DjVu image / document 11781# Extension: .djvu 11782# Reference: http://djvu.org/docs/DjVu3Spec.djvu 11783# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 11784# Modified by (1): Abel Cheung <abelcheung@gmail.com> 117850 string AT&TFORM 11786>12 string DJVM DjVu multiple page document 11787!:mime image/vnd.djvu 11788>12 string DJVU DjVu image or single page document 11789!:mime image/vnd.djvu 11790>12 string DJVI DjVu shared document 11791!:mime image/vnd.djvu 11792>12 string THUM DjVu page thumbnails 11793!:mime image/vnd.djvu 11794 11795# Originally by Marc Espie 11796# Modified by Robert Minsk <robertminsk at yahoo.com> 11797# http://www.openexr.com/openexrfilelayout.pdf 117980 lelong 20000630 OpenEXR image data, 11799!:mime image/x-exr 11800>4 lelong&0x000000ff x version %d, 11801>4 lelong ^0x00000200 storage: scanline 11802>4 lelong &0x00000200 storage: tiled 11803>8 search/0x1000 compression\0 \b, compression: 11804>>&16 byte 0 none 11805>>&16 byte 1 rle 11806>>&16 byte 2 zips 11807>>&16 byte 3 zip 11808>>&16 byte 4 piz 11809>>&16 byte 5 pxr24 11810>>&16 byte 6 b44 11811>>&16 byte 7 b44a 11812>>&16 byte >7 unknown 11813>8 search/0x1000 dataWindow\0 \b, dataWindow: 11814>>&10 lelong x (%d 11815>>&14 lelong x %d)- 11816>>&18 lelong x \b(%d 11817>>&22 lelong x %d) 11818>8 search/0x1000 displayWindow\0 \b, displayWindow: 11819>>&10 lelong x (%d 11820>>&14 lelong x %d)- 11821>>&18 lelong x \b(%d 11822>>&22 lelong x %d) 11823>8 search/0x1000 lineOrder\0 \b, lineOrder: 11824>>&14 byte 0 increasing y 11825>>&14 byte 1 decreasing y 11826>>&14 byte 2 random y 11827>>&14 byte >2 unknown 11828 11829# SMPTE Digital Picture Exchange Format, SMPTE DPX 11830# 11831# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 11832# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 11833# Robert Minsk <robertminsk at yahoo.com> 118340 string SDPX DPX image data, big-endian, 11835!:mime image/x-dpx 11836>768 beshort <4 11837>>772 belong x %dx 11838>>776 belong x \b%d, 11839>768 beshort >3 11840>>776 belong x %dx 11841>>772 belong x \b%d, 11842>768 beshort 0 left to right/top to bottom 11843>768 beshort 1 right to left/top to bottom 11844>768 beshort 2 left to right/bottom to top 11845>768 beshort 3 right to left/bottom to top 11846>768 beshort 4 top to bottom/left to right 11847>768 beshort 5 top to bottom/right to left 11848>768 leshort 6 bottom to top/left to right 11849>768 leshort 7 bottom to top/right to left 11850 11851# From: Tom Hilinski <tom.hilinski@comcast.net> 11852# http://www.unidata.ucar.edu/packages/netcdf/ 118530 string CDF\001 NetCDF Data Format data 11854 11855#----------------------------------------------------------------------- 11856# Hierarchical Data Format, used to facilitate scientific data exchange 11857# specifications at http://hdf.ncsa.uiuc.edu/ 118580 belong 0x0e031301 Hierarchical Data Format (version 4) data 11859!:mime application/x-hdf 118600 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 11861!:mime application/x-hdf 11862512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block 11863!:mime application/x-hdf 118641024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 11865!:mime application/x-hdf 118662048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 11867!:mime application/x-hdf 118684096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 11869!:mime application/x-hdf 11870 11871 11872# From: Tobias Burnus <burnus@net-b.de> 11873# Xara (for a while: Corel Xara) is a graphic package, see 11874# http://www.xara.com/ for Windows and as GPL application for Linux 118750 string XARA\243\243 Xara graphics file 11876 11877# http://www.cartesianinc.com/Tech/ 118780 string CPC\262 Cartesian Perceptual Compression image 11879!:mime image/x-cpi 11880 11881# From Albert Cahalan <acahalan@gmail.com> 11882# puredigital used it for the CVS disposable camcorder 11883#8 lelong 4 ZBM bitmap image data 11884#>4 leshort x %u x 11885#>6 leshort x %u 11886 11887# From Albert Cahalan <acahalan@gmail.com> 11888# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 118890 string C565 OLPC firmware icon image data 11890>4 leshort x %u x 11891>6 leshort x %u 11892 11893# Applied Images - Image files from Cytovision 11894# Gustavo Junior Alves <gjalves@gjalves.com.br> 118950 string \xce\xda\xde\xfa Cytovision Metaphases file 118960 string \xed\xad\xef\xac Cytovision Karyotype file 118970 string \x0b\x00\x03\x00 Cytovision FISH Probe file 118980 string \xed\xfe\xda\xbe Cytovision FLEX file 118990 string \xed\xab\xed\xfe Cytovision FLEX file 119000 string \xad\xfd\xea\xad Cytovision RATS file 11901 11902# Wavelet Scalar Quantization format used in gray-scale fingerprint images 11903# From Tano M Fotang <mfotang@quanteq.com> 119040 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 11905 11906# Type: PCO B16 image files 11907# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 11908# From: Florian Philipp <florian.philipp@binarywings.net> 11909# Extension: .b16 11910# Description: Pixel image format produced by PCO Camware, typically used 11911# together with PCO cameras. 11912# Note: Different versions exist for e.g. 8 bit and 16 bit images. 11913# Documentation is incomplete. 119140 string/b PCO- PCO B16 image data 11915>12 lelong x \b, %dx 11916>16 lelong x \b%d 11917>20 lelong 0 \b, short header 11918>20 lelong -1 \b, extended header 11919>>24 lelong 0 \b, grayscale 11920>>>36 lelong 0 linear LUT 11921>>>36 lelong 1 logarithmic LUT 11922>>>28 lelong x [%d 11923>>>32 lelong x \b,%d] 11924>>24 lelong 1 \b, color 11925>>>64 lelong 0 linear LUT 11926>>>64 lelong 1 logarithmic LUT 11927>>>40 lelong x r[%d 11928>>>44 lelong x \b,%d] 11929>>>48 lelong x g[%d 11930>>>52 lelong x \b,%d] 11931>>>56 lelong x b[%d 11932>>>60 lelong x \b,%d] 11933 11934# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 11935# From: Markus Heidelberg <markus.heidelberg at web.de> 119360 string/t [BitmapInfo2] Polar Monitor Bitmap text 11937!:mime image/x-polar-monitor-bitmap 11938 11939# From: Rick Richardson <rickrich@gmail.com> 119400 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 11941 11942# Type: Ulead Photo Explorer5 (.pe5) 11943# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 11944# From: Simon Horman <horms@debian.org> 119450 string IIO2H Ulead Photo Explorer5 11946 11947# Type: X11 cursor 11948# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 11949# From: Mathias Brodala <info@noctus.net> 119500 string Xcur X11 cursor 11951 11952# Type: Olympus ORF raw images. 11953# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF 11954# From: Adam Buchbinder <adam.buchbinder@gmail.com> 119550 string MMOR Olympus ORF raw image data, big-endian 11956!:mime image/x-olympus-orf 119570 string IIRO Olympus ORF raw image data, little-endian 11958!:mime image/x-olympus-orf 119590 string IIRS Olympus ORF raw image data, little-endian 11960!:mime image/x-olympus-orf 11961 11962# Type: files used in modern AVCHD camcoders to store clip information 11963# Extension: .cpi 11964# From: Alexander Danilov <alexander.a.danilov@gmail.com> 119650 string HDMV0100 AVCHD Clip Information 11966 11967# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11968# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 11969# Radiance HDR; usually has .pic or .hdr extension. 119700 string #?RADIANCE\n Radiance HDR image data 11971#!mime image/vnd.radiance 11972 11973# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11974# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 11975# Used by the pfstools packages. The regex matches for the image size could 11976# probably use some work. The MIME type is made up; if there's one in 11977# actual common use, it should replace the one below. 119780 string PFS1\x0a PFS HDR image data 11979#!mime image/x-pfs 11980>1 regex [0-9]*\ \b, %s 11981>>1 regex \ [0-9]{4} \bx%s 11982 11983# Type: Foveon X3F 11984# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf 11985# From: Adam Buchbinder <adam.buchbinder@gmail.com> 11986# Note that the MIME type isn't defined anywhere that I can find; if 11987# there's a canonical type for this format, it should replace this one. 119880 string FOVb Foveon X3F raw image data 11989!:mime image/x-x3f 11990>6 leshort x \b, version %d. 11991>4 leshort x \b%d 11992>28 lelong x \b, %dx 11993>32 lelong x \b%d 11994 11995# Paint.NET file 11996# From Adam Buchbinder <adam.buchbinder@gmail.com> 119970 string PDN3 Paint.NET image data 11998!:mime image/x-paintnet 11999 12000# Not really an image. 12001# From: "Tano M. Fotang" <mfotang@quanteq.com> 120020 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 12003 12004# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip 12005# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 1200690 bequad 0x574D50484F544F00 JPEG-XR Image 12007>98 byte&0x08 =0x08 \b, hard tiling 12008>99 byte&0x80 =0x80 \b, tiling present 12009>99 byte&0x40 =0x40 \b, codestream present 12010>99 byte&0x38 x \b, spatial xform= 12011>99 byte&0x38 0x00 \bTL 12012>99 byte&0x38 0x08 \bBL 12013>99 byte&0x38 0x10 \bTR 12014>99 byte&0x38 0x18 \bBR 12015>99 byte&0x38 0x20 \bBT 12016>99 byte&0x38 0x28 \bRB 12017>99 byte&0x38 0x30 \bLT 12018>99 byte&0x38 0x38 \bLB 12019>100 byte&0x80 =0x80 \b, short header 12020>>102 beshort+1 x \b, %d 12021>>104 beshort+1 x \bx%d 12022>100 byte&0x80 =0x00 \b, long header 12023>>102 belong+1 x \b, %x 12024>>106 belong+1 x \bx%x 12025>101 beshort&0xf x \b, bitdepth= 12026>>101 beshort&0xf 0x0 \b1-WHITE=1 12027>>101 beshort&0xf 0x1 \b8 12028>>101 beshort&0xf 0x2 \b16 12029>>101 beshort&0xf 0x3 \b16-SIGNED 12030>>101 beshort&0xf 0x4 \b16-FLOAT 12031>>101 beshort&0xf 0x5 \b(reserved 5) 12032>>101 beshort&0xf 0x6 \b32-SIGNED 12033>>101 beshort&0xf 0x7 \b32-FLOAT 12034>>101 beshort&0xf 0x8 \b5 12035>>101 beshort&0xf 0x9 \b10 12036>>101 beshort&0xf 0xa \b5-6-5 12037>>101 beshort&0xf 0xb \b(reserved %d) 12038>>101 beshort&0xf 0xc \b(reserved %d) 12039>>101 beshort&0xf 0xd \b(reserved %d) 12040>>101 beshort&0xf 0xe \b(reserved %d) 12041>>101 beshort&0xf 0xf \b1-BLACK=1 12042>101 beshort&0xf0 x \b, colorfmt= 12043>>101 beshort&0xf0 0x00 \bYONLY 12044>>101 beshort&0xf0 0x10 \bYUV240 12045>>101 beshort&0xf0 0x20 \bYWV422 12046>>101 beshort&0xf0 0x30 \bYWV444 12047>>101 beshort&0xf0 0x40 \bCMYK 12048>>101 beshort&0xf0 0x50 \bCMYKDIRECT 12049>>101 beshort&0xf0 0x60 \bNCOMPONENT 12050>>101 beshort&0xf0 0x70 \bRGB 12051>>101 beshort&0xf0 0x80 \bRGBE 12052>>101 beshort&0xf0 >0x80 \b(reserved 0x%x) 12053 12054# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 12055# 12056# BPG (Better Portable Graphics) format 12057# http://bellard.org/bpg/ 12058# http://fileformats.archiveteam.org/wiki/BPG 12059# 120600 string \x42\x50\x47\xFB BPG (Better Portable Graphics) 12061!:mime image/bpg 12062 12063#------------------------------------------------------------------------------ 12064# $File$ 12065# inform: file(1) magic for Inform interactive fiction language 12066 12067# URL: http://www.inform-fiction.org/ 12068# From: Reuben Thomas <rrt@sc3d.org> 12069 120700 search/100/cW constant\ story Inform source text 12071 12072#------------------------------------------------------------------------------ 12073# $File: intel,v 1.11 2013/02/06 14:18:52 christos Exp $ 12074# intel: file(1) magic for x86 Unix 12075# 12076# Various flavors of x86 UNIX executable/object (other than Xenix, which 12077# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 12078# Windows as well. 12079# 12080# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 12081# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 12082# as well, if, as, and when IBM makes it portable. 12083# 12084# The `versions' should be un-commented if they work for you. 12085# (Was the problem just one of endianness?) 12086# 120870 leshort 0502 basic-16 executable 12088>12 lelong >0 not stripped 12089#>22 leshort >0 - version %d 120900 leshort 0503 basic-16 executable (TV) 12091>12 lelong >0 not stripped 12092#>22 leshort >0 - version %d 120930 leshort 0510 x86 executable 12094>12 lelong >0 not stripped 120950 leshort 0511 x86 executable (TV) 12096>12 lelong >0 not stripped 120970 leshort =0512 iAPX 286 executable small model (COFF) 12098>12 lelong >0 not stripped 12099#>22 leshort >0 - version %d 121000 leshort =0522 iAPX 286 executable large model (COFF) 12101>12 lelong >0 not stripped 12102#>22 leshort >0 - version %d 12103# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 121040 leshort =0514 80386 COFF executable 12105>12 lelong >0 not stripped 12106>22 leshort >0 - version %d 12107 12108# rom: file(1) magic for BIOS ROM Extensions found in intel machines 12109# mapped into memory between 0xC0000 and 0xFFFFF 12110# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 121110 beshort 0x55AA BIOS (ia32) ROM Ext. 12112>5 string USB USB 12113>7 string LDR UNDI image 12114>30 string IBM IBM comp. Video 12115>26 string Adaptec Adaptec 12116>28 string Adaptec Adaptec 12117>42 string PROMISE Promise 12118>2 byte x (%d*512) 12119 12120# Flash descriptors for Intel SPI flash roms. 12121# From Dr. Jesus <j@hug.gs> 121220 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1212316 lelong 0x0ff0a55a Intel serial flash for PCH ROM 12124 12125#------------------------------------------------------------------------------ 12126# $File$ 12127# interleaf: file(1) magic for InterLeaf TPS: 12128# 121290 string =\210OPS Interleaf saved data 121300 string =<!OPS Interleaf document text 12131>5 string ,\ Version\ = \b, version 12132>>17 string >\0 %.3s 12133 12134#------------------------------------------------------------------------------ 12135# $File$ 12136# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 12137# "/etc/magic": 12138# From: guy@netapp.com (Guy Harris) 12139# 121404 string pgscriptver IslandWrite document 1214113 string DrawFile IslandDraw document 12142 12143 12144#------------------------------------------------------------------------------ 12145# $File$ 12146# ispell: file(1) magic for ispell 12147# 12148# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 12149# will match 0x9600 through 0x9603 in *both* little endian and big endian. 12150# (No other current magic entries collide.) 12151# 12152# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 12153# 121540 leshort&0xFFFC 0x9600 little endian ispell 12155>0 byte 0 hash file (?), 12156>0 byte 1 3.0 hash file, 12157>0 byte 2 3.1 hash file, 12158>0 byte 3 hash file (?), 12159>2 leshort 0x00 8-bit, no capitalization, 26 flags 12160>2 leshort 0x01 7-bit, no capitalization, 26 flags 12161>2 leshort 0x02 8-bit, capitalization, 26 flags 12162>2 leshort 0x03 7-bit, capitalization, 26 flags 12163>2 leshort 0x04 8-bit, no capitalization, 52 flags 12164>2 leshort 0x05 7-bit, no capitalization, 52 flags 12165>2 leshort 0x06 8-bit, capitalization, 52 flags 12166>2 leshort 0x07 7-bit, capitalization, 52 flags 12167>2 leshort 0x08 8-bit, no capitalization, 128 flags 12168>2 leshort 0x09 7-bit, no capitalization, 128 flags 12169>2 leshort 0x0A 8-bit, capitalization, 128 flags 12170>2 leshort 0x0B 7-bit, capitalization, 128 flags 12171>2 leshort 0x0C 8-bit, no capitalization, 256 flags 12172>2 leshort 0x0D 7-bit, no capitalization, 256 flags 12173>2 leshort 0x0E 8-bit, capitalization, 256 flags 12174>2 leshort 0x0F 7-bit, capitalization, 256 flags 12175>4 leshort >0 and %d string characters 121760 beshort&0xFFFC 0x9600 big endian ispell 12177>1 byte 0 hash file (?), 12178>1 byte 1 3.0 hash file, 12179>1 byte 2 3.1 hash file, 12180>1 byte 3 hash file (?), 12181>2 beshort 0x00 8-bit, no capitalization, 26 flags 12182>2 beshort 0x01 7-bit, no capitalization, 26 flags 12183>2 beshort 0x02 8-bit, capitalization, 26 flags 12184>2 beshort 0x03 7-bit, capitalization, 26 flags 12185>2 beshort 0x04 8-bit, no capitalization, 52 flags 12186>2 beshort 0x05 7-bit, no capitalization, 52 flags 12187>2 beshort 0x06 8-bit, capitalization, 52 flags 12188>2 beshort 0x07 7-bit, capitalization, 52 flags 12189>2 beshort 0x08 8-bit, no capitalization, 128 flags 12190>2 beshort 0x09 7-bit, no capitalization, 128 flags 12191>2 beshort 0x0A 8-bit, capitalization, 128 flags 12192>2 beshort 0x0B 7-bit, capitalization, 128 flags 12193>2 beshort 0x0C 8-bit, no capitalization, 256 flags 12194>2 beshort 0x0D 7-bit, no capitalization, 256 flags 12195>2 beshort 0x0E 8-bit, capitalization, 256 flags 12196>2 beshort 0x0F 7-bit, capitalization, 256 flags 12197>4 beshort >0 and %d string characters 12198# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 12199# Ispell 4.0 122000 string ISPL ispell 12201>4 long x hash file version %d, 12202>8 long x lexletters %d, 12203>12 long x lexsize %d, 12204>16 long x hashsize %d, 12205>20 long x stblsize %d 12206 12207#------------------------------------------------------------------------------ 12208# $File: isz,v 1.2 2014/04/28 12:04:50 christos Exp $ 12209# ISO Zipped file format 12210# http://www.ezbsystems.com/isz/iszspec.txt 122110 string IsZ! ISO Zipped file 12212>4 byte x \b, header size %u 12213>5 byte x \b, version %u 12214>8 lelong x \b, serial %u 12215#12 leshort x \b, sector size %u 12216#>16 lelong x \b, total sectors %u 12217>17 byte >0 \b, password protected 12218#>24 lequad x \b, segment size %llu 12219#>32 lelong x \b, blocks %u 12220#>36 lelong x \b, block size %u 12221 12222#------------------------------------------------------------ 12223# $File: java,v 1.15 2013/08/14 09:10:36 christos Exp $ 12224# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 12225# same magic number, 0xcafebabe, so they are both handled 12226# in the entry called "cafebabe". 12227#------------------------------------------------------------ 12228# Java serialization 12229# From Martin Pool (m.pool@pharos.com.au) 122300 beshort 0xaced Java serialization data 12231>2 beshort >0x0004 \b, version %d 12232 122330 belong 0xfeedfeed Java KeyStore 12234!:mime application/x-java-keystore 122350 belong 0xcececece Java JCE KeyStore 12236!:mime application/x-java-jce-keystore 12237 12238# Java source 122390 regex ^import.*;$ Java source 12240!:mime text/x-java 12241 12242#------------------------------------------------------------------------------ 12243# $File: $ 12244# javascript: magic for javascript and node.js scripts. 12245# 122460 search/1/w #!/bin/node Node.js script text executable 12247!:mime application/javascript 122480 search/1/w #!/usr/bin/node Node.js script text executable 12249!:mime application/javascript 122500 search/1/w #!/bin/nodejs Node.js script text executable 12251!:mime application/javascript 122520 search/1/w #!/usr/bin/nodejs Node.js script text executable 12253!:mime application/javascript 122540 search/1 #!/usr/bin/env\ node Node.js script text executable 12255!:mime application/javascript 122560 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 12257!:mime application/javascript 12258 12259#------------------------------------------------------------------------------ 12260# $File: jpeg,v 1.26 2015/01/02 22:40:27 christos Exp $ 12261# JPEG images 12262# SunOS 5.5.1 had 12263# 12264# 0 string \377\330\377\340 JPEG file 12265# 0 string \377\330\377\356 JPG file 12266# 12267# both of which turn into "JPEG image data" here. 12268# 122690 beshort 0xffd8 JPEG image data 12270!:mime image/jpeg 12271!:apple 8BIMJPEG 12272!:strength *3 12273>6 string JFIF \b, JFIF standard 12274# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 12275# in a vain attempt to add image size reporting for JFIF. Note that these 12276# tests are not fool-proof since some perfectly valid JPEGs are currently 12277# impossible to specify in magic(4) format. 12278# First, a little JFIF version info: 12279>>11 byte x \b %d. 12280>>12 byte x \b%02d 12281# Next, the resolution or aspect ratio of the image: 12282>>13 byte 0 \b, aspect ratio 12283>>13 byte 1 \b, resolution (DPI) 12284>>13 byte 2 \b, resolution (DPCM) 12285>>14 beshort x \b, density %dx 12286>>16 beshort x \b%d 12287>>4 beshort x \b, segment length %d 12288# Next, show thumbnail info, if it exists: 12289>>18 byte !0 \b, thumbnail %dx 12290>>>19 byte x \b%d 12291>6 string Exif \b, Exif standard: [ 12292>>12 indirect/r x 12293>>12 string x \b] 12294 12295# Jump to the first segment 12296>(4.S+4) use jpeg_segment 12297 12298# This uses recursion... 122990 name jpeg_segment 12300>0 beshort 0xFFFE 12301# Recursion handled by FFE0 12302#>>(2.S+2) use jpeg_segment 12303>>2 pstring/HJ x \b, comment: "%s" 12304 12305>0 beshort 0xFFC0 12306>>(2.S+2) use jpeg_segment 12307>>4 byte x \b, baseline, precision %d 12308>>7 beshort x \b, %dx 12309>>5 beshort x \b%d 12310>>9 byte x \b, frames %d 12311 12312>0 beshort 0xFFC1 12313>>(2.S+2) use jpeg_segment 12314>>4 byte x \b, extended sequential, precision %d 12315>>7 beshort x \b, %dx 12316>>5 beshort x \b%d 12317>>9 byte x \b, frames %d 12318 12319>0 beshort 0xFFC2 12320>>(2.S+2) use jpeg_segment 12321>>4 byte x \b, progressive, precision %d 12322>>7 beshort x \b, %dx 12323>>5 beshort x \b%d 12324>>9 byte x \b, frames %d 12325 12326# Define Huffman Tables 12327>0 beshort 0xFFC4 12328>>(2.S+2) use jpeg_segment 12329 12330>0 beshort 0xFFE1 12331# Recursion handled by FFE0 12332#>>(2.S+2) use jpeg_segment 12333>>4 string Exif \b, Exif Standard: [ 12334>>>10 indirect/r x 12335>>>10 string x \b] 12336 12337# Application specific markers 12338>0 beshort&0xFFE0 =0xFFE0 12339>>(2.S+2) use jpeg_segment 12340 12341# DB: Define Quantization tables 12342# DD: Define Restart interval [XXX: wrong here, it is 4 bytes] 12343# D8: Start of image 12344# D9: End of image 12345# Dn: Restart 12346>0 beshort&0xFFD0 =0xFFD0 12347>>0 beshort&0xFFE0 !0xFFE0 12348>>>(2.S+2) use jpeg_segment 12349 12350#>0 beshort x unknown 0x%x 12351#>>(2.S+2) use jpeg_segment 12352 12353# HSI is Handmade Software's proprietary JPEG encoding scheme 123540 string hsi1 JPEG image data, HSI proprietary 12355 12356# From: David Santinoli <david@santinoli.com> 123570 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 12358# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 12359# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 12360# https://github.com/bitsgalore/jp2kMagic 12361# 12362# Now read value of 'Brand' field, which yields a few possibilities: 12363>20 string \x6a\x70\x32\x20 Part 1 (JP2) 12364!:mime image/jp2 12365>20 string \x6a\x70\x78\x20 Part 2 (JPX) 12366!:mime image/jpx 12367>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 12368!:mime image/jpm 12369>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 12370!:mime video/mj2 12371 12372# Type: JPEG 2000 codesream 12373# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 123740 belong 0xff4fff51 JPEG 2000 codestream 1237545 beshort 0xff52 12376 12377#------------------------------------------------------------------------------ 12378# $File: karma,v 1.6 2009/09/19 16:28:10 christos Exp $ 12379# karma: file(1) magic for Karma data files 12380# 12381# From <rgooch@atnf.csiro.au> 12382 123830 string KarmaRHD Version Karma Data Structure Version 12384>16 belong x %u 12385 12386#------------------------------------------------------------------------------ 12387# $File: kde,v 1.4 2009/09/19 16:28:10 christos Exp $ 12388# kde: file(1) magic for KDE 12389 123900 string/t [KDE\ Desktop\ Entry] KDE desktop entry 12391!:mime application/x-kdelnk 123920 string/t #\ KDE\ Config\ File KDE config file 12393!:mime application/x-kdelnk 123940 string/t #\ xmcd xmcd database file for kscd 12395!:mime text/x-xmcd 12396 12397#------------------------------------------------------------------------------ 12398# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $ 12399# keepass: file(1) magic for KeePass file 12400# 12401# Keepass Password Safe: 12402# * original one: http://keepass.info/ 12403# * *nix port: http://www.keepassx.org/ 12404# * android port: http://code.google.com/p/keepassdroid/ 12405 124060 lelong 0x9AA2D903 Keepass password database 12407>4 lelong 0xB54BFB65 1.x KDB 12408>>48 lelong >0 \b, %d groups 12409>>52 lelong >0 \b, %d entries 12410>>8 lelong&0x0f 1 \b, SHA-256 12411>>8 lelong&0x0f 2 \b, AES 12412>>8 lelong&0x0f 4 \b, RC4 12413>>8 lelong&0x0f 8 \b, Twofish 12414>>120 lelong >0 \b, %d key transformation rounds 12415>4 lelong 0xB54BFB67 2.x KDBX 12416 12417#------------------------------------------------------------------------------ 12418# $File: map,v 1.1 2014/06/03 18:22:25 christos Exp $ 12419# kerberos: MIT kerberos file binary formats 12420# 12421 12422# This magic entry is for demonstration purposes and could be improved 12423# if the following features were implemented in file: 12424# 12425# Strings inside [[ .. ]] in the descriptions have special meanings and 12426# are not printed. 12427# 12428# - Provide some form of iteration in number of components 12429# [[${counter}=%d]] in the description 12430# then append 12431# [${counter}--] in the offset of the entries 12432# - Provide a way to round the next offset 12433# Add [R:4] after the offset? 12434# - Provide a way to have optional entries 12435# XXX: Syntax: 12436# - Provide a way to "save" entries to print them later. 12437# if the description is [[${name}=%s]], then nothing is 12438# printed and a subsequent entry in the same magic file 12439# can refer to ${name} 12440# - Provide a way to format strings as hex values 12441# 12442# http://www.gnu.org/software/shishi/manual/html_node/\ 12443# The-Keytab-Binary-File-Format.html 12444# 12445 124460 name keytab_entry 12447#>0 beshort x \b, size=%d 12448#>2 beshort x \b, components=%d 12449>4 pstring/H x \b, realm=%s 12450>>&0 pstring/H x \b, principal=%s/ 12451>>>&0 pstring/H x \b%s 12452>>>>&0 belong x \b, type=%d 12453>>>>>&0 bedate x \b, date=%s 12454>>>>>>&0 byte x \b, kvno=%u 12455#>>>>>>>&0 pstring/H x 12456#>>>>>>>>&0 belong x 12457#>>>>>>>>>>&0 use keytab_entry 12458 124590 belong 0x05020000 Kerberos Keytab file 12460>4 use keytab_entry 12461 12462#------------------------------------------------------------------------------ 12463# $File: kml,v 1.2 2009/09/19 16:28:10 christos Exp $ 12464# Type: Google KML, formerly Keyhole Markup Language 12465# Future development of this format has been handed 12466# over to the Open Geospatial Consortium. 12467# http://www.opengeospatial.org/standards/kml/ 12468# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 124690 string/t \<?xml 12470>20 search/400 \ xmlns= 12471>>&0 regex ['"]http://earth.google.com/kml Google KML document 12472!:mime application/vnd.google-earth.kml+xml 12473>>>&1 string 2.0' \b, version 2.0 12474>>>&1 string 2.1' \b, version 2.1 12475>>>&1 string 2.2' \b, version 2.2 12476 12477#------------------------------------------------------------------------------ 12478# Type: OpenGIS KML, formerly Keyhole Markup Language 12479# This standard is maintained by the 12480# Open Geospatial Consortium. 12481# http://www.opengeospatial.org/standards/kml/ 12482# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 12483>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 12484!:mime application/vnd.google-earth.kml+xml 12485>>>&1 string/t 2.2 \b, version 2.2 12486 12487#------------------------------------------------------------------------------ 12488# Type: Google KML Archive (ZIP based) 12489# http://code.google.com/apis/kml/documentation/kml_tut.html 12490# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 124910 string PK\003\004 12492>4 byte 0x14 12493>>30 string doc.kml Compressed Google KML Document, including resources. 12494!:mime application/vnd.google-earth.kmz 12495 12496#------------------------------------------------------------------------------ 12497# $File$ 12498# DEC SRC Virtual Paper: Lectern files 12499# Karl M. Hegbloom <karlheg@inetarena.com> 125000 string lect DEC SRC Virtual Paper Lectern file 12501 12502#------------------------------------------------------------------------------ 12503# $File$ 12504# lex: file(1) magic for lex 12505# 12506# derived empirically, your offsets may vary! 125070 search/100 yyprevious C program text (from lex) 12508>3 search/1 >\0 for %s 12509# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 125100 search/100 generated\ by\ flex C program text (from flex) 12511# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 125120 search/1 %{ lex description text 12513 12514#------------------------------------------------------------------------------ 12515# $File$ 12516# lif: file(1) magic for lif 12517# 12518# (Daniel Quinlan <quinlan@yggdrasil.com>) 12519# 125200 beshort 0x8000 lif file 12521 12522#------------------------------------------------------------------------------ 12523# $File: linux,v 1.58 2014/08/04 06:21:30 christos Exp $ 12524# linux: file(1) magic for Linux files 12525# 12526# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 12527# The following basic Linux magic is useful for reference, but using 12528# "long" magic is a better practice in order to avoid collisions. 12529# 12530# 2 leshort 100 Linux/i386 12531# >0 leshort 0407 impure executable (OMAGIC) 12532# >0 leshort 0410 pure executable (NMAGIC) 12533# >0 leshort 0413 demand-paged executable (ZMAGIC) 12534# >0 leshort 0314 demand-paged executable (QMAGIC) 12535# 125360 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 12537>16 lelong 0 \b, stripped 125380 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 12539>16 lelong 0 \b, stripped 125400 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 12541>16 lelong 0 \b, stripped 125420 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 12543>16 lelong 0 \b, stripped 12544# 125450 string \007\001\000 Linux/i386 object file 12546>20 lelong >0x1020 \b, DLL library 12547# Linux-8086 stuff: 125480 string \01\03\020\04 Linux-8086 impure executable 12549>28 long !0 not stripped 125500 string \01\03\040\04 Linux-8086 executable 12551>28 long !0 not stripped 12552# 125530 string \243\206\001\0 Linux-8086 object file 12554# 125550 string \01\03\020\20 Minix-386 impure executable 12556>28 long !0 not stripped 125570 string \01\03\040\20 Minix-386 executable 12558>28 long !0 not stripped 125590 string \01\03\04\20 Minix-386 NSYM/GNU executable 12560>28 long !0 not stripped 12561# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 12562216 lelong 0421 Linux/i386 core file 12563!:strength / 2 12564>220 string >\0 of '%s' 12565>200 lelong >0 (signal %d) 12566# 12567# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 12568# this can be overridden by the DOS executable (COM) entry 125692 string LILO Linux/i386 LILO boot/chain loader 12570# 12571# Linux make config build file, from Ole Aamot <oka@oka.no> 12572# Updated by Ken Sharp 1257328 string make\ config Linux make config build file (old) 1257449 search/70 Kernel\ Configuration Linux make config build file 12575 12576# 12577# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 12578# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 12579# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 125800 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 12581>2 byte&0x01 0 256 characters, 12582>2 byte&0x01 !0 512 characters, 12583>2 byte&0x02 0 no directory, 12584>2 byte&0x02 !0 Unicode directory, 12585>3 byte >0 8x%d 125860 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 12587>16 lelong x %d characters, 12588>12 lelong&0x01 0 no directory, 12589>12 lelong&0x01 !0 Unicode directory, 12590>24 lelong x %d 12591>28 lelong x \bx%d 12592 12593# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 125944086 string SWAP-SPACE Linux/i386 swap file 12595# From: Jeff Bailey <jbailey@ubuntu.com> 12596# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 125974076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 12598# From: James Hunt <james.hunt@ubuntu.com> 125994076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) 12600# according to man page of mkswap (8) March 1999 12601# volume label and UUID Russell Coker 12602# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 126034086 string SWAPSPACE2 Linux/i386 swap file (new style), 12604>0x400 long x version %d (4K pages), 12605>0x404 long x size %d pages, 12606>1052 string \0 no label, 12607>1052 string >\0 LABEL=%s, 12608>0x40c belong x UUID=%08x 12609>0x410 beshort x \b-%04x 12610>0x412 beshort x \b-%04x 12611>0x414 beshort x \b-%04x 12612>0x416 belong x \b-%08x 12613>0x41a beshort x \b%04x 12614# From Daniel Novotny <dnovotny@redhat.com> 12615# swap file for PowerPC 1261665526 string SWAPSPACE2 Linux/ppc swap file 1261716374 string SWAPSPACE2 Linux/ia64 swap file 12618# 12619# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 12620# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 12621# and Nicolas Lichtmaier <nick@debian.org> 12622# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 12623# Linux kernel boot images (i386 arch) (Wolfram Kleff) 12624514 string HdrS Linux kernel 12625!:strength + 55 12626>510 leshort 0xAA55 x86 boot executable 12627>>518 leshort >0x1ff 12628>>>529 byte 0 zImage, 12629>>>529 byte 1 bzImage, 12630>>>526 lelong >0 12631>>>>(526.s+0x200) string >\0 version %s, 12632>>498 leshort 1 RO-rootFS, 12633>>498 leshort 0 RW-rootFS, 12634>>508 leshort >0 root_dev 0x%X, 12635>>502 leshort >0 swap_dev 0x%X, 12636>>504 leshort >0 RAMdisksize %u KB, 12637>>506 leshort 0xFFFF Normal VGA 12638>>506 leshort 0xFFFE Extended VGA 12639>>506 leshort 0xFFFD Prompt for Videomode 12640>>506 leshort >0 Video mode %d 12641# This also matches new kernels, which were caught above by "HdrS". 126420 belong 0xb8c0078e Linux kernel 12643>0x1e3 string Loading version 1.3.79 or older 12644>0x1e9 string Loading from prehistoric times 12645 12646# System.map files - Nicolas Lichtmaier <nick@debian.org> 126478 search/1 \ A\ _text Linux kernel symbol map text 12648 12649# LSM entries - Nicolas Lichtmaier <nick@debian.org> 126500 search/1 Begin3 Linux Software Map entry text 126510 search/1 Begin4 Linux Software Map entry text (new format) 12652 12653# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 126540 belong 0x4f4f4f4d User-mode Linux COW file 12655>4 belong <3 \b, version %d 12656>>8 string >\0 \b, backing file %s 12657>4 belong >2 \b, version %d 12658>>32 string >\0 \b, backing file %s 12659 12660############################################################################ 12661# Linux kernel versions 12662 126630 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 12664>497 leshort 0 x86 boot sector 12665>>514 belong 0x8e of a kernel from the dawn of time! 12666>>514 belong 0x908ed8b4 version 0.99-1.1.42 12667>>514 belong 0x908ed8b8 for memtest86 12668 12669>497 leshort !0 x86 kernel 12670>>504 leshort >0 RAMdisksize=%u KB 12671>>502 leshort >0 swap=0x%X 12672>>508 leshort >0 root=0x%X 12673>>>498 leshort 1 \b-ro 12674>>>498 leshort 0 \b-rw 12675>>506 leshort 0xFFFF vga=normal 12676>>506 leshort 0xFFFE vga=extended 12677>>506 leshort 0xFFFD vga=ask 12678>>506 leshort >0 vga=%d 12679>>514 belong 0x908ed881 version 1.1.43-1.1.45 12680>>514 belong 0x15b281cd 12681>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 12682>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 12683>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 12684>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 12685>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 12686>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 12687>>514 string HdrS 12688>>>518 leshort >0x1FF 12689>>>>529 byte 0 \b, zImage 12690>>>>529 byte 1 \b, bzImage 12691>>>>(526.s+0x200) string >\0 \b, version %s 12692 12693# Linux boot sector thefts. 126940 belong 0xb8c0078e Linux 12695>0x1e6 belong 0x454c4b53 ELKS Kernel 12696>0x1e6 belong !0x454c4b53 style boot sector 12697 12698############################################################################ 12699# Linux S390 kernel image 12700# Created by: Jan Kaluza <jkaluza@redhat.com> 127018 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 12702>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 12703# 64bit 12704>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 12705>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 12706>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 12707>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 12708# 32bit 12709>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 12710>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 12711>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 12712>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 12713 12714# Linux ARM compressed kernel image 12715# From: Kevin Cernekee <cernekee@gmail.com> 1271636 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian) 1271736 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 12718 12719############################################################################ 12720# Linux 8086 executable 127210 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 12722>5 string . 12723>>4 string >\0 \b, libc version %s 12724 127250 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 12726>2 byte&0x01 !0 \b, unmapped zero page 12727>2 byte&0x20 0 \b, impure 12728>2 byte&0x20 !0 12729>>2 byte&0x10 !0 \b, A_EXEC 12730>2 byte&0x02 !0 \b, A_PAL 12731>2 byte&0x04 !0 \b, A_NSYM 12732>2 byte&0x08 !0 \b, A_STAND 12733>2 byte&0x40 !0 \b, A_PURE 12734>2 byte&0x80 !0 \b, A_TOVLY 12735>28 long !0 \b, not stripped 12736>37 string . 12737>>36 string >\0 \b, libc version %s 12738 12739# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 12740# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 12741# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 12742# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 12743 12744# SYSLINUX boot logo files (from 'ppmtolss16' sources) 12745# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 12746# file extension .lss .16 127470 lelong =0x1413f33d SYSLINUX' LSS16 image data 12748# syslinux-4.05/mime/image/x-lss16.xml 12749!:mime image/x-lss16 12750>4 leshort x \b, width %d 12751>6 leshort x \b, height %d 12752 127530 string OOOM User-Mode-Linux's Copy-On-Write disk image 12754>4 belong x version %d 12755 12756# SE Linux policy database 12757# From: Mike Frysinger <vapier@gentoo.org> 127580 lelong 0xf97cff8c SE Linux policy 12759>16 lelong x v%d 12760>20 lelong 1 MLS 12761>24 lelong x %d symbols 12762>28 lelong x %d ocons 12763 12764# Linux Logical Volume Manager (LVM) 12765# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 12766# 12767# System ID, UUID and volume group name are 128 bytes long 12768# but they should never be full and initialized with zeros... 12769# 12770# LVM1 12771# 127720x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 12773>0x12c string >\0 , System ID: %s 12774 127750x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 12776>0x12c string >\0 , System ID: %s 12777 12778# LVM2 12779# 12780# It seems that the label header can be in one the four first sector 12781# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 12782# 12783# 0x200 seems to be the common case 12784 127850x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 12786# read the offset to add to the start of the header, and the header 12787# start in 0x200 12788>&(&-12.l-0x21) byte x 12789# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 12790>>&0x0 string >\x2f \b, UUID: %.6s 12791>>&0x6 string >\x2f \b-%.4s 12792>>&0xa string >\x2f \b-%.4s 12793>>&0xe string >\x2f \b-%.4s 12794>>&0x12 string >\x2f \b-%.4s 12795>>&0x16 string >\x2f \b-%.4s 12796>>&0x1a string >\x2f \b-%.6s 12797>>&0x20 lequad x \b, size: %lld 12798 127990x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 12800>&(&-12.l-0x21) byte x 12801# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 12802>>&0x0 string >\x2f \b, UUID: %.6s 12803>>&0x6 string >\x2f \b-%.4s 12804>>&0xa string >\x2f \b-%.4s 12805>>&0xe string >\x2f \b-%.4s 12806>>&0x12 string >\x2f \b-%.4s 12807>>&0x16 string >\x2f \b-%.4s 12808>>&0x1a string >\x2f \b-%.6s 12809>>&0x20 lequad x \b, size: %lld 12810 128110x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 12812>&(&-12.l-0x21) byte x 12813# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 12814>>&0x0 string >\x2f \b, UUID: %.6s 12815>>&0x6 string >\x2f \b-%.4s 12816>>&0xa string >\x2f \b-%.4s 12817>>&0xe string >\x2f \b-%.4s 12818>>&0x12 string >\x2f \b-%.4s 12819>>&0x16 string >\x2f \b-%.4s 12820>>&0x1a string >\x2f \b-%.6s 12821>>&0x20 lequad x \b, size: %lld 12822 128230x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 12824>&(&-12.l-0x21) byte x 12825# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 12826>>&0x0 string >\x2f \b, UUID: %.6s 12827>>&0x6 string >\x2f \b-%.4s 12828>>&0xa string >\x2f \b-%.4s 12829>>&0xe string >\x2f \b-%.4s 12830>>&0x12 string >\x2f \b-%.4s 12831>>&0x16 string >\x2f \b-%.4s 12832>>&0x1a string >\x2f \b-%.6s 12833>>&0x20 lequad x \b, size: %lld 12834 12835# LVM snapshot 12836# from Jason Farrel 128370 string SnAp LVM Snapshot (CopyOnWrite store) 12838>4 lelong !0 - valid, 12839>4 lelong 0 - invalid, 12840>8 lelong x version %d, 12841>12 lelong x chunk_size %d 12842 12843# SE Linux policy database 128440 lelong 0xf97cff8c SE Linux policy 12845>16 lelong x v%d 12846>20 lelong 1 MLS 12847>24 lelong x %d symbols 12848>28 lelong x %d ocons 12849 12850# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 12851# Anthon van der Neut (anthon@mnt.org) 128520 string LUKS\xba\xbe LUKS encrypted file, 12853>6 beshort x ver %d 12854>8 string x [%s, 12855>40 string x %s, 12856>72 string x %s] 12857>168 string x UUID: %s 12858 12859 12860# Summary: Xen saved domain file 12861# Created by: Radek Vokal <rvokal@redhat.com> 128620 string LinuxGuestRecord Xen saved domain 12863>20 search/256 (name 12864>>&1 string x (name %s) 12865 12866# Type: Xen, the virtual machine monitor 12867# From: Radek Vokal <rvokal@redhat.com> 128680 string LinuxGuestRecord Xen saved domain 12869#>2 regex \(name\ [^)]*\) %s 12870>20 search/256 (name (name 12871>>&1 string x %s...) 12872 12873# Systemd journald files 12874# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/. 12875# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 12876 12877# check magic 128780 string LPKSHHRH 12879# check that state is one of known values 12880>16 ubyte&252 0 12881# check that each half of three unique id128s is non-zero 12882>>24 ubequad >0 12883>>>32 ubequad >0 12884>>>>40 ubequad >0 12885>>>>>48 ubequad >0 12886>>>>>>56 ubequad >0 12887>>>>>>>64 ubequad >0 Journal file 12888!:mime application/octet-stream 12889# provide more info 12890>>>>>>>>184 leqdate 0 empty 12891>>>>>>>>16 ubyte 0 \b, offline 12892>>>>>>>>16 ubyte 1 \b, online 12893>>>>>>>>16 ubyte 2 \b, archived 12894>>>>>>>>8 ulelong&1 1 \b, sealed 12895>>>>>>>>12 ulelong&1 1 \b, compressed 12896 12897# BCache backing and cache devices 12898# From: Gabriel de Perthuis <g2p.code@gmail.com> 128990x1008 lequad 8 12900>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 12901>>0x1010 ulequad 0 cache device 12902>>0x1010 ulequad 1 backing device 12903>>0x1010 ulequad 3 cache device 12904>>0x1010 ulequad 4 backing device 12905>>0x1048 string >0 \b, label "%.32s" 12906>>0x1028 ubelong x \b, uuid %08x 12907>>0x102c ubeshort x \b-%04x 12908>>0x102e ubeshort x \b-%04x 12909>>0x1030 ubeshort x \b-%04x 12910>>0x1032 ubelong x \b-%08x 12911>>0x1036 ubeshort x \b%04x 12912>>0x1038 ubelong x \b, set uuid %08x 12913>>0x103c ubeshort x \b-%04x 12914>>0x103e ubeshort x \b-%04x 12915>>0x1040 ubeshort x \b-%04x 12916>>0x1042 ubelong x \b-%08x 12917>>0x1046 ubeshort x \b%04x 12918 12919# Linux device tree: 12920# File format description can be found in the Linux kernel sources at 12921# Documentation/devicetree/booting-without-of.txt 12922# From Christoph Biedl 129230 belong 0xd00dfeed 12924# structure and strings must be within blob 12925>&(8.L) byte x 12926>>&(12.L) byte x 12927>>>20 belong >1 Device Tree Blob version %d 12928>>>>4 belong x \b, size=%d 12929>>>>20 belong >1 12930>>>>>28 belong x \b, boot CPU=%d 12931>>>>20 belong >2 12932>>>>>32 belong x \b, string block size=%d 12933>>>>20 belong >16 12934>>>>>36 belong x \b, DT structure block size=%d 12935 12936# glibc locale archive as defined in glibc locale/locarchive.h 129370 lelong 0xde020109 locale archive 12938>24 lelong x %d strings 12939 12940# Summary: Database file for mlocate 12941# Description: A database file as used by mlocate, a fast implementation 12942# of locate/updatedb. It uses merging to reuse the existing 12943# database and avoid rereading most of the filesystem. It's 12944# the default version of locate on Arch Linux (and others). 12945# File path: /var/lib/mlocate/mlocate.db by default (but configurable) 12946# Site: https://fedorahosted.org/mlocate/ 12947# Format docs: http://linux.die.net/man/5/mlocate.db 12948# Type: mlocate database file 12949# URL: https://fedorahosted.org/mlocate/ 12950# From: Wander Nauta <info@wandernauta.nl> 129510 string \0mlocate mlocate database 12952>12 byte x \b, version %d 12953>13 byte 1 \b, require visibility 12954>16 string x \b, root %s 12955 12956#------------------------------------------------------------------------------ 12957# $File$ 12958# lisp: file(1) magic for lisp programs 12959# 12960# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 12961 12962# updated by Joerg Jenderek 12963# GRR: This lot is too weak 12964#0 string ;; 12965# windows INF files often begin with semicolon and use CRLF as line end 12966# lisp files are mainly created on unix system with LF as line end 12967#>2 search/4096 !\r Lisp/Scheme program text 12968#>2 search/4096 \r Windows INF file 12969 129700 search/4096 (setq\ Lisp/Scheme program text 12971!:mime text/x-lisp 129720 search/4096 (defvar\ Lisp/Scheme program text 12973!:mime text/x-lisp 129740 search/4096 (defparam\ Lisp/Scheme program text 12975!:mime text/x-lisp 129760 search/4096 (defun\ Lisp/Scheme program text 12977!:mime text/x-lisp 129780 search/4096 (autoload\ Lisp/Scheme program text 12979!:mime text/x-lisp 129800 search/4096 (custom-set-variables\ Lisp/Scheme program text 12981!:mime text/x-lisp 12982 12983# Emacs 18 - this is always correct, but not very magical. 129840 string \012( Emacs v18 byte-compiled Lisp data 12985!:mime application/x-elc 12986# Emacs 19+ - ver. recognition added by Ian Springer 12987# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 12988# - Chris Chittleborough <cchittleborough@yahoo.com.au> 129890 string ;ELC 12990>4 byte >18 12991>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 12992!:mime application/x-elc 12993 12994# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 129950 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 129960 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 12997 129980 long 0x70768BD2 CLISP memory image data 129990 long 0xD28B7670 CLISP memory image data, other endian 13000 13001#.com and .bin for MIT scheme 130020 string \372\372\372\372 MIT scheme (library?) 13003 13004# From: David Allouche <david@allouche.net> 130050 search/1 \<TeXmacs| TeXmacs document text 13006!:mime text/texmacs 13007 13008#------------------------------------------------------------------------------ 13009# $File: llvm,v 1.7 2013/01/08 01:34:38 christos Exp $ 13010# llvm: file(1) magic for LLVM byte-codes 13011# URL: http://llvm.org/docs/BitCodeFormat.html 13012# From: Al Stone <ahs3@fc.hp.com> 13013 130140 string llvm LLVM byte-codes, uncompressed 130150 string llvc0 LLVM byte-codes, null compression 130160 string llvc1 LLVM byte-codes, gzip compression 130170 string llvc2 LLVM byte-codes, bzip2 compression 13018 130190 lelong 0x0b17c0de LLVM bitcode, wrapper 13020# Are these Mach-O ABI values? They appear to be. 13021>16 lelong 0x01000007 x86_64 13022>16 lelong 0x00000007 i386 13023>16 lelong 0x00000012 ppc 13024>16 lelong 0x01000012 ppc64 13025>16 lelong 0x0000000c arm 13026 130270 string BC\xc0\xde LLVM IR bitcode 13028 13029#------------------------------------------------------------------------------ 13030# $File: lua,v 1.5 2009/09/19 16:28:10 christos Exp $ 13031# lua: file(1) magic for Lua scripting language 13032# URL: http://www.lua.org/ 13033# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 13034 13035# Lua scripts 130360 search/1/w #!\ /usr/bin/lua Lua script text executable 13037!:mime text/x-lua 130380 search/1/w #!\ /usr/local/bin/lua Lua script text executable 13039!:mime text/x-lua 130400 search/1 #!/usr/bin/env\ lua Lua script text executable 13041!:mime text/x-lua 130420 search/1 #!\ /usr/bin/env\ lua Lua script text executable 13043!:mime text/x-lua 13044 13045# Lua bytecode 130460 string \033Lua Lua bytecode, 13047>4 byte 0x50 version 5.0 13048>4 byte 0x51 version 5.1 13049>4 byte 0x52 version 5.2 13050 13051#------------------------------------------------------------------------------ 13052# $File$ 13053# luks: file(1) magic for Linux Unified Key Setup 13054# URL: http://luks.endorphin.org/spec 13055# From: Anthon van der Neut <anthon@mnt.org> 13056 130570 string LUKS\xba\xbe LUKS encrypted file, 13058>6 beshort x ver %d 13059>8 string x [%s, 13060>40 string x %s, 13061>72 string x %s] 13062>168 string x UUID: %s 13063#------------------------------------------------------------------------------ 13064# $File$ 13065# make: file(1) magic for M4 scripts 13066# 130670 regex \^dnl\ M4 macro processor script text 13068!:mime text/x-m4 13069 13070#------------------------------------------------------------ 13071# $File: mach,v 1.18 2014/03/29 15:40:34 christos Exp $ 13072# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 13073# Unfortunately the first, cafebabe, is shared with 13074# Java ByteCode, so they are both handled in the file "cafebabe". 13075# The "feedface" ones are handled herein. 13076#------------------------------------------------------------ 13077# if set, it's for the 64-bit version of the architecture 13078# yes, this is separate from the low-order magic number bit 13079# it's also separate from the "64-bit libraries" bit in the 13080# upper 8 bits of the CPU subtype 13081 130820 name mach-o-cpu 13083>0 belong&0x01000000 0 13084# 13085# 32-bit ABIs. 13086# 13087# 1 vax 13088>>0 belong&0x00ffffff 1 13089>>>4 belong&0x00ffffff 0 vax 13090>>>4 belong&0x00ffffff 1 vax11/780 13091>>>4 belong&0x00ffffff 2 vax11/785 13092>>>4 belong&0x00ffffff 3 vax11/750 13093>>>4 belong&0x00ffffff 4 vax11/730 13094>>>4 belong&0x00ffffff 5 uvaxI 13095>>>4 belong&0x00ffffff 6 uvaxII 13096>>>4 belong&0x00ffffff 7 vax8200 13097>>>4 belong&0x00ffffff 8 vax8500 13098>>>4 belong&0x00ffffff 9 vax8600 13099>>>4 belong&0x00ffffff 10 vax8650 13100>>>4 belong&0x00ffffff 11 vax8800 13101>>>4 belong&0x00ffffff 12 uvaxIII 13102>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 13103>>0 belong&0x00ffffff 2 romp 13104>>0 belong&0x00ffffff 3 architecture=3 13105>>0 belong&0x00ffffff 4 ns32032 13106>>0 belong&0x00ffffff 5 ns32332 13107>>0 belong&0x00ffffff 6 m68k 13108# 7 x86 13109>>0 belong&0x00ffffff 7 13110>>>4 belong&0x0000000f 3 i386 13111>>>4 belong&0x0000000f 4 i486 13112>>>>4 belong&0x00fffff0 0 13113>>>>4 belong&0x00fffff0 0x80 \bsx 13114>>>4 belong&0x0000000f 5 i586 13115>>>4 belong&0x0000000f 6 13116>>>>4 belong&0x00fffff0 0 p6 13117>>>>4 belong&0x00fffff0 0x10 pentium_pro 13118>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 13119>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 13120>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 13121>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 13122>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x 13123>>>4 belong&0x0000000f 7 celeron 13124>>>>4 belong&0x00fffff0 0x00 \b_m0x%x 13125>>>>4 belong&0x00fffff0 0x10 \b_m0x%x 13126>>>>4 belong&0x00fffff0 0x20 \b_m0x%x 13127>>>>4 belong&0x00fffff0 0x30 \b_m0x%x 13128>>>>4 belong&0x00fffff0 0x40 \b_m0x%x 13129>>>>4 belong&0x00fffff0 0x50 \b_m0x%x 13130>>>>4 belong&0x00fffff0 0x60 13131>>>>4 belong&0x00fffff0 0x70 \b_mobile 13132>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x 13133>>>4 belong&0x0000000f 8 pentium_3 13134>>>>4 belong&0x00fffff0 0x00 13135>>>>4 belong&0x00fffff0 0x10 \b_m 13136>>>>4 belong&0x00fffff0 0x20 \b_xeon 13137>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x 13138>>>4 belong&0x0000000f 9 pentiumM 13139>>>>4 belong&0x00fffff0 0x00 13140>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x 13141>>>4 belong&0x0000000f 10 pentium_4 13142>>>>4 belong&0x00fffff0 0x00 13143>>>>4 belong&0x00fffff0 0x10 \b_m 13144>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 13145>>>4 belong&0x0000000f 11 itanium 13146>>>>4 belong&0x00fffff0 0x00 13147>>>>4 belong&0x00fffff0 0x10 \b_2 13148>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 13149>>>4 belong&0x0000000f 12 xeon 13150>>>>4 belong&0x00fffff0 0x00 13151>>>>4 belong&0x00fffff0 0x10 \b_mp 13152>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 13153>>>4 belong&0x0000000f >12 ia32 family=%d 13154>>>>4 belong&0x00fffff0 0x00 13155>>>>4 belong&0x00fffff0 >0x00 model=%x 13156>>0 belong&0x00ffffff 8 mips 13157>>>4 belong&0x00ffffff 1 R2300 13158>>>4 belong&0x00ffffff 2 R2600 13159>>>4 belong&0x00ffffff 3 R2800 13160>>>4 belong&0x00ffffff 4 R2000a 13161>>>4 belong&0x00ffffff 5 R2000 13162>>>4 belong&0x00ffffff 6 R3000a 13163>>>4 belong&0x00ffffff 7 R3000 13164>>>4 belong&0x00ffffff >7 subarchitecture=%d 13165>>0 belong&0x00ffffff 9 ns32532 13166>>0 belong&0x00ffffff 10 mc98000 13167>>0 belong&0x00ffffff 11 hppa 13168>>>4 belong&0x00ffffff 0 7100 13169>>>4 belong&0x00ffffff 1 7100LC 13170>>>4 belong&0x00ffffff >1 subarchitecture=%d 13171>>0 belong&0x00ffffff 12 arm 13172>>>4 belong&0x00ffffff 0 13173>>>4 belong&0x00ffffff 1 subarchitecture=%d 13174>>>4 belong&0x00ffffff 2 subarchitecture=%d 13175>>>4 belong&0x00ffffff 3 subarchitecture=%d 13176>>>4 belong&0x00ffffff 4 subarchitecture=%d 13177>>>4 belong&0x00ffffff 5 \b_v4t 13178>>>4 belong&0x00ffffff 6 \b_v6 13179>>>4 belong&0x00ffffff 7 \b_v5tej 13180>>>4 belong&0x00ffffff 8 \b_xscale 13181>>>4 belong&0x00ffffff 9 \b_v7 13182>>>4 belong&0x00ffffff 10 \b_v7f 13183>>>4 belong&0x00ffffff 11 subarchitecture=%d 13184>>>4 belong&0x00ffffff 12 \b_v7k 13185>>>4 belong&0x00ffffff >12 subarchitecture=%d 13186# 13 m88k 13187>>0 belong&0x00ffffff 13 13188>>>4 belong&0x00ffffff 0 mc88000 13189>>>4 belong&0x00ffffff 1 mc88100 13190>>>4 belong&0x00ffffff 2 mc88110 13191>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 13192>>0 belong&0x00ffffff 14 SPARC 13193>>0 belong&0x00ffffff 15 i860g 13194>>0 belong&0x00ffffff 16 alpha 13195>>0 belong&0x00ffffff 17 rs6000 13196>>0 belong&0x00ffffff 18 ppc 13197>>>4 belong&0x00ffffff 0 13198>>>4 belong&0x00ffffff 1 \b_601 13199>>>4 belong&0x00ffffff 2 \b_602 13200>>>4 belong&0x00ffffff 3 \b_603 13201>>>4 belong&0x00ffffff 4 \b_603e 13202>>>4 belong&0x00ffffff 5 \b_603ev 13203>>>4 belong&0x00ffffff 6 \b_604 13204>>>4 belong&0x00ffffff 7 \b_604e 13205>>>4 belong&0x00ffffff 8 \b_620 13206>>>4 belong&0x00ffffff 9 \b_650 13207>>>4 belong&0x00ffffff 10 \b_7400 13208>>>4 belong&0x00ffffff 11 \b_7450 13209>>>4 belong&0x00ffffff 100 \b_970 13210>>>4 belong&0x00ffffff >100 subarchitecture=%d 13211>>0 belong&0x00ffffff >18 architecture=%d 13212>0 belong&0x01000000 0x01000000 13213# 13214# 64-bit ABIs. 13215# 13216>>0 belong&0x00ffffff 0 64-bit architecture=%d 13217>>0 belong&0x00ffffff 1 64-bit architecture=%d 13218>>0 belong&0x00ffffff 2 64-bit architecture=%d 13219>>0 belong&0x00ffffff 3 64-bit architecture=%d 13220>>0 belong&0x00ffffff 4 64-bit architecture=%d 13221>>0 belong&0x00ffffff 5 64-bit architecture=%d 13222>>0 belong&0x00ffffff 6 64-bit architecture=%d 13223>>0 belong&0x00ffffff 7 x86_64 13224>>>4 belong&0x00ffffff 0 subarchitecture=%d 13225>>>4 belong&0x00ffffff 1 subarchitecture=%d 13226>>>4 belong&0x00ffffff 2 subarchitecture=%d 13227>>>4 belong&0x00ffffff 3 13228>>>4 belong&0x00ffffff 4 \b_arch1 13229>>>4 belong&0x00ffffff >4 subarchitecture=%d 13230>>0 belong&0x00ffffff 8 64-bit architecture=%d 13231>>0 belong&0x00ffffff 9 64-bit architecture=%d 13232>>0 belong&0x00ffffff 10 64-bit architecture=%d 13233>>0 belong&0x00ffffff 11 64-bit architecture=%d 13234>>0 belong&0x00ffffff 12 64-bit architecture=%d 13235>>0 belong&0x00ffffff 13 64-bit architecture=%d 13236>>0 belong&0x00ffffff 14 64-bit architecture=%d 13237>>0 belong&0x00ffffff 15 64-bit architecture=%d 13238>>0 belong&0x00ffffff 16 64-bit architecture=%d 13239>>0 belong&0x00ffffff 17 64-bit architecture=%d 13240>>0 belong&0x00ffffff 18 ppc64 13241>>>4 belong&0x00ffffff 0 13242>>>4 belong&0x00ffffff 1 \b_601 13243>>>4 belong&0x00ffffff 2 \b_602 13244>>>4 belong&0x00ffffff 3 \b_603 13245>>>4 belong&0x00ffffff 4 \b_603e 13246>>>4 belong&0x00ffffff 5 \b_603ev 13247>>>4 belong&0x00ffffff 6 \b_604 13248>>>4 belong&0x00ffffff 7 \b_604e 13249>>>4 belong&0x00ffffff 8 \b_620 13250>>>4 belong&0x00ffffff 9 \b_650 13251>>>4 belong&0x00ffffff 10 \b_7400 13252>>>4 belong&0x00ffffff 11 \b_7450 13253>>>4 belong&0x00ffffff 100 \b_970 13254>>>4 belong&0x00ffffff >100 subarchitecture=%d 13255>>0 belong&0x00ffffff >18 64-bit architecture=%d 13256 13257 132580 name mach-o-be 13259>0 byte 0xcf 64-bit 13260>4 use mach-o-cpu 13261>12 belong 1 object 13262>12 belong 2 executable 13263>12 belong 3 fixed virtual memory shared library 13264>12 belong 4 core 13265>12 belong 5 preload executable 13266>12 belong 6 dynamically linked shared library 13267>12 belong 7 dynamic linker 13268>12 belong 8 bundle 13269>12 belong 9 dynamically linked shared library stub 13270>12 belong 10 dSYM companion file 13271>12 belong 11 kext bundle 13272>12 belong >11 13273>>12 belong x filetype=%d 13274 13275# 132760 lelong&0xfffffffe 0xfeedface Mach-O 13277!:strength +1 13278>0 use \^mach-o-be 13279 132800 belong&0xfffffffe 0xfeedface Mach-O 13281!:strength +1 13282>0 use mach-o-be 13283 13284#------------------------------------------------------------------------------ 13285# $File: macintosh,v 1.24 2014/08/30 08:34:17 christos Exp $ 13286# macintosh description 13287# 13288# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 13289# Daniel Quinlan, quinlan@yggdrasil.com 1329011 string must\ be\ converted\ with\ BinHex BinHex binary text 13291!:mime application/mac-binhex40 13292>41 string x \b, version %.3s 13293 13294# Stuffit archives are the de facto standard of compression for Macintosh 13295# files obtained from most archives. (franklsm@tuns.ca) 132960 string SIT! StuffIt Archive (data) 13297!:mime application/x-stuffit 13298!:apple SIT!SIT! 13299>2 string x : %s 133000 string SITD StuffIt Deluxe (data) 13301>2 string x : %s 133020 string Seg StuffIt Deluxe Segment (data) 13303>2 string x : %s 13304 13305# Newer StuffIt archives (grant@netbsd.org) 133060 string StuffIt StuffIt Archive 13307!:mime application/x-stuffit 13308!:apple SIT!SIT! 13309#>162 string >0 : %s 13310 13311# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 13312# GRR: Too weak 13313#0 string APPL Macintosh Application (data) 13314#>2 string x \b: %s 13315 13316# Macintosh System files (franklsm@tuns.ca) 13317# GRR: Too weak 13318#0 string zsys Macintosh System File (data) 13319#0 string FNDR Macintosh Finder (data) 13320#0 string libr Macintosh Library (data) 13321#>2 string x : %s 13322#0 string shlb Macintosh Shared Library (data) 13323#>2 string x : %s 13324#0 string cdev Macintosh Control Panel (data) 13325#>2 string x : %s 13326#0 string INIT Macintosh Extension (data) 13327#>2 string x : %s 13328#0 string FFIL Macintosh Truetype Font (data) 13329#>2 string x : %s 13330#0 string LWFN Macintosh Postscript Font (data) 13331#>2 string x : %s 13332 13333# Additional Macintosh Files (franklsm@tuns.ca) 13334# GRR: Too weak 13335#0 string PACT Macintosh Compact Pro Archive (data) 13336#>2 string x : %s 13337#0 string ttro Macintosh TeachText File (data) 13338#>2 string x : %s 13339#0 string TEXT Macintosh TeachText File (data) 13340#>2 string x : %s 13341#0 string PDF Macintosh PDF File (data) 13342#>2 string x : %s 13343 13344# MacBinary format (Eric Fischer, enf@pobox.com) 13345# 13346# Unfortunately MacBinary doesn't really have a magic number prior 13347# to the MacBinary III format. The checksum is really the way to 13348# do it, but the magic file format isn't up to the challenge. 13349# 13350# 0 byte 0 13351# 1 byte # filename length 13352# 2 string # filename 13353# 65 string # file type 13354# 69 string # file creator 13355# 73 byte # Finder flags 13356# 74 byte 0 13357# 75 beshort # vertical posn in window 13358# 77 beshort # horiz posn in window 13359# 79 beshort # window or folder ID 13360# 81 byte # protected? 13361# 82 byte 0 13362# 83 belong # length of data segment 13363# 87 belong # length of resource segment 13364# 91 belong # file creation date 13365# 95 belong # file modification date 13366# 99 beshort # length of comment after resource 13367# 101 byte # new Finder flags 13368# 102 string mBIN # (only in MacBinary III) 13369# 106 byte # char. code of file name 13370# 107 byte # still more Finder flags 13371# 116 belong # total file length 13372# 120 beshort # length of add'l header 13373# 122 byte 129 # for MacBinary II 13374# 122 byte 130 # for MacBinary III 13375# 123 byte 129 # minimum version that can read fmt 13376# 124 beshort # checksum 13377# 13378# This attempts to use the version numbers as a magic number, requiring 13379# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 13380# be 0x81. This works for the files I have, but maybe not for everyone's. 13381 13382# Unfortunately, this magic is quite weak - MPi 13383#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 13384 13385# MacBinary I doesn't have the version number field at all, but MacBinary II 13386# has been in use since 1987 so I hope there aren't many really old files 13387# floating around that this will miss. The original spec calls for using 13388# the nulls in 0, 74, and 82 as the magic number. 13389# 13390# Another possibility, that would also work for MacBinary I, is to use 13391# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 13392# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 13393# and that 74 will be 0. So something like 13394# 13395# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 13396# 13397# >73 byte&0x01 0x01 \b, inited 13398# >73 byte&0x02 0x02 \b, changed 13399# >73 byte&0x04 0x04 \b, busy 13400# >73 byte&0x08 0x08 \b, bozo 13401# >73 byte&0x10 0x10 \b, system 13402# >73 byte&0x10 0x20 \b, bundle 13403# >73 byte&0x10 0x40 \b, invisible 13404# >73 byte&0x10 0x80 \b, locked 13405 13406#>65 string x \b, type "%4.4s" 13407 13408#>65 string 8BIM (PhotoShop) 13409#>65 string ALB3 (PageMaker 3) 13410#>65 string ALB4 (PageMaker 4) 13411#>65 string ALT3 (PageMaker 3) 13412#>65 string APPL (application) 13413#>65 string AWWP (AppleWorks word processor) 13414#>65 string CIRC (simulated circuit) 13415#>65 string DRWG (MacDraw) 13416#>65 string EPSF (Encapsulated PostScript) 13417#>65 string FFIL (font suitcase) 13418#>65 string FKEY (function key) 13419#>65 string FNDR (Macintosh Finder) 13420#>65 string GIFf (GIF image) 13421#>65 string Gzip (GNU gzip) 13422#>65 string INIT (system extension) 13423#>65 string LIB\ (library) 13424#>65 string LWFN (PostScript font) 13425#>65 string MSBC (Microsoft BASIC) 13426#>65 string PACT (Compact Pro archive) 13427#>65 string PDF\ (Portable Document Format) 13428#>65 string PICT (picture) 13429#>65 string PNTG (MacPaint picture) 13430#>65 string PREF (preferences) 13431#>65 string PROJ (Think C project) 13432#>65 string QPRJ (Think Pascal project) 13433#>65 string SCFL (Defender scores) 13434#>65 string SCRN (startup screen) 13435#>65 string SITD (StuffIt Deluxe) 13436#>65 string SPn3 (SuperPaint) 13437#>65 string STAK (HyperCard stack) 13438#>65 string Seg\ (StuffIt segment) 13439#>65 string TARF (Unix tar archive) 13440#>65 string TEXT (ASCII) 13441#>65 string TIFF (TIFF image) 13442#>65 string TOVF (Eudora table of contents) 13443#>65 string WDBN (Microsoft Word word processor) 13444#>65 string WORD (MacWrite word processor) 13445#>65 string XLS\ (Microsoft Excel) 13446#>65 string ZIVM (compress (.Z)) 13447#>65 string ZSYS (Pre-System 7 system file) 13448#>65 string acf3 (Aldus FreeHand) 13449#>65 string cdev (control panel) 13450#>65 string dfil (Desk Accessory suitcase) 13451#>65 string libr (library) 13452#>65 string nX^d (WriteNow word processor) 13453#>65 string nX^w (WriteNow dictionary) 13454#>65 string rsrc (resource) 13455#>65 string scbk (Scrapbook) 13456#>65 string shlb (shared library) 13457#>65 string ttro (SimpleText read-only) 13458#>65 string zsys (system file) 13459 13460#>69 string x \b, creator "%4.4s" 13461 13462# Somewhere, Apple has a repository of registered Creator IDs. These are 13463# just the ones that I happened to have files from and was able to identify. 13464 13465#>69 string 8BIM (Adobe Photoshop) 13466#>69 string ALD3 (PageMaker 3) 13467#>69 string ALD4 (PageMaker 4) 13468#>69 string ALFA (Alpha editor) 13469#>69 string APLS (Apple Scanner) 13470#>69 string APSC (Apple Scanner) 13471#>69 string BRKL (Brickles) 13472#>69 string BTFT (BitFont) 13473#>69 string CCL2 (Common Lisp 2) 13474#>69 string CCL\ (Common Lisp) 13475#>69 string CDmo (The Talking Moose) 13476#>69 string CPCT (Compact Pro) 13477#>69 string CSOm (Eudora) 13478#>69 string DMOV (Font/DA Mover) 13479#>69 string DSIM (DigSim) 13480#>69 string EDIT (Macintosh Edit) 13481#>69 string ERIK (Macintosh Finder) 13482#>69 string EXTR (self-extracting archive) 13483#>69 string Gzip (GNU gzip) 13484#>69 string KAHL (Think C) 13485#>69 string LWFU (LaserWriter Utility) 13486#>69 string LZIV (compress) 13487#>69 string MACA (MacWrite) 13488#>69 string MACS (Macintosh operating system) 13489#>69 string MAcK (MacKnowledge terminal emulator) 13490#>69 string MLND (Defender) 13491#>69 string MPNT (MacPaint) 13492#>69 string MSBB (Microsoft BASIC (binary)) 13493#>69 string MSWD (Microsoft Word) 13494#>69 string NCSA (NCSA Telnet) 13495#>69 string PJMM (Think Pascal) 13496#>69 string PSAL (Hunt the Wumpus) 13497#>69 string PSI2 (Apple File Exchange) 13498#>69 string R*ch (BBEdit) 13499#>69 string RMKR (Resource Maker) 13500#>69 string RSED (Resource Editor) 13501#>69 string Rich (BBEdit) 13502#>69 string SIT! (StuffIt) 13503#>69 string SPNT (SuperPaint) 13504#>69 string Unix (NeXT Mac filesystem) 13505#>69 string VIM! (Vim editor) 13506#>69 string WILD (HyperCard) 13507#>69 string XCEL (Microsoft Excel) 13508#>69 string aCa2 (Fontographer) 13509#>69 string aca3 (Aldus FreeHand) 13510#>69 string dosa (Macintosh MS-DOS file system) 13511#>69 string movr (Font/DA Mover) 13512#>69 string nX^n (WriteNow) 13513#>69 string pdos (Apple ProDOS file system) 13514#>69 string scbk (Scrapbook) 13515#>69 string ttxt (SimpleText) 13516#>69 string ufox (Foreign File Access) 13517 13518# Just in case... 13519 13520102 string mBIN MacBinary III data with surprising version number 13521 13522# sas magic from Bruce Foster (bef@nwu.edu) 13523# 13524#0 string SAS SAS 13525#>8 string x %s 135260 string SAS SAS 13527>24 string DATA data file 13528>24 string CATALOG catalog 13529>24 string INDEX data file index 13530>24 string VIEW data view 13531# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 13532# 135330x54 string SAS SAS 7+ 13534>0x9C string DATA data file 13535>0x9C string CATALOG catalog 13536>0x9C string INDEX data file index 13537>0x9C string VIEW data view 13538 13539# spss magic for SPSS system and portable files, 13540# from Bruce Foster (bef@nwu.edu). 13541 135420 long 0xc1e2c3c9 SPSS Portable File 13543>40 string x %s 13544 135450 string $FL2 SPSS System File 13546>24 string x %s 13547 135480 string $FL3 SPSS System File 13549>24 string x %s 13550 13551# Macintosh filesystem data 13552# From "Tom N Harris" <telliamed@mac.com> 13553# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 13554# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 13555# entries depend on the data arithmetic added after v.35 13556# There's also some Pascal strings in here, ditto... 13557 13558# The boot block signature, according to IM:Files, is 13559# "for HFS volumes, this field always contains the value 0x4C4B." 13560# But if this is true for MFS or HFS+ volumes, I don't know. 13561# Alternatively, the boot block is supposed to be zeroed if it's 13562# unused, so a simply >0 should suffice. 13563 135640x400 beshort 0xD2D7 Macintosh MFS data 13565>0 beshort 0x4C4B (bootable) 13566>0x40a beshort &0x8000 (locked) 13567>0x402 beldate-0x7C25B080 x created: %s, 13568>0x406 beldate-0x7C25B080 >0 last backup: %s, 13569>0x414 belong x block size: %d, 13570>0x412 beshort x number of blocks: %d, 13571>0x424 pstring x volume name: %s 13572 13573# *.hfs updated by Joerg Jenderek 13574# http://en.wikipedia.org/wiki/Hierarchical_File_System 13575# "BD" gives many false positives 135760x400 beshort 0x4244 13577# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 13578# first block of volume bit map (always 3) 13579>0x40e ubeshort 0x0003 13580# maximal length of volume name is 27 13581>>0x424 ubyte <28 Macintosh HFS data 13582#!:mime application/octet-stream 13583# these mime and apple types are not sure 13584!:mime application/x-apple-diskimage 13585#!:apple hfsdINIT 13586#!:apple MACSdisk 13587>>>0 beshort 0x4C4B (bootable) 13588#>>>0 beshort 0x0000 (not bootable) 13589>>>0x40a beshort &0x8000 (locked) 13590>>>0x40a beshort ^0x0100 (mounted) 13591>>>0x40a beshort &0x0200 (spared blocks) 13592>>>0x40a beshort &0x0800 (unclean) 13593>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 13594# http://www.epochconverter.com/ 13595# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 13596# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 13597# construct not working 13598#>>>0x402 beldate-0x7C25B080 x created: %s, 13599#>>>0x406 beldate-0x7C25B080 x last modified: %s, 13600#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 13601# found block sizes 200h,1200h,2800h 13602>>>0x414 belong x block size: %d, 13603>>>0x412 beshort x number of blocks: %d, 13604>>>0x424 pstring x volume name: %s 13605 136060x400 beshort 0x482B Macintosh HFS Extended 13607>&0 beshort x version %d data 13608>0 beshort 0x4C4B (bootable) 13609>0x404 belong ^0x00000100 (mounted) 13610>&2 belong &0x00000200 (spared blocks) 13611>&2 belong &0x00000800 (unclean) 13612>&2 belong &0x00008000 (locked) 13613>&6 string x last mounted by: '%.4s', 13614# really, that should be treated as a belong and we print a string 13615# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 13616>&14 beldate-0x7C25B080 x created: %s, 13617# only the creation date is local time, all other timestamps in HFS+ are UTC. 13618>&18 bedate-0x7C25B080 x last modified: %s, 13619>&22 bedate-0x7C25B080 >0 last backup: %s, 13620>&26 bedate-0x7C25B080 >0 last checked: %s, 13621>&38 belong x block size: %d, 13622>&42 belong x number of blocks: %d, 13623>&46 belong x free blocks: %d 13624 13625## AFAIK, only the signature is different 13626# same as Apple Partition Map 13627# GRR: This magic is too weak, it is just "TS" 13628#0x200 beshort 0x5453 Apple Old Partition data 13629#>0x2 beshort x block size: %d, 13630#>0x230 string x first type: %s, 13631#>0x210 string x name: %s, 13632#>0x254 belong x number of blocks: %d, 13633#>0x400 beshort 0x504D 13634#>>0x430 string x second type: %s, 13635#>>0x410 string x name: %s, 13636#>>0x454 belong x number of blocks: %d, 13637#>>0x800 beshort 0x504D 13638#>>>0x830 string x third type: %s, 13639#>>>0x810 string x name: %s, 13640#>>>0x854 belong x number of blocks: %d, 13641#>>>0xa00 beshort 0x504D 13642#>>>>0xa30 string x fourth type: %s, 13643#>>>>0xa10 string x name: %s, 13644#>>>>0xa54 belong x number of blocks: %d 13645 13646# From: Remi Mommsen <mommsen@slac.stanford.edu> 136470 string BOMStore Mac OS X bill of materials (BOM) file 13648 13649# From: Adam Buchbinder <adam.buchbinder@gmail.com> 13650# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 13651# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 13652# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 13653# don't know what they mean. 136540 belong 0x100 13655>(0x4.L+24) beshort x 13656>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 13657>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 13658>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 13659>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 13660 13661#------------------------------------------------------------------------------ 13662# $File: cups,v 1.2 2012/11/02 21:50:29 christos Exp $ 13663# MacOS files 13664# 13665 136660 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 13667 13668#------------------------------------------------------------------------------ 13669# $File: magic,v 1.9 2009/09/19 16:28:10 christos Exp $ 13670# magic: file(1) magic for magic files 13671# 136720 string/t #\ Magic magic text file for file(1) cmd 136730 lelong 0xF11E041C magic binary file for file(1) cmd 13674>4 lelong x (version %d) (little endian) 136750 belong 0xF11E041C magic binary file for file(1) cmd 13676>4 belong x (version %d) (big endian) 13677#------------------------------------------------------------------------------ 13678# $File: mail.news,v 1.21 2012/06/21 01:44:52 christos Exp $ 13679# mail.news: file(1) magic for mail and news 13680# 13681# Unfortunately, saved netnews also has From line added in some news software. 13682#0 string From mail text 136830 string/t Relay-Version: old news text 13684!:mime message/rfc822 136850 string/t #!\ rnews batched news text 13686!:mime message/rfc822 136870 string/t N#!\ rnews mailed, batched news text 13688!:mime message/rfc822 136890 string/t Forward\ to mail forwarding text 13690!:mime message/rfc822 136910 string/t Pipe\ to mail piping text 13692!:mime message/rfc822 136930 string/tc delivered-to: SMTP mail text 13694!:mime message/rfc822 136950 string/tc return-path: SMTP mail text 13696!:mime message/rfc822 136970 string/t Path: news text 13698!:mime message/news 136990 string/t Xref: news text 13700!:mime message/news 137010 string/t From: news or mail text 13702!:mime message/rfc822 137030 string/t Article saved news text 13704!:mime message/news 137050 string/t BABYL Emacs RMAIL text 137060 string/t Received: RFC 822 mail text 13707!:mime message/rfc822 137080 string/t MIME-Version: MIME entity text 13709#0 string/t Content- MIME entity text 13710 13711# TNEF files... 137120 lelong 0x223E9F78 Transport Neutral Encapsulation Format 13713!:mime application/vnd.ms-tnef 13714 13715# From: Kevin Sullivan <ksulliva@psc.edu> 137160 string *mbx* MBX mail folder 13717 13718# From: Simon Matter <simon.matter@invoca.ch> 137190 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 13720 13721# JAM(mbp) Fidonet message area databases 13722# JHR file 137230 string JAM\0 JAM message area header file 13724>12 leshort >0 (%d messages) 13725 13726# Squish Fidonet message area databases 13727# SQD file (requires at least one message in the area) 13728# XXX: Weak magic 13729#256 leshort 0xAFAE4453 Squish message area data file 13730#>4 leshort >0 (%d messages) 13731 13732#0 string \<!--\ MHonArc text/html; x-type=mhonarc 13733 13734# Cyrus: file(1) magic for compiled Cyrus sieve scripts 13735# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 13736# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 13737# From: Philipp Hahn <hahn@univention.de> 13738 13739# Compiled Cyrus sieve script 137400 string CyrSBytecode Cyrus sieve bytecode data, 13741>12 belong =1 version 1, big-endian 13742>12 lelong =1 version 1, little-endian 13743>12 belong x version %d, network-endian 13744#------------------------------------------------------------------------------ 13745# $File$ 13746# make: file(1) magic for makefiles 13747# 137480 regex \^CFLAGS makefile script text 13749!:mime text/x-makefile 137500 regex \^LDFLAGS makefile script text 13751!:mime text/x-makefile 137520 regex \^all: makefile script text 13753!:mime text/x-makefile 137540 regex \^.PRECIOUS makefile script text 13755!:mime text/x-makefile 13756 137570 regex \^SUBDIRS automake makefile script text 13758!:mime text/x-makefile 13759 13760 13761#------------------------------------------------------------------------------ 13762# $File: msdos,v 1.99 2014/06/03 01:40:24 christos Exp $ 13763# map: file(1) magic for Map data 13764# 13765 13766# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 137678 string .FIT FIT Map data 13768>15 byte 0 13769>>35 belong x \b, unit id %d 13770# 20 years after unix epoch 13771>>39 lelong x \b, serial %u 13772>>43 ledate/631152000 x \b, %s 13773 13774>>47 leshort x \b, manufacturer %d 13775>>47 leshort 1 \b (garmin) 13776>>49 leshort x \b, product %d 13777>>53 byte x \b, type %d 13778>>53 byte 1 \b (Device) 13779>>53 byte 2 \b (Settings) 13780>>53 byte 3 \b (Sports/Cycling) 13781>>53 byte 4 \b (Activity) 13782>>53 byte 8 \b (Elevations) 13783>>53 byte 10 \b (Totals) 13784 13785#------------------------------------------------------------------------------ 13786# $File: maple,v 1.6 2009/09/19 16:28:10 christos Exp $ 13787# maple: file(1) magic for maple files 13788# "H. Nanosecond" <aldomel@ix.netcom.com> 13789# Maple V release 4, a multi-purpose math program 13790# 13791 13792# maple library .lib 137930 string \000MVR4\nI MapleVr4 library 13794 13795# .ind 13796# no magic for these :-( 13797# they are compiled indexes for maple files 13798 13799# .hdb 138000 string \000\004\000\000 Maple help database 13801 13802# .mhp 13803# this has the form <PACKAGE=name> 138040 string \<PACKAGE= Maple help file 138050 string \<HELP\ NAME= Maple help file 138060 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 13807#0 string #\ Newton Maple help file, old style 138080 string #\ daub Maple help file, old style 13809#0 string #=========== Maple help file, old style 13810 13811# .mws 138120 string \000\000\001\044\000\221 Maple worksheet 13813#this is anomalous 138140 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 13815# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 13816# that is {VERSION major_version miunor_version computer_type version_string} 138170 string {VERSION\ Maple worksheet 13818>9 string >\0 version %.1s. 13819>>11 string >\0 %.1s 13820 13821# .mps 138220 string \0\0\001$ Maple something 13823# from byte 4 it is either 'nul E' or 'soh R' 13824# I think 'nul E' means a file that was saved as a different name 13825# a sort of revision marking 13826# 'soh R' means new 13827>4 string \000\105 An old revision 13828>4 string \001\122 The latest save 13829 13830# .mpl 13831# some of these are the same as .mps above 13832#0000000 000 000 001 044 000 105 same as .mps 13833#0000000 000 000 001 044 001 122 same as .mps 13834 138350 string #\n##\ <SHAREFILE= Maple something 138360 string \n#\n##\ <SHAREFILE= Maple something 138370 string ##\ <SHAREFILE= Maple something 138380 string #\r##\ <SHAREFILE= Maple something 138390 string \r#\r##\ <SHAREFILE= Maple something 138400 string #\ \r##\ <DESCRIBE> Maple something anomalous. 13841#-------------------------------------------- 13842# marc21: file(1) magic for MARC 21 Format 13843# 13844# Kevin Ford (kefo@loc.gov) 13845# 13846# MARC21 formats are for the representation and communication 13847# of bibliographic and related information in machine-readable 13848# form. For more info, see http://www.loc.gov/marc/ 13849 13850 13851# leader position 20-21 must be 45 1385220 string 45 13853 13854# leader starts with 5 digits, followed by codes specific to MARC format 13855>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 13856!:mime application/marc 13857>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority 13858!:mime application/marc 13859>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 13860!:mime application/marc 138610 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification 13862!:mime application/marc 13863>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community 13864!:mime application/marc 13865 13866# leader position 22-23, should be "00" but is it? 13867>0 regex/1l (^.{21})([^0]{2}) (non-conforming) 13868!:mime application/marc 13869 13870#------------------------------------------------------------------------------ 13871# $File$ 13872# mathcad: file(1) magic for Mathcad documents 13873# URL: http://www.mathsoft.com/ 13874# From: Josh Triplett <josh@freedesktop.org> 13875 138760 string .MCAD\t Mathcad document 13877 13878#------------------------------------------------------------------------------ 13879# $File$ 13880# mathematica: file(1) magic for mathematica files 13881# "H. Nanosecond" <aldomel@ix.netcom.com> 13882# Mathematica a multi-purpose math program 13883# versions 2.2 and 3.0 13884 13885#mathematica .mb 138860 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 138870 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 13888 13889# .ma 13890# multiple possibilites: 13891 138920 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 13893#>41 string >\0 %s 13894 13895#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 13896 13897#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 13898#>675 string >\0 %s #doesn't work well 13899 13900# there may be 'cr' instread of 'nl' in some does this matter? 13901 13902# generic: 139030 string (*^\r\r::[\011 Mathematica notebook version 2.x 139040 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 139050 string (*^\015 Mathematica notebook version 2.x 139060 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 139070 string (*^\r::[\011 Mathematica notebook version 2.x 139080 string (*^\r\n::[\011 Mathematica notebook version 2.x 139090 string (*^\n\n::[\011 Mathematica notebook version 2.x 139100 string (*^\n::[\011 Mathematica notebook version 2.x 13911 13912 13913# Mathematica .mx files 13914 13915#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 139160 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 13917#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 13918# >71... is optional 13919>88 string >\0 from %s 13920 13921 13922# Mathematica files PBF: 13923# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 139240 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 13925 13926# .ml files These are menu resources I think 13927# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 13928# how to put that into a magic rule? 139294 string \ A~ MAthematica .ml file 13930 13931# .nb files 13932#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 139330 string (*********************** Mathematica 3.0 notebook 13934 13935# other (* matches it is a comment start in these langs 13936# GRR: Too weak; also matches other languages e.g. ML 13937#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 13938 13939######################### 13940# MatLab v5 139410 string MATLAB Matlab v5 mat-file 13942>126 short 0x494d (big endian) 13943>>124 beshort x version 0x%04x 13944>126 short 0x4d49 (little endian) 13945>>124 leshort x version 0x%04x 13946 13947 13948#------------------------------------------------------------------------------ 13949# $File: matroska,v 1.7 2012/08/26 10:06:15 christos Exp $ 13950# matroska: file(1) magic for Matroska files 13951# 13952# See http://www.matroska.org/ 13953# 13954 13955# EBML id: 139560 belong 0x1a45dfa3 13957# DocType id: 13958>4 search/4096 \x42\x82 13959# DocType contents: 13960>>&1 string webm WebM 13961!:mime video/webm 13962>>&1 string matroska Matroska data 13963!:mime video/x-matroska 13964 13965#------------------------------------------------------------------------------ 13966# $File$ 13967# Mavroyanopoulos Nikos <nmav@hellug.gr> 13968# mcrypt: file(1) magic for mcrypt 2.2.x; 139690 string \0m\3 mcrypt 2.5 encrypted data, 13970>4 string >\0 algorithm: %s, 13971>>&1 leshort >0 keysize: %d bytes, 13972>>>&0 string >\0 mode: %s, 13973 139740 string \0m\2 mcrypt 2.2 encrypted data, 13975>3 byte 0 algorithm: blowfish-448, 13976>3 byte 1 algorithm: DES, 13977>3 byte 2 algorithm: 3DES, 13978>3 byte 3 algorithm: 3-WAY, 13979>3 byte 4 algorithm: GOST, 13980>3 byte 6 algorithm: SAFER-SK64, 13981>3 byte 7 algorithm: SAFER-SK128, 13982>3 byte 8 algorithm: CAST-128, 13983>3 byte 9 algorithm: xTEA, 13984>3 byte 10 algorithm: TWOFISH-128, 13985>3 byte 11 algorithm: RC2, 13986>3 byte 12 algorithm: TWOFISH-192, 13987>3 byte 13 algorithm: TWOFISH-256, 13988>3 byte 14 algorithm: blowfish-128, 13989>3 byte 15 algorithm: blowfish-192, 13990>3 byte 16 algorithm: blowfish-256, 13991>3 byte 100 algorithm: RC6, 13992>3 byte 101 algorithm: IDEA, 13993>4 byte 0 mode: CBC, 13994>4 byte 1 mode: ECB, 13995>4 byte 2 mode: CFB, 13996>4 byte 3 mode: OFB, 13997>4 byte 4 mode: nOFB, 13998>5 byte 0 keymode: 8bit 13999>5 byte 1 keymode: 4bit 14000>5 byte 2 keymode: SHA-1 hash 14001>5 byte 3 keymode: MD5 hash 14002 14003#------------------------------------------------------------------------------ 14004# $File$ 14005# mercurial: file(1) magic for Mercurial changeset bundles 14006# http://www.selenic.com/mercurial/wiki/ 14007# 14008# Jesse Glick (jesse.glick@sun.com) 14009# 14010 140110 string HG10 Mercurial changeset bundle 14012>4 string UN (uncompressed) 14013>4 string GZ (gzip compressed) 14014>4 string BZ (bzip2 compressed) 14015 14016#------------------------------------------------------------------------------ 14017# $File: mathematica,v 1.7 2009/09/19 16:28:10 christos Exp $ 14018# metastore: file(1) magic for metastore files 14019# From: Thomas Wissen 14020# see http://david.hardeman.nu/software.php#metastore 140210 string MeTaSt00r3 Metastore data file, 14022>10 bequad x version %0llx 14023 14024#------------------------------------------------------------------------------ 14025# $File: rinex,v 1.4 2011/05/03 01:44:17 christos Exp $ 14026# rinex: file(1) magic for RINEX files 14027# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 14028# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 14029# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 1403060 string RINEX 14031>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 14032>>&32 string x \b, date %15.15s 14033>>5 string x \b, version %6.6s 14034!:mime rinex/broadcast 14035>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 14036>>&32 string x \b, date %15.15s 14037>>5 string x \b, version %6.6s 14038!:mime rinex/observation 14039>80 search/256 XXRINEXC RINEX Data, Clock 14040>>&32 string x \b, date %15.15s 14041>>5 string x \b, version %6.6s 14042!:mime rinex/clock 14043>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 14044>>&32 string x \b, date %15.15s 14045>>5 string x \b, version %6.6s 14046!:mime rinex/navigation 14047>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 14048>>&32 string x \b, date %15.15s 14049>>5 string x \b, version %6.6s 14050!:mime rinex/navigation 14051>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 14052>>&32 string x \b, date %15.15s 14053>>5 string x \b, version %6.6s 14054!:mime rinex/navigation 14055>80 search/256 XXRINEXM RINEX Data, Meteorological 14056>>&32 string x \b, date %15.15s 14057>>5 string x \b, version %6.6s 14058!:mime rinex/meteorological 14059>80 search/256 XXRINEXN RINEX Data, Navigation 14060>>&32 string x \b, date %15.15s 14061>>5 string x \b, version %6.6s 14062!:mime rinex/navigation 14063>80 search/256 XXRINEXO RINEX Data, Observation 14064>>&32 string x \b, date %15.15s 14065>>5 string x \b, version %6.6s 14066!:mime rinex/observation 14067 14068# https://en.wikipedia.org/wiki/GRIB 140690 string GRIB 14070>7 byte =1 Gridded binary (GRIB) version 1 14071>7 byte =2 Gridded binary (GRIB) version 2 14072 14073#------------------------------------------------------------------------------ 14074# $File: mime,v 1.5 2009/09/19 16:28:10 christos Exp $ 14075# mime: file(1) magic for MIME encoded files 14076# 140770 string/t Content-Type:\ 14078>14 string >\0 %s 140790 string/t Content-Type: 14080>13 string >\0 %s 14081 14082#------------------------------------------------------------------------------ 14083# $File: mips,v 1.9 2013/01/12 03:09:51 christos Exp $ 14084# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 14085# and DEC Ultrix 14086# 140870 beshort 0x0160 MIPSEB ECOFF executable 14088>20 beshort 0407 (impure) 14089>20 beshort 0410 (swapped) 14090>20 beshort 0413 (paged) 14091>8 belong >0 not stripped 14092>8 belong 0 stripped 14093>22 byte x - version %d 14094>23 byte x \b.%d 14095# 140960 beshort 0x0162 MIPSEL-BE ECOFF executable 14097>20 beshort 0407 (impure) 14098>20 beshort 0410 (swapped) 14099>20 beshort 0413 (paged) 14100>8 belong >0 not stripped 14101>8 belong 0 stripped 14102>23 byte x - version %d 14103>22 byte x \b.%d 14104# 141050 beshort 0x6001 MIPSEB-LE ECOFF executable 14106>20 beshort 03401 (impure) 14107>20 beshort 04001 (swapped) 14108>20 beshort 05401 (paged) 14109>8 belong >0 not stripped 14110>8 belong 0 stripped 14111>23 byte x - version %d 14112>22 byte x \b.%d 14113# 141140 beshort 0x6201 MIPSEL ECOFF executable 14115>20 beshort 03401 (impure) 14116>20 beshort 04001 (swapped) 14117>20 beshort 05401 (paged) 14118>8 belong >0 not stripped 14119>8 belong 0 stripped 14120>23 byte x - version %d 14121>22 byte x \b.%d 14122# 14123# MIPS 2 additions 14124# 141250 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 14126>20 beshort 0407 (impure) 14127>20 beshort 0410 (swapped) 14128>20 beshort 0413 (paged) 14129>8 belong >0 not stripped 14130>8 belong 0 stripped 14131>22 byte x - version %d 14132>23 byte x \b.%d 14133# 141340 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 14135>20 beshort 0407 (impure) 14136>20 beshort 0410 (swapped) 14137>20 beshort 0413 (paged) 14138>8 belong >0 not stripped 14139>8 belong 0 stripped 14140>22 byte x - version %d 14141>23 byte x \b.%d 14142# 141430 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 14144>20 beshort 03401 (impure) 14145>20 beshort 04001 (swapped) 14146>20 beshort 05401 (paged) 14147>8 belong >0 not stripped 14148>8 belong 0 stripped 14149>23 byte x - version %d 14150>22 byte x \b.%d 14151# 141520 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 14153>20 beshort 03401 (impure) 14154>20 beshort 04001 (swapped) 14155>20 beshort 05401 (paged) 14156>8 belong >0 not stripped 14157>8 belong 0 stripped 14158>23 byte x - version %d 14159>22 byte x \b.%d 14160# 14161# MIPS 3 additions 14162# 141630 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 14164>20 beshort 0407 (impure) 14165>20 beshort 0410 (swapped) 14166>20 beshort 0413 (paged) 14167>8 belong >0 not stripped 14168>8 belong 0 stripped 14169>22 byte x - version %d 14170>23 byte x \b.%d 14171# 141720 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 14173>20 beshort 0407 (impure) 14174>20 beshort 0410 (swapped) 14175>20 beshort 0413 (paged) 14176>8 belong >0 not stripped 14177>8 belong 0 stripped 14178>22 byte x - version %d 14179>23 byte x \b.%d 14180# 141810 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 14182>20 beshort 03401 (impure) 14183>20 beshort 04001 (swapped) 14184>20 beshort 05401 (paged) 14185>8 belong >0 not stripped 14186>8 belong 0 stripped 14187>23 byte x - version %d 14188>22 byte x \b.%d 14189# 141900 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 14191>20 beshort 03401 (impure) 14192>20 beshort 04001 (swapped) 14193>20 beshort 05401 (paged) 14194>8 belong >0 not stripped 14195>8 belong 0 stripped 14196>23 byte x - version %d 14197>22 byte x \b.%d 14198# 141990 beshort 0x180 MIPSEB Ucode 142000 beshort 0x182 MIPSEL-BE Ucode 14201 14202#------------------------------------------------------------------------------ 14203# $File$ 14204# mirage: file(1) magic for Mirage executables 14205# 14206# XXX - byte order? 14207# 142080 long 31415 Mirage Assembler m.out executable 14209 14210#----------------------------------------------------------------------------- 14211# $File: misctools,v 1.13 2013/01/16 13:53:10 christos Exp $ 14212# misctools: file(1) magic for miscellaneous UNIX tools. 14213# 142140 search/1 %%!! X-Post-It-Note text 142150 string/c BEGIN:VCALENDAR vCalendar calendar file 14216!:mime text/calendar 142170 string/c BEGIN:VCARD vCard visiting card 14218!:mime text/x-vcard 14219 14220# Summary: Libtool library file 14221# Extension: .la 14222# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 142230 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 14224 14225# Summary: Libtool object file 14226# Extension: .lo 14227# Submitted by: Abel Cheung <abelcheung@gmail.com> 142280 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 14229 14230# From: Daniel Novotny <dnovotny@redhat.com> 142310 string MDMP\x93\xA7 MDMP crash report data 14232 14233# Summary: abook addressbook file 14234# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu> 142350 string #\x20abook\x20addressbook\x20file abook address book 14236!:mime application/x-abook-addressbook 14237 14238#------------------------------------------------------------------------------ 14239# $File$ 14240# mkid: file(1) magic for mkid(1) databases 14241# 14242# ID is the binary tags database produced by mkid(1). 14243# 14244# XXX - byte order? 14245# 142460 string \311\304 ID tags data 14247>2 short >0 version %d 14248 14249#------------------------------------------------------------------------------ 14250# $File$ 14251# mlssa: file(1) magic for MLSSA datafiles 14252# 142530 lelong 0xffffabcd MLSSA datafile, 14254>4 leshort x algorithm %d, 14255>10 lelong x %d samples 14256 14257#------------------------------------------------------------------------------ 14258# $File$ 14259# mmdf: file(1) magic for MMDF mail files 14260# 142610 string \001\001\001\001 MMDF mailbox 14262 14263#------------------------------------------------------------------------------ 14264# $File: modem,v 1.5 2010/09/20 18:55:20 rrt Exp $ 14265# modem: file(1) magic for modem programs 14266# 14267# From: Florian La Roche <florian@knorke.saar.de> 142681 string PC\ Research,\ Inc Digifax-G3-File 14269>29 byte 1 \b, fine resolution 14270>29 byte 0 \b, normal resolution 14271 142720 short 0x0100 raw G3 data, byte-padded 142730 short 0x1400 raw G3 data 14274# 14275# Magic data for vgetty voice formats 14276# (Martin Seine & Marc Eberhard) 14277 14278# 14279# raw modem data version 1 14280# 142810 string RMD1 raw modem data 14282>4 string >\0 (%s / 14283>20 short >0 compression type 0x%04x) 14284 14285# 14286# portable voice format 1 14287# 142880 string PVF1\n portable voice format 14289>5 string >\0 (binary %s) 14290 14291# 14292# portable voice format 2 14293# 142940 string PVF2\n portable voice format 14295>5 string >\0 (ascii %s) 14296 14297# From: Bernd Nuernberger <bernd.nuernberger@web.de> 14298# Brooktrout G3 fax data incl. 128 byte header 14299# Common suffixes: 3??, BRK, BRT, BTR 143000 leshort 0x01bb 14301>2 leshort 0x0100 Brooktrout 301 fax image, 14302>>9 leshort x %d x 14303>>0x2d leshort x %d 14304>>6 leshort 200 \b, fine resolution 14305>>6 leshort 100 \b, normal resolution 14306>>11 byte 1 \b, G3 compression 14307>>11 byte 2 \b, G32D compression 14308 14309#------------------------------------------------------------------------------ 14310# $File: motorola,v 1.10 2009/09/19 16:28:11 christos Exp $ 14311# motorola: file(1) magic for Motorola 68K and 88K binaries 14312# 14313# 68K 14314# 143150 beshort 0520 mc68k COFF 14316>18 beshort ^00000020 object 14317>18 beshort &00000020 executable 14318>12 belong >0 not stripped 14319>168 string .lowmem Apple toolbox 14320>20 beshort 0407 (impure) 14321>20 beshort 0410 (pure) 14322>20 beshort 0413 (demand paged) 14323>20 beshort 0421 (standalone) 143240 beshort 0521 mc68k executable (shared) 14325>12 belong >0 not stripped 143260 beshort 0522 mc68k executable (shared demand paged) 14327>12 belong >0 not stripped 14328# 14329# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 14330# 143310 beshort 0554 68K BCS executable 14332# 14333# 88K 14334# 14335# Motorola/88Open BCS 14336# 143370 beshort 0555 88K BCS executable 14338# 14339# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 143400 string S0 Motorola S-Record; binary data in text format 14341 14342# ATARI ST relocatable PRG 14343# 14344# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 14345# (according to Roland Waldi, Oct 21, 1987) 14346# besides the magic 0x601a, the text segment size is checked to be 14347# not larger than 1 MB (which is a lot on ST). 14348# The additional 0x601b distinction I took from Doug Lee's magic. 143490 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 14350>2 belong x (txt=%d, 14351>6 belong x dat=%d, 14352>10 belong x bss=%d, 14353>14 belong x sym=%d) 143540 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 14355>2 belong x (txt=%d, 14356>6 belong x dat=%d, 14357>10 belong x bss=%d, 14358>14 belong x sym=%d) 14359 14360# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 143610 beshort 0x601A Atari 68xxx executable, 14362>2 belong x text len %u, 14363>6 belong x data len %u, 14364>10 belong x BSS len %u, 14365>14 belong x symboltab len %u, 14366>18 belong 0 14367>22 belong &0x01 fastload flag, 14368>22 belong &0x02 may be loaded to alternate RAM, 14369>22 belong &0x04 malloc may be from alternate RAM, 14370>22 belong x flags: 0x%X, 14371>26 beshort 0 no relocation tab 14372>26 beshort !0 + relocation tab 14373>30 string SFX [Self-Extracting LZH SFX archive] 14374>38 string SFX [Self-Extracting LZH SFX archive] 14375>44 string ZIP! [Self-Extracting ZIP SFX archive] 14376 143770 beshort 0x0064 Atari 68xxx CPX file 14378>8 beshort x (version %04x) 14379 14380#------------------------------------------------------------------------------ 14381# $File: mozilla,v 1.5 2015/01/24 15:48:42 christos Exp $ 14382# mozilla: file(1) magic for Mozilla XUL fastload files 14383# (XUL.mfasl and XPC.mfasl) 14384# URL: http://www.mozilla.org/ 14385# From: Josh Triplett <josh@freedesktop.org> 14386 143870 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 143880 string mozLz4a Mozilla lz4 compressed bookmark data 14389 14390#------------------------------------------------------------------------------ 14391# $File: msdos,v 1.99 2014/06/03 01:40:24 christos Exp $ 14392# msdos: file(1) magic for MS-DOS files 14393# 14394 14395# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 14396# updated by Joerg Jenderek at Oct 2008,Apr 2011 143970 string/t @ 14398>1 string/cW \ echo\ off DOS batch file text 14399!:mime text/x-msdos-batch 14400>1 string/cW echo\ off DOS batch file text 14401!:mime text/x-msdos-batch 14402>1 string/cW rem DOS batch file text 14403!:mime text/x-msdos-batch 14404>1 string/cW set\ DOS batch file text 14405!:mime text/x-msdos-batch 14406 14407 14408# OS/2 batch files are REXX. the second regex is a bit generic, oh well 14409# the matched commands seem to be common in REXX and uncommon elsewhere 14410100 search/0xffff rxfuncadd 14411>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 14412100 search/0xffff say 14413>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 14414 144150 leshort 0x14c MS Windows COFF Intel 80386 object file 14416#>4 ledate x stamp %s 144170 leshort 0x166 MS Windows COFF MIPS R4000 object file 14418#>4 ledate x stamp %s 144190 leshort 0x184 MS Windows COFF Alpha object file 14420#>4 ledate x stamp %s 144210 leshort 0x268 MS Windows COFF Motorola 68000 object file 14422#>4 ledate x stamp %s 144230 leshort 0x1f0 MS Windows COFF PowerPC object file 14424#>4 ledate x stamp %s 144250 leshort 0x290 MS Windows COFF PA-RISC object file 14426#>4 ledate x stamp %s 14427 14428# Tests for various EXE types. 14429# 14430# Many of the compressed formats were extraced from IDARC 1.23 source code. 14431# 144320 string/b MZ 14433# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 14434>0x18 leshort <0x40 MS-DOS executable 14435!:mime application/x-dosexec 14436# These traditional tests usually work but not always. When test quality support is 14437# implemented these can be turned on. 14438#>>0x18 leshort 0x1c (Borland compiler) 14439#>>0x18 leshort 0x1e (MS compiler) 14440 14441# If the relocation table is 0x40 or more bytes into the file, it's definitely 14442# not a DOS EXE. 14443>0x18 leshort >0x3f 14444 14445# Maybe it's a PE? 14446>>(0x3c.l) string PE\0\0 PE 14447!:mime application/x-dosexec 14448>>>(0x3c.l+24) leshort 0x010b \b32 executable 14449>>>(0x3c.l+24) leshort 0x020b \b32+ executable 14450>>>(0x3c.l+24) leshort 0x0107 ROM image 14451>>>(0x3c.l+24) default x Unknown PE signature 14452>>>>&0 leshort x 0x%x 14453>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 14454>>>(0x3c.l+92) leshort 1 (native) 14455>>>(0x3c.l+92) leshort 2 (GUI) 14456>>>(0x3c.l+92) leshort 3 (console) 14457>>>(0x3c.l+92) leshort 7 (POSIX) 14458>>>(0x3c.l+92) leshort 9 (Windows CE) 14459>>>(0x3c.l+92) leshort 10 (EFI application) 14460>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 14461>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 14462>>>(0x3c.l+92) leshort 13 (EFI ROM) 14463>>>(0x3c.l+92) leshort 14 (XBOX) 14464>>>(0x3c.l+92) leshort 15 (Windows boot application) 14465>>>(0x3c.l+92) default x (Unknown subsystem 14466>>>>&0 leshort x 0x%x) 14467>>>(0x3c.l+4) leshort 0x14c Intel 80386 14468>>>(0x3c.l+4) leshort 0x166 MIPS R4000 14469>>>(0x3c.l+4) leshort 0x168 MIPS R10000 14470>>>(0x3c.l+4) leshort 0x184 Alpha 14471>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 14472>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 14473>>>(0x3c.l+4) leshort 0x1c0 ARM 14474>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 14475>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 14476>>>(0x3c.l+4) leshort 0x1f0 PowerPC 14477>>>(0x3c.l+4) leshort 0x200 Intel Itanium 14478>>>(0x3c.l+4) leshort 0x266 MIPS16 14479>>>(0x3c.l+4) leshort 0x268 Motorola 68000 14480>>>(0x3c.l+4) leshort 0x290 PA-RISC 14481>>>(0x3c.l+4) leshort 0x366 MIPSIV 14482>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 14483>>>(0x3c.l+4) leshort 0xebc EFI byte code 14484>>>(0x3c.l+4) leshort 0x8664 x86-64 14485>>>(0x3c.l+4) leshort 0xc0ee MSIL 14486>>>(0x3c.l+4) default x Unknown processor type 14487>>>>&0 leshort x 0x%x 14488>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 14489>>>(0x3c.l+22) leshort&0x1000 >0 system file 14490>>>(0x3c.l+24) leshort 0x010b 14491>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 14492>>>(0x3c.l+24) leshort 0x020b 14493>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 14494 14495# hooray, there's a DOS extender using the PE format, with a valid PE 14496# executable inside (which just prints a message and exits if run in win) 14497>>>(8.s*16) string 32STUB \b, 32rtm DOS extender 14498>>>(8.s*16) string !32STUB \b, for MS Windows 14499>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 14500>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 14501>>>(0x3c.l+0xf8) search/0x140 UPX2 14502>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 14503>>>(0x3c.l+0xf8) search/0x140 .idata 14504>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 14505>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 14506>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 14507>>>(0x3c.l+0xf8) search/0x140 .rsrc 14508>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 14509>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 14510>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 14511>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 14512>>>(0x3c.l+0xf8) search/0x140 .data 14513>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 14514>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 14515>>>>(0x3c.l+0xf7) byte x 14516>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 14517>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 14518>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 14519>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 14520>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 14521>>>0x30 string Inno \b, InnoSetup self-extracting archive 14522 14523# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 14524# must be one of the unusual subformats. 14525>>(0x3c.l) string !PE\0\0 MS-DOS executable 14526!:mime application/x-dosexec 14527 14528>>(0x3c.l) string NE \b, NE 14529!:mime application/x-dosexec 14530>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 14531>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 14532>>>(0x3c.l+0x36) byte 3 for MS-DOS 14533>>>(0x3c.l+0x36) byte 4 for Windows 386 14534>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 14535>>>(0x3c.l+0x36) default x 14536>>>>(0x3c.l+0x36) byte x (unknown OS %x) 14537>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 14538>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) 14539>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) 14540>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 14541>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 14542 14543>>(0x3c.l) string LX\0\0 \b, LX 14544!:mime application/x-dosexec 14545>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 14546>>>(0x3c.l+0x0a) leshort 1 for OS/2 14547>>>(0x3c.l+0x0a) leshort 2 for MS Windows 14548>>>(0x3c.l+0x0a) leshort 3 for DOS 14549>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 14550>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 14551>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 14552>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 14553>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 14554>>>(0x3c.l+0x08) leshort 1 i80286 14555>>>(0x3c.l+0x08) leshort 2 i80386 14556>>>(0x3c.l+0x08) leshort 3 i80486 14557>>>(8.s*16) string emx \b, emx 14558>>>>&1 string x %s 14559>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 14560 14561# MS Windows system file, supposedly a collection of LE executables 14562>>(0x3c.l) string W3 \b, W3 for MS Windows 14563!:mime application/x-dosexec 14564 14565>>(0x3c.l) string LE\0\0 \b, LE executable 14566!:mime application/x-dosexec 14567>>>(0x3c.l+0x0a) leshort 1 14568# some DOS extenders use LE files with OS/2 header 14569>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 14570>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 14571>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 14572>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 14573>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 14574>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 14575>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 14576# this is a wild guess; hopefully it is a specific signature 14577>>>>&0x24 lelong <0x50 14578>>>>>(&0x4c.l) string \xfc\xb8WATCOM 14579>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 14580# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 14581#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 14582# fails with DOS-Extenders. 14583>>>(0x3c.l+0x0a) leshort 2 for MS Windows 14584>>>(0x3c.l+0x0a) leshort 3 for DOS 14585>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 14586>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 14587>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 14588 14589# looks like ASCII, probably some embedded copyright message. 14590# and definitely not NE/LE/LX/PE 14591>>0x3c lelong >0x20000000 14592>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 14593!:mime application/x-dosexec 14594# header data too small for extended executable 14595>2 long !0 14596>>0x18 leshort <0x40 14597>>>(4.s*512) leshort !0x014c 14598 14599>>>>&(2.s-514) string !LE 14600>>>>>&-2 string !BW \b, MZ for MS-DOS 14601!:mime application/x-dosexec 14602>>>>&(2.s-514) string LE \b, LE 14603>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 14604# educated guess since indirection is still not capable enough for complex offset 14605# calculations (next embedded executable would be at &(&2*512+&0-2) 14606# I suspect there are only LE executables in these multi-exe files 14607>>>>&(2.s-514) string BW 14608>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 14609>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 14610 14611# This sequence skips to the first COFF segment, usually .text 14612>(4.s*512) leshort 0x014c \b, COFF 14613!:mime application/x-dosexec 14614>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 14615>>(8.s*16) string emx 14616>>>&1 string x for DOS, Win or OS/2, emx %s 14617>>&(&0x42.l-3) byte x 14618>>>&0x26 string UPX \b, UPX compressed 14619# and yet another guess: small .text, and after large .data is unusal, could be 32lite 14620>>&0x2c search/0xa0 .text 14621>>>&0x0b lelong <0x2000 14622>>>>&0 lelong >0x6000 \b, 32lite compressed 14623 14624>(8.s*16) string $WdX \b, WDos/X DOS extender 14625 14626# By now an executable type should have been printed out. The executable 14627# may be a self-uncompressing archive, so look for evidence of that and 14628# print it out. 14629# 14630# Some signatures below from Greg Roelofs, newt@uchicago.edu. 14631# 14632>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 14633>0xe7 string LH/2\ Self-Extract \b, %s 14634>0x1c string UC2X \b, UCEXE compressed 14635>0x1c string WWP\ \b, WWPACK compressed 14636>0x1c string RJSX \b, ARJ self-extracting archive 14637>0x1c string diet \b, diet compressed 14638>0x1c string LZ09 \b, LZEXE v0.90 compressed 14639>0x1c string LZ91 \b, LZEXE v0.91 compressed 14640>0x1c string tz \b, TinyProg compressed 14641>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 14642!:mime application/zip 14643# Yes, this really is "Copr", not "Corp." 14644>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 14645!:mime application/zip 14646# winarj stores a message in the stub instead of the sig in the MZ header 14647>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 14648>0x20 string AIN 14649>>0x23 string 2 \b, AIN 2.x compressed 14650>>0x23 string <2 \b, AIN 1.x compressed 14651>>0x23 string >2 \b, AIN 1.x compressed 14652>0x24 string LHa's\ SFX \b, LHa self-extracting archive 14653!:mime application/x-lha 14654>0x24 string LHA's\ SFX \b, LHa self-extracting archive 14655!:mime application/x-lha 14656>0x24 string \ $ARX \b, ARX self-extracting archive 14657>0x24 string \ $LHarc \b, LHarc self-extracting archive 14658>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 14659>0x40 string aPKG \b, aPackage self-extracting archive 14660>0x64 string W\ Collis\0\0 \b, Compack compressed 14661>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 14662>>&0xf4 search/0x140 \x0\x40\x1\x0 14663>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 14664>1638 string -lh5- \b, LHa self-extracting archive v2.13S 14665>0x17888 string Rar! \b, RAR self-extracting archive 14666 14667# Skip to the end of the EXE. This will usually work fine in the PE case 14668# because the MZ image is hardcoded into the toolchain and almost certainly 14669# won't match any of these signatures. 14670>(4.s*512) long x 14671>>&(2.s-517) byte x 14672>>>&0 string PK\3\4 \b, ZIP self-extracting archive 14673>>>&0 string Rar! \b, RAR self-extracting archive 14674>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 14675>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 14676>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 14677>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 14678>>>&7 search/400 **ACE** \b, ACE self-extracting archive 14679>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 14680 14681# a few unknown ZIP sfxes, no idea if they are needed or if they are 14682# already captured by the generic patterns above 14683>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 14684# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 14685# 14686 14687# TELVOX Teleinformatica CODEC self-extractor for OS/2: 14688>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 14689>>49824 leshort =1 \b, 1 file 14690>>49824 leshort >1 \b, %u files 14691 14692# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc 14693# and http://www.freedos.org/software/?prog=kpdos 14694# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 146950 string/b KCF FreeDOS KEYBoard Layout collection 14696# only version=0x100 found 14697>3 uleshort x \b, version 0x%x 14698# length of string containing author,info and special characters 14699>6 ubyte >0 14700#>>6 pstring x \b, name=%s 14701>>7 string >\0 \b, author=%-.14s 14702>>7 search/254 \xff \b, info= 14703#>>>&0 string x \b%-s 14704>>>&0 string x \b%-.15s 14705# for FreeDOS *.KL files 147060 string/b KLF FreeDOS KEYBoard Layout file 14707# only version=0x100 or 0x101 found 14708>3 uleshort x \b, version 0x%x 14709# stringlength 14710>5 ubyte >0 14711>>8 string x \b, name=%-.2s 147120 string \xffKEYB\ \ \ \0\0\0\0 14713>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 14714 14715# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com) 14716# Uncommenting only the first two lines will cover about 2/3 of COM files, 14717# but it isn't feasible to match all COM files since there must be at least 14718# two dozen different one-byte "magics". 14719# test too generic ? 147200 byte 0xe9 DOS executable (COM) 14721>0x1FE leshort 0xAA55 \b, boot code 14722>6 string SFX\ of\ LHarc (%s) 14723 14724# DOS device driver updated by Joerg Jenderek at May 2011 14725# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 147260 ulequad&0x07a0ffffffff 0xffffffff DOS executable ( 14727>40 search/7 UPX! \bUPX compressed 14728# DOS device driver attributes 14729>4 uleshort&0x8000 0x0000 \bblock device driver 14730# character device 14731>4 uleshort&0x8000 0x8000 \b 14732>>4 uleshort&0x0008 0x0008 \bclock 14733# fast video output by int 29h 14734>>4 uleshort&0x0010 0x0010 \bfast 14735# standard input/output device 14736>>4 uleshort&0x0003 >0 \bstandard 14737>>>4 uleshort&0x0001 0x0001 \binput 14738>>>4 uleshort&0x0003 0x0003 \b/ 14739>>>4 uleshort&0x0002 0x0002 \boutput 14740>>4 uleshort&0x8000 0x8000 \bcharacter device driver 14741>0 ubyte x 14742# upx compressed device driver has garbage instead of real in name field of header 14743>>40 search/7 UPX! 14744>>40 default x 14745# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 14746>>>12 ubyte >0x27 \b 14747>>>>10 ubyte >0x20 14748>>>>>10 ubyte !0x2E 14749>>>>>>10 ubyte !0x2A \b%c 14750>>>>11 ubyte >0x20 14751>>>>>11 ubyte !0x2E \b%c 14752>>>>12 ubyte >0x20 14753>>>>>12 ubyte !0x39 14754>>>>>>12 ubyte !0x2E \b%c 14755>>>13 ubyte >0x20 14756>>>>13 ubyte !0x2E \b%c 14757>>>>14 ubyte >0x20 14758>>>>>14 ubyte !0x2E \b%c 14759>>>>15 ubyte >0x20 14760>>>>>15 ubyte !0x2E \b%c 14761>>>>16 ubyte >0x20 14762>>>>>16 ubyte !0x2E 14763>>>>>>16 ubyte <0xCB \b%c 14764>>>>17 ubyte >0x20 14765>>>>>17 ubyte !0x2E 14766>>>>>>17 ubyte <0x90 \b%c 14767# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 14768>>>4 uleshort&0x8000 0x8000 14769>>>>12 ubyte <0x2F 14770# they have their real name at offset 22 14771>>>>>22 string >\0 \b%-.5s 14772>4 uleshort&0x8000 0x0000 14773# 32 bit sector addressing ( > 32 MB) for block devices 14774>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 14775# support by driver functions 13h, 17h, 18h 14776>4 uleshort&0x0040 0x0040 \b,IOCTL- 14777# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 14778>4 uleshort&0x0800 0x0800 \b,close media- 14779# output until busy support by int 10h for character device driver 14780>4 uleshort&0x8000 0x8000 14781>>4 uleshort&0x2000 0x2000 \b,until busy- 14782# direct read/write support by driver functions 03h,0Ch 14783>4 uleshort&0x4000 0x4000 \b,control strings- 14784>4 uleshort&0x8000 0x8000 14785>>4 uleshort&0x6840 >0 \bsupport 14786>4 uleshort&0x8000 0x0000 14787>>4 uleshort&0x4842 >0 \bsupport 14788>0 ubyte x \b) 14789# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 14790# Too weak, matches files that only contain 0's 14791#0 ulequad&0x000007a0ffffffed 0x0000000000000000 DOS-executable ( 14792#>4 uleshort&0x8000 0x8000 \bcharacter device driver 14793#>>10 string x %-.8s 14794#>4 uleshort&0x4000 0x4000 \b,control strings-support) 14795 14796# test too generic ? 147970 byte 0x8c DOS executable (COM) 14798# updated by Joerg Jenderek at Oct 2008 147990 ulelong 0xffff10eb DR-DOS executable (COM) 14800# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 148010 ubeshort&0xeb8d >0xeb00 14802# DR-DOS STACKER.COM SCREATE.SYS missed 14803>0 byte 0xeb 14804>>0x1FE leshort 0xAA55 DOS executable (COM), boot code 14805>>85 string UPX DOS executable (COM), UPX compressed 14806>>4 string \ $ARX DOS executable (COM), ARX self-extracting archive 14807>>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive 14808>>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive 14809# updated by Joerg Jenderek at Oct 2008 14810#0 byte 0xb8 COM executable 148110 uleshort&0x80ff 0x00b8 14812# modified by Joerg Jenderek 14813>1 lelong !0x21cd4cff COM executable for DOS 14814# http://syslinux.zytor.com/comboot.php 14815# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 14816# start with assembler instructions mov eax,21cd4cffh 148170 uleshort&0xc0ff 0xc0b8 14818>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) 14819# syslinux:doc/comboot.txt 14820# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 14821# eax,21cd4cfeh) as a magic number. 148220 string/b \xb8\xfe\x4c\xcd\x21 COM executable (COM32R) 14823# start with assembler instructions mov eax,21cd4cfeh 148240 uleshort&0xc0ff 0xc0b8 14825>1 lelong 0x21cd4cfe COM executable (32-bit COMBOOT, relocatable) 148260 string/b \x81\xfc 14827>4 string \x77\x02\xcd\x20\xb9 14828>>36 string UPX! FREE-DOS executable (COM), UPX compressed 14829252 string Must\ have\ DOS\ version DR-DOS executable (COM) 14830# added by Joerg Jenderek at Oct 2008 14831# GRR search is not working 14832#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 1483334 string UPX! FREE-DOS executable (COM), UPX compressed 1483435 string UPX! FREE-DOS executable (COM), UPX compressed 14835# GRR search is not working 14836#2 search/28 \xcd\x21 COM executable for MS-DOS 14837#WHICHFAT.cOM 148382 string \xcd\x21 COM executable for DOS 14839#DELTREE.cOM DELTREE2.cOM 148404 string \xcd\x21 COM executable for DOS 14841#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 148425 string \xcd\x21 COM executable for DOS 14843#DELTMP.COm HASFAT32.cOM 148447 string \xcd\x21 14845>0 byte !0xb8 COM executable for DOS 14846#COMP.cOM MORE.COm 1484710 string \xcd\x21 14848>5 string !\xcd\x21 COM executable for DOS 14849#comecho.com 1485013 string \xcd\x21 COM executable for DOS 14851#HELP.COm EDIT.coM 1485218 string \xcd\x21 COM executable for MS-DOS 14853#NWRPLTRM.COm 1485423 string \xcd\x21 COM executable for MS-DOS 14855#LOADFIX.cOm LOADFIX.cOm 1485630 string \xcd\x21 COM executable for MS-DOS 14857#syslinux.com 3.11 1485870 string \xcd\x21 COM executable for DOS 14859# many compressed/converted COMs start with a copy loop instead of a jump 148600x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 148610x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 14862>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 148630x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 14864# FIXME: missing diet .com compression 14865 14866# miscellaneous formats 148670 string/b LZ MS-DOS executable (built-in) 14868#0 byte 0xf0 MS-DOS program library data 14869# 14870 14871# AAF files: 14872# <stuartc@rd.bbc.co.uk> Stuart Cunningham 148730 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 14874>30 byte 9 (512B sectors) 14875>30 byte 12 (4kB sectors) 148760 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 14877>30 byte 9 (512B sectors) 14878>30 byte 12 (4kB sectors) 14879 14880# Popular applications 148812080 string Microsoft\ Word\ 6.0\ Document %s 14882!:mime application/msword 148832080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 14884!:mime application/msword 14885# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 148862112 string MSWordDoc Microsoft Word document data 14887!:mime application/msword 14888# 148890 belong 0x31be0000 Microsoft Word Document 14890!:mime application/msword 14891# 148920 string/b PO^Q` Microsoft Word 6.0 Document 14893!:mime application/msword 14894# 148950 string/b \376\067\0\043 Microsoft Office Document 14896!:mime application/msword 148970 string/b \333\245-\0\0\0 Microsoft Office Document 14898!:mime application/msword 14899512 string/b \354\245\301 Microsoft Word Document 14900!:mime application/msword 14901 14902# 149030 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 14904!:mime application/msword 14905# 149062080 string Microsoft\ Excel\ 5.0\ Worksheet %s 14907!:mime application/vnd.ms-excel 14908# 149090 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 14910!:mime application/msword 14911 149122080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 14913!:mime application/vnd.ms-excel 14914# 14915# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 149162114 string Biff5 Microsoft Excel 5.0 Worksheet 14917!:mime application/vnd.ms-excel 14918# Italian MS-Excel 149192121 string Biff5 Microsoft Excel 5.0 Worksheet 14920!:mime application/vnd.ms-excel 149210 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 14922!:mime application/vnd.ms-excel 14923# 149240 belong 0x00001a00 Lotus 1-2-3 14925!:mime application/x-123 14926>4 belong 0x00100400 wk3 document data 14927>4 belong 0x02100400 wk4 document data 14928>4 belong 0x07800100 fm3 or fmb document data 14929>4 belong 0x07800000 fm3 or fmb document data 14930# 149310 belong 0x00000200 Lotus 1-2-3 14932!:mime application/x-123 14933>4 belong 0x06040600 wk1 document data 14934>4 belong 0x06800200 fmt document data 149350 string/b WordPro\0 Lotus WordPro 14936!:mime application/vnd.lotus-wordpro 149370 string/b WordPro\r\373 Lotus WordPro 14938!:mime application/vnd.lotus-wordpro 14939 14940 14941# Summary: Script used by InstallScield to uninstall applications 14942# Extension: .isu 14943# Submitted by: unknown 14944# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 149450 string \x71\xa8\x00\x00\x01\x02 14946>12 string Stirling\ Technologies, InstallShield Uninstall Script 14947 14948# Winamp .avs 14949#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 149500 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 14951 14952# Windows Metafont .WMF 149530 string/b \327\315\306\232 ms-windows metafont .wmf 149540 string/b \002\000\011\000 ms-windows metafont .wmf 149550 string/b \001\000\011\000 ms-windows metafont .wmf 14956 14957#tz3 files whatever that is (MS Works files) 149580 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 149590 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 149600 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 14961 14962# PGP sig files .sig 14963#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 149640 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 149650 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 149660 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 149670 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 149680 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 149690 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 14970 14971# windows zips files .dmf 149720 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 14973 14974 14975#ico files 149760 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 14977 14978# Windows icons 149790 name ico-dir 14980# not entirely accurate, the number of icons is part of the header 14981>0 byte 1 - 1 icon 14982>0 ubyte >1 - %d icons 14983>2 byte 0 \b, 256x 14984>2 byte !0 \b, %dx 14985>3 byte 0 \b256 14986>3 byte !0 \b%d 14987>4 ubyte !0 \b, %d colors 14988 149890 belong 0x00000100 14990>9 byte 0 14991>>0 byte x MS Windows icon resource 14992!:mime image/x-icon 14993>>4 use ico-dir 14994>9 ubyte 0xff 14995>>0 byte x MS Windows icon resource 14996!:mime image/x-icon 14997>>4 use ico-dir 14998 14999# Windows non-animated cursors 150000 name cur-dir 15001# not entirely accurate, the number of icons is part of the header 15002>0 byte 1 - 1 icon 15003>0 ubyte >1 - %d icons 15004>2 byte 0 \b, 256x 15005>2 byte !0 \b, %dx 15006>3 byte 0 \b256 15007>3 byte !0 \b%d 15008>6 uleshort x \b, hotspot @%dx 15009>8 uleshort x \b%d 15010 150110 belong 0x00000200 15012>9 byte 0 15013>>0 byte x MS Windows cursor resource 15014!:mime image/x-cur 15015>>4 use cur-dir 15016>9 ubyte 0xff 15017>>0 byte x MS Windows cursor resource 15018!:mime image/x-cur 15019>>4 use cur-dir 15020 15021# .chr files 150220 string/b PK\010\010BGI Borland font 15023>4 string >\0 %s 15024# then there is a copyright notice 15025 15026 15027# .bgi files 150280 string/b pk\010\010BGI Borland device 15029>4 string >\0 %s 15030# then there is a copyright notice 15031 15032 15033# Windows Recycle Bin record file (named INFO2) 15034# By Abel Cheung (abelcheung AT gmail dot com) 15035# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 15036# Since Vista uses another structure, INFO2 structure probably won't change 15037# anymore. Detailed analysis in: 15038# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 150390 lelong 0x00000004 15040>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 15041 150420 lelong 0x00000005 15043>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 15044 15045 15046##### put in Either Magic/font or Magic/news 15047# Acroread or something files wrongly identified as G3 .pfm 15048# these have the form \000 \001 any? \002 \000 \000 15049# or \000 \001 any? \022 \000 \000 150500 belong&0xffff00ff 0x00010012 PFM data 15051>4 string \000\000 15052>6 string >\060 - %s 15053 150540 belong&0xffff00ff 0x00010002 PFM data 15055>4 string \000\000 15056>6 string >\060 - %s 15057#0 string \000\001 pfm? 15058#>3 string \022\000\000Copyright\ yes 15059#>3 string \002\000\000Copyright\ yes 15060#>3 string >\0 oops, not a font file. Cancel that. 15061#it clashes with ttf files so put it lower down. 15062 15063# From Doug Lee via a FreeBSD pr 150649 string GERBILDOC First Choice document 150659 string GERBILDB First Choice database 150669 string GERBILCLIP First Choice database 150670 string GERBIL First Choice device file 150689 string RABBITGRAPH RabbitGraph file 150690 string DCU1 Borland Delphi .DCU file 150700 string =!<spell> MKS Spell hash list (old format) 150710 string =!<spell2> MKS Spell hash list 15072# Too simple - MPi 15073#0 string AH Halo(TM) bitmapped font file 150740 lelong 0x08086b70 TurboC BGI file 150750 lelong 0x08084b50 TurboC Font file 15076 15077# Debian#712046: The magic below identifies "Delphi compiled form data". 15078# An additional source of information is available at: 15079# http://www.woodmann.com/fravia/dafix_t1.htm 150800 string TPF0 15081>4 pstring >\0 Delphi compiled form '%s' 15082 15083# tests for DBase files moved, updated and merged to database 15084 150850 string PMCC Windows 3.x .GRP file 150861 string RDC-meg MegaDots 15087>8 byte >0x2F version %c 15088>9 byte >0x2F \b.%c file 150890 lelong 0x4C 15090>4 lelong 0x00021401 Windows shortcut file 15091 15092# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm 15093# only for windows versions equal or greater 3.0 150940x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 15095!:mime application/x-dosexec 15096#>2 string >\0 \b, Title:%.30s 15097>0x24 string >\0 \b for %.63s 15098>0x65 string >\0 \b, directory=%.64s 15099>0xA5 string >\0 \b, parameters=%.64s 15100#>0x181 leshort x \b, offset %x 15101#>0x183 leshort x \b, offsetdata %x 15102#>0x185 leshort x \b, section length %x 15103>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 15104>>&0x5e ubyte >0 15105>>>&-1 string <PIFMGR.DLL \b, icon=%s 15106#>>>&-1 string PIFMGR.DLL \b, icon=%s 15107>>>&-1 string >PIFMGR.DLL \b, icon=%s 15108>>&0xF0 ubyte >0 15109>>>&-1 string <Terminal \b, font=%.32s 15110#>>>&-1 string =Terminal \b, font=%.32s 15111>>>&-1 string >Terminal \b, font=%.32s 15112>>&0x110 ubyte >0 15113>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 15114#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 15115>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 15116#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 15117#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 15118>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 15119#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 15120>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 15121#>>&06 string x \b:%s 15122>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 15123#>>&06 string x \b:%s 15124 15125# DOS EPS Binary File Header 15126# From: Ed Sznyter <ews@Black.Market.NET> 151270 belong 0xC5D0D3C6 DOS EPS Binary File 15128>4 long >0 Postscript starts at byte %d 15129>>8 long >0 length %d 15130>>>12 long >0 Metafile starts at byte %d 15131>>>>16 long >0 length %d 15132>>>20 long >0 TIFF starts at byte %d 15133>>>>24 long >0 length %d 15134 15135# TNEF magic From "Joomy" <joomy@se-ed.net> 15136# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 151370 leshort 0x223e9f78 TNEF 15138!:mime application/vnd.ms-tnef 15139 15140# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 15141# of http://www.davep.org/norton-guides/ng2h-105.tgz 15142# http://en.wikipedia.org/wiki/Norton_Guides 151430 string NG\0\001 15144# only value 0x100 found at offset 2 15145>2 ulelong 0x00000100 Norton Guide 15146# Title[40] 15147>>8 string >\0 "%-.40s" 15148#>>6 uleshort x \b, MenuCount=%u 15149# szCredits[5][66] 15150>>48 string >\0 \b, %-.66s 15151>>114 string >\0 %-.66s 15152 15153# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 15154# of http://www.4dos.info/ 15155# pointer,HelpID[8]=4DHnnnmm 151560 ulelong 0x48443408 4DOS help file 15157>4 string x \b, version %-4.4s 15158 15159# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 151600 ulequad 0x3a000000024e4c MS Advisor help file 15161 15162# HtmlHelp files (.chm) 151630 string/b ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data 15164 15165# GFA-BASIC (Wolfram Kleff) 151662 string/b GFA-BASIC3 GFA-BASIC 3 data 15167 15168#------------------------------------------------------------------------------ 15169# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 15170# Microsoft Cabinet files 151710 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 15172!:mime application/vnd.ms-cab-compressed 15173>8 lelong x \b, %u bytes 15174>28 leshort 1 \b, 1 file 15175>28 leshort >1 \b, %u files 15176 15177# InstallShield Cabinet files 151780 string/b ISc( InstallShield Cabinet archive data 15179>5 byte&0xf0 =0x60 version 6, 15180>5 byte&0xf0 !0x60 version 4/5, 15181>(12.l+40) lelong x %u files 15182 15183# Windows CE package files 151840 string/b MSCE\0\0\0\0 Microsoft WinCE install header 15185>20 lelong 0 \b, architecture-independent 15186>20 lelong 103 \b, Hitachi SH3 15187>20 lelong 104 \b, Hitachi SH4 15188>20 lelong 0xA11 \b, StrongARM 15189>20 lelong 4000 \b, MIPS R4000 15190>20 lelong 10003 \b, Hitachi SH3 15191>20 lelong 10004 \b, Hitachi SH3E 15192>20 lelong 10005 \b, Hitachi SH4 15193>20 lelong 70001 \b, ARM 7TDMI 15194>52 leshort 1 \b, 1 file 15195>52 leshort >1 \b, %u files 15196>56 leshort 1 \b, 1 registry entry 15197>56 leshort >1 \b, %u registry entries 15198 15199 15200# Windows Enhanced Metafile (EMF) 15201# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 15202# for further information. 152030 ulelong 1 15204>40 string \ EMF Windows Enhanced Metafile (EMF) image data 15205>>44 ulelong x version 0x%x 15206 15207# from http://filext.com by Derek M Jones <derek@knosof.co.uk> 15208# False positive with PPT (also currently this string is too long) 15209#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 152100 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document 15211#>48 byte 0x1B Excel Document 15212#!:mime application/vnd.ms-excel 15213>546 string bjbj Microsoft Word Document 15214!:mime application/msword 15215>546 string jbjb Microsoft Word Document 15216!:mime application/msword 15217 152180 string/b \224\246\056 Microsoft Word Document 15219!:mime application/msword 15220 15221512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 15222!:mime application/msword 15223 15224# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 15225# Magic type for Dell's BIOS .hdr files 15226# Dell's .hdr 152270 string/b $RBU 15228>23 string Dell %s system BIOS 15229>5 byte 2 15230>>48 byte x version %d. 15231>>49 byte x \b%d. 15232>>50 byte x \b%d 15233>5 byte <2 15234>>48 string x version %.3s 15235 15236# Type: Microsoft DirectDraw Surface 15237# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 15238# From: Morten Hustveit <morten@debian.org> 152390 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), 15240>16 lelong >0 %d x 15241>12 lelong >0 %d, 15242>84 string x %.4s 15243 15244# Type: Microsoft Document Imaging Format (.mdi) 15245# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 15246# From: Daniele Sempione <scrows@oziosi.org> 152470 short 0x5045 Microsoft Document Imaging Format 15248 15249# MS eBook format (.lit) 152500 string/b ITOLITLS Microsoft Reader eBook Data 15251>8 lelong x \b, version %u 15252!:mime application/x-ms-reader 15253 15254# Windows CE Binary Image Data Format 15255# From: Dr. Jesus <j@hug.gs> 152560 string/b B000FF\n Windows Embedded CE binary image 15257 15258# Windows Imaging (WIM) Image 152590 string/b MSWIM\000\000\000 Windows imaging (WIM) image 15260 15261# The second byte of these signatures is a file version; I don't know what, 15262# if anything, produced files with version numbers 0-2. 15263# From: John Elliott <johne@seasip.demon.co.uk> 152640 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 152650 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 152660 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 152670 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 15268 152690 string MIOPEN Mallard BASIC Jetsam data 152700 string Jetsam0 Mallard BASIC Jetsam index data 15271 15272 15273#------------------------------------------------------------------------------ 15274# $File: msooxml,v 1.4 2014/01/06 18:16:24 rrt Exp $ 15275# msooxml: file(1) magic for Microsoft Office XML 15276# From: Ralf Brown <ralf.brown@gmail.com> 15277 15278# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 15279# archive. The first member file is normally "[Content_Types].xml". 15280# but some libreoffice generated files put this later. Perhaps skip 15281# the "[Content_Types].xml" test? 15282# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 15283# file of ePub or OpenDocument, we'll have to scan for a filename 15284# which can distinguish between the three types 15285 15286# start by checking for ZIP local file header signature 152870 string PK\003\004 15288!:strength +10 15289# make sure the first file is correct 15290>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels 15291# skip to the second local file header 15292# since some documents include a 520-byte extra field following the file 15293# header, we need to scan for the next header 15294>>(18.l+49) search/2000 PK\003\004 15295# now skip to the *third* local file header; again, we need to scan due to a 15296# 520-byte extra field following the file header 15297>>>&26 search/1000 PK\003\004 15298# and check the subdirectory name to determine which type of OOXML 15299# file we have. Correct the mimetype with the registered ones: 15300# http://technet.microsoft.com/en-us/library/cc179224.aspx 15301>>>>&26 string word/ Microsoft Word 2007+ 15302!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 15303>>>>&26 string ppt/ Microsoft PowerPoint 2007+ 15304!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 15305>>>>&26 string xl/ Microsoft Excel 2007+ 15306!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 15307>>>>&26 default x Microsoft OOXML 15308 15309#------------------------------------------------------------------------------ 15310# $File$ 15311# msvc: file(1) magic for msvc 15312# "H. Nanosecond" <aldomel@ix.netcom.com> 15313# Microsoft visual C 15314# 15315# I have version 1.0 15316 15317# .aps 153180 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 15319 15320# .ide 15321#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 153220 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 15323 15324# .res 153250 string \000\000\000\000\040\000\000\000\377 MSVC .res 153260 string \377\003\000\377\001\000\020\020\350 MSVC .res 153270 string \377\003\000\377\001\000\060\020\350 MSVC .res 15328 15329#.lib 153300 string \360\015\000\000 Microsoft Visual C library 153310 string \360\075\000\000 Microsoft Visual C library 153320 string \360\175\000\000 Microsoft Visual C library 15333 15334#.pch 153350 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 15336 15337# .pdb 15338# too long 0 string Microsoft\ C/C++\ program\ database\ 153390 string Microsoft\ C/C++\ MSVC program database 15340>18 string program\ database\ 15341>33 string >\0 ver %s 15342 15343#.sbr 153440 string \000\002\000\007\000 MSVC .sbr 15345>5 string >\0 %s 15346 15347#.bsc 153480 string \002\000\002\001 MSVC .bsc 15349 15350#.wsp 153510 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 15352# these seem to start with the version and contain menus 15353 15354#------------------------------------------------------------------------------ 15355# msx: file(1) magic for the MSX Home Computer 15356# v1.1 15357# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 15358 15359############## MSX Music file formats ############## 15360 15361# Gigamix MGSDRV music file 153620 string MGS MSX Gigamix MGSDRV3 music file, 15363>6 ubeshort 0x0D0A 15364>>3 byte x \bv%c 15365>>4 byte x \b.%c 15366>>5 byte x \b%c 15367>>8 string >\0 \b, title: %s 15368 153691 string mgs2\ MSX Gigamix MGSDRV2 music file 15370>6 uleshort 0x80 15371>>0x2E uleshort 0 15372>>>0x30 string >\0 \b, title: %s 15373 15374# KSS music file 153750 string KSCC KSS music file v1.03 15376>0xE byte 0 15377>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 15378>>0xF byte&0x02 2 \b, soundchip(s): SN76489 15379>>>0xF byte&0x04 4 stereo 15380>>0xF byte&0x01 1 \b, YM2413 15381>>0xF byte&0x08 8 \b, Y8950 15382 153830 string KSSX KSS music file v1.20 15384>0xE byte&0xEF 0 15385>>0xF byte&0x40 0x00 \b, 60Hz 15386>>0xF byte&0x40 0x40 \b, 50Hz 15387>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 15388>>0xF byte&0x02 0x02 \b, soundchips: SN76489 15389>>>0xF byte&0x04 0x04 stereo 15390>>0xF byte&0x01 0x01 \b, 15391>>>0xF byte&0x18 0x00 \bYM2413 15392>>>0xF byte&0x18 0x08 \bYM2413, Y8950 15393>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 15394>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 15395 15396# Moonblaster for Moonsound 153970 string MBMS 15398>4 byte 0x10 MSX Moonblaster for MoonSound music 15399 15400# Music Player K-kaz 154010 string MPK MSX Music Player K-kaz song 15402>6 ubeshort 0x0D0A 15403>>3 byte x v%c 15404>>4 byte x \b.%c 15405>>5 byte x \b%c 15406 15407# I don't know why these don't work 15408#0 search/0xFFFF \r\n.FM9 15409#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 15410#0 search/0xFFFF \r\nFM1\ \= 15411#>0 search/0xFFFF \r\nPSG1\= 15412#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 15413 15414# OPX Music file 154150x35 beshort 0x0d0a 15416>0x7B beshort 0x0d0a 15417>>0x7D byte 0x1a 15418>>>0x87 uleshort 0 MSX OPX Music file 15419>>>>0x86 byte 0 v1.5 15420>>>>>0 string >\32 \b, title: %s 15421>>>>0x86 byte 1 v2.4 15422>>>>>0 string >\32 \b, title: %s 15423 15424# SCMD music file 154250x8B string SCMD 15426>0xCE uleshort 0 MSX SCMD Music file 15427#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 15428>>0x8F string >\0 \b, title: %s 15429 154300 search/0xFFFF \r\n@title 15431>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 15432 15433 15434############## MSX image file formats ############## 15435 15436# MSX raw VRAM dump 154370 ubyte 0xFE 15438>1 uleshort 0 15439>>5 uleshort 0 15440>>>3 uleshort 0x37FF MSX SC2/GRP raw image 15441>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 15442>>>3 uleshort >0x769E 15443>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 15444>>>>>3 uleshort 0x7FFF \b, with sprite patterns 15445>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 15446>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 15447 15448# Graph Saurus compressed images 154490 ubyte 0xFD 15450>1 uleshort 0 15451>>5 uleshort 0 15452>>>3 uleshort >0x013D MSX Graph Saurus compressed image 15453 15454# Maki-chan Graphic format 154550 string MAKI02\ \ Maki-chan image, 15456>8 byte x system ID: %c 15457>9 byte x \b%c 15458>10 byte x \b%c 15459>11 byte x \b%c, 15460>13 search/0x200 \x1A 15461# >>&3 ubyte 0 , video mode: PC-98 400 lines, 16 analog colors 15462# >>&3 ubyte 1 , video mode: MSX SC7, 16 analog colors 15463# >>&3 ubyte 2 , video mode: VM-98 400 lines, 8 analog colors 15464# >>&3 ubyte 3 , video mode: PC-88 analog, 200 lines, 8 analog colors 15465# >>&3 ubyte 4 , video mode: 400 lines, 16 digital colors 15466# >>&3 ubyte 5 , video mode: 200 lines, 16 digital colors 15467# >>&3 ubyte 6 , video mode: old PC-98 digital 400 lines, 8 colors 15468# >>&3 ubyte 7 , video mode: PC-88 400 lines, 8 digital colors 15469>>&8 uleshort+1 x %dx 15470>>&10 uleshort+1 x \b%d, 15471>>&3 ubyte&0x82 0x80 256 colors 15472>>&3 ubyte&0x82 0x00 16 colors 15473>>&3 ubyte&0x82 0x01 8 colors 15474>>&3 ubyte&0x04 4 digital 15475>>&3 ubyte&0x04 0 analog 15476>>&3 ubyte&0x01 1 \b, 2:1 dot aspect ratio 15477 15478# Japanese PIC file 154790 string PIC\x1A 15480>4 lelong 0 Japanese PIC image file 15481 15482# MSX G9B image file 154830 string G9B 15484>1 uleshort 11 15485>>3 uleshort >10 15486>>>5 ubyte >0 MSX G9B image, depth=%d 15487>>>>8 uleshort x \b, %dx 15488>>>>10 uleshort x \b%d 15489>>>>5 ubyte <9 15490>>>>>6 ubyte 0 15491>>>>>>7 ubyte x \b, codec=%d RGB color palettes 15492>>>>>6 ubyte 64 \b, codec=RGB fixed color 15493>>>>>6 ubyte 128 \b, codec=YJK 15494>>>>>6 ubyte 192 \b, codec=YUV 15495>>>>5 ubyte >8 codec=RGB fixed color 15496>>>>12 ubyte 0 \b, raw 15497>>>>12 ubyte 1 \b, bitbuster compression 15498 15499############## Other MSX file formats ############## 15500 15501# MSX ROMs 155020 string AB 15503>2 uleshort 0x0010 MSX ROM 15504>>2 uleshort x \b, init=0x%4x 15505>>4 uleshort >0 \b, stat=0x%4x 15506>>6 uleshort >0 \b, dev=0x%4x 15507>>8 uleshort >0 \b, bas=0x%4x 15508>2 uleshort 0x4010 MSX ROM 15509>>2 uleshort x \b, init=0x%04x 15510>>4 uleshort >0 \b, stat=0x%04x 15511>>6 uleshort >0 \b, dev=0x%04x 15512>>8 uleshort >0 \b, bas=0x%04x 15513>2 uleshort 0x8010 MSX ROM 15514>>2 uleshort x \b, init=0x%04x 15515>>4 uleshort >0 \b, stat=0x%04x 15516>>6 uleshort >0 \b, dev=0x%04x 15517>>8 uleshort >0 \b, bas=0x%04x 15518 155190 string AB 15520#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 15521#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 15522#>3 string @3\x80IA862 Golvellius MSX1 ROM 15523>2 uleshort >10 15524>>10 string \0\0\0\0\0\0 MSX ROM 15525>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 15526>>>0x10 string CD \b, Konami RC- 15527>>>>0x12 ubyte x \b%d 15528>>>>0x13 ubyte/16 x \b%d 15529>>>>0x13 ubyte&0xF x \b%d 15530>>>0x10 string EF \b, Konami RC- 15531>>>>0x12 ubyte x \b%d 15532>>>>0x13 ubyte/16 x \b%d 15533>>>>0x13 ubyte&0xF x \b%d 15534>>>2 uleshort x \b, init=0x%04x 15535>>>4 uleshort >0 \b, stat=0x%04x 15536>>>6 uleshort >0 \b, dev=0x%04x 15537>>>8 uleshort >0 \b, bas=0x%04x 15538>2 uleshort 0 15539>>4 uleshort 0 15540>>>6 uleshort 0 15541>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x 15542 155430x4000 string AB 15544>0x4002 uleshort >0x4010 15545>>0x400A string \0\0\0\0\0\0 MSX MegaROM with nonstandard page order 15546>>0x4002 uleshort x \b, init=0x%04x 15547>>0x4004 uleshort >0 \b, stat=0x%04x 15548>>0x4006 uleshort >0 \b, dev=0x%04x 15549>>0x4008 uleshort >0 \b, bas=0x%04x 15550 155510x8000 string AB 15552>0x8002 uleshort >0x4010 15553>>0x800A string \0\0\0\0\0\0 MSX MegaROM with nonstandard page order 15554>>0x8002 uleshort x \b, init=0x%04x 15555>>0x8004 uleshort >0 \b, stat=0x%04x 15556>>0x8006 uleshort >0 \b, dev=0x%04x 15557>>0x8008 uleshort >0 \b, bas=0x%04x 15558 15559 155600x3C000 string AB 15561>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 15562>>0x3C002 uleshort x \b, init=0x%04x 15563>>0x3C004 uleshort >0 \b, stat=0x%04x 15564>>0x3C006 uleshort >0 \b, dev=0x%04x 15565>>0x3C008 uleshort >0 \b, bas=0x%04x 15566 15567# MSX BIN file 15568#0 byte 0xFE 15569#>1 uleshort >0x8000 15570#>>3 uleshort >0x8004 15571#>>>5 uleshort >0x8000 MSX BIN file 15572 15573# MSX-BASIC file 155740 byte 0xFF 15575>3 uleshort 0x000A 15576>>1 uleshort >0x8000 MSX-BASIC program 15577 15578# MSX .CAS file 155790 string \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 15580 15581# Mega-Assembler file 155820 byte 0xFE 15583>1 uleshort 0x0001 15584>>5 uleshort 0xffff 15585>>>6 byte 0x0A MSX Mega-Assembler source 15586 15587# Execrom Patchfile 155880 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 15589>0x12 ubyte/16 x v%d 15590>0x12 ubyte&0xF x \b.%d 15591>0x13 ubyte x \b, contains %d patches 15592 15593# Konami's King's Valley-2 custom stage (ELG file) 155944 uleshort 0x0900 15595>0xF byte 1 15596>>0x14 byte 0 15597>>>0x1E string \ \ \ 15598>>>>0x23 byte 1 15599>>>>>0x25 byte 0 15600>>>>>>0x15 string >\x30 15601>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 15602>>>>>>>>0x1D byte <32 \b, theme: %d 15603 15604# Metal Gear 1 savegame 15605#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 15606#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 15607#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 15608 15609# ------------------------------------------------------------------------ 15610# $File$ 15611# mup: file(1) magic for Mup (Music Publisher) input file. 15612# 15613# From: Abel Cheung <abel (@) oaka.org> 15614# 15615# NOTE: This header is mainly proposed in the Arkkra mailing list, 15616# and is not a mandatory header because of old mup input file 15617# compatibility. Noteedit also use mup format, but is not forcing 15618# user to use any header as well. 15619# 156200 search/1 //!Mup Mup music publication program input text 15621>6 string -Arkkra (Arkkra) 15622>>13 string - 15623>>>16 string . 15624>>>>14 string x \b, need V%.4s 15625>>>15 string . 15626>>>>14 string x \b, need V%.3s 15627>6 string - 15628>>9 string . 15629>>>7 string x \b, need V%.4s 15630>>8 string . 15631>>>7 string x \b, need V%.3s 15632#------------------------------------------------------------------------------ 15633# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 15634# music: file (1) magic for music formats 15635 15636# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 15637# and Bagpipe Writer by Doug Wickstrom 15638# 156390 string Bagpipe Bagpipe 15640>8 string Reader Reader 15641>>15 string >\0 (version %.3s) 15642>8 string Music\ Writer Music Writer 15643>>20 string : 15644>>>21 string >\0 (version %.3s) 15645>>21 string Gold Gold 15646>>>25 string : 15647>>>>26 string >\0 (version %.3s) 15648 15649 15650#----------------------------------------------------------------------------- 15651# $File: natinst,v 1.5 2013/02/06 14:18:52 christos Exp $ 15652# natinst: file(1) magic for National Instruments Code Files 15653 15654# 15655# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 15656# version 1 15657# Many formats still missing, we use, for the moment LabVIEW 15658# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 15659# 156600 string RSRC National Instruments, 15661# Check if it's a LabVIEW File 15662>8 string LV LabVIEW File, 15663# Check which kind of file it is 15664>>10 string SB Code Resource File, data 15665>>10 string IN Virtual Instrument Program, data 15666>>10 string AR VI Library, data 15667# This is for Menu Libraries 15668>8 string LMNULBVW Portable File Names, data 15669# This is for General Resources 15670>8 string rsc Resources File, data 15671# This is for VXI Package 156720 string VMAP National Instruments, VXI File, data 15673 15674#------------------------------------------------------------------------------ 15675# $File: ncr,v 1.7 2009/09/19 16:28:11 christos Exp $ 15676# ncr: file(1) magic for NCR Tower objects 15677# 15678# contributed by 15679# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 15680# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 15681# 156820 beshort 000610 Tower/XP rel 2 object 15683>12 belong >0 not stripped 15684>20 beshort 0407 executable 15685>20 beshort 0410 pure executable 15686>22 beshort >0 - version %d 156870 beshort 000615 Tower/XP rel 2 object 15688>12 belong >0 not stripped 15689>20 beshort 0407 executable 15690>20 beshort 0410 pure executable 15691>22 beshort >0 - version %d 156920 beshort 000620 Tower/XP rel 3 object 15693>12 belong >0 not stripped 15694>20 beshort 0407 executable 15695>20 beshort 0410 pure executable 15696>22 beshort >0 - version %d 156970 beshort 000625 Tower/XP rel 3 object 15698>12 belong >0 not stripped 15699>20 beshort 0407 executable 15700>20 beshort 0410 pure executable 15701>22 beshort >0 - version %d 157020 beshort 000630 Tower32/600/400 68020 object 15703>12 belong >0 not stripped 15704>20 beshort 0407 executable 15705>20 beshort 0410 pure executable 15706>22 beshort >0 - version %d 157070 beshort 000640 Tower32/800 68020 15708>18 beshort &020000 w/68881 object 15709>18 beshort &040000 compatible object 15710>18 beshort &060000 object 15711>20 beshort 0407 executable 15712>20 beshort 0413 pure executable 15713>12 belong >0 not stripped 15714>22 beshort >0 - version %d 157150 beshort 000645 Tower32/800 68010 15716>18 beshort &040000 compatible object 15717>18 beshort &060000 object 15718>20 beshort 0407 executable 15719>20 beshort 0413 pure executable 15720>12 belong >0 not stripped 15721>22 beshort >0 - version %d 15722 15723#------------------------------------------------------------ 15724# $File: java,v 1.12 2009/09/19 16:28:10 christos Exp $ 15725 15726# From: Mikhail Gusarov <dottedmag@dottedmag.net> 15727# NekoVM (http://nekovm.org/) bytecode 157280 string NEKO NekoVM bytecode 15729>4 lelong x (%d global symbols, 15730>8 lelong x %d global fields, 15731>12 lelong x %d bytecode ops) 15732!:mime application/x-nekovm-bytecode 15733 15734 15735#------------------------------------------------------------------------------ 15736# $File: netbsd,v 1.21 2014/03/29 15:40:34 christos Exp $ 15737# netbsd: file(1) magic for NetBSD objects 15738# 15739# All new-style magic numbers are in network byte order. 15740# The old-style magic numbers are indistinguishable from the same magic 15741# numbers used in other systems, and are handled, for all those systems, 15742# in aout. 15743# 15744 157450 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 15746>0 byte &0x80 15747>>20 lelong <4096 shared library 15748>>20 lelong =4096 dynamically linked executable 15749>>20 lelong >4096 dynamically linked executable 15750>0 byte ^0x80 executable 15751>16 lelong >0 not stripped 157520 belong&0377777777 041400410 a.out NetBSD/i386 pure 15753>0 byte &0x80 dynamically linked executable 15754>0 byte ^0x80 executable 15755>16 lelong >0 not stripped 157560 belong&0377777777 041400407 a.out NetBSD/i386 15757>0 byte &0x80 dynamically linked executable 15758>0 byte ^0x80 15759>>0 byte &0x40 position independent 15760>>20 lelong !0 executable 15761>>20 lelong =0 object file 15762>16 lelong >0 not stripped 157630 belong&0377777777 041400507 a.out NetBSD/i386 core 15764>12 string >\0 from '%s' 15765>32 lelong !0 (signal %d) 15766 157670 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 15768>0 byte &0x80 15769>>20 belong <8192 shared library 15770>>20 belong =8192 dynamically linked executable 15771>>20 belong >8192 dynamically linked executable 15772>0 byte ^0x80 executable 15773>16 belong >0 not stripped 157740 belong&0377777777 041600410 a.out NetBSD/m68k pure 15775>0 byte &0x80 dynamically linked executable 15776>0 byte ^0x80 executable 15777>16 belong >0 not stripped 157780 belong&0377777777 041600407 a.out NetBSD/m68k 15779>0 byte &0x80 dynamically linked executable 15780>0 byte ^0x80 15781>>0 byte &0x40 position independent 15782>>20 belong !0 executable 15783>>20 belong =0 object file 15784>16 belong >0 not stripped 157850 belong&0377777777 041600507 a.out NetBSD/m68k core 15786>12 string >\0 from '%s' 15787>32 belong !0 (signal %d) 15788 157890 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 15790>0 byte &0x80 15791>>20 belong <4096 shared library 15792>>20 belong =4096 dynamically linked executable 15793>>20 belong >4096 dynamically linked executable 15794>0 byte ^0x80 executable 15795>16 belong >0 not stripped 157960 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 15797>0 byte &0x80 dynamically linked executable 15798>0 byte ^0x80 executable 15799>16 belong >0 not stripped 158000 belong&0377777777 042000407 a.out NetBSD/m68k4k 15801>0 byte &0x80 dynamically linked executable 15802>0 byte ^0x80 15803>>0 byte &0x40 position independent 15804>>20 belong !0 executable 15805>>20 belong =0 object file 15806>16 belong >0 not stripped 158070 belong&0377777777 042000507 a.out NetBSD/m68k4k core 15808>12 string >\0 from '%s' 15809>32 belong !0 (signal %d) 15810 158110 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 15812>0 byte &0x80 15813>>20 lelong <4096 shared library 15814>>20 lelong =4096 dynamically linked executable 15815>>20 lelong >4096 dynamically linked executable 15816>0 byte ^0x80 executable 15817>16 lelong >0 not stripped 158180 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 15819>0 byte &0x80 dynamically linked executable 15820>0 byte ^0x80 executable 15821>16 lelong >0 not stripped 158220 belong&0377777777 042200407 a.out NetBSD/ns32532 15823>0 byte &0x80 dynamically linked executable 15824>0 byte ^0x80 15825>>0 byte &0x40 position independent 15826>>20 lelong !0 executable 15827>>20 lelong =0 object file 15828>16 lelong >0 not stripped 158290 belong&0377777777 042200507 a.out NetBSD/ns32532 core 15830>12 string >\0 from '%s' 15831>32 lelong !0 (signal %d) 15832 158330 belong&0377777777 045200507 a.out NetBSD/powerpc core 15834>12 string >\0 from '%s' 15835 158360 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged 15837>0 byte &0x80 15838>>20 belong <8192 shared library 15839>>20 belong =8192 dynamically linked executable 15840>>20 belong >8192 dynamically linked executable 15841>0 byte ^0x80 executable 15842>16 belong >0 not stripped 158430 belong&0377777777 042400410 a.out NetBSD/SPARC pure 15844>0 byte &0x80 dynamically linked executable 15845>0 byte ^0x80 executable 15846>16 belong >0 not stripped 158470 belong&0377777777 042400407 a.out NetBSD/SPARC 15848>0 byte &0x80 dynamically linked executable 15849>0 byte ^0x80 15850>>0 byte &0x40 position independent 15851>>20 belong !0 executable 15852>>20 belong =0 object file 15853>16 belong >0 not stripped 158540 belong&0377777777 042400507 a.out NetBSD/SPARC core 15855>12 string >\0 from '%s' 15856>32 belong !0 (signal %d) 15857 158580 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 15859>0 byte &0x80 15860>>20 lelong <4096 shared library 15861>>20 lelong =4096 dynamically linked executable 15862>>20 lelong >4096 dynamically linked executable 15863>0 byte ^0x80 executable 15864>16 lelong >0 not stripped 158650 belong&0377777777 042600410 a.out NetBSD/pmax pure 15866>0 byte &0x80 dynamically linked executable 15867>0 byte ^0x80 executable 15868>16 lelong >0 not stripped 158690 belong&0377777777 042600407 a.out NetBSD/pmax 15870>0 byte &0x80 dynamically linked executable 15871>0 byte ^0x80 15872>>0 byte &0x40 position independent 15873>>20 lelong !0 executable 15874>>20 lelong =0 object file 15875>16 lelong >0 not stripped 158760 belong&0377777777 042600507 a.out NetBSD/pmax core 15877>12 string >\0 from '%s' 15878>32 lelong !0 (signal %d) 15879 158800 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 15881>0 byte &0x80 15882>>20 lelong <4096 shared library 15883>>20 lelong =4096 dynamically linked executable 15884>>20 lelong >4096 dynamically linked executable 15885>0 byte ^0x80 executable 15886>16 lelong >0 not stripped 158870 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 15888>0 byte &0x80 dynamically linked executable 15889>0 byte ^0x80 executable 15890>16 lelong >0 not stripped 158910 belong&0377777777 043000407 a.out NetBSD/vax 1k 15892>0 byte &0x80 dynamically linked executable 15893>0 byte ^0x80 15894>>0 byte &0x40 position independent 15895>>20 lelong !0 executable 15896>>20 lelong =0 object file 15897>16 lelong >0 not stripped 158980 belong&0377777777 043000507 a.out NetBSD/vax 1k core 15899>12 string >\0 from '%s' 15900>32 lelong !0 (signal %d) 15901 159020 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 15903>0 byte &0x80 15904>>20 lelong <4096 shared library 15905>>20 lelong =4096 dynamically linked executable 15906>>20 lelong >4096 dynamically linked executable 15907>0 byte ^0x80 executable 15908>16 lelong >0 not stripped 159090 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 15910>0 byte &0x80 dynamically linked executable 15911>0 byte ^0x80 executable 15912>16 lelong >0 not stripped 159130 belong&0377777777 045400407 a.out NetBSD/vax 4k 15914>0 byte &0x80 dynamically linked executable 15915>0 byte ^0x80 15916>>0 byte &0x40 position independent 15917>>20 lelong !0 executable 15918>>20 lelong =0 object file 15919>16 lelong >0 not stripped 159200 belong&0377777777 045400507 a.out NetBSD/vax 4k core 15921>12 string >\0 from '%s' 15922>32 lelong !0 (signal %d) 15923 15924# NetBSD/alpha does not support (and has never supported) a.out objects, 15925# so no rules are provided for them. NetBSD/alpha ELF objects are 15926# dealt with in "elf". 159270 lelong 0x00070185 ECOFF NetBSD/alpha binary 15928>10 leshort 0x0001 not stripped 15929>10 leshort 0x0000 stripped 159300 belong&0377777777 043200507 a.out NetBSD/alpha core 15931>12 string >\0 from '%s' 15932>32 lelong !0 (signal %d) 15933 159340 belong&0377777777 043400413 a.out NetBSD/mips demand paged 15935>0 byte &0x80 15936>>20 belong <8192 shared library 15937>>20 belong =8192 dynamically linked executable 15938>>20 belong >8192 dynamically linked executable 15939>0 byte ^0x80 executable 15940>16 belong >0 not stripped 159410 belong&0377777777 043400410 a.out NetBSD/mips pure 15942>0 byte &0x80 dynamically linked executable 15943>0 byte ^0x80 executable 15944>16 belong >0 not stripped 159450 belong&0377777777 043400407 a.out NetBSD/mips 15946>0 byte &0x80 dynamically linked executable 15947>0 byte ^0x80 15948>>0 byte &0x40 position independent 15949>>20 belong !0 executable 15950>>20 belong =0 object file 15951>16 belong >0 not stripped 159520 belong&0377777777 043400507 a.out NetBSD/mips core 15953>12 string >\0 from '%s' 15954>32 belong !0 (signal %d) 15955 159560 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 15957>0 byte &0x80 15958>>20 lelong <4096 shared library 15959>>20 lelong =4096 dynamically linked executable 15960>>20 lelong >4096 dynamically linked executable 15961>0 byte ^0x80 executable 15962>16 lelong >0 not stripped 159630 belong&0377777777 043600410 a.out NetBSD/arm32 pure 15964>0 byte &0x80 dynamically linked executable 15965>0 byte ^0x80 executable 15966>16 lelong >0 not stripped 159670 belong&0377777777 043600407 a.out NetBSD/arm32 15968>0 byte &0x80 dynamically linked executable 15969>0 byte ^0x80 15970>>0 byte &0x40 position independent 15971>>20 lelong !0 executable 15972>>20 lelong =0 object file 15973>16 lelong >0 not stripped 15974# NetBSD/arm26 has always used ELF objects, but it shares a core file 15975# format with NetBSD/arm32. 159760 belong&0377777777 043600507 a.out NetBSD/arm core 15977>12 string >\0 from '%s' 15978>32 lelong !0 (signal %d) 15979 15980# Kernel core dump format 159810 belong&0x0000ffff 0x00008fca NetBSD kernel core file 15982>0 belong&0x03ff0000 0x00000000 \b, Unknown 15983>0 belong&0x03ff0000 0x00010000 \b, sun 68010/68020 15984>0 belong&0x03ff0000 0x00020000 \b, sun 68020 15985>0 belong&0x03ff0000 0x00640000 \b, 386 PC 15986>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 15987>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 15988>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 15989>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 15990>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD 15991>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 15992>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 15993>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 15994>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 15995>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 15996>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 15997>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 15998>0 belong&0x03ff0000 0x00950000 \b, ppc BSD (Big Endian) 15999>0 belong&0x03ff0000 0x00960000 \b, vax BSD (4K pages) 16000>0 belong&0x03ff0000 0x00970000 \b, mips1 BSD 16001>0 belong&0x03ff0000 0x00980000 \b, mips2 BSD 16002>0 belong&0x03ff0000 0x00990000 \b, m88k BSD 16003>0 belong&0x03ff0000 0x00920000 \b, parisc BSD 16004>0 belong&0x03ff0000 0x009b0000 \b, sh5/64 BSD 16005>0 belong&0x03ff0000 0x009c0000 \b, SPARC/64 BSD 16006>0 belong&0x03ff0000 0x009d0000 \b, amd64 BSD 16007>0 belong&0x03ff0000 0x009e0000 \b, sh5/32 BSD 16008>0 belong&0x03ff0000 0x009f0000 \b, ia64 BSD 16009>0 belong&0x03ff0000 0x00b70000 \b, aarch64 BSD 16010>0 belong&0x03ff0000 0x00b80000 \b, or1k BSD 16011>0 belong&0x03ff0000 0x00b90000 \b, Risk-V BSD 16012>0 belong&0x03ff0000 0x00c80000 \b, hp200 BSD 16013>0 belong&0x03ff0000 0x012c0000 \b, hp300 BSD 16014>0 belong&0x03ff0000 0x020b0000 \b, hp800 HP-UX 16015>0 belong&0x03ff0000 0x020c0000 \b, hp200/hp300 HP-UX 16016>0 belong&0xfc000000 0x04000000 \b, CPU 16017>0 belong&0xfc000000 0x08000000 \b, DATA 16018>0 belong&0xfc000000 0x10000000 \b, STACK 16019>4 leshort x \b, (headersize = %d 16020>6 leshort x \b, segmentsize = %d 16021>6 lelong x \b, segments = %d) 16022 16023#------------------------------------------------------------------------------ 16024# $File$ 16025# netscape: file(1) magic for Netscape files 16026# "H. Nanosecond" <aldomel@ix.netcom.com> 16027# version 3 and 4 I think 16028# 16029 16030# Netscape Address book .nab 160310 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 16032 16033# Netscape Communicator address book 160340 string \000\017\102\111 Netscape Communicator address book 16035 16036# .snm Caches 160370 string #\ Netscape\ folder\ cache Netscape folder cache 160380 string \000\036\204\220\000 Netscape folder cache 16039# .n2p 16040# Net 2 Phone 16041#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 160420 string SX961999 Net2phone 16043 16044# 16045#This is files ending in .art, FIXME add more rules 160460 string JG\004\016\0\0\0\0 ART 16047 16048#------------------------------------------------------------------------------ 16049# $File$ 16050# netware: file(1) magic for NetWare Loadable Modules (NLMs) 16051# From: Mads Martin Joergensen <mmj@suse.de> 16052 160530 string NetWare\ Loadable\ Module NetWare Loadable Module 16054 16055#------------------------------------------------------------------------------ 16056# $File$ 16057# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 16058# 160590 string StartFontMetrics ASCII font metrics 160600 string StartFont ASCII font bits 160610 belong 0x137A2944 NeWS bitmap font 160620 belong 0x137A2947 NeWS font family 160630 belong 0x137A2950 scalable OpenFont binary 160640 belong 0x137A2951 encrypted scalable OpenFont binary 160658 belong 0x137A2B45 X11/NeWS bitmap font 160668 belong 0x137A2B48 X11/NeWS font family 16067 16068#------------------------------------------------------------------------------ 16069# $File: nitpicker,v 1.5 2014/04/28 12:04:50 christos Exp $ 16070# nitpicker: file(1) magic for Flowfiles. 16071# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de 160720 string NPFF NItpicker Flow File 16073>4 byte x V%d. 16074>5 byte x %d 16075>6 bedate x started: %s 16076>10 bedate x stopped: %s 16077>14 belong x Bytes: %u 16078>18 belong x Bytes1: %u 16079>22 belong x Flows: %u 16080>26 belong x Pkts: %u 16081 16082#------------------------------------------------------------------------------ 16083# $File: oasis,v 1.1 2011/03/15 02:09:38 christos Exp $ 16084# OASIS 16085# Summary: OASIS stream file 16086# Long description: Open Artwork System Interchange Standard 16087# File extension: .oas 16088# Full name: Ben Cowley (bcowley@broadcom.com) 16089# Philip Dixon (pdixon@broadcom.com) 16090# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 16091# (see page 3) 160920 string %SEMI-OASIS\r\n OASIS Stream file 16093 16094#------------------------------------------------------------------------------ 16095# $File: ocaml,v 1.4 2009/09/19 16:28:11 christos Exp $ 16096# ocaml: file(1) magic for Objective Caml files. 160970 string Caml1999 OCaml 16098>8 string X exec file 16099>8 string I interface file (.cmi) 16100>8 string O object file (.cmo) 16101>8 string A library file (.cma) 16102>8 string Y native object file (.cmx) 16103>8 string Z native library file (.cmxa) 16104>8 string M abstract syntax tree implementation file 16105>8 string N abstract syntax tree interface file 16106>9 string >\0 (Version %3.3s) 16107 16108#------------------------------------------------------------------------------ 16109# $File$ 16110# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 161110 string Octave-1-L Octave binary data (little endian) 161120 string Octave-1-B Octave binary data (big endian) 16113 16114#------------------------------------------------------------------------------ 16115# $File$ 16116# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 16117# storage (http://en.wikipedia.org/wiki/Structured_Storage) 16118# Additional tests for OLE 2 Compound Documents should be under this recipe. 16119 161200 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document 16121# - Microstation V8 DGN files (www.bentley.com) 16122# Last update on 10/23/2006 by Lester Hightower 16123> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN 16124# - Visio documents 16125# Last update on 10/23/2006 by Lester Hightower 16126> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document 16127 16128#------------------------------------------------------------------------------ 16129# $File$ 16130# olf: file(1) magic for OLF executables 16131# 16132# We have to check the byte order flag to see what byte order all the 16133# other stuff in the header is in. 16134# 16135# MIPS R3000 may also be for MIPS R2000. 16136# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 16137# 16138# Created by Erik Theisen <etheisen@openbsd.org> 16139# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 161400 string \177OLF OLF 16141>4 byte 0 invalid class 16142>4 byte 1 32-bit 16143>4 byte 2 64-bit 16144>7 byte 0 invalid os 16145>7 byte 1 OpenBSD 16146>7 byte 2 NetBSD 16147>7 byte 3 FreeBSD 16148>7 byte 4 4.4BSD 16149>7 byte 5 Linux 16150>7 byte 6 SVR4 16151>7 byte 7 esix 16152>7 byte 8 Solaris 16153>7 byte 9 Irix 16154>7 byte 10 SCO 16155>7 byte 11 Dell 16156>7 byte 12 NCR 16157>5 byte 0 invalid byte order 16158>5 byte 1 LSB 16159>>16 leshort 0 no file type, 16160>>16 leshort 1 relocatable, 16161>>16 leshort 2 executable, 16162>>16 leshort 3 shared object, 16163# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 16164# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 16165>>16 leshort 4 core file 16166>>>(0x38+0xcc) string >\0 of '%s' 16167>>>(0x38+0x10) lelong >0 (signal %d), 16168>>16 leshort &0xff00 processor-specific, 16169>>18 leshort 0 no machine, 16170>>18 leshort 1 AT&T WE32100 - invalid byte order, 16171>>18 leshort 2 SPARC - invalid byte order, 16172>>18 leshort 3 Intel 80386, 16173>>18 leshort 4 Motorola 68000 - invalid byte order, 16174>>18 leshort 5 Motorola 88000 - invalid byte order, 16175>>18 leshort 6 Intel 80486, 16176>>18 leshort 7 Intel 80860, 16177>>18 leshort 8 MIPS R3000_BE - invalid byte order, 16178>>18 leshort 9 Amdahl - invalid byte order, 16179>>18 leshort 10 MIPS R3000_LE, 16180>>18 leshort 11 RS6000 - invalid byte order, 16181>>18 leshort 15 PA-RISC - invalid byte order, 16182>>18 leshort 16 nCUBE, 16183>>18 leshort 17 VPP500, 16184>>18 leshort 18 SPARC32PLUS, 16185>>18 leshort 20 PowerPC, 16186>>18 leshort 0x9026 Alpha, 16187>>20 lelong 0 invalid version 16188>>20 lelong 1 version 1 16189>>36 lelong 1 MathCoPro/FPU/MAU Required 16190>8 string >\0 (%s) 16191>5 byte 2 MSB 16192>>16 beshort 0 no file type, 16193>>16 beshort 1 relocatable, 16194>>16 beshort 2 executable, 16195>>16 beshort 3 shared object, 16196>>16 beshort 4 core file, 16197>>>(0x38+0xcc) string >\0 of '%s' 16198>>>(0x38+0x10) belong >0 (signal %d), 16199>>16 beshort &0xff00 processor-specific, 16200>>18 beshort 0 no machine, 16201>>18 beshort 1 AT&T WE32100, 16202>>18 beshort 2 SPARC, 16203>>18 beshort 3 Intel 80386 - invalid byte order, 16204>>18 beshort 4 Motorola 68000, 16205>>18 beshort 5 Motorola 88000, 16206>>18 beshort 6 Intel 80486 - invalid byte order, 16207>>18 beshort 7 Intel 80860, 16208>>18 beshort 8 MIPS R3000_BE, 16209>>18 beshort 9 Amdahl, 16210>>18 beshort 10 MIPS R3000_LE - invalid byte order, 16211>>18 beshort 11 RS6000, 16212>>18 beshort 15 PA-RISC, 16213>>18 beshort 16 nCUBE, 16214>>18 beshort 17 VPP500, 16215>>18 beshort 18 SPARC32PLUS, 16216>>18 beshort 20 PowerPC or cisco 4500, 16217>>18 beshort 21 cisco 7500, 16218>>18 beshort 24 cisco SVIP, 16219>>18 beshort 25 cisco 7200, 16220>>18 beshort 36 cisco 12000, 16221>>18 beshort 0x9026 Alpha, 16222>>20 belong 0 invalid version 16223>>20 belong 1 version 1 16224>>36 belong 1 MathCoPro/FPU/MAU Required 16225 16226#------------------------------------------------------------------------------ 16227# $File: os2,v 1.7 2009/09/19 16:28:11 christos Exp $ 16228# os2: file(1) magic for OS/2 files 16229# 16230 16231# Provided 1998/08/22 by 16232# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 162331 search/1 InternetShortcut MS Windows 95 Internet shortcut text 16234>17 search/100 URL= (URL=< 16235>>&0 string x \b%s>) 16236 16237# OS/2 URL objects 16238# Provided 1998/08/22 by 16239# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 16240#0 string http: OS/2 URL object text 16241#>5 string >\ (WWW) <http:%s> 16242#0 string mailto: OS/2 URL object text 16243#>7 string >\ (email) <%s> 16244#0 string news: OS/2 URL object text 16245#>5 string >\ (Usenet) <%s> 16246#0 string ftp: OS/2 URL object text 16247#>4 string >\ (FTP) <ftp:%s> 16248#0 string file: OS/2 URL object text 16249#>5 string >\ (Local file) <%s> 16250 16251# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 16252# Carl Hauser (chauser.parc@xerox.com) and 16253# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 16254# list the following header format in inf02a.doc: 16255# 16256# int16 ID; // ID magic word (5348h = "HS") 16257# int8 unknown1; // unknown purpose, could be third letter of ID 16258# int8 flags; // probably a flag word... 16259# // bit 0: set if INF style file 16260# // bit 4: set if HLP style file 16261# // patching this byte allows reading HLP files 16262# // using the VIEW command, while help files 16263# // seem to work with INF settings here as well. 16264# int16 hdrsize; // total size of header 16265# int16 unknown2; // unknown purpose 16266# 162670 string HSP\x01\x9b\x00 OS/2 INF 16268>107 string >0 (%s) 162690 string HSP\x10\x9b\x00 OS/2 HLP 16270>107 string >0 (%s) 16271 16272# OS/2 INI (this is a guess) 162730 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 16274 16275#------------------------------------------------------------------------------ 16276# $File$ 16277# os400: file(1) magic for IBM OS/400 files 16278# 16279# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 16280# In spite of its quite variable format (due to internal memory page 16281# length differences between CISC and RISC versions of the OS) the 16282# SAVF structure hasn't suitable offsets to identify the catalog 16283# header in the first descriptor where there are some useful infos, 16284# so we must search in a somewhat large area for a particular string 16285# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 16286# descriptor space) preceded by a two byte constant. 16287# 162881090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 16289>&212 byte 0x01 \b, created with SAVOBJ 16290>&212 byte 0x02 \b, created with SAVLIB 16291>&212 byte 0x07 \b, created with SAVCFG 16292>&212 byte 0x08 \b, created with SAVSECDTA 16293>&212 byte 0x0A \b, created with SAVSECDTA 16294>&212 byte 0x0B \b, created with SAVDLO 16295>&212 byte 0x0D \b, created with SAVLICPGM 16296>&212 byte 0x11 \b, created with SAVCHGOBJ 16297>&213 byte 0x44 \b, at least V5R4 to open 16298>&213 byte 0x43 \b, at least V5R3 to open 16299>&213 byte 0x42 \b, at least V5R2 to open 16300>&213 byte 0x41 \b, at least V5R1 to open 16301>&213 byte 0x40 \b, at least V4R5 to open 16302>&213 byte 0x3F \b, at least V4R4 to open 16303>&213 byte 0x3E \b, at least V4R3 to open 16304>&213 byte 0x3C \b, at least V4R2 to open 16305>&213 byte 0x3D \b, at least V4R1M4 to open 16306>&213 byte 0x3B \b, at least V4R1 to open 16307>&213 byte 0x3A \b, at least V3R7 to open 16308>&213 byte 0x35 \b, at least V3R6 to open 16309>&213 byte 0x36 \b, at least V3R2 to open 16310>&213 byte 0x34 \b, at least V3R1 to open 16311>&213 byte 0x31 \b, at least V3R0M5 to open 16312>&213 byte 0x30 \b, at least V2R3 to open 16313 16314#------------------------------------------------------------------------------ 16315# $File: os9,v 1.6 2009/09/19 16:28:11 christos Exp $ 16316# 16317# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 16318# 16319# Redistribution and use in source and binary forms, with or without 16320# modification, are permitted provided that the following conditions 16321# are met: 16322# 1. Redistributions of source code must retain the above copyright 16323# notice, this list of conditions and the following disclaimer. 16324# 2. Redistributions in binary form must reproduce the above copyright 16325# notice, this list of conditions and the following disclaimer in the 16326# documentation and/or other materials provided with the distribution. 16327# 16328# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16329# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16330# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 16331# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 16332# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 16333# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 16334# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 16335# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 16336# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 16337# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 16338# 16339# 16340# 16341# OS9/6809 module descriptions: 16342# 163430 beshort 0x87CD OS9/6809 module: 16344# 16345>6 byte&0x0f 0x00 non-executable 16346>6 byte&0x0f 0x01 machine language 16347>6 byte&0x0f 0x02 BASIC I-code 16348>6 byte&0x0f 0x03 Pascal P-code 16349>6 byte&0x0f 0x04 C I-code 16350>6 byte&0x0f 0x05 COBOL I-code 16351>6 byte&0x0f 0x06 Fortran I-code 16352# 16353>6 byte&0xf0 0x10 program executable 16354>6 byte&0xf0 0x20 subroutine 16355>6 byte&0xf0 0x30 multi-module 16356>6 byte&0xf0 0x40 data module 16357# 16358>6 byte&0xf0 0xC0 system module 16359>6 byte&0xf0 0xD0 file manager 16360>6 byte&0xf0 0xE0 device driver 16361>6 byte&0xf0 0xF0 device descriptor 16362# 16363# OS9/m68k stuff (to be continued) 16364# 163650 beshort 0x4AFC OS9/68K module: 16366# 16367# attr 16368>0x14 byte&0x80 0x80 re-entrant 16369>0x14 byte&0x40 0x40 ghost 16370>0x14 byte&0x20 0x20 system-state 16371# 16372# lang: 16373# 16374>0x13 byte 1 machine language 16375>0x13 byte 2 BASIC I-code 16376>0x13 byte 3 Pascal P-code 16377>0x13 byte 4 C I-code 16378>0x13 byte 5 COBOL I-code 16379>0x13 byte 6 Fortran I-code 16380# 16381# 16382# type: 16383# 16384>0x12 byte 1 program executable 16385>0x12 byte 2 subroutine 16386>0x12 byte 3 multi-module 16387>0x12 byte 4 data module 16388>0x12 byte 11 trap library 16389>0x12 byte 12 system module 16390>0x12 byte 13 file manager 16391>0x12 byte 14 device driver 16392>0x12 byte 15 device descriptor 16393 16394#------------------------------------------------------------------------------ 16395# $File$ 16396# 16397# Mach magic number info 16398# 163990 long 0xefbe OSF/Rose object 16400# I386 magic number info 16401# 164020 short 0565 i386 COFF object 16403 16404#------------------------------------------------------------------------------ 16405# $File: palm,v 1.12 2014/03/28 19:11:40 christos Exp $ 16406# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 16407# 16408# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 16409 16410# These are weak, byte 59 is not guaranteed to be 0 and there are 16411# 8 character identifiers at byte 60, one I found for appl is BIGb. 16412# What are the possibilities and where is this documented? 16413 16414# The common header format for PalmOS .pdb/.prc files is 16415# { 16416# char name[ 32 ]; 16417# Word attributes; 16418# Word version; 16419# DWord creationDate; 16420# DWord modificationDate; 16421# DWord lastBackupDate; 16422# DWord modificationNumber; 16423# DWord appInfoID; 16424# DWord sortInfoID; 16425# char type[4]; 16426# char creator[4]; 16427# DWord uniqueIDSeed; 16428# RecordListType recordList; 16429# }; 16430# 16431# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 16432# or Unix/POSIX time + 2082844800. 16433 164340 name aportisdoc 16435# date is supposed to be big-endian seconds since 1 Jan 1904, but many 16436# files contain the timestamp in little-endian or a completely 16437# nonsensical value... 16438#>36 bedate-2082844800 >0 \b, created %s 16439# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 16440>(78.L) beshort =1 \b, uncompressed 16441# compressed 16442>(78.L) beshort >1 16443>>(78.L+4) belong x \b, %d bytes uncompressed 16444 16445# appl 16446#60 string appl PalmOS application 16447#>0 string >\0 "%s" 16448 16449# HACK 16450#60 string HACK HackMaster hack 16451#>0 string >\0 "%s" 16452 16453# iSiloX e-book 1645460 string SDocSilX iSiloX E-book 16455>0 string >\0 "%s" 16456 16457# Mobipocket (www.mobipocket.com), donated by Carl Witty 16458# expanded by Ralf Brown 1645960 string BOOKMOBI Mobipocket E-book 16460# MobiPocket stores a full title, pointed at by the belong at offset 16461# 0x54 in its header at (78.L), with length given by the belong at 16462# offset 0x58. 16463# there's no guarantee that the title string is null-terminated, but 16464# we currently can't specify a variable-length string where the length 16465# field is not at the start of the string; in practice, the data 16466# following the string always seems to start with a zero byte 16467>(78.L) belong x 16468>>&(&0x50.L-4) string >\0 "%s" 16469>0 use aportisdoc 16470>>(78.L+0x68) belong >0 \b, version %d 16471>>(78.L+0x1C) belong !0 \b, codepage %d 16472>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 16473 16474# AportisDoc/PalmDOC 1647560 string TEXtREAd AportisDoc/PalmDOC E-book 16476>0 string >\0 "%s" 16477>0 use aportisdoc 16478 16479# Variety of PalmOS document types 16480# Michael-John Turner <mj@debian.org> 16481# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 1648260 string BVokBDIC BDicty PalmOS document 16483>0 string >\0 "%s" 1648460 string DB99DBOS DB PalmOS document 16485>0 string >\0 "%s" 1648660 string vIMGView FireViewer/ImageViewer PalmOS document 16487>0 string >\0 "%s" 1648860 string PmDBPmDB HanDBase PalmOS document 16489>0 string >\0 "%s" 1649060 string InfoINDB InfoView PalmOS document 16491>0 string >\0 "%s" 1649260 string ToGoToGo iSilo PalmOS document 16493>0 string >\0 "%s" 1649460 string JfDbJBas JFile PalmOS document 16495>0 string >\0 "%s" 1649660 string JfDbJFil JFile Pro PalmOS document 16497>0 string >\0 "%s" 1649860 string DATALSdb List PalmOS document 16499>0 string >\0 "%s" 1650060 string Mdb1Mdb1 MobileDB PalmOS document 16501>0 string >\0 "%s" 1650260 string PNRdPPrs PeanutPress PalmOS document 16503>0 string >\0 "%s" 1650460 string DataPlkr Plucker PalmOS document 16505>0 string >\0 "%s" 1650660 string DataSprd QuickSheet PalmOS document 16507>0 string >\0 "%s" 1650860 string SM01SMem SuperMemo PalmOS document 16509>0 string >\0 "%s" 1651060 string TEXtTlDc TealDoc PalmOS document 16511>0 string >\0 "%s" 1651260 string InfoTlIf TealInfo PalmOS document 16513>0 string >\0 "%s" 1651460 string DataTlMl TealMeal PalmOS document 16515>0 string >\0 "%s" 1651660 string DataTlPt TealPaint PalmOS document 16517>0 string >\0 "%s" 1651860 string dataTDBP ThinkDB PalmOS document 16519>0 string >\0 "%s" 1652060 string TdatTide Tides PalmOS document 16521>0 string >\0 "%s" 1652260 string ToRaTRPW TomeRaider PalmOS document 16523>0 string >\0 "%s" 16524 16525# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 16526# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 16527# annotations. 16528# For other versions, just outputs version. 16529# 1653060 string zTXT A GutenPalm zTXT e-book 16531>0 string >\0 "%s" 16532>(0x4E.L) byte 0 16533>>(0x4E.L+1) byte x (v0.%02d) 16534>(0x4E.L) byte 1 16535>>(0x4E.L+1) byte x (v1.%02d) 16536>>>(0x4E.L+10) beshort >0 16537>>>>(0x4E.L+10) beshort <2 - 1 bookmark 16538>>>>(0x4E.L+10) beshort >1 - %d bookmarks 16539>>>(0x4E.L+14) beshort >0 16540>>>>(0x4E.L+14) beshort <2 - 1 annotation 16541>>>>(0x4E.L+14) beshort >1 - %d annotations 16542>(0x4E.L) byte >1 (v%d. 16543>>(0x4E.L+1) byte x %02d) 16544 16545# Palm OS .prc file types 1654660 string libr 16547# flags, only bit 0 or bit 6 16548# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29 16549# http://web.mit.edu/tytso/www/pilot/prc-format.html 16550>0x20 beshort&0xffbe 0 16551>>0 string >\0 Palm OS dynamic library data "%s" 1655260 string ptch Palm OS operating system patch data 16553>0 string >\0 "%s" 16554 16555# Mobipocket (www.mobipocket.com), donated by Carl Witty 1655660 string BOOKMOBI Mobipocket E-book 16557>0 string >\0 "%s" 16558 16559#------------------------------------------------------------------------------ 16560# $File$ 16561# 16562# Parix COFF executables 16563# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 16564# 165650 beshort&0xfff 0xACE PARIX 16566>0 byte&0xf0 0x80 T800 16567>0 byte&0xf0 0x90 T9000 16568>19 byte&0x02 0x02 executable 16569>19 byte&0x02 0x00 object 16570>19 byte&0x0c 0x00 not stripped 16571#------------------------------------------------------------------------------ 16572# $File$ 16573# parrot: file(1) magic for Parrot Virtual Machine 16574# URL: http://www.lua.org/ 16575# From: Lubomir Rintel <lkundrak@v3.sk> 16576 16577# Compiled Parrot byte code 165780 string \376PBC\r\n\032\n Parrot bytecode 16579>64 byte x %d. 16580>72 byte x \b%d, 16581>8 byte >0 %d byte words, 16582>16 byte 0 little-endian, 16583>16 byte 1 big-endian, 16584>32 byte 0 IEEE-754 8 byte double floats, 16585>32 byte 1 x86 12 byte long double floats, 16586>32 byte 2 IEEE-754 16 byte long double floats, 16587>32 byte 3 MIPS 16 byte long double floats, 16588>32 byte 4 AIX 16 byte long double floats, 16589>32 byte 5 4-byte floats, 16590>40 byte x Parrot %d. 16591>48 byte x \b%d. 16592>56 byte x \b%d 16593#------------------------------------------------------------------------------ 16594# $File: pascal,v 1.1 2011/12/08 12:12:46 rrt Exp $ 16595# pascal: file(1) magic for Pascal source 16596# 165970 search/8192 (input, Pascal source text 16598!:mime text/x-pascal 16599#0 regex \^program Pascal source text 16600#!:mime text/x-pascal 16601#0 regex \^record Pascal source text 16602#!:mime text/x-pascal 16603 16604#------------------------------------------------------------------------------ 16605# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 16606# file(1) magic(5) data for OpenStreetMap 16607 16608# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 16609# http://wiki.openstreetmap.org/wiki/PBF_Format 16610# From: Markus Heidelberg <markus.heidelberg@web.de> 166110 belong 0x0000000D 16612>4 beshort 0x0A09 16613>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 16614 16615#------------------------------------------------------------------------------ 16616# $File$ 16617# pbm: file(1) magic for Portable Bitmap files 16618# 16619# XXX - byte order? 16620# 166210 short 0x2a17 "compact bitmap" format (Poskanzer) 16622 16623#------------------------------------------------------------------------------ 16624# $File: pdf,v 1.7 2013/08/22 07:47:26 christos Exp $ 16625# pdf: file(1) magic for Portable Document Format 16626# 16627 166280 string %PDF- PDF document 16629!:mime application/pdf 16630>5 byte x \b, version %c 16631>7 byte x \b.%c 16632 166330 string \012%PDF- PDF document 16634!:mime application/pdf 16635>6 byte x \b, version %c 16636>8 byte x \b.%c 16637 16638# From: Nick Schmalenberger <nick@schmalenberger.us> 16639# Forms Data Format 166400 string %FDF- FDF document 16641!:mime application/vnd.fdf 16642>5 byte x \b, version %c 16643>7 byte x \b.%c 16644 16645#------------------------------------------------------------------------------ 16646# $File: pdp,v 1.9 2013/04/19 20:11:43 christos Exp $ 16647# pdp: file(1) magic for PDP-11 executable/object and APL workspace 16648# 166490 lelong 0101555 PDP-11 single precision APL workspace 166500 lelong 0101554 PDP-11 double precision APL workspace 16651# 16652# PDP-11 a.out 16653# 166540 leshort 0407 PDP-11 executable 16655>8 leshort >0 not stripped 16656>15 byte >0 - version %d 16657 16658# updated by Joerg Jenderek at Mar 2013 16659# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 166600 leshort 0401 16661# skip *.PNF with WinDirPathOffset 58h 16662>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 16663# skip *.PNF with high byte of InfVersionDatumCount zero 16664#>>15 byte !0 PDP-11 UNIX/RT ldp 166650 leshort 0405 PDP-11 old overlay 16666 166670 leshort 0410 PDP-11 pure executable 16668>8 leshort >0 not stripped 16669>15 byte >0 - version %d 16670 166710 leshort 0411 PDP-11 separate I&D executable 16672>8 leshort >0 not stripped 16673>15 byte >0 - version %d 16674 166750 leshort 0437 PDP-11 kernel overlay 16676 16677# These last three are derived from 2.11BSD file(1) 166780 leshort 0413 PDP-11 demand-paged pure executable 16679>8 leshort >0 not stripped 16680 166810 leshort 0430 PDP-11 overlaid pure executable 16682>8 leshort >0 not stripped 16683 166840 leshort 0431 PDP-11 overlaid separate executable 16685>8 leshort >0 not stripped 16686#------------------------------------------------------------------------------ 16687# $File: perl,v 1.22 2014/04/28 12:04:35 christos Exp $ 16688# perl: file(1) magic for Larry Wall's perl language. 16689# 16690# The `eval' lines recognizes an outrageously clever hack. 16691# Keith Waclena <keith@cerberus.uchicago.edu> 16692# Send additions to <perl5-porters@perl.org> 166930 search/1 eval\ "exec\ /bin/perl Perl script text 16694!:mime text/x-perl 166950 search/1 eval\ "exec\ /usr/bin/perl Perl script text 16696!:mime text/x-perl 166970 search/1 eval\ "exec\ /usr/local/bin/perl Perl script text 16698!:mime text/x-perl 166990 search/1 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 16700!:mime text/x-perl 167010 search/1 #!/usr/bin/env\ perl Perl script text executable 16702!:mime text/x-perl 167030 search/1 #!\ /usr/bin/env\ perl Perl script text executable 16704!:mime text/x-perl 167050 search/1 #! 16706>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable 16707!:mime text/x-perl 16708 16709# by Dmitry V. Levin and Alexey Tourbin 16710# check the first line 167110 search/1 package 16712>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 16713!:strength + 10 16714# not 'p', check other lines 167150 search/1 !p 16716>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 16717>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 16718!:strength + 10 16719 16720# Perl POD documents 16721# From: Tom Hukins <tom@eborcom.com> 167220 search/1/W \=pod\n Perl POD document text 167230 search/1/W \n\=pod\n Perl POD document text 167240 search/1/W \=head1\ Perl POD document text 167250 search/1/W \n\=head1\ Perl POD document text 167260 search/1/W \=head2\ Perl POD document text 167270 search/1/W \n\=head2\ Perl POD document text 167280 search/1/W \=encoding\ Perl POD document text 167290 search/1/W \n\=encoding\ Perl POD document text 16730 16731 16732# Perl Storable data files. 167330 string perl-store perl Storable (v0.6) data 16734>4 byte >0 (net-order %d) 16735>>4 byte &01 (network-ordered) 16736>>4 byte =3 (major 1) 16737>>4 byte =2 (major 1) 16738 167390 string pst0 perl Storable (v0.7) data 16740>4 byte >0 16741>>4 byte &01 (network-ordered) 16742>>4 byte =5 (major 2) 16743>>4 byte =4 (major 2) 16744>>5 byte >0 (minor %d) 16745 16746# This is Debian #742949 by Zefram <zefram@fysh.org>: 16747# ----------------------------------------------------------- 16748# The Perl module Hash::SharedMem 16749# <https://metacpan.org/release/Hash-SharedMem> defines a file format 16750# for a key/value store. Details of the file format are in the "DESIGN" 16751# file in the module distribution. Magic: 167520 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian 16753>8 bequad <0x1000000 16754>>15 byte >2 \b, line size 2^%d byte 16755>>14 byte >2 \b, page size 2^%d byte 16756>>13 byte &1 16757>>>13 byte >1 \b, max fanout %d 167580 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian 16759>8 lequad <0x1000000 16760>>8 byte >2 \b, line size 2^%d byte 16761>>9 byte >2 \b, page size 2^%d byte 16762>>10 byte &1 16763>>>10 byte >1 \b, max fanout %d 167640 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian 16765>8 bequad <0x1000000 16766>>15 byte >2 \b, line size 2^%d byte 16767>>14 byte >2 \b, page size 2^%d byte 16768>>13 byte &1 16769>>>13 byte >1 \b, max fanout %d 167700 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian 16771>8 lequad <0x1000000 16772>>8 byte >2 \b, line size 2^%d byte 16773>>9 byte >2 \b, page size 2^%d byte 16774>>10 byte &1 16775>>>10 byte >1 \b, max fanout %d 16776 16777#------------------------------------------------------------------------------ 16778# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $ 16779# pgf: file(1) magic for Progressive Graphics File (PGF) 16780# 16781# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf> 16782# 2013 by Philipp Hahn <pmhahn debian org> 167830 string PGF Progressive Graphics image data, 16784!:mime image/x-pgf 16785>3 string 2 version %s, 16786>3 string 4 version %s, 16787>3 string 5 version %s, 16788>3 string 6 version %s, 16789# PGFPreHeader 16790#>>4 lelong x header size %d, 16791# PGFHeader 16792>>8 lelong x %d x 16793>>12 lelong x %d, 16794>>16 byte x %d levels, 16795>>17 byte x compression level %d, 16796>>18 byte x %d bpp, 16797>>19 byte x %d channels, 16798>>20 clear x 16799>>20 byte 0 bitmap, 16800>>20 byte 1 gray scale, 16801>>20 byte 2 indexed color, 16802>>20 byte 3 RGB color, 16803>>20 byte 4 CYMK color, 16804>>20 byte 5 HSL color, 16805>>20 byte 6 HSB color, 16806>>20 byte 7 multi-channel, 16807>>20 byte 8 duo tone, 16808>>20 byte 9 LAB color, 16809>>20 byte 10 gray scale 16, 16810>>20 byte 11 RGB color 48, 16811>>20 byte 12 LAB color 48, 16812>>20 byte 13 CYMK color 64, 16813>>20 byte 14 deep multi-channel, 16814>>20 byte 15 duo tone 16, 16815>>20 byte 17 RGBA color, 16816>>20 byte 18 gray scale 32, 16817>>20 byte 19 RGB color 12, 16818>>20 byte 20 RGB color 16, 16819>>20 byte 255 unknown format, 16820>>20 default x format 16821>>>20 byte x \b %d, 16822>>21 byte x %d bpc 16823# PGFPostHeader 16824# Level-Sizes 16825#>>(4.l+4) lelong x level 0 size: %d 16826#>>(4.l+8) lelong x level 1 size: %d 16827#>>(4.l+12) lelong x level 2 size: %d 16828 16829#------------------------------------------------------------------------------ 16830# $File: pgp,v 1.10 2014/10/14 16:50:37 christos Exp $ 16831# pgp: file(1) magic for Pretty Good Privacy 16832# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 16833# 168340 beshort 0x9900 PGP key public ring 16835!:mime application/x-pgp-keyring 168360 beshort 0x9501 PGP key security ring 16837!:mime application/x-pgp-keyring 168380 beshort 0x9500 PGP key security ring 16839!:mime application/x-pgp-keyring 168400 beshort 0xa600 PGP encrypted data 16841#!:mime application/pgp-encrypted 16842#0 string -----BEGIN\040PGP text/PGP armored data 16843!:mime text/PGP # encoding: armored data 16844#>15 string PUBLIC\040KEY\040BLOCK- public key block 16845#>15 string MESSAGE- message 16846#>15 string SIGNED\040MESSAGE- signed message 16847#>15 string PGP\040SIGNATURE- signature 16848 168492 string ---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK- PGP public key block 16850!:mime application/pgp-keys 16851>10 search/100 \n\n 16852>>&0 use pgp 168530 string -----BEGIN\040PGP\40MESSAGE- PGP message 16854!:mime application/pgp 16855>10 search/100 \n\n 16856>>&0 use pgp 168570 string -----BEGIN\040PGP\40SIGNATURE- PGP signature 16858!:mime application/pgp-signature 16859>10 search/100 \n\n 16860>>&0 use pgp 16861 16862# Decode the type of the packet based on it's base64 encoding. 16863# Idea from Mark Martinec 16864# The specification is in RFC 4880, section 4.2 and 4.3: 16865# http://tools.ietf.org/html/rfc4880#section-4.2 16866 168670 name pgp 16868>0 byte 0x67 Reserved (old) 16869>0 byte 0x68 Public-Key Encrypted Session Key (old) 16870>0 byte 0x69 Signature (old) 16871>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 16872>0 byte 0x6b One-Pass Signature (old) 16873>0 byte 0x6c Secret-Key (old) 16874>0 byte 0x6d Public-Key (old) 16875>0 byte 0x6e Secret-Subkey (old) 16876>0 byte 0x6f Compressed Data (old) 16877>0 byte 0x70 Symmetrically Encrypted Data (old) 16878>0 byte 0x71 Marker (old) 16879>0 byte 0x72 Literal Data (old) 16880>0 byte 0x73 Trust (old) 16881>0 byte 0x74 User ID (old) 16882>0 byte 0x75 Public-Subkey (old) 16883>0 byte 0x76 Unused (old) 16884>0 byte 0x77 16885>>1 byte&0xc0 0x00 Reserved 16886>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 16887>>1 byte&0xc0 0x80 Signature 16888>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 16889>0 byte 0x78 16890>>1 byte&0xc0 0x00 One-Pass Signature 16891>>1 byte&0xc0 0x40 Secret-Key 16892>>1 byte&0xc0 0x80 Public-Key 16893>>1 byte&0xc0 0xc0 Secret-Subkey 16894>0 byte 0x79 16895>>1 byte&0xc0 0x00 Compressed Data 16896>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 16897>>1 byte&0xc0 0x80 Marker 16898>>1 byte&0xc0 0xc0 Literal Data 16899>0 byte 0x7a 16900>>1 byte&0xc0 0x00 Trust 16901>>1 byte&0xc0 0x40 User ID 16902>>1 byte&0xc0 0x80 Public-Subkey 16903>>1 byte&0xc0 0xc0 Unused [z%x] 16904>0 byte 0x30 16905>>1 byte&0xc0 0x00 Unused [0%x] 16906>>1 byte&0xc0 0x40 User Attribute 16907>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 16908>>1 byte&0xc0 0xc0 Modification Detection Code 16909 16910# magic signatures to detect PGP crypto material (from stef) 16911# detects and extracts metadata from: 16912# - symmetric encrypted packet header 16913# - RSA (e=65537) secret (sub-)keys 16914 16915# 1024b RSA encrypted data 16916 169170 string \x84\x8c\x03 PGP RSA encrypted session key - 16918>3 lelong x keyid: %X 16919>7 lelong x %X 16920>11 byte 0x01 RSA (Encrypt or Sign) 1024b 16921>11 byte 0x02 RSA Encrypt-Only 1024b 16922>12 string \x04\x00 16923>12 string \x03\xff 16924>12 string \x03\xfe 16925>12 string \x03\xfd 16926>12 string \x03\xfc 16927>12 string \x03\xfb 16928>12 string \x03\xfa 16929>12 string \x03\xf9 16930>142 byte 0xd2 . 16931 16932# 2048b RSA encrypted data 16933 169340 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 16935>4 lelong x keyid: %X 16936>8 lelong x %X 16937>12 byte 0x01 RSA (Encrypt or Sign) 2048b 16938>12 byte 0x02 RSA Encrypt-Only 2048b 16939>13 string \x08\x00 16940>13 string \x07\xff 16941>13 string \x07\xfe 16942>13 string \x07\xfd 16943>13 string \x07\xfc 16944>13 string \x07\xfb 16945>13 string \x07\xfa 16946>13 string \x07\xf9 16947>271 byte 0xd2 . 16948 16949# 3072b RSA encrypted data 16950 169510 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 16952>4 lelong x keyid: %X 16953>8 lelong x %X 16954>12 byte 0x01 RSA (Encrypt or Sign) 3072b 16955>12 byte 0x02 RSA Encrypt-Only 3072b 16956>13 string \x0c\x00 16957>13 string \x0b\xff 16958>13 string \x0b\xfe 16959>13 string \x0b\xfd 16960>13 string \x0b\xfc 16961>13 string \x0b\xfb 16962>13 string \x0b\xfa 16963>13 string \x0b\xf9 16964>399 byte 0xd2 . 16965 16966# 3072b RSA encrypted data 16967 169680 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 16969>4 lelong x keyid: %X 16970>8 lelong x %X 16971>12 byte 0x01 RSA (Encrypt or Sign) 4096b 16972>12 byte 0x02 RSA Encrypt-Only 4096b 16973>13 string \x10\x00 16974>13 string \x0f\xff 16975>13 string \x0f\xfe 16976>13 string \x0f\xfd 16977>13 string \x0f\xfc 16978>13 string \x0f\xfb 16979>13 string \x0f\xfa 16980>13 string \x0f\xf9 16981>527 byte 0xd2 . 16982 16983# 4096b RSA encrypted data 16984 169850 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 16986>4 lelong x keyid: %X 16987>8 lelong x %X 16988>12 byte 0x01 RSA (Encrypt or Sign) 8129b 16989>12 byte 0x02 RSA Encrypt-Only 8129b 16990>13 string \x20\x00 16991>13 string \x1f\xff 16992>13 string \x1f\xfe 16993>13 string \x1f\xfd 16994>13 string \x1f\xfc 16995>13 string \x1f\xfb 16996>13 string \x1f\xfa 16997>13 string \x1f\xf9 16998>1039 byte 0xd2 . 16999 17000# crypto algo mapper 17001 170020 name crypto 17003>0 byte 0x00 Plaintext or unencrypted data 17004>0 byte 0x01 IDEA 17005>0 byte 0x02 TripleDES 17006>0 byte 0x03 CAST5 (128 bit key) 17007>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 17008>0 byte 0x07 AES with 128-bit key 17009>0 byte 0x08 AES with 192-bit key 17010>0 byte 0x09 AES with 256-bit key 17011>0 byte 0x0a Twofish with 256-bit key 17012 17013# hash algo mapper 17014 170150 name hash 17016>0 byte 0x01 MD5 17017>0 byte 0x02 SHA-1 17018>0 byte 0x03 RIPE-MD/160 17019>0 byte 0x08 SHA256 17020>0 byte 0x09 SHA384 17021>0 byte 0x0a SHA512 17022>0 byte 0x0b SHA224 17023 17024# pgp symmetric encrypted data 17025 170260 byte 0x8c PGP symmetric key encrypted data - 17027>1 byte 0x0d 17028>1 byte 0x0c 17029>2 byte 0x04 17030>3 use crypto 17031>4 byte 0x01 salted - 17032>>5 use hash 17033>>14 byte 0xd2 . 17034>>14 byte 0xc9 . 17035>4 byte 0x03 salted & iterated - 17036>>5 use hash 17037>>15 byte 0xd2 . 17038>>15 byte 0xc9 . 17039 17040# encrypted keymaterial needs s2k & can be checksummed/hashed 17041 170420 name chkcrypto 17043>0 use crypto 17044>1 byte 0x00 Simple S2K 17045>1 byte 0x01 Salted S2K 17046>1 byte 0x03 Salted&Iterated S2K 17047>2 use hash 17048 17049# all PGP keys start with this prolog 17050# containing version, creation date, and purpose 17051 170520 name keyprolog 17053>0 byte 0x04 17054>1 beldate x created on %s - 17055>5 byte 0x01 RSA (Encrypt or Sign) 17056>5 byte 0x02 RSA Encrypt-Only 17057 17058# end of secret keys known signature 17059# contains e=65537 and the prolog to 17060# the encrypted parameters 17061 170620 name keyend 17063>0 string \x00\x11\x01\x00\x01 e=65537 17064>5 use crypto 17065>5 byte 0xff checksummed 17066>>6 use chkcrypto 17067>5 byte 0xfe hashed 17068>>6 use chkcrypto 17069 17070# PGP secret keys contain also the public parts 17071# these vary by bitsize of the key 17072 170730 name x1024 17074>0 use keyprolog 17075>6 string \x03\xfe 17076>6 string \x03\xff 17077>6 string \x04\x00 17078>136 use keyend 17079 170800 name x2048 17081>0 use keyprolog 17082>6 string \x80\x00 17083>6 string \x07\xfe 17084>6 string \x07\xff 17085>264 use keyend 17086 170870 name x3072 17088>0 use keyprolog 17089>6 string \x0b\xfe 17090>6 string \x0b\xff 17091>6 string \x0c\x00 17092>392 use keyend 17093 170940 name x4096 17095>0 use keyprolog 17096>6 string \x10\x00 17097>6 string \x0f\xfe 17098>6 string \x0f\xff 17099>520 use keyend 17100 17101# \x00|\x1f[\xfe\xff]).{1024})' 171020 name x8192 17103>0 use keyprolog 17104>6 string \x20\x00 17105>6 string \x1f\xfe 17106>6 string \x1f\xff 17107>1032 use keyend 17108 17109# depending on the size of the pkt 17110# we branch into the proper key size 17111# signatures defined as x{keysize} 17112 17113>0 name pgpkey 17114>0 string \x01\xd8 1024b 17115>>2 use x1024 17116>0 string \x01\xeb 1024b 17117>>2 use x1024 17118>0 string \x01\xfb 1024b 17119>>2 use x1024 17120>0 string \x01\xfd 1024b 17121>>2 use x1024 17122>0 string \x01\xf3 1024b 17123>>2 use x1024 17124>0 string \x01\xee 1024b 17125>>2 use x1024 17126>0 string \x01\xfe 1024b 17127>>2 use x1024 17128>0 string \x01\xf4 1024b 17129>>2 use x1024 17130>0 string \x02\x0d 1024b 17131>>2 use x1024 17132>0 string \x02\x03 1024b 17133>>2 use x1024 17134>0 string \x02\x05 1024b 17135>>2 use x1024 17136>0 string \x02\x15 1024b 17137>>2 use x1024 17138>0 string \x02\x00 1024b 17139>>2 use x1024 17140>0 string \x02\x10 1024b 17141>>2 use x1024 17142>0 string \x02\x04 1024b 17143>>2 use x1024 17144>0 string \x02\x06 1024b 17145>>2 use x1024 17146>0 string \x02\x16 1024b 17147>>2 use x1024 17148>0 string \x03\x98 2048b 17149>>2 use x2048 17150>0 string \x03\xab 2048b 17151>>2 use x2048 17152>0 string \x03\xbb 2048b 17153>>2 use x2048 17154>0 string \x03\xbd 2048b 17155>>2 use x2048 17156>0 string \x03\xcd 2048b 17157>>2 use x2048 17158>0 string \x03\xb3 2048b 17159>>2 use x2048 17160>0 string \x03\xc3 2048b 17161>>2 use x2048 17162>0 string \x03\xc5 2048b 17163>>2 use x2048 17164>0 string \x03\xd5 2048b 17165>>2 use x2048 17166>0 string \x03\xae 2048b 17167>>2 use x2048 17168>0 string \x03\xbe 2048b 17169>>2 use x2048 17170>0 string \x03\xc0 2048b 17171>>2 use x2048 17172>0 string \x03\xd0 2048b 17173>>2 use x2048 17174>0 string \x03\xb4 2048b 17175>>2 use x2048 17176>0 string \x03\xc4 2048b 17177>>2 use x2048 17178>0 string \x03\xc6 2048b 17179>>2 use x2048 17180>0 string \x03\xd6 2048b 17181>>2 use x2048 17182>0 string \x05X 3072b 17183>>2 use x3072 17184>0 string \x05k 3072b 17185>>2 use x3072 17186>0 string \x05{ 3072b 17187>>2 use x3072 17188>0 string \x05} 3072b 17189>>2 use x3072 17190>0 string \x05\x8d 3072b 17191>>2 use x3072 17192>0 string \x05s 3072b 17193>>2 use x3072 17194>0 string \x05\x83 3072b 17195>>2 use x3072 17196>0 string \x05\x85 3072b 17197>>2 use x3072 17198>0 string \x05\x95 3072b 17199>>2 use x3072 17200>0 string \x05n 3072b 17201>>2 use x3072 17202>0 string \x05\x7e 3072b 17203>>2 use x3072 17204>0 string \x05\x80 3072b 17205>>2 use x3072 17206>0 string \x05\x90 3072b 17207>>2 use x3072 17208>0 string \x05t 3072b 17209>>2 use x3072 17210>0 string \x05\x84 3072b 17211>>2 use x3072 17212>0 string \x05\x86 3072b 17213>>2 use x3072 17214>0 string \x05\x96 3072b 17215>>2 use x3072 17216>0 string \x07[ 4096b 17217>>2 use x4096 17218>0 string \x07\x18 4096b 17219>>2 use x4096 17220>0 string \x07+ 4096b 17221>>2 use x4096 17222>0 string \x07; 4096b 17223>>2 use x4096 17224>0 string \x07= 4096b 17225>>2 use x4096 17226>0 string \x07M 4096b 17227>>2 use x4096 17228>0 string \x073 4096b 17229>>2 use x4096 17230>0 string \x07C 4096b 17231>>2 use x4096 17232>0 string \x07E 4096b 17233>>2 use x4096 17234>0 string \x07U 4096b 17235>>2 use x4096 17236>0 string \x07. 4096b 17237>>2 use x4096 17238>0 string \x07> 4096b 17239>>2 use x4096 17240>0 string \x07@ 4096b 17241>>2 use x4096 17242>0 string \x07P 4096b 17243>>2 use x4096 17244>0 string \x074 4096b 17245>>2 use x4096 17246>0 string \x07D 4096b 17247>>2 use x4096 17248>0 string \x07F 4096b 17249>>2 use x4096 17250>0 string \x07V 4096b 17251>>2 use x4096 17252>0 string \x0e[ 8192b 17253>>2 use x8192 17254>0 string \x0e\x18 8192b 17255>>2 use x8192 17256>0 string \x0e+ 8192b 17257>>2 use x8192 17258>0 string \x0e; 8192b 17259>>2 use x8192 17260>0 string \x0e= 8192b 17261>>2 use x8192 17262>0 string \x0eM 8192b 17263>>2 use x8192 17264>0 string \x0e3 8192b 17265>>2 use x8192 17266>0 string \x0eC 8192b 17267>>2 use x8192 17268>0 string \x0eE 8192b 17269>>2 use x8192 17270>0 string \x0eU 8192b 17271>>2 use x8192 17272>0 string \x0e. 8192b 17273>>2 use x8192 17274>0 string \x0e> 8192b 17275>>2 use x8192 17276>0 string \x0e@ 8192b 17277>>2 use x8192 17278>0 string \x0eP 8192b 17279>>2 use x8192 17280>0 string \x0e4 8192b 17281>>2 use x8192 17282>0 string \x0eD 8192b 17283>>2 use x8192 17284>0 string \x0eF 8192b 17285>>2 use x8192 17286>0 string \x0eV 8192b 17287>>2 use x8192 17288 17289# PGP RSA (e=65537) secret (sub-)key header 17290 172910 byte 0x95 PGP Secret Key - 17292>1 use pgpkey 172930 byte 0x97 PGP Secret Sub-key - 17294>1 use pgpkey 172950 byte 0x9d PGP Secret Sub-key - 17296>1 use pgpkey 17297 17298#------------------------------------------------------------------------------ 17299# $File$ 17300# pkgadd: file(1) magic for SysV R4 PKG Datastreams 17301# 173020 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 17303!:mime application/x-svr4-package 17304 17305#------------------------------------------------------------------------------ 17306# $File$ 17307# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 17308# From: "Stefan A. Haubenthal" <polluks@web.de> 17309# 173100 belong 0x00000107 Plan 9 executable, Motorola 68k 173110 belong 0x000001EB Plan 9 executable, Intel 386 173120 belong 0x00000247 Plan 9 executable, Intel 960 173130 belong 0x000002AB Plan 9 executable, SPARC 173140 belong 0x00000407 Plan 9 executable, MIPS R3000 173150 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 173160 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 173170 belong 0x000005AB Plan 9 executable, AMD 29000 173180 belong 0x00000647 Plan 9 executable, ARM 7-something 173190 belong 0x000006EB Plan 9 executable, PowerPC 173200 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 173210 belong 0x0000084B Plan 9 executable, DEC Alpha 17322 17323#------------------------------------------------------------------------------ 17324# $File$ 17325# plus5: file(1) magic for Plus Five's UNIX MUMPS 17326# 17327# XXX - byte order? Paging Hokey.... 17328# 173290 short 0x259 mumps avl global 17330>2 byte >0 (V%d) 17331>6 byte >0 with %d byte name 17332>7 byte >0 and %d byte data cells 173330 short 0x25a mumps blt global 17334>2 byte >0 (V%d) 17335>8 short >0 - %d byte blocks 17336>15 byte 0x00 - P/D format 17337>15 byte 0x01 - P/K/D format 17338>15 byte 0x02 - K/D format 17339>15 byte >0x02 - Bad Flags 17340 17341#------------------------------------------------------------------------------ 17342# $File: printer,v 1.25 2011/05/20 23:31:46 christos Exp $ 17343# printer: file(1) magic for printer-formatted files 17344# 17345 17346# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 173470 string %! PostScript document text 17348!:mime application/postscript 17349!:apple ASPSTEXT 17350>2 string PS-Adobe- conforming 17351>>11 string >\0 DSC level %.3s 17352>>>15 string EPS \b, type %s 17353>>>15 string Query \b, type %s 17354>>>15 string ExitServer \b, type %s 17355>>>15 search/1000 %%LanguageLevel:\ 17356>>>>&0 string >\0 \b, Level %s 17357# Some PCs have the annoying habit of adding a ^D as a document separator 173580 string \004%! PostScript document text 17359!:mime application/postscript 17360!:apple ASPSTEXT 17361>3 string PS-Adobe- conforming 17362>>12 string >\0 DSC level %.3s 17363>>>16 string EPS \b, type %s 17364>>>16 string Query \b, type %s 17365>>>16 string ExitServer \b, type %s 17366>>>16 search/1000 %%LanguageLevel:\ 17367>>>>&0 string >\0 \b, Level %s 173680 string \033%-12345X%!PS PostScript document 17369 17370# DOS EPS Binary File Header 17371# From: Ed Sznyter <ews@Black.Market.NET> 173720 belong 0xC5D0D3C6 DOS EPS Binary File 17373>4 long >0 Postscript starts at byte %d 17374>>8 long >0 length %d 17375>>>12 long >0 Metafile starts at byte %d 17376>>>>16 long >0 length %d 17377>>>20 long >0 TIFF starts at byte %d 17378>>>>24 long >0 length %d 17379 17380# Summary: Adobe's PostScript Printer Description File 17381# Extension: .ppd 17382# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 17383# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 17384# 173850 string *PPD-Adobe:\x20 PPD file 17386>&0 string x \b, version %s 17387 17388# HP Printer Job Language 173890 string \033%-12345X@PJL HP Printer Job Language data 17390# HP Printer Job Language 17391# The header found on Win95 HP plot files is the "Silliest Thing possible" 17392# (TM) 17393# Every driver puts the language at some random position, with random case 17394# (LANGUAGE and Language) 17395# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 17396# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 17397# 173980 string \033%-12345X@PJL HP Printer Job Language data 17399>&0 string >\0 %s 17400>>&0 string >\0 %s 17401>>>&0 string >\0 %s 17402>>>>&0 string >\0 %s 17403#>15 string \ ENTER\ LANGUAGE\ = 17404#>31 string PostScript PostScript 17405 17406# From: Stefan Thurner <thurners@nicsys.de> 174070 string \033%-12345X@PJL 17408>&0 search/10000 %! PJL encapsulated PostScript document text 17409 17410# Rick Richardson <rickrich@gmail.com> 17411 17412# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language 17413# For Oki Data Printers - HIPERC 17414# For Konica Minolta Printers - LAVAFLOW 17415# For Samsung Printers - QPDL 17416# For HP Printers - ZJS stands for Zenographics ZJStream 174170 string \033%-12345X@PJL HP Printer Job Language data 17418>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL 17419>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC 17420>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW 17421>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL 17422>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL 17423>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS 17424 17425 17426# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 174270 string \033E\033 HP PCL printer data 17428>3 string \&l0A - default page size 17429>3 string \&l1A - US executive page size 17430>3 string \&l2A - US letter page size 17431>3 string \&l3A - US legal page size 17432>3 string \&l26A - A4 page size 17433>3 string \&l80A - Monarch envelope size 17434>3 string \&l81A - No. 10 envelope size 17435>3 string \&l90A - Intl. DL envelope size 17436>3 string \&l91A - Intl. C5 envelope size 17437>3 string \&l100A - Intl. B5 envelope size 17438>3 string \&l-81A - No. 10 envelope size (landscape) 17439>3 string \&l-90A - Intl. DL envelope size (landscape) 17440 17441# IMAGEN printer-ready files: 174420 string @document( Imagen printer 17443# this only works if "language xxx" is first item in Imagen header. 17444>10 string language\ impress (imPRESS data) 17445>10 string language\ daisy (daisywheel text) 17446>10 string language\ diablo (daisywheel text) 17447>10 string language\ printer (line printer emulation) 17448>10 string language\ tektronix (Tektronix 4014 emulation) 17449# Add any other languages that your Imagen uses - remember 17450# to keep the word `text' if the file is human-readable. 17451# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 17452# 17453# Now magic for IMAGEN font files... 174540 string Rast RST-format raster font data 17455>45 string >0 face %s 17456# From Jukka Ukkonen 174570 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 17458 17459# From <mike@flyn.org> 17460# These are the /etc/magic entries to decode data sent to an Epson printer. 174610 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 17462 17463 17464#------------------------------------------------------------------------------ 17465# zenographics: file(1) magic for Zenographics ZjStream printer data 17466# Rick Richardson <rickrich@gmail.com> 174670 string JZJZ 17468>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 174690 string ZJZJ 17470>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 17471 17472 17473#------------------------------------------------------------------------------ 17474# Oak Technologies printer stream 17475# Rick Richardson <rickrich@gmail.com> 174760 string OAK 17477>0x07 byte 0 17478>0x0b byte 0 Oak Technologies printer stream 17479 17480# This would otherwise be recognized as PostScript - nick@debian.org 174810 string %!VMF SunClock's Vector Map Format data 17482 17483#------------------------------------------------------------------------------ 17484# HP LaserJet 1000 series downloadable firmware file 174850 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 17486 17487# From: Paolo <oopla@users.sf.net> 17488# Epson ESC/Page, ESC/PageColor 174890 string \x1b\x01@EJL Epson ESC/Page language printer data 17490 17491#------------------------------------------------------------------------------ 17492# $File$ 17493# project: file(1) magic for Project management 17494# 17495# Magic strings for ftnchek project files. Alexander Mai 174960 string FTNCHEK_\ P project file for ftnchek 17497>10 string 1 version 2.7 17498>10 string 2 version 2.8 to 2.10 17499>10 string 3 version 2.11 or later 17500 17501#------------------------------------------------------------------------------ 17502# $File$ 17503# psdbms: file(1) magic for psdatabase 17504# 175050 belong&0xff00ffff 0x56000000 ps database 17506>1 string >\0 version %s 17507>4 string >\0 from kernel %s 17508 17509#------------------------------------------------------------------------------ 17510# $File$ 17511# pulsar: file(1) magic for Pulsar POP3 daemon binary files 17512# 17513# http://pulsar.sourceforge.net 17514# mailto:rok.papez@lugos.si 17515# 17516 175170 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 17518>4 ubelong x Version: %d. 17519>8 ubelong x \b%d 17520 17521 17522#------------------------------------------------------------------------------ 17523# $File: vax,v 1.7 2009/09/19 16:28:13 christos Exp $ 17524# pwsafe: file(1) magic for passwordsafe file 17525# 17526# Password Safe 17527# http://passwordsafe.sourceforge.net/ 17528# file format specs 17529# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 17530# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 17531# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 17532# V2 and V1 have no easy identifier that I can find 17533# .psafe3 175340 string PWS3 Password Safe V3 database 17535 17536#------------------------------------------------------------------------------ 17537# $File$ 17538# pyramid: file(1) magic for Pyramids 17539# 17540# XXX - byte order? 17541# 175420 long 0x50900107 Pyramid 90x family executable 175430 long 0x50900108 Pyramid 90x family pure executable 17544>16 long >0 not stripped 175450 long 0x5090010b Pyramid 90x family demand paged pure executable 17546>16 long >0 not stripped 17547 17548#------------------------------------------------------------------------------ 17549# $File: python,v 1.25 2014/05/06 16:08:32 christos Exp $ 17550# python: file(1) magic for python 17551# 17552# Outlook puts """ too for urgent messages 17553# From: David Necas <yeti@physics.muni.cz> 17554# often the module starts with a multiline string 175550 string/t """ Python script text executable 17556# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming 17557# that Py_UnicodeFlag is off for Python 2) 17558# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n" 175590 belong 0x994e0d0a python 1.5/1.6 byte-compiled 175600 belong 0x87c60d0a python 2.0 byte-compiled 175610 belong 0x2aeb0d0a python 2.1 byte-compiled 175620 belong 0x2ded0d0a python 2.2 byte-compiled 175630 belong 0x3bf20d0a python 2.3 byte-compiled 175640 belong 0x6df20d0a python 2.4 byte-compiled 175650 belong 0xb3f20d0a python 2.5 byte-compiled 175660 belong 0xd1f20d0a python 2.6 byte-compiled 175670 belong 0x03f30d0a python 2.7 byte-compiled 175680 belong 0x3b0c0d0a python 3.0 byte-compiled 175690 belong 0x4f0c0d0a python 3.1 byte-compiled 175700 belong 0x6c0c0d0a python 3.2 byte-compiled 175710 belong 0x9e0c0d0a python 3.3 byte-compiled 175720 belong 0xee0c0d0a python 3.4 byte-compiled 17573 175740 search/1/w #!\ /usr/bin/python Python script text executable 17575!:mime text/x-python 175760 search/1/w #!\ /usr/local/bin/python Python script text executable 17577!:mime text/x-python 175780 search/1 #!/usr/bin/env\ python Python script text executable 17579!:mime text/x-python 175800 search/1 #!\ /usr/bin/env\ python Python script text executable 17581!:mime text/x-python 17582 17583 17584# from module.submodule import func1, func2 175850 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable 17586!:mime text/x-python 17587 17588# def __init__ (self, ...): 175890 search/4096 def\ __init__ 17590>&0 search/64 self Python script text executable 17591!:mime text/x-python 17592 17593# comments 17594#0 search/4096 ''' 17595#>&0 regex .*'''$ Python script text executable 17596#!:mime text/x-python 17597 17598#0 search/4096 """ 17599#>&0 regex .*"""$ Python script text executable 17600#!:mime text/x-python 17601 17602# try: 17603# except: or finally: 17604# block 176050 search/4096 try: 17606>&0 regex \^\\s*except.*: Python script text executable 17607!:mime text/x-python 17608>&0 search/4096 finally: Python script text executable 17609!:mime text/x-python 17610 17611# def name(args, args): 176120 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100} 17613>&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable 17614!:mime text/x-python 17615 17616#------------------------------------------------------------------------------ 17617# $File: qt,v 1.1 2014/12/12 16:48:39 christos Exp $ 17618# qt: file(1) magic for Qt 17619 17620# http://doc.qt.io/qt-5/resources.html 176210 string \<!DOCTYPE\040RCC\> Qt Resource Collection file 17622 17623# https://qt.gitorious.org/qt/qtbase/source/\ 17624# 5367fa356233da4c0f28172a8f817791525f5457:\ 17625# src/tools/rcc/rcc.cpp#L840 176260 string qres\0\0 Qt Binary Resource file 176270 search/1024 The\040Resource\040Compiler\040for\040Qt Qt C-code resource file 17628 17629# https://qt.gitorious.org/qt/qtbase/source/\ 17630# 5367fa356233da4c0f28172a8f817791525f5457:\ 17631# src/corelib/kernel/qtranslator.cpp#L62 176320 string \x3c\xb8\x64\x18\xca\xef\x9c\x95 17633>8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file 17634 17635#------------------------------------------------------------------------------ 17636# $File: revision,v 1.8 2010/11/25 15:00:12 christos Exp $ 17637# file(1) magic for revision control files 17638# From Hendrik Scholz <hendrik@scholz.net> 176390 string/t /1\ :pserver: cvs password text file 17640 17641# Conary changesets 17642# From: Jonathan Smith <smithj@rpath.com> 176430 belong 0xea3f81bb Conary changeset data 17644 17645# Type: Git bundles (git-bundle) 17646# From: Josh Triplett <josh@freedesktop.org> 176470 string #\ v2\ git\ bundle\n Git bundle 17648 17649# Type: Git pack 17650# From: Adam Buchbinder <adam.buchbinder@gmail.com> 17651# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 17652# those have a little-endian offset immediately following the magic 'PACK', 17653# the first byte of which is never 0, while the first byte of the Git pack 17654# version, since it's a tiny number stored in big-endian format, is always 0. 176550 string PACK\0 Git pack 17656>4 belong >0 \b, version %d 17657>>8 belong >0 \b, %d objects 17658 17659# Type: Git pack index 17660# From: Adam Buchbinder <adam.buchbinder@gmail.com> 176610 string \377tOc Git pack index 17662>4 belong =2 \b, version 2 17663 17664# Type: Git index file 17665# From: Frederic Briare <fbriere@fbriere.net> 176660 string DIRC Git index 17667>4 belong >0 \b, version %d 17668>>8 belong >0 \b, %d entries 17669 17670# Type: Mercurial bundles 17671# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 176720 string HG10 Mercurial bundle, 17673>4 string UN uncompressed 17674>4 string BZ bzip2 compressed 17675 17676# Type: Subversion (SVN) dumps 17677# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 176780 string SVN-fs-dump-format-version: Subversion dumpfile 17679>28 string >\0 (version: %s) 17680 17681# Type: Bazaar revision bundles and merge requests 17682# URL: http://www.bazaar-vcs.org/ 17683# From: Jelmer Vernooij <jelmer@samba.org> 176840 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 176850 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 17686 17687#------------------------------------------------------------------------------ 17688# $File: riff,v 1.30 2014/09/23 17:02:12 christos Exp $ 17689# riff: file(1) magic for RIFF format 17690# See 17691# 17692# http://www.seanet.com/users/matts/riffmci/riffmci.htm 17693# 17694 17695# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz 176960 name riff-wave 17697>0 leshort 1 \b, Microsoft PCM 17698>>14 leshort >0 17699>>>14 leshort <1024 \b, %d bit 17700>0 leshort 2 \b, Microsoft ADPCM 17701>0 leshort 6 \b, ITU G.711 A-law 17702>0 leshort 7 \b, ITU G.711 mu-law 17703>0 leshort 8 \b, Microsoft DTS 17704>0 leshort 17 \b, IMA ADPCM 17705>0 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 17706>0 leshort 49 \b, GSM 6.10 17707>0 leshort 64 \b, ITU G.721 ADPCM 17708>0 leshort 80 \b, MPEG 17709>0 leshort 85 \b, MPEG Layer 3 17710>0 leshort 0x2001 \b, DTS 17711>2 leshort =1 \b, mono 17712>2 leshort =2 \b, stereo 17713>2 leshort >2 17714>>2 leshort <128 \b, %d channels 17715>4 lelong >0 17716>>4 lelong <1000000 %d Hz 17717 17718# try to find "fmt " 177190 name riff-walk 17720>0 string fmt\x20 17721>>4 lelong <0x80 17722>>>8 use riff-wave 17723>0 string LIST 17724>>&(4.l+4) use riff-walk 17725>0 string DISP 17726>>&(4.l+4) use riff-walk 17727>0 string bext 17728>>&(4.l+4) use riff-walk 17729>0 string Fake 17730>>&(4.l+4) use riff-walk 17731>0 string fact 17732>>&(4.l+4) use riff-walk 17733>0 string VP8 17734>>11 byte 0x9d 17735>>>12 byte 0x01 17736>>>>13 byte 0x2a \b, VP8 encoding 17737>>>>>14 leshort&0x3fff x \b, %d 17738>>>>>16 leshort&0x3fff x \bx%d, Scaling: 17739>>>>>14 leshort&0xc000 0x0000 \b [none] 17740>>>>>14 leshort&0xc000 0x1000 \b [5/4] 17741>>>>>14 leshort&0xc000 0x2000 \b [5/3] 17742>>>>>14 leshort&0xc000 0x3000 \b [2] 17743>>>>>14 leshort&0xc000 0x0000 \bx[none] 17744>>>>>14 leshort&0xc000 0x1000 \bx[5/4] 17745>>>>>14 leshort&0xc000 0x2000 \bx[5/3] 17746>>>>>14 leshort&0xc000 0x3000 \bx[2] 17747>>>>>15 byte&0x80 =0x00 \b, YUV color 17748>>>>>15 byte&0x80 =0x80 \b, bad color specification 17749>>>>>15 byte&0x40 =0x40 \b, no clamping required 17750>>>>>15 byte&0x40 =0x00 \b, decoders should clamp 17751#>0 string x we got %s 17752#>>&(4.l+4) use riff-walk 17753 17754# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 17755# 177560 string RIFF RIFF (little-endian) data 17757# RIFF Palette format 17758>8 string PAL \b, palette 17759>>16 leshort x \b, version %d 17760>>18 leshort x \b, %d entries 17761# RIFF Device Independent Bitmap format 17762>8 string RDIB \b, device-independent bitmap 17763>>16 string BM 17764>>>30 leshort 12 \b, OS/2 1.x format 17765>>>>34 leshort x \b, %d x 17766>>>>36 leshort x %d 17767>>>30 leshort 64 \b, OS/2 2.x format 17768>>>>34 leshort x \b, %d x 17769>>>>36 leshort x %d 17770>>>30 leshort 40 \b, Windows 3.x format 17771>>>>34 lelong x \b, %d x 17772>>>>38 lelong x %d x 17773>>>>44 leshort x %d 17774# RIFF MIDI format 17775>8 string RMID \b, MIDI 17776# RIFF Multimedia Movie File format 17777>8 string RMMP \b, multimedia movie 17778# RIFF wrapper for MP3 17779>8 string RMP3 \b, MPEG Layer 3 audio 17780# Microsoft WAVE format (*.wav) 17781>8 string WAVE \b, WAVE audio 17782!:mime audio/x-wav 17783>>12 string >\0 17784>>>12 use riff-walk 17785# Corel Draw Picture 17786>8 string CDRA \b, Corel Draw Picture 17787!:mime image/x-coreldraw 17788>8 string CDR6 \b, Corel Draw Picture, version 6 17789!:mime image/x-coreldraw 17790>8 string NUNDROOT \b, Steinberg CuBase 17791# AVI == Audio Video Interleave 17792>8 string AVI\040 \b, AVI 17793!:mime video/x-msvideo 17794>>12 string LIST 17795>>>20 string hdrlavih 17796>>>>&36 lelong x \b, %u x 17797>>>>&40 lelong x %u, 17798>>>>&4 lelong >1000000 <1 fps, 17799>>>>&4 lelong 1000000 1.00 fps, 17800>>>>&4 lelong 500000 2.00 fps, 17801>>>>&4 lelong 333333 3.00 fps, 17802>>>>&4 lelong 250000 4.00 fps, 17803>>>>&4 lelong 200000 5.00 fps, 17804>>>>&4 lelong 166667 6.00 fps, 17805>>>>&4 lelong 142857 7.00 fps, 17806>>>>&4 lelong 125000 8.00 fps, 17807>>>>&4 lelong 111111 9.00 fps, 17808>>>>&4 lelong 100000 10.00 fps, 17809# ]9.9,10.1[ 17810>>>>&4 lelong <101010 17811>>>>>&-4 lelong >99010 17812>>>>>>&-4 lelong !100000 ~10 fps, 17813>>>>&4 lelong 83333 12.00 fps, 17814# ]11.9,12.1[ 17815>>>>&4 lelong <84034 17816>>>>>&-4 lelong >82645 17817>>>>>>&-4 lelong !83333 ~12 fps, 17818>>>>&4 lelong 66667 15.00 fps, 17819# ]14.9,15.1[ 17820>>>>&4 lelong <67114 17821>>>>>&-4 lelong >66225 17822>>>>>>&-4 lelong !66667 ~15 fps, 17823>>>>&4 lelong 50000 20.00 fps, 17824>>>>&4 lelong 41708 23.98 fps, 17825>>>>&4 lelong 41667 24.00 fps, 17826# ]23.9,24.1[ 17827>>>>&4 lelong <41841 17828>>>>>&-4 lelong >41494 17829>>>>>>&-4 lelong !41708 17830>>>>>>>&-4 lelong !41667 ~24 fps, 17831>>>>&4 lelong 40000 25.00 fps, 17832# ]24.9,25.1[ 17833>>>>&4 lelong <40161 17834>>>>>&-4 lelong >39841 17835>>>>>>&-4 lelong !40000 ~25 fps, 17836>>>>&4 lelong 33367 29.97 fps, 17837>>>>&4 lelong 33333 30.00 fps, 17838# ]29.9,30.1[ 17839>>>>&4 lelong <33445 17840>>>>>&-4 lelong >33223 17841>>>>>>&-4 lelong !33367 17842>>>>>>>&-4 lelong !33333 ~30 fps, 17843>>>>&4 lelong <32224 >30 fps, 17844##>>>>&4 lelong x (%lu) 17845##>>>>&20 lelong x %lu frames, 17846# Note: The tests below assume that the AVI has 1 or 2 streams, 17847# "vids" optionally followed by "auds". 17848# (Should cover 99.9% of all AVIs.) 17849# assuming avih length = 56 17850>>>88 string LIST 17851>>>>96 string strlstrh 17852>>>>>108 string vids video: 17853>>>>>>&0 lelong 0 uncompressed 17854# skip past vids strh 17855>>>>>>(104.l+108) string strf 17856>>>>>>>(104.l+132) lelong 1 RLE 8bpp 17857>>>>>>>(104.l+132) string/c cvid Cinepak 17858>>>>>>>(104.l+132) string/c i263 Intel I.263 17859>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 17860>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 17861>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 17862>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 17863>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 17864>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 17865>>>>>>>(104.l+132) string/c mjpg Motion JPEG 17866>>>>>>>(104.l+132) string/c div3 DivX 3 17867>>>>>>>>112 string/c div3 Low-Motion 17868>>>>>>>>112 string/c div4 Fast-Motion 17869>>>>>>>(104.l+132) string/c divx DivX 4 17870>>>>>>>(104.l+132) string/c dx50 DivX 5 17871>>>>>>>(104.l+132) string/c xvid XviD 17872>>>>>>>(104.l+132) string/c h264 H.264 17873>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 17874>>>>>>>(104.l+132) string/c h264 X.264 or H.264 17875>>>>>>>(104.l+132) lelong 0 17876##>>>>>>>(104.l+132) string x (%.4s) 17877# skip past first (video) LIST 17878>>>>(92.l+96) string LIST 17879>>>>>(92.l+104) string strlstrh 17880>>>>>>(92.l+116) string auds \b, audio: 17881# auds strh length = 56: 17882>>>>>>>(92.l+172) string strf 17883>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 17884>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 17885>>>>>>>>(92.l+180) leshort 0x0006 aLaw 17886>>>>>>>>(92.l+180) leshort 0x0007 uLaw 17887>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 17888>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 17889>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 17890>>>>>>>>(92.l+180) leshort 0x0161 DivX 17891##>>>>>>>>(92.l+180) leshort x (0x%.4x) 17892>>>>>>>>(92.l+182) leshort 1 (mono, 17893>>>>>>>>(92.l+182) leshort 2 (stereo, 17894>>>>>>>>(92.l+182) leshort >2 (%d channels, 17895>>>>>>>>(92.l+184) lelong x %d Hz) 17896# auds strh length = 64: 17897>>>>>>>(92.l+180) string strf 17898>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 17899>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 17900>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 17901>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 17902>>>>>>>>(92.l+188) leshort 0x0161 DivX 17903##>>>>>>>>(92.l+188) leshort x (0x%.4x) 17904>>>>>>>>(92.l+190) leshort 1 (mono, 17905>>>>>>>>(92.l+190) leshort 2 (stereo, 17906>>>>>>>>(92.l+190) leshort >2 (%d channels, 17907>>>>>>>>(92.l+192) lelong x %d Hz) 17908# Animated Cursor format 17909>8 string ACON \b, animated cursor 17910# SoundFont 2 <mpruett@sgi.com> 17911>8 string sfbk SoundFont/Bank 17912# MPEG-1 wrapped in a RIFF, apparently 17913>8 string CDXA \b, wrapped MPEG-1 (CDXA) 17914>8 string 4XMV \b, 4X Movie file 17915# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV 17916>8 string AMV\040 \b, AMV 17917>8 string WEBP \b, Web/P image 17918!:mime image/webp 17919>>12 use riff-walk 17920 17921# 17922# XXX - some of the below may only appear in little-endian form. 17923# 17924# Also "MV93" appears to be for one form of Macromedia Director 17925# files, and "GDMF" appears to be another multimedia format. 17926# 179270 string RIFX RIFF (big-endian) data 17928# RIFF Palette format 17929>8 string PAL \b, palette 17930>>16 beshort x \b, version %d 17931>>18 beshort x \b, %d entries 17932# RIFF Device Independent Bitmap format 17933>8 string RDIB \b, device-independent bitmap 17934>>16 string BM 17935>>>30 beshort 12 \b, OS/2 1.x format 17936>>>>34 beshort x \b, %d x 17937>>>>36 beshort x %d 17938>>>30 beshort 64 \b, OS/2 2.x format 17939>>>>34 beshort x \b, %d x 17940>>>>36 beshort x %d 17941>>>30 beshort 40 \b, Windows 3.x format 17942>>>>34 belong x \b, %d x 17943>>>>38 belong x %d x 17944>>>>44 beshort x %d 17945# RIFF MIDI format 17946>8 string RMID \b, MIDI 17947# RIFF Multimedia Movie File format 17948>8 string RMMP \b, multimedia movie 17949# Microsoft WAVE format (*.wav) 17950>8 string WAVE \b, WAVE audio 17951>>20 leshort 1 \b, Microsoft PCM 17952>>>34 leshort >0 \b, %d bit 17953>>22 beshort =1 \b, mono 17954>>22 beshort =2 \b, stereo 17955>>22 beshort >2 \b, %d channels 17956>>24 belong >0 %d Hz 17957# Corel Draw Picture 17958>8 string CDRA \b, Corel Draw Picture 17959>8 string CDR6 \b, Corel Draw Picture, version 6 17960# AVI == Audio Video Interleave 17961>8 string AVI\040 \b, AVI 17962# Animated Cursor format 17963>8 string ACON \b, animated cursor 17964# Notation Interchange File Format (big-endian only) 17965>8 string NIFF \b, Notation Interchange File Format 17966# SoundFont 2 <mpruett@sgi.com> 17967>8 string sfbk SoundFont/Bank 17968 17969#------------------------------------------------------------------------------ 17970# Sony Wave64 17971# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 17972# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 179730 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 17974# 128 bit + total file size (64 bits) so 24 bytes 17975# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 17976>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 17977!:mime audio/x-w64 17978# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 17979>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 17980>>>&10 leshort =1 \b, mono 17981>>>&10 leshort =2 \b, stereo 17982>>>&10 leshort >2 \b, %d channels 17983>>>&12 lelong >0 %d Hz 17984 17985#------------------------------------------------------------------------------ 17986# MBWF/RF64 17987# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf 179880 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 17989!:mime audio/x-wav 17990>40 search/256 fmt\x20 \b 17991>>&6 leshort =1 \b, mono 17992>>&6 leshort =2 \b, stereo 17993>>&6 leshort >2 \b, %d channels 17994>>&8 lelong >0 %d Hz 17995 17996#------------------------------------------------------------------------------ 17997# $File: rinex,v 1.3 2011/04/04 21:12:03 christos Exp $ 17998# rinex: file(1) magic for RINEX files 17999# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 18000# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 18001# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 1800260 string RINEX 18003>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 18004>>&32 string x \b, date %15.15s 18005>>5 string x \b, version %6.6s 18006!:mime rinex/broadcast 18007>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 18008>>&32 string x \b, date %15.15s 18009>>5 string x \b, version %6.6s 18010!:mime rinex/observation 18011>80 search/256 XXRINEXC RINEX Data, Clock 18012>>&32 string x \b, date %15.15s 18013>>5 string x \b, version %6.6s 18014!:mime rinex/clock 18015>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 18016>>&32 string x \b, date %15.15s 18017>>5 string x \b, version %6.6s 18018!:mime rinex/navigation 18019>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 18020>>&32 string x \b, date %15.15s 18021>>5 string x \b, version %6.6s 18022!:mime rinex/navigation 18023>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 18024>>&32 string x \b, date %15.15s 18025>>5 string x \b, version %6.6s 18026!:mime rinex/navigation 18027>80 search/256 XXRINEXM RINEX Data, Meteorological 18028>>&32 string x \b, date %15.15s 18029>>5 string x \b, version %6.6s 18030!:mime rinex/meteorological 18031>80 search/256 XXRINEXN RINEX Data, Navigation 18032>>&32 string x \b, date %15.15s 18033>>5 string x \b, version %6.6s 18034!:mime rinex/navigation 18035>80 search/256 XXRINEXO RINEX Data, Observation 18036>>&32 string x \b, date %15.15s 18037>>5 string x \b, version %6.6s 18038!:mime rinex/observation 18039 18040#------------------------------------------------------------------------------ 18041# $File: rpm,v 1.11 2011/06/14 12:47:41 christos Exp $ 18042# 18043# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 18044# 180450 belong 0xedabeedb RPM 18046!:mime application/x-rpm 18047>4 byte x v%d 18048>5 byte x \b.%d 18049>6 beshort 1 src 18050>6 beshort 0 bin 18051>>8 beshort 1 i386/x86_64 18052>>8 beshort 2 Alpha/Sparc64 18053>>8 beshort 3 Sparc 18054>>8 beshort 4 MIPS 18055>>8 beshort 5 PowerPC 18056>>8 beshort 6 68000 18057>>8 beshort 7 SGI 18058>>8 beshort 8 RS6000 18059>>8 beshort 9 IA64 18060>>8 beshort 10 Sparc64 18061>>8 beshort 11 MIPSel 18062>>8 beshort 12 ARM 18063>>8 beshort 13 MiNT 18064>>8 beshort 14 S/390 18065>>8 beshort 15 S/390x 18066>>8 beshort 16 PowerPC64 18067>>8 beshort 17 SuperH 18068>>8 beshort 18 Xtensa 18069>>8 beshort 255 noarch 18070 18071#delta RPM Daniel Novotny (dnovotny@redhat.com) 180720 string drpm Delta RPM 18073!:mime application/x-rpm 18074>12 string x %s 18075>>8 beshort 11 MIPSel 18076>>8 beshort 12 ARM 18077>>8 beshort 13 MiNT 18078>>8 beshort 14 S/390 18079>>8 beshort 15 S/390x 18080>>8 beshort 16 PowerPC64 18081>>8 beshort 17 SuperH 18082>>8 beshort 18 Xtensa 18083>>10 string x %s 18084 18085#------------------------------------------------------------------------------ 18086# $File$ 18087# rtf: file(1) magic for Rich Text Format (RTF) 18088# 18089# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 18090# 180910 string {\\rtf Rich Text Format data, 18092!:mime text/rtf 18093>5 string 1 version 1, 18094>>6 string \\ansi ANSI 18095>>6 string \\mac Apple Macintosh 18096>>6 string \\pc IBM PC, code page 437 18097>>6 string \\pca IBM PS/2, code page 850 18098>>6 default x unknown character set 18099>5 default x unknown version 18100 18101#------------------------------------------------------------------------------ 18102# $File: ruby,v 1.4 2010/07/08 20:24:13 christos Exp $ 18103# ruby: file(1) magic for Ruby scripting language 18104# URL: http://www.ruby-lang.org/ 18105# From: Reuben Thomas <rrt@sc3d.org> 18106 18107# Ruby scripts 181080 search/1/w #!\ /usr/bin/ruby Ruby script text executable 18109!:mime text/x-ruby 181100 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 18111!:mime text/x-ruby 181120 search/1 #!/usr/bin/env\ ruby Ruby script text executable 18113!:mime text/x-ruby 181140 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 18115!:mime text/x-ruby 18116 18117# What looks like ruby, but does not have a shebang 18118# (modules and such) 18119# From: Lubomir Rintel <lkundrak@v3.sk> 181200 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+' 18121>0 regex include\ [A-Z]|def\ [a-z]|\ do$ 18122>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text 18123!:mime text/x-ruby 181240 regex \^[\ \t]*(class|module)[\ \t][A-Z] 18125>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 18126>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text 18127!:mime text/x-ruby 18128 18129#------------------------------------------------------------------------------ 18130# $File$ 18131# sc: file(1) magic for "sc" spreadsheet 18132# 1813338 string Spreadsheet sc spreadsheet file 18134!:mime application/x-sc 18135 18136#------------------------------------------------------------------------------ 18137# $File$ 18138# sccs: file(1) magic for SCCS archives 18139# 18140# SCCS archive structure: 18141# \001h01207 18142# \001s 00276/00000/00000 18143# \001d D 1.1 87/09/23 08:09:20 ian 1 0 18144# \001c date and time created 87/09/23 08:09:20 by ian 18145# \001e 18146# \001u 18147# \001U 18148# ... etc. 18149# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 18150# *Sigh*. And these both came from various parts of the USG. 18151# Maybe we should just switch everybody from SCCS to RCS! 18152# Further, you can't just say '\001h0', because the five-digit number 18153# is a checksum that could (presumably) have any leading digit, 18154# and we don't have regular expression matching yet. 18155# Hence the following official kludge: 181568 string \001s\ SCCS archive data 18157 18158#------------------------------------------------------------------------------ 18159# $File: scientific,v 1.8 2014/01/06 17:46:23 rrt Exp $ 18160# scientific: file(1) magic for scientific formats 18161# 18162# From: Joe Krahn <krahn@niehs.nih.gov> 18163 18164######################################################## 18165# CCP4 data and plot files: 181660 string MTZ\040 MTZ reflection file 18167 1816892 string PLOT%%84 Plot84 plotting file 18169>52 byte 1 , Little-endian 18170>55 byte 1 , Big-endian 18171 18172######################################################## 18173# Electron density MAP/MASK formats 18174 181750 string EZD_MAP NEWEZD Electron Density Map 18176109 string MAP\040( Old EZD Electron Density Map 18177 181780 string/c :-)\040Origin BRIX Electron Density Map 18179>170 string >0 , Sigma:%.12s 18180#>4 string >0 %.178s 18181#>4 addr x %.178s 18182 181837 string 18\040!NTITLE XPLOR ASCII Electron Density Map 181849 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 18185 18186208 string MAP\040 CCP4 Electron Density Map 18187# Assumes same stamp for float and double (normal case) 18188>212 byte 17 \b, Big-endian 18189>212 byte 34 \b, VAX format 18190>212 byte 68 \b, Little-endian 18191>212 byte 85 \b, Convex native 18192 18193############################################################ 18194# X-Ray Area Detector images 181950 string R-AXIS4\ \ \ R-Axis Area Detector Image: 18196>796 lelong <20 Little-endian, IP #%d, 18197>>768 lelong >0 Size=%dx 18198>>772 lelong >0 \b%d 18199>796 belong <20 Big-endian, IP #%d, 18200>>768 belong >0 Size=%dx 18201>>772 belong >0 \b%d 18202 182030 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 18204>796 lelong <20 Little-endian, IP #%d, 18205>>768 lelong >0 Size=%dx 18206>>772 lelong >0 \b%d 18207>796 belong <20 Big-endian, IP #%d, 18208>>768 belong >0 Size=%dx 18209>>772 belong >0 \b%d 18210 18211 182121028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 18213>1072 ulong >1 Compressed(%d), 18214>1100 ulong >1 %d headers, 18215>1104 ulong >0 %d x 18216>1108 ulong >0 %d, 18217>1120 ulong >0 %d bits/pixel 18218 18219# Type: GEDCOM genealogical (family history) data 18220# From: Giuseppe Bilotta 182210 search/1/c 0\ HEAD GEDCOM genealogy text 18222>&0 search 1\ GEDC 18223>>&0 search 2\ VERS version 18224>>>&1 string >\0 %s 18225# From: Phil Endecott <phil05@chezphil.org> 182260 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 182270 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 182280 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 182290 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 18230 18231# PDB: Protein Data Bank files 18232# Adam Buchbinder <adam.buchbinder@gmail.com> 18233# 18234# http://www.wwpdb.org/documentation/format32/sect2.html 18235# http://www.ch.ic.ac.uk/chemime/ 18236# 18237# The PDB file format is fixed-field, 80 columns. From the spec: 18238# 18239# COLS DATA 18240# 1 - 6 "HEADER" 18241# 11 - 50 String(40) 18242# 51 - 59 Date 18243# 63 - 66 IDcode 18244# 18245# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 18246# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 18247# uppercase letters. However, examples have been seen without the date string, 18248# e.g., the example on the chemime site. 182490 string HEADER\ \ \ \ 18250>&0 regex/1l \^.{40} 18251>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 18252>>>&0 regex/1ls [A-Z0-9]{4}.{14}$ 18253>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s 18254!:mime chemical/x-pdb 18255>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 18256 18257# Type: GDSII Stream file 182580 belong 0x00060002 GDSII Stream file 18259>4 byte 0x00 18260>>5 byte x version %d.0 18261>4 byte >0x00 version %d 18262>>5 byte x \b.%d 18263 18264#------------------------------------------------------------------------------ 18265# $File$ 182660 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 182670 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 182680 belong 0xedfeedfe Sun 'jks' Java Keystore File data 18269# Type: SE Linux policy modules *.pp reference policy 18270# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 18271# URL: http://doc.coker.com.au/computers/selinux-magic 18272# From: Russell Coker <russell@coker.com.au> 18273 182740 lelong 0xf97cff8f SE Linux modular policy 18275>4 lelong x version %d, 18276>8 lelong x %d sections, 18277>>(12.l) lelong 0xf97cff8d 18278>>>(12.l+27) lelong x mod version %d, 18279>>>(12.l+31) lelong 0 Not MLS, 18280>>>(12.l+31) lelong 1 MLS, 18281>>>(12.l+23) lelong 2 18282>>>>(12.l+47) string >\0 module name %s 18283>>>(12.l+23) lelong 1 base 18284 182851 string policy_module( SE Linux policy module source 182862 string policy_module( SE Linux policy module source 18287 182880 string ##\ <summary> SE Linux policy interface source 18289 18290#0 search gen_context( SE Linux policy file contexts 18291 18292#0 search gen_sens( SE Linux policy MLS constraints source 18293 18294#------------------------------------------------------------------------------ 18295# $File$ 18296# sendmail: file(1) magic for sendmail config files 18297# 18298# XXX - byte order? 18299# 183000 byte 046 Sendmail frozen configuration 18301>16 string >\0 - version %s 183020 short 0x271c Sendmail frozen configuration 18303>16 string >\0 - version %s 18304 18305#------------------------------------------------------------------------------ 18306# sendmail: file(1) magic for sendmail m4(1) files 18307# 18308# From Hendrik Scholz <hendrik@scholz.net> 18309# i.e. files in /usr/share/sendmail/cf/ 18310# 183110 string divert(-1)\n sendmail m4 text file 18312 18313 18314#------------------------------------------------------------------------------ 18315# $File: sequent,v 1.11 2014/06/02 19:27:54 christos Exp $ 18316# sequent: file(1) magic for Sequent machines 18317# 18318# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 18319# For Sequent's multiprocessor systems (incomplete). 183200 lelong 0x00ea BALANCE NS32000 .o 18321>16 lelong >0 not stripped 18322>124 lelong >0 version %d 183230 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 18324>16 lelong >0 not stripped 18325>124 lelong >0 version %d 183260 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 18327>16 lelong >0 not stripped 18328>124 lelong >0 version %d 183290 lelong 0x30ea BALANCE NS32000 standalone executable 18330>16 lelong >0 not stripped 18331>124 lelong >0 version %d 18332# 18333# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 18334# Symmetry magic nums will not be reached if DOS COM comes before them; 18335# byte 0xeb is matched before these get a chance. 183360 leshort 0x12eb SYMMETRY i386 .o 18337>16 lelong >0 not stripped 18338>124 lelong >0 version %d 183390 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 18340>16 lelong >0 not stripped 18341>124 lelong >0 version %d 183420 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 18343>16 lelong >0 not stripped 18344>124 lelong >0 version %d 18345# http://en.wikipedia.org/wiki/Sequent_Computer_Systems 18346# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader 18347#0 leshort 0x42eb SYMMETRY i386 standalone executable 183480 leshort 0x42eb 18349# skip unlike negative version 18350>124 lelong >-1 18351# assuming version 28867614 is very low probable 18352>>124 lelong !28867614 SYMMETRY i386 standalone executable 18353>>>16 lelong >0 not stripped 18354>>>124 lelong >0 version %d 18355 18356#------------------------------------------------------------------------------ 18357# $File: sereal,v 1.2 2014/11/11 20:10:49 christos Exp $ 18358# sereal: file(1) magic the Sereal binary serialization format 18359# 18360# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com> 18361# 18362# See the specification of the format at 18363# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format 18364# 18365# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by 18366# doing (byte&0xF0)>>4 here, but unfortunately that's not 18367# supported. So when we print out a message about an unknown format 18368# we'll print out e.g. 0x30 instead of the more human-readable 18369# 0x30>>4. 18370# 18371# See https://github.com/Sereal/Sereal/commit/35372ae01d in the 18372# Sereal.git repository for test Sereal data. 183730 name sereal 18374>4 byte&0x0F x (version %d, 18375>4 byte&0xF0 0x00 uncompressed) 18376>4 byte&0xF0 0x10 compressed with non-incremental Snappy) 18377>4 byte&0xF0 0x20 compressed with incremental Snappy) 18378>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4) 18379 183800 string/b \=srl Sereal data packet 18381!:mime application/sereal 18382>&0 use sereal 183830 string/b \=\xF3rl Sereal data packet 18384!:mime application/sereal 18385>&0 use sereal 183860 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded 18387!:mime application/sereal 18388>&0 use sereal 18389 18390 18391#------------------------------------------------------------------------------ 18392# $File: sgi,v 1.20 2014/03/10 00:53:38 christos Exp $ 18393# sgi: file(1) magic for Silicon Graphics operating systems and applications 18394# 18395# Executable images are handled either in aout (for old-style a.out 18396# files for 68K; they are indistinguishable from other big-endian 32-bit 18397# a.out files) or in mips (for MIPS ECOFF and Ucode files) 18398# 18399 18400# kbd file definitions 184010 string kbd!map kbd map file 18402>8 byte >0 Ver %d: 18403>10 short >0 with %d table(s) 18404 184050 beshort 0x8765 disk quotas file 18406 184070 beshort 0x0506 IRIS Showcase file 18408>2 byte 0x49 - 18409>3 byte x - version %d 184100 beshort 0x0226 IRIS Showcase template 18411>2 byte 0x63 - 18412>3 byte x - version %d 184130 belong 0x5343464d IRIS Showcase file 18414>4 byte x - version %d 184150 belong 0x5443464d IRIS Showcase template 18416>4 byte x - version %d 184170 belong 0xdeadbabe IRIX Parallel Arena 18418>8 belong >0 - version %d 18419 18420# core files 18421# 18422# 32bit core file 184230 belong 0xdeadadb0 IRIX core dump 18424>4 belong 1 of 18425>16 string >\0 '%s' 18426# 64bit core file 184270 belong 0xdeadad40 IRIX 64-bit core dump 18428>4 belong 1 of 18429>16 string >\0 '%s' 18430# N32bit core file 184310 belong 0xbabec0bb IRIX N32 core dump 18432>4 belong 1 of 18433>16 string >\0 '%s' 18434# New style crash dump file 184350 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 18436>36 string >\0 '%s' 18437 18438# Trusted IRIX info 184390 string SGIAUDIT SGI Audit file 18440>8 byte x - version %d 18441>9 byte x \b.%d 18442# 184430 string WNGZWZSC Wingz compiled script 184440 string WNGZWZSS Wingz spreadsheet 184450 string WNGZWZHP Wingz help file 18446# 184470 string #Inventor V IRIS Inventor 1.0 file 184480 string #Inventor V2 Open Inventor 2.0 file 18449# GLF is OpenGL stream encoding 184500 string glfHeadMagic(); GLF_TEXT 184514 belong 0x7d000000 GLF_BINARY_LSB_FIRST 18452!:strength -30 184534 belong 0x0000007d GLF_BINARY_MSB_FIRST 18454!:strength -30 18455# GLS is OpenGL stream encoding; GLS is the successor of GLF 184560 string glsBeginGLS( GLS_TEXT 184574 belong 0x10000000 GLS_BINARY_LSB_FIRST 18458!:strength -30 184594 belong 0x00000010 GLS_BINARY_MSB_FIRST 18460!:strength -30 18461 18462# 18463# 18464# Performance Co-Pilot file types 184650 string PmNs PCP compiled namespace (V.0) 184660 string PmN PCP compiled namespace 18467>3 string >\0 (V.%1.1s) 18468#3 lelong 0x84500526 PCP archive 184693 belong 0x84500526 PCP archive 18470>7 byte x (V.%d) 18471#>20 lelong -2 temporal index 18472#>20 lelong -1 metadata 18473#>20 lelong 0 log volume #0 18474#>20 lelong >0 log volume #%d 18475>20 belong -2 temporal index 18476>20 belong -1 metadata 18477>20 belong 0 log volume #0 18478>20 belong >0 log volume #%d 18479>24 string >\0 host: %s 184800 string PCPFolio PCP 18481>9 string Version: Archive Folio 18482>18 string >\0 (V.%s) 184830 string #pmchart PCP pmchart view 18484>9 string Version 18485>17 string >\0 (V%-3.3s) 184860 string #kmchart PCP kmchart view 18487>9 string Version 18488>17 string >\0 (V.%s) 184890 string pmview PCP pmview config 18490>7 string Version 18491>15 string >\0 (V%-3.3s) 184920 string #pmlogger PCP pmlogger config 18493>10 string Version 18494>18 string >\0 (V%1.1s) 184950 string #pmdahotproc PCP pmdahotproc config 18496>13 string Version 18497>21 string >\0 (V%-3.3s) 184980 string PcPh PCP Help 18499>4 string 1 Index 18500>4 string 2 Text 18501>5 string >\0 (V.%1.1s) 185020 string #pmieconf-rules PCP pmieconf rules 18503>16 string >\0 (V.%1.1s) 185043 string pmieconf-pmie PCP pmie config 18505>17 string >\0 (V.%1.1s) 18506 18507# SpeedShop data files 185080 lelong 0x13130303 SpeedShop data file 18509 18510# mdbm files 185110 lelong 0x01023962 mdbm file, version 0 (obsolete) 185120 string mdbm mdbm file, 18513>5 byte x version %d, 18514>6 byte x 2^%d pages, 18515>7 byte x pagesize 2^%d, 18516>17 byte x hash %d, 18517>11 byte x dataformat %d 18518 18519# Alias Maya files 185200 string/t //Maya\040ASCII Alias Maya Ascii File, 18521>13 string >\0 version %s 185228 string MAYAFOR4 Alias Maya Binary File, 18523>32 string >\0 version %s scene 185248 string MayaFOR4 Alias Maya Binary File, 18525>32 string >\0 version %s scene 185268 string CIMG Alias Maya Image File 185278 string DEEP Alias Maya Image File 18528#------------------------------------------------------------------------------ 18529# $File: sgml,v 1.29 2012/08/26 10:25:41 christos Exp $ 18530# Type: SVG Vectorial Graphics 18531# From: Noel Torres <tecnico@ejerciciosresueltos.com> 185320 string \<?xml\ version=" 18533>15 string >\0 18534>>19 search/4096 \<svg SVG Scalable Vector Graphics image 18535!:mime image/svg+xml 18536>>19 search/4096 \<gnc-v2 GnuCash file 18537!:mime application/x-gnucash 18538 18539# Sitemap file 185400 string/t \<?xml\ version=" 18541>15 string >\0 18542>>19 search/4096 \<urlset XML Sitemap document text 18543!:mime application/xml-sitemap 18544 18545# OpenStreetMap XML (.osm) 18546# http://wiki.openstreetmap.org/wiki/OSM_XML 18547# From: Markus Heidelberg <markus.heidelberg@web.de> 185480 string \<?xml\ version=" 18549>15 string >\0 18550>>19 search/4096 \<osm OpenStreetMap XML data 18551 18552# xhtml 185530 string/t \<?xml\ version=" 18554>15 string >\0 18555>>19 search/4096/cWbt \<!doctype\ html XHTML document text 18556!:mime text/html 185570 string/t \<?xml\ version=' 18558>15 string >\0 18559>>19 search/4096/cWbt \<!doctype\ html XHTML document text 18560!:mime text/html 185610 string/t \<?xml\ version=" 18562>15 string >\0 18563>>19 search/4096/cWbt \<html broken XHTML document text 18564!:mime text/html 18565 18566#------------------------------------------------------------------------------ 18567# sgml: file(1) magic for Standard Generalized Markup Language 18568# HyperText Markup Language (HTML) is an SGML document type, 18569# from Daniel Quinlan (quinlan@yggdrasil.com) 18570# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 185710 search/4096/cWt \<!doctype\ html HTML document text 18572!:mime text/html 18573!:strength + 5 185740 search/4096/cwt \<head HTML document text 18575!:mime text/html 18576!:strength + 5 185770 search/4096/cwt \<title HTML document text 18578!:mime text/html 18579!:strength + 5 185800 search/4096/cwt \<html HTML document text 18581!:mime text/html 18582!:strength + 5 185830 search/4096/cwt \<script HTML document text 18584!:mime text/html 18585!:strength + 5 185860 search/4096/cwt \<style HTML document text 18587!:mime text/html 18588!:strength + 5 185890 search/4096/cwt \<table HTML document text 18590!:mime text/html 18591!:strength + 5 185920 search/4096/cwt \<a\ href= HTML document text 18593!:mime text/html 18594!:strength + 5 18595 18596# Extensible markup language (XML), a subset of SGML 18597# from Marc Prud'hommeaux (marc@apocalypse.org) 185980 search/1/cwt \<?xml XML document text 18599!:mime application/xml 18600!:strength + 5 186010 string/t \<?xml\ version\ " XML 18602!:mime application/xml 18603!:strength + 5 186040 string/t \<?xml\ version=" XML 18605!:mime application/xml 18606!:strength + 5 18607>15 string/t >\0 %.3s document text 18608>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 18609>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 186100 string \<?xml\ version=' XML 18611!:mime application/xml 18612!:strength + 5 18613>15 string/t >\0 %.3s document text 18614>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 18615>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 186160 search/1/wbt \<?xml XML document text 18617!:mime application/xml 18618!:strength - 10 186190 search/1/wt \<?XML broken XML document text 18620!:mime application/xml 18621!:strength - 10 18622 18623 18624# SGML, mostly from rph@sq 186250 search/4096/cwt \<!doctype exported SGML document text 186260 search/4096/cwt \<!subdoc exported SGML subdocument text 186270 search/4096/cwt \<!-- exported SGML document text 18628!:strength - 10 18629 18630# Web browser cookie files 18631# (Mozilla, Galeon, Netscape 4, Konqueror..) 18632# Ulf Harnhammar <ulfh@update.uu.se> 186330 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 186340 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 186350 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 18636 18637#------------------------------------------------------------------------ 18638# $File: sharc,v 1.6 2009/09/19 16:28:12 christos Exp $ 18639# file(1) magic for sharc files 18640# 18641# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 18642# FutureGroove Music (dsp@futuregroove.de) 18643 18644#------------------------------------------------------------------------ 18645#0 string Draw RiscOS Drawfile 18646#0 string PACK RiscOS PackdDir archive 18647 18648#------------------------------------------------------------------------ 18649# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 18650 18651#0 string =! Assembler source 18652#0 string Analog ADi asm listing file 186530 string .SYSTEM SHARC architecture file 186540 string .system SHARC architecture file 18655 186560 leshort 0x521C SHARC COFF binary 18657>2 leshort >1 , %d sections 18658>>12 lelong >0 , not stripped 18659 18660#------------------------------------------------------------------------------ 18661# $File$ 18662# sinclair: file(1) sinclair QL 18663 18664# additions to /etc/magic by Thomas M. Ott (ThMO) 18665 18666# Sinclair QL floppy disk formats (ThMO) 186670 string =QL5 QL disk dump data, 18668>3 string =A 720 KB, 18669>3 string =B 1.44 MB, 18670>3 string =C 3.2 MB, 18671>4 string >\0 label:%.10s 18672 18673# Sinclair QL OS dump (ThMO) 18674# (NOTE: if `file' would be able to use indirect references in a endian format 18675# differing from the natural host format, this could be written more 18676# reliably and faster...) 18677# 18678# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more 18679# than the first 8K of a file... #-( 18680# 18681#0 belong =0x30000 18682#>49124 belong <47104 18683#>>49128 belong <47104 18684#>>>49132 belong <47104 18685#>>>>49136 belong <47104 QL OS dump data, 18686#>>>>>49148 string >\0 type %.3s, 18687#>>>>>49142 string >\0 version %.4s 18688 18689# Sinclair QL firmware executables (ThMO) 186900 string NqNqNq`\004 QL firmware executable (BCPL) 18691 18692# Sinclair QL libraries (was ThMO) 186930 beshort 0xFB01 QDOS object 18694>2 pstring x '%s' 18695 18696# Sinclair QL executables (was ThMO) 186974 belong 0x4AFB QDOS executable 18698>9 pstring x '%s' 18699 18700# Sinclair QL ROM (ThMO) 187010 belong =0x4AFB0001 QL plugin-ROM data, 18702>9 pstring =\0 un-named 18703>9 pstring >\0 named: %s 18704# Type: SiSU Markup Language 18705# URL: http://www.sisudoc.org/ 18706# From: Ralph Amissah <ralph.amissah@gmail.com> 18707 187080 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 18709>5 regex [0-9.]+ %s 18710 187110 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 18712>5 regex [0-9.]+ %s 18713 187140 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 18715>5 regex [0-9.]+ %s 18716 187170 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 18718>5 regex [0-9.]+ %s 18719 187200 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 18721>5 regex [0-9.]+ %s 18722 18723#------------------------------------------------------------------------------ 18724# $File$ 18725# Sketch Drawings: http://sketch.sourceforge.net/ 18726# From: Edwin Mons <e@ik.nu> 187270 search/1 ##Sketch Sketch document text 18728 18729#----------------------------------------------- 18730# $File$ 18731# GNU Smalltalk image, starting at version 1.6.2 18732# From: catull_us@yahoo.com 18733# 187340 string GSTIm\0\0 GNU SmallTalk 18735# little-endian 18736>7 byte&1 =0 LE image version 18737>>10 byte x %d. 18738>>9 byte x \b%d. 18739>>8 byte x \b%d 18740#>>12 lelong x , data: %ld 18741#>>16 lelong x , table: %ld 18742#>>20 lelong x , memory: %ld 18743# big-endian 18744>7 byte&1 =1 BE image version 18745>>8 byte x %d. 18746>>9 byte x \b%d. 18747>>10 byte x \b%d 18748#>>12 belong x , data: %ld 18749#>>16 belong x , table: %ld 18750#>>20 belong x , memory: %ld 18751 18752 18753 18754#------------------------------------------------------------------------------ 18755# $File$ 18756# smile: file(1) magic for Smile serialization 18757# 18758# The Smile serialization format uses a 4-byte header: 18759# 18760# Constant byte #0: 0x3A (ASCII ':') 18761# Constant byte #1: 0x29 (ASCII ')') 18762# Constant byte #2: 0x0A (ASCII linefeed, '\n') 18763# Variable byte #3, consisting of bits: 18764# Bits 4-7 (4 MSB): 4-bit version number 18765# Bits 3: Reserved 18766# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 18767# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 18768# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 18769# 18770# Reference: http://wiki.fasterxml.com/SmileFormatSpec 18771# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 18772 18773# Detection 187740 string :)\n Smile binary data 18775 18776# Versioning 18777>3 byte&0xF0 x version %d: 18778 18779# Properties 18780>3 byte&0x04 0x04 binary raw, 18781>3 byte&0x04 0x00 binary encoded, 18782>3 byte&0x02 0x02 shared String values enabled, 18783>3 byte&0x02 0x00 shared String values disabled, 18784>3 byte&0x01 0x01 shared field names enabled 18785>3 byte&0x01 0x00 shared field names disabled 18786 18787 18788#------------------------------------------------------------------------------ 18789# $File: sniffer,v 1.18 2011/08/08 08:49:27 christos Exp $ 18790# sniffer: file(1) magic for packet capture files 18791# 18792# From: guy@alum.mit.edu (Guy Harris) 18793# 18794 18795# 18796# Microsoft Network Monitor 1.x capture files. 18797# 187980 string RTSS NetMon capture file 18799>5 byte x - version %d 18800>4 byte x \b.%d 18801>6 leshort 0 (Unknown) 18802>6 leshort 1 (Ethernet) 18803>6 leshort 2 (Token Ring) 18804>6 leshort 3 (FDDI) 18805>6 leshort 4 (ATM) 18806>6 leshort >4 (type %d) 18807 18808# 18809# Microsoft Network Monitor 2.x capture files. 18810# 188110 string GMBU NetMon capture file 18812>5 byte x - version %d 18813>4 byte x \b.%d 18814>6 leshort 0 (Unknown) 18815>6 leshort 1 (Ethernet) 18816>6 leshort 2 (Token Ring) 18817>6 leshort 3 (FDDI) 18818>6 leshort 4 (ATM) 18819>6 leshort 5 (IP-over-IEEE 1394) 18820>6 leshort 6 (802.11) 18821>6 leshort 7 (Raw IP) 18822>6 leshort 8 (Raw IP) 18823>6 leshort 9 (Raw IP) 18824>6 leshort >9 (type %d) 18825 18826# 18827# Network General Sniffer capture files. 18828# Sorry, make that "Network Associates Sniffer capture files." 18829# Sorry, make that "Network General old DOS Sniffer capture files." 18830# 188310 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file 18832>33 byte 2 (compressed) 18833>23 leshort x - version %d 18834>25 leshort x \b.%d 18835>32 byte 0 (Token Ring) 18836>32 byte 1 (Ethernet) 18837>32 byte 2 (ARCNET) 18838>32 byte 3 (StarLAN) 18839>32 byte 4 (PC Network broadband) 18840>32 byte 5 (LocalTalk) 18841>32 byte 6 (Znet) 18842>32 byte 7 (Internetwork Analyzer) 18843>32 byte 9 (FDDI) 18844>32 byte 10 (ATM) 18845 18846# 18847# Cinco Networks NetXRay capture files. 18848# Sorry, make that "Network General Sniffer Basic capture files." 18849# Sorry, make that "Network Associates Sniffer Basic capture files." 18850# Sorry, make that "Network Associates Sniffer Basic, and Windows 18851# Sniffer Pro", capture files." 18852# Sorry, make that "Network General Sniffer capture files." 18853# Sorry, make that "NetScout Sniffer capture files." 18854# 188550 string XCP\0 NetXRay capture file 18856>4 string >\0 - version %s 18857>44 leshort 0 (Ethernet) 18858>44 leshort 1 (Token Ring) 18859>44 leshort 2 (FDDI) 18860>44 leshort 3 (WAN) 18861>44 leshort 8 (ATM) 18862>44 leshort 9 (802.11) 18863 18864# 18865# "libpcap" capture files. 18866# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 18867# the main program that uses that format, but there are other programs 18868# that use "libpcap", or that use the same capture file format.) 18869# 188700 name pcap-be 18871>4 beshort x - version %d 18872>6 beshort x \b.%d 18873>20 belong 0 (No link-layer encapsulation 18874>20 belong 1 (Ethernet 18875>20 belong 2 (3Mb Ethernet 18876>20 belong 3 (AX.25 18877>20 belong 4 (ProNET 18878>20 belong 5 (CHAOS 18879>20 belong 6 (Token Ring 18880>20 belong 7 (BSD ARCNET 18881>20 belong 8 (SLIP 18882>20 belong 9 (PPP 18883>20 belong 10 (FDDI 18884>20 belong 11 (RFC 1483 ATM 18885>20 belong 12 (raw IP 18886>20 belong 13 (BSD/OS SLIP 18887>20 belong 14 (BSD/OS PPP 18888>20 belong 19 (Linux ATM Classical IP 18889>20 belong 50 (PPP or Cisco HDLC 18890>20 belong 51 (PPP-over-Ethernet 18891>20 belong 99 (Symantec Enterprise Firewall 18892>20 belong 100 (RFC 1483 ATM 18893>20 belong 101 (raw IP 18894>20 belong 102 (BSD/OS SLIP 18895>20 belong 103 (BSD/OS PPP 18896>20 belong 104 (BSD/OS Cisco HDLC 18897>20 belong 105 (802.11 18898>20 belong 106 (Linux Classical IP over ATM 18899>20 belong 107 (Frame Relay 18900>20 belong 108 (OpenBSD loopback 18901>20 belong 109 (OpenBSD IPsec encrypted 18902>20 belong 112 (Cisco HDLC 18903>20 belong 113 (Linux "cooked" 18904>20 belong 114 (LocalTalk 18905>20 belong 117 (OpenBSD PFLOG 18906>20 belong 119 (802.11 with Prism header 18907>20 belong 122 (RFC 2625 IP over Fibre Channel 18908>20 belong 123 (SunATM 18909>20 belong 127 (802.11 with radiotap header 18910>20 belong 129 (Linux ARCNET 18911>20 belong 138 (Apple IP over IEEE 1394 18912>20 belong 139 (MTP2 with pseudo-header 18913>20 belong 140 (MTP2 18914>20 belong 141 (MTP3 18915>20 belong 142 (SCCP 18916>20 belong 143 (DOCSIS 18917>20 belong 144 (IrDA 18918>20 belong 147 (Private use 0 18919>20 belong 148 (Private use 1 18920>20 belong 149 (Private use 2 18921>20 belong 150 (Private use 3 18922>20 belong 151 (Private use 4 18923>20 belong 152 (Private use 5 18924>20 belong 153 (Private use 6 18925>20 belong 154 (Private use 7 18926>20 belong 155 (Private use 8 18927>20 belong 156 (Private use 9 18928>20 belong 157 (Private use 10 18929>20 belong 158 (Private use 11 18930>20 belong 159 (Private use 12 18931>20 belong 160 (Private use 13 18932>20 belong 161 (Private use 14 18933>20 belong 162 (Private use 15 18934>20 belong 163 (802.11 with AVS header 18935>20 belong 165 (BACnet MS/TP 18936>20 belong 166 (PPPD 18937>20 belong 169 (GPRS LLC 18938>20 belong 177 (Linux LAPD 18939>20 belong 187 (Bluetooth HCI H4 18940>20 belong 189 (Linux USB 18941>20 belong 192 (PPI 18942>20 belong 195 (802.15.4 18943>20 belong 196 (SITA 18944>20 belong 197 (Endace ERF 18945>20 belong 201 (Bluetooth HCI H4 with pseudo-header 18946>20 belong 202 (AX.25 with KISS header 18947>20 belong 203 (LAPD 18948>20 belong 204 (PPP with direction pseudo-header 18949>20 belong 205 (Cisco HDLC with direction pseudo-header 18950>20 belong 206 (Frame Relay with direction pseudo-header 18951>20 belong 209 (Linux IPMB 18952>20 belong 215 (802.15.4 with non-ASK PHY header 18953>20 belong 220 (Memory-mapped Linux USB 18954>20 belong 224 (Fibre Channel FC-2 18955>20 belong 225 (Fibre Channel FC-2 with frame delimiters 18956>20 belong 226 (Solaris IPNET 18957>20 belong 227 (SocketCAN 18958>20 belong 228 (Raw IPv4 18959>20 belong 229 (Raw IPv6 18960>20 belong 230 (802.15.4 without FCS 18961>20 belong 231 (D-Bus messages 18962>20 belong 235 (DVB-CI 18963>20 belong 236 (MUX27010 18964>20 belong 237 (STANAG 5066 D_PDUs 18965>20 belong 239 (Linux netlink NFLOG messages 18966>20 belong 240 (Hilscher netAnalyzer 18967>20 belong 241 (Hilscher netAnalyzer with delimiters 18968>20 belong 242 (IP-over-Infiniband 18969>20 belong 243 (MPEG-2 Transport Stream packets 18970>20 belong 244 (ng4t ng40 18971>20 belong 245 (NFC LLCP 18972>20 belong 247 (Infiniband 18973>20 belong 248 (SCTP 18974>16 belong x \b, capture length %d) 18975 189760 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) 18977!:mime application/vnd.tcpdump.pcap 18978>0 use pcap-be 189790 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) 18980!:mime application/vnd.tcpdump.pcap 18981>0 use \^pcap-be 18982 18983# 18984# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 18985# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 18986# the main program that uses that format, but there are other programs 18987# that use "libpcap", or that use the same capture file format.) 18988# 189890 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) 18990>0 use pcap-be 189910 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) 18992>0 use \^pcap-be 18993 18994# 18995# "pcap-ng" capture files. 18996# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html 18997# Pcap-ng files can contain multiple sections. Printing the endianness, 18998# snaplen, or other information from the first SHB may be misleading. 18999# 190000 ubelong 0x0a0d0d0a 19001>8 ubelong 0x1a2b3c4d pcap-ng capture file 19002>>12 beshort x - version %d 19003>>14 beshort x \b.%d 190040 ulelong 0x0a0d0d0a 19005>8 ulelong 0x1a2b3c4d pcap-ng capture file 19006>>12 leshort x - version %d 19007>>14 leshort x \b.%d 19008 19009# 19010# AIX "iptrace" capture files. 19011# 190120 string iptrace\ 1.0 "iptrace" capture file 190130 string iptrace\ 2.0 "iptrace" capture file 19014 19015# 19016# Novell LANalyzer capture files. 19017# 190180 leshort 0x1001 LANalyzer capture file 190190 leshort 0x1007 LANalyzer capture file 19020 19021# 19022# HP-UX "nettl" capture files. 19023# 190240 string \x54\x52\x00\x64\x00 "nettl" capture file 19025 19026# 19027# RADCOM WAN/LAN Analyzer capture files. 19028# 190290 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 19030 19031# 19032# NetStumbler log files. Not really packets, per se, but about as 19033# close as you can get. These are log files from NetStumbler, a 19034# Windows program, that scans for 802.11b networks. 19035# 190360 string NetS NetStumbler log file 19037>8 lelong x \b, %d stations found 19038 19039# 19040# *Peek tagged capture files. 19041# 190420 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 19043 19044# 19045# Visual Networks traffic capture files. 19046# 190470 string \x05VNF Visual Networks traffic capture file 19048 19049# 19050# Network Instruments Observer capture files. 19051# 190520 string ObserverPktBuffe Network Instruments Observer capture file 19053 19054# 19055# Files from Accellent Group's 5View products. 19056# 190570 string \xaa\xaa\xaa\xaa 5View capture file 19058 19059#------------------------------------------------------------------------------ 19060# $File$ 19061# softquad: file(1) magic for SoftQuad Publishing Software 19062# 19063# Author/Editor and RulesBuilder 19064# 19065# XXX - byte order? 19066# 190670 string \<!SQ\ DTD> Compiled SGML rules file 19068>9 string >\0 Type %s 190690 string \<!SQ\ A/E> A/E SGML Document binary 19070>9 string >\0 Type %s 190710 string \<!SQ\ STS> A/E SGML binary styles file 19072>9 string >\0 Type %s 190730 short 0xc0de Compiled PSI (v1) data 190740 short 0xc0da Compiled PSI (v2) data 19075>3 string >\0 (%s) 19076# Binary sqtroff font/desc files... 190770 short 0125252 SoftQuad DESC or font file binary 19078>2 short >0 - version %d 19079# Bitmaps... 190800 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 19081#0 string SQ\ BITMAP2 SoftQuad Raster Format data 19082# sqtroff intermediate language (replacement for ditroff int. lang.) 190830 string X\ SoftQuad troff Context intermediate 19084>2 string 495 for AT&T 495 laser printer 19085>2 string hp for Hewlett-Packard LaserJet 19086>2 string impr for IMAGEN imPRESS 19087>2 string ps for PostScript 19088 19089# From: Michael Piefel <piefel@debian.org> 19090# sqtroff intermediate language (replacement for ditroff int. lang.) 190910 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 190920 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 190930 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 190940 string X\ ps SoftQuad troff Context intermediate for PostScript 19095 19096#------------------------------------------------------------------------------ 19097# $File$ 19098# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 19099# 19100# Cloyce D. Spradling <cloyce@headgear.org> 19101 191020 string spec SPEC 19103>4 string .cpu CPU 19104>>8 string <: \b%.4s 19105>>12 string . raw result text 19106 1910717 string version=SPECjbb SPECjbb 19108>32 string <: \b%.4s 19109>>37 string <: v%.4s raw result text 19110 191110 string BEGIN\040SPECWEB SPECweb 19112>13 string <: \b%.2s 19113>>15 string _SSL \b_SSL 19114>>>20 string <: v%.4s raw result text 19115>>16 string <: v%.4s raw result text 19116 19117#------------------------------------------------------------------------------ 19118# $File: spectrum,v 1.6 2009/09/19 16:28:12 christos Exp $ 19119# spectrum: file(1) magic for Spectrum emulator files. 19120# 19121# John Elliott <jce@seasip.demon.co.uk> 19122 19123# 19124# Spectrum +3DOS header 19125# 191260 string PLUS3DOS\032 Spectrum +3 data 19127>15 byte 0 - BASIC program 19128>15 byte 1 - number array 19129>15 byte 2 - character array 19130>15 byte 3 - memory block 19131>>16 belong 0x001B0040 (screen) 19132>15 byte 4 - Tasword document 19133>15 string TAPEFILE - ZXT tapefile 19134# 19135# Tape file. This assumes the .TAP starts with a Spectrum-format header, 19136# which nearly all will. 19137# 19138# Update: Sanity-check string contents to be printable. 19139# -Adam Buchbinder <adam.buchbinder@gmail.com> 19140# 191410 string \023\000\000 19142>4 string >\0 19143>>4 string <\177 Spectrum .TAP data "%-10.10s" 19144>>>3 byte 0 - BASIC program 19145>>>3 byte 1 - number array 19146>>>3 byte 2 - character array 19147>>>3 byte 3 - memory block 19148>>>>14 belong 0x001B0040 (screen) 19149 19150# The following three blocks are from pak21-spectrum@srcf.ucam.org 19151# TZX tape images 191520 string ZXTape!\x1a Spectrum .TZX data 19153>8 byte x version %d 19154>9 byte x \b.%d 19155 19156# RZX input recording files 191570 string RZX! Spectrum .RZX data 19158>4 byte x version %d 19159>5 byte x \b.%d 19160 19161# Floppy disk images 191620 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 191630 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 191640 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 191650 string SINCLAIR Spectrum .SCL Betadisk image 19166 19167# Hard disk images 191680 string RS-IDE\x1a Spectrum .HDF hard disk image 19169>7 byte x \b, version 0x%02x 19170 19171#------------------------------------------------------------------------------ 19172# $File: sql,v 1.14 2014/04/28 12:04:50 christos Exp $ 19173# sql: file(1) magic for SQL files 19174# 19175# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 19176# Recognize some MySQL files. 19177# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 19178# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 19179# 191800 beshort 0xfe01 MySQL table definition file 19181>2 byte x Version %d 191820 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 19183>3 byte x Version %d 191840 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 19185>3 byte x Version %d 191860 belong&0xffffff00 0xfefe0900 MySQL Maria index file 19187>3 byte x Version %d 191880 belong&0xffffff00 0xfefe0A00 MySQL Maria compressed data file 19189>3 byte x Version %d 191900 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 19191>3 byte x Version %d 191920 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 19193>3 byte x Version %d 191940 string \376bin MySQL replication log 191950 belong&0xffffff00 0xfefe0b00 19196>4 string MARIALOG MySQL Maria transaction log file 19197>>3 byte x Version %d 191980 belong&0xffffff00 0xfefe0c00 19199>4 string MACF MySQL Maria control file 19200>>3 byte x Version %d 19201 19202#------------------------------------------------------------------------------ 19203# iRiver H Series database file 19204# From Ken Guest <ken@linux.ie> 19205# As observed from iRivNavi.iDB and unencoded firmware 19206# 192070 string iRivDB iRiver Database file 19208>11 string >\0 Version %s 19209>39 string iHP-100 [H Series] 19210 19211#------------------------------------------------------------------------------ 19212# SQLite database files 19213# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 19214# 19215# Version 1 used GDBM internally; its files cannot be distinguished 19216# from other GDBM files. 19217# 19218# Version 2 used this format: 192190 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 19220 19221# Version 3 of SQLite allows applications to embed their own "user version" 19222# number in the database at offset 60. Later, SQLite added an "application id" 19223# at offset 68 that is preferred over "user version" for indicating the 19224# associated application. 19225# 192260 string SQLite\ format\ 3 19227>60 belong =0x5f4d544e Monotone source repository - SQLite3 database 19228>68 belong =0x0f055112 Fossil checkout - SQLite3 database 19229>68 belong =0x0f055113 Fossil global configuration - SQLite3 database 19230>68 belong =0x0f055111 Fossil repository - SQLite3 database 19231>68 belong =0x42654462 Bentley Systems BeSQLite Database - SQLite3 database 19232>68 belong =0x42654c6e Bentley Systems Localization File - SQLite3 database 19233>68 belong =0x47504b47 OGC GeoPackage file - SQLite3 database 19234>68 default x SQLite 3.x database 19235>>68 belong !0 \b, application id %u 19236>>60 belong !0 \b, user version %d 19237 19238# SQLite Write-Ahead Log from SQLite version >= 3.7.0 19239# http://www.sqlite.org/fileformat.html#walformat 192400 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 19241>4 belong x version %d 19242 19243# SQLite Rollback Journal 19244# http://www.sqlite.org/fileformat.html#rollbackjournal 192450 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 19246 19247# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 19248# http://www.ullrich.es/job/service-menue/panasonic/panasonic-sendersortierung-sat-am-pc/ 19249# pceditor_V2003.jar 192500 string PSDB\0 Panasonic channel list database 19251>126 string SQLite\ format\ 3 19252>>&-15 indirect x \b; contains 19253# Type: OpenSSH key files 19254# From: Nicolas Collignon <tsointsoin@gmail.com> 19255 192560 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 19257>28 string >\0 version %s 192580 string -----BEGIN\ OPENSSH\ PRIVATE\ KEY----- OpenSSH private key 19259 192600 string ssh-dss\ OpenSSH DSA public key 192610 string ssh-rsa\ OpenSSH RSA public key 192620 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 192630 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 192640 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 192650 string ssh-ed25519 OpenSSH ED25519 public key 19266# Type: OpenSSL certificates/key files 19267# From: Nicolas Collignon <tsointsoin@gmail.com> 19268 192690 string -----BEGIN\ CERTIFICATE----- PEM certificate 192700 string -----BEGIN\ CERTIFICATE\ REQ PEM certificate request 192710 string -----BEGIN\ RSA\ PRIVATE PEM RSA private key 192720 string -----BEGIN\ DSA\ PRIVATE PEM DSA private key 192730 string -----BEGIN\ EC\ PRIVATE PEM EC private key 19274 19275#------------------------------------------------------------------------------ 19276# $File: sun,v 1.26 2014/03/29 15:40:34 christos Exp $ 19277# sun: file(1) magic for Sun machines 19278# 19279# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 19280# releases. (5.x uses ELF.) Entries for executables without an 19281# architecture type, used before the 68020-based Sun-3's came out, 19282# are in aout, as they're indistinguishable from other big-endian 19283# 32-bit a.out files. 19284# 192850 belong&077777777 0600413 a.out SunOS SPARC demand paged 19286>0 byte &0x80 19287>>20 belong <4096 shared library 19288>>20 belong =4096 dynamically linked executable 19289>>20 belong >4096 dynamically linked executable 19290>0 byte ^0x80 executable 19291>16 belong >0 not stripped 19292 192930 belong&077777777 0600410 a.out SunOS SPARC pure 19294>0 byte &0x80 dynamically linked executable 19295>0 byte ^0x80 executable 19296>16 belong >0 not stripped 19297 192980 belong&077777777 0600407 a.out SunOS SPARC 19299>0 byte &0x80 dynamically linked executable 19300>0 byte ^0x80 executable 19301>16 belong >0 not stripped 19302 193030 belong&077777777 0400413 a.out SunOS mc68020 demand paged 19304>0 byte &0x80 19305>>20 belong <4096 shared library 19306>>20 belong =4096 dynamically linked executable 19307>>20 belong >4096 dynamically linked executable 19308>0 byte ^0x80 executable 19309>16 belong >0 not stripped 19310 193110 belong&077777777 0400410 a.out SunOS mc68020 pure 19312>0 byte &0x80 dynamically linked executable 19313>0 byte ^0x80 executable 19314>16 belong >0 not stripped 19315 193160 belong&077777777 0400407 a.out SunOS mc68020 19317>0 byte &0x80 dynamically linked executable 19318>0 byte ^0x80 executable 19319>16 belong >0 not stripped 19320 193210 belong&077777777 0200413 a.out SunOS mc68010 demand paged 19322>0 byte &0x80 19323>>20 belong <4096 shared library 19324>>20 belong =4096 dynamically linked executable 19325>>20 belong >4096 dynamically linked executable 19326>0 byte ^0x80 executable 19327>16 belong >0 not stripped 19328 193290 belong&077777777 0200410 a.out SunOS mc68010 pure 19330>0 byte &0x80 dynamically linked executable 19331>0 byte ^0x80 executable 19332>16 belong >0 not stripped 19333 193340 belong&077777777 0200407 a.out SunOS mc68010 19335>0 byte &0x80 dynamically linked executable 19336>0 byte ^0x80 executable 19337>16 belong >0 not stripped 19338 19339# 19340# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 19341# binary executed in compatibility mode under SunOS 5.x". 19342# 193430 belong 0x080456 SunOS core file 19344>4 belong 432 (SPARC) 19345>>132 string >\0 from '%s' 19346>>116 belong =3 (quit) 19347>>116 belong =4 (illegal instruction) 19348>>116 belong =5 (trace trap) 19349>>116 belong =6 (abort) 19350>>116 belong =7 (emulator trap) 19351>>116 belong =8 (arithmetic exception) 19352>>116 belong =9 (kill) 19353>>116 belong =10 (bus error) 19354>>116 belong =11 (segmentation violation) 19355>>116 belong =12 (bad argument to system call) 19356>>116 belong =29 (resource lost) 19357>>120 belong x (T=%dK, 19358>>124 belong x D=%dK, 19359>>128 belong x S=%dK) 19360>4 belong 826 (68K) 19361>>128 string >\0 from '%s' 19362>4 belong 456 (SPARC 4.x BCP) 19363>>152 string >\0 from '%s' 19364# Sun SunPC 193650 long 0xfa33c08e SunPC 4.0 Hard Disk 193660 string #SUNPC_CONFIG SunPC 4.0 Properties Values 19367# Sun snoop (see RFC 1761, which describes the capture file format, 19368# RFC 3827, which describes some additional datalink types, and 19369# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 19370# which is the IANA registry of Snoop datalink types) 19371# 193720 string snoop Snoop capture file 19373>8 belong >0 - version %d 19374>12 belong 0 (IEEE 802.3) 19375>12 belong 1 (IEEE 802.4) 19376>12 belong 2 (IEEE 802.5) 19377>12 belong 3 (IEEE 802.6) 19378>12 belong 4 (Ethernet) 19379>12 belong 5 (HDLC) 19380>12 belong 6 (Character synchronous) 19381>12 belong 7 (IBM channel-to-channel adapter) 19382>12 belong 8 (FDDI) 19383>12 belong 9 (Other) 19384>12 belong 10 (type %d) 19385>12 belong 11 (type %d) 19386>12 belong 12 (type %d) 19387>12 belong 13 (type %d) 19388>12 belong 14 (type %d) 19389>12 belong 15 (type %d) 19390>12 belong 16 (Fibre Channel) 19391>12 belong 17 (ATM) 19392>12 belong 18 (ATM Classical IP) 19393>12 belong 19 (type %d) 19394>12 belong 20 (type %d) 19395>12 belong 21 (type %d) 19396>12 belong 22 (type %d) 19397>12 belong 23 (type %d) 19398>12 belong 24 (type %d) 19399>12 belong 25 (type %d) 19400>12 belong 26 (IP over Infiniband) 19401>12 belong >26 (type %d) 19402 19403#--------------------------------------------------------------------------- 19404# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 19405# lead Sun/Cobalt developer) who agrees that they are good and worthy of 19406# inclusion. 19407 19408# Boot ROM images for Sun/Cobalt Linux server appliances 194090 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 19410>38 string x V%.4s 19411 19412# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 19413# at the very end where file(1) can't get it. 194140 string CRfs COBALT boot rom data (Flat boot rom or file system) 19415 19416#------------------------------------------------------------------------------ 19417# msx: file(1) magic for the SymbOS operating system 19418# http://www.symbos.de 19419# Fabio R. Schmidlin <frs@pop.com.br> 19420 19421# SymbOS EXE file 194220x30 string SymExe SymbOS executable 19423>0x36 ubyte x v%c 19424>0x37 ubyte x \b.%c 19425>0xF string x \b, name: %s 19426 19427# SymbOS DOX document 194280 string INFOq\0 SymbOS DOX document 19429 19430# Symbos driver 194310 string SMD1 SymbOS driver 19432>19 byte x \b, name: %c 19433>20 byte x \b%c 19434>21 byte x \b%c 19435>22 byte x \b%c 19436>23 byte x \b%c 19437>24 byte x \b%c 19438>25 byte x \b%c 19439>26 byte x \b%c 19440>27 byte x \b%c 19441>28 byte x \b%c 19442>29 byte x \b%c 19443>30 byte x \b%c 19444>31 byte x \b%c 19445 19446# Symbos video 194470 string SymVid SymbOS video 19448>6 ubyte x v%c 19449>7 ubyte x \b.%c 19450 19451# Soundtrakker 128 ST2 music 194520 byte 0 19453>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 19454>>1 string x name: %s 19455 19456 19457 19458#------------------------------------------------------------------------ 19459# $File: sysex,v 1.7 2013/09/16 15:12:42 christos Exp $ 19460# sysex: file(1) magic for MIDI sysex files 19461# 19462# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 19463# where real SYStem EXclusive messages at offset 1 are limited to seven bits 19464# http://en.wikipedia.org/wiki/MIDI 194650 ubeshort&0xFF80 0xF000 SysEx File - 19466 19467# North American Group 19468>1 byte 0x01 Sequential 19469>1 byte 0x02 IDP 19470>1 byte 0x03 OctavePlateau 19471>1 byte 0x04 Moog 19472>1 byte 0x05 Passport 19473>1 byte 0x06 Lexicon 19474>1 byte 0x07 Kurzweil/Future Retro 19475>>3 byte 0x77 777 19476>>4 byte 0x00 Bank 19477>>4 byte 0x01 Song 19478>>5 byte 0x0f 16 19479>>5 byte 0x0e 15 19480>>5 byte 0x0d 14 19481>>5 byte 0x0c 13 19482>>5 byte 0x0b 12 19483>>5 byte 0x0a 11 19484>>5 byte 0x09 10 19485>>5 byte 0x08 9 19486>>5 byte 0x07 8 19487>>5 byte 0x06 7 19488>>5 byte 0x05 6 19489>>5 byte 0x04 5 19490>>5 byte 0x03 4 19491>>5 byte 0x02 3 19492>>5 byte 0x01 2 19493>>5 byte 0x00 1 19494>>5 byte 0x10 (ALL) 19495>>2 byte x \b, Channel %d 19496>1 byte 0x08 Fender 19497>1 byte 0x09 Gulbransen 19498>1 byte 0x0a AKG 19499>1 byte 0x0b Voyce 19500>1 byte 0x0c Waveframe 19501>1 byte 0x0d ADA 19502>1 byte 0x0e Garfield 19503>1 byte 0x0f Ensoniq 19504>1 byte 0x10 Oberheim 19505>>2 byte 0x06 Matrix 6 series 19506>>3 byte 0x0A Dump (All) 19507>>3 byte 0x01 Dump (Bank) 19508>>4 belong 0x0002040E Matrix 1000 19509>>>11 byte <2 User bank %d 19510>>>11 byte >1 Preset bank %d 19511>1 byte 0x11 Apple 19512>1 byte 0x12 GreyMatter 19513>1 byte 0x14 PalmTree 19514>1 byte 0x15 JLCooper 19515>1 byte 0x16 Lowrey 19516>1 byte 0x17 AdamsSmith 19517>1 byte 0x18 E-mu 19518>1 byte 0x19 Harmony 19519>1 byte 0x1a ART 19520>1 byte 0x1b Baldwin 19521>1 byte 0x1c Eventide 19522>1 byte 0x1d Inventronics 19523>1 byte 0x1f Clarity 19524 19525# European Group 19526>1 byte 0x21 SIEL 19527>1 byte 0x22 Synthaxe 19528>1 byte 0x24 Hohner 19529>1 byte 0x25 Twister 19530>1 byte 0x26 Solton 19531>1 byte 0x27 Jellinghaus 19532>1 byte 0x28 Southworth 19533>1 byte 0x29 PPG 19534>1 byte 0x2a JEN 19535>1 byte 0x2b SSL 19536>1 byte 0x2c AudioVertrieb 19537 19538>1 byte 0x2f ELKA 19539>>3 byte 0x09 EK-44 19540 19541>1 byte 0x30 Dynacord 19542>1 byte 0x31 Jomox 19543>1 byte 0x33 Clavia 19544>1 byte 0x39 Soundcraft 19545# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 19546>1 byte 0x3e Waldorf 19547>>2 byte 0x00 microWave 19548>>2 byte 0x0E microwave2 / XT 19549>>2 byte 0x0F Q / Q+ 19550>>3 byte =0 (default id) 19551>>3 byte >0 ( 19552>>>3 byte <0x7F \bdevice %d) 19553>>>3 byte =0x7F \bbroadcast id) 19554>>3 byte 0x7f Microwave I 19555>>>4 byte 0x00 SNDR (Sound Request) 19556>>>4 byte 0x10 SNDD (Sound Dump) 19557>>>4 byte 0x20 SNDP (Sound Parameter Change) 19558>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 19559>>>4 byte 0x70 BOOT (Sound Reserved) 19560>>>4 byte 0x01 MULR (Multi Request) 19561>>>4 byte 0x11 MULD (Multi Dump) 19562>>>4 byte 0x21 MULP (Multi Parameter Change) 19563>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 19564>>>4 byte 0x71 OS (Multi Reserved) 19565>>>4 byte 0x02 DRMR (Drum Map Request) 19566>>>4 byte 0x12 DRMD (Drum Map Dump) 19567>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 19568>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 19569>>>4 byte 0x72 BIN (Drum Map Reserved) 19570>>>4 byte 0x03 PATR (Sequencer Pattern Request) 19571>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 19572>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 19573>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 19574>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 19575>>>4 byte 0x04 GLBR (Global Parameter Request) 19576>>>4 byte 0x14 GLBD (Global Parameter Dump) 19577>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 19578>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 19579>>>4 byte 0x07 MODR (Mode Parameter Request) 19580>>>4 byte 0x17 MODD (Mode Parameter Dump) 19581>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 19582>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 19583>>2 byte 0x10 microQ 19584>>>4 byte 0x00 SNDR (Sound Request) 19585>>>4 byte 0x10 SNDD (Sound Dump) 19586>>>4 byte 0x20 SNDP (Sound Parameter Change) 19587>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 19588>>>4 byte 0x70 (Sound Reserved) 19589>>>4 byte 0x01 MULR (Multi Request) 19590>>>4 byte 0x11 MULD (Multi Dump) 19591>>>4 byte 0x21 MULP (Multi Parameter Change) 19592>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 19593>>>4 byte 0x71 OS (Multi Reserved) 19594>>>4 byte 0x02 DRMR (Drum Map Request) 19595>>>4 byte 0x12 DRMD (Drum Map Dump) 19596>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 19597>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 19598>>>4 byte 0x72 BIN (Drum Map Reserved) 19599>>>4 byte 0x04 GLBR (Global Parameter Request) 19600>>>4 byte 0x14 GLBD (Global Parameter Dump) 19601>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 19602>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 19603>>2 byte 0x11 rackAttack 19604>>>4 byte 0x00 SNDR (Sound Parameter Request) 19605>>>4 byte 0x10 SNDD (Sound Parameter Dump) 19606>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 19607>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 19608>>>4 byte 0x01 PRGR (Program Parameter Request) 19609>>>4 byte 0x11 PRGD (Program Parameter Dump) 19610>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 19611>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 19612>>>4 byte 0x71 OS (Program Parameter Reserved) 19613>>>4 byte 0x03 PATR (Pattern Parameter Request) 19614>>>4 byte 0x13 PATD (Pattern Parameter Dump) 19615>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 19616>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 19617>>>4 byte 0x04 GLBR (Global Parameter Request) 19618>>>4 byte 0x14 GLBD (Global Parameter Dump) 19619>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 19620>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 19621>>>4 byte 0x05 EFXR (FX Parameter Request) 19622>>>4 byte 0x15 EFXD (FX Parameter Dump) 19623>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 19624>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 19625>>>4 byte 0x07 MODR (Mode Command Request) 19626>>>4 byte 0x17 MODD (Mode Command Dump) 19627>>>4 byte 0x27 MODP (Mode Command Parameter Change) 19628>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 19629>>2 byte 0x03 Wave 19630>>>4 byte 0x00 SBPR (Soundprogram) 19631>>>4 byte 0x01 SAPR (Performance) 19632>>>4 byte 0x02 SWAVE (Wave) 19633>>>4 byte 0x03 SWTBL (Wave control table) 19634>>>4 byte 0x04 SVT (Velocity Curve) 19635>>>4 byte 0x05 STT (Tuning Table) 19636>>>4 byte 0x06 SGLB (Global Parameters) 19637>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 19638>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 19639>>>4 byte 0x09 SBPRPAR (Sound Parameter) 19640>>>4 byte 0x0A SARRPAR (Performance Parameter) 19641>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 19642>>>4 byte 0x0F SBULK (Bulk Switch on/off) 19643 19644# Japanese Group 19645>1 byte 0x40 Kawai 19646>>3 byte 0x20 K1 19647>>3 byte 0x22 K4 19648 19649>1 byte 0x41 Roland 19650>>3 byte 0x14 D-50 19651>>3 byte 0x2b U-220 19652>>3 byte 0x02 TR-707 19653 19654>1 byte 0x42 Korg 19655>>3 byte 0x19 M1 19656 19657>1 byte 0x43 Yamaha 19658>1 byte 0x44 Casio 19659>1 byte 0x46 Kamiya 19660>1 byte 0x47 Akai 19661>1 byte 0x48 Victor 19662>1 byte 0x49 Mesosha 19663>1 byte 0x4b Fujitsu 19664>1 byte 0x4c Sony 19665>1 byte 0x4e Teac 19666>1 byte 0x50 Matsushita 19667>1 byte 0x51 Fostex 19668>1 byte 0x52 Zoom 19669>1 byte 0x54 Matsushita 19670>1 byte 0x57 Acoustic tech. lab. 19671# http://www.midi.org/techspecs/manid.php 19672>1 belong&0xffffff00 0x00007400 Ta Horng 19673>1 belong&0xffffff00 0x00007500 e-Tek 19674>1 belong&0xffffff00 0x00007600 E-Voice 19675>1 belong&0xffffff00 0x00007700 Midisoft 19676>1 belong&0xffffff00 0x00007800 Q-Sound 19677>1 belong&0xffffff00 0x00007900 Westrex 19678>1 belong&0xffffff00 0x00007a00 Nvidia* 19679>1 belong&0xffffff00 0x00007b00 ESS 19680>1 belong&0xffffff00 0x00007c00 Mediatrix 19681>1 belong&0xffffff00 0x00007d00 Brooktree 19682>1 belong&0xffffff00 0x00007e00 Otari 19683>1 belong&0xffffff00 0x00007f00 Key Electronics 19684>1 belong&0xffffff00 0x00010000 Shure 19685>1 belong&0xffffff00 0x00010100 AuraSound 19686>1 belong&0xffffff00 0x00010200 Crystal 19687>1 belong&0xffffff00 0x00010300 Rockwell 19688>1 belong&0xffffff00 0x00010400 Silicon Graphics 19689>1 belong&0xffffff00 0x00010500 Midiman 19690>1 belong&0xffffff00 0x00010600 PreSonus 19691>1 belong&0xffffff00 0x00010800 Topaz 19692>1 belong&0xffffff00 0x00010900 Cast Lightning 19693>1 belong&0xffffff00 0x00010a00 Microsoft 19694>1 belong&0xffffff00 0x00010b00 Sonic Foundry 19695>1 belong&0xffffff00 0x00010c00 Line 6 19696>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 19697>1 belong&0xffffff00 0x00010e00 Van Koerving 19698>1 belong&0xffffff00 0x00010f00 Altech Systems 19699>1 belong&0xffffff00 0x00011000 S & S Research 19700>1 belong&0xffffff00 0x00011100 VLSI Technology 19701>1 belong&0xffffff00 0x00011200 Chromatic 19702>1 belong&0xffffff00 0x00011300 Sapphire 19703>1 belong&0xffffff00 0x00011400 IDRC 19704>1 belong&0xffffff00 0x00011500 Justonic Tuning 19705>1 belong&0xffffff00 0x00011600 TorComp 19706>1 belong&0xffffff00 0x00011700 Newtek Inc. 19707>1 belong&0xffffff00 0x00011800 Sound Sculpture 19708>1 belong&0xffffff00 0x00011900 Walker Technical 19709>1 belong&0xffffff00 0x00011a00 Digital Harmony 19710>1 belong&0xffffff00 0x00011b00 InVision 19711>1 belong&0xffffff00 0x00011c00 T-Square 19712>1 belong&0xffffff00 0x00011d00 Nemesys 19713>1 belong&0xffffff00 0x00011e00 DBX 19714>1 belong&0xffffff00 0x00011f00 Syndyne 19715>1 belong&0xffffff00 0x00012000 Bitheadz 19716>1 belong&0xffffff00 0x00012100 Cakewalk 19717>1 belong&0xffffff00 0x00012200 Staccato 19718>1 belong&0xffffff00 0x00012300 National Semicon. 19719>1 belong&0xffffff00 0x00012400 Boom Theory 19720>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 19721>1 belong&0xffffff00 0x00012600 Antares 19722>1 belong&0xffffff00 0x00012700 Angel Software 19723>1 belong&0xffffff00 0x00012800 St Louis Music 19724>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 19725>1 belong&0xffffff00 0x00012a00 Ashley Audio 19726>1 belong&0xffffff00 0x00012b00 Vari-Lite 19727>1 belong&0xffffff00 0x00012c00 Summit Audio 19728>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 19729>1 belong&0xffffff00 0x00012e00 SeaSound 19730>1 belong&0xffffff00 0x00012f00 U.S. Robotics 19731>1 belong&0xffffff00 0x00013000 Aurisis 19732>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 19733>1 belong&0xffffff00 0x00013200 FM7 Inc. 19734>1 belong&0xffffff00 0x00013300 Swivel Systems 19735>1 belong&0xffffff00 0x00013400 Hyperactive 19736>1 belong&0xffffff00 0x00013500 MidiLite 19737>1 belong&0xffffff00 0x00013600 Radical 19738>1 belong&0xffffff00 0x00013700 Roger Linn 19739>1 belong&0xffffff00 0x00013800 Helicon 19740>1 belong&0xffffff00 0x00013900 Event 19741>1 belong&0xffffff00 0x00013a00 Sonic Network 19742>1 belong&0xffffff00 0x00013b00 Realtime Music 19743>1 belong&0xffffff00 0x00013c00 Apogee Digital 19744 19745>1 belong&0xffffff00 0x00202b00 Medeli Electronics 19746>1 belong&0xffffff00 0x00202c00 Charlie Lab 19747>1 belong&0xffffff00 0x00202d00 Blue Chip Music 19748>1 belong&0xffffff00 0x00202e00 BEE OH Corp 19749>1 belong&0xffffff00 0x00202f00 LG Semicon America 19750>1 belong&0xffffff00 0x00203000 TESI 19751>1 belong&0xffffff00 0x00203100 EMAGIC 19752>1 belong&0xffffff00 0x00203200 Behringer 19753>1 belong&0xffffff00 0x00203300 Access Music 19754>1 belong&0xffffff00 0x00203400 Synoptic 19755>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 19756>1 belong&0xffffff00 0x00203600 Terratec 19757>1 belong&0xffffff00 0x00203700 Proel SpA 19758>1 belong&0xffffff00 0x00203800 IBK MIDI 19759>1 belong&0xffffff00 0x00203900 IRCAM 19760>1 belong&0xffffff00 0x00203a00 Propellerhead Software 19761>1 belong&0xffffff00 0x00203b00 Red Sound Systems 19762>1 belong&0xffffff00 0x00203c00 Electron ESI AB 19763>1 belong&0xffffff00 0x00203d00 Sintefex Audio 19764>1 belong&0xffffff00 0x00203e00 Music and More 19765>1 belong&0xffffff00 0x00203f00 Amsaro 19766>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 19767>1 belong&0xffffff00 0x00204100 Touched by Sound 19768>1 belong&0xffffff00 0x00204200 DSP Arts 19769>1 belong&0xffffff00 0x00204300 Phil Rees Music 19770>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 19771>1 belong&0xffffff00 0x00204500 Soundart 19772>1 belong&0xffffff00 0x00204600 C-Mexx Software 19773>1 belong&0xffffff00 0x00204700 Klavis Tech. 19774>1 belong&0xffffff00 0x00204800 Noteheads AB 19775 197760 string T707 Roland TR-707 Data 19777#------------------------------------------------------------------------------ 19778# file: file(1) magic for Tcl scripting language 19779# URL: http://www.tcl.tk/ 19780# From: gustaf neumann 19781 19782# Tcl scripts 197830 search/1/w #!\ /usr/bin/tcl Tcl script text executable 19784!:mime text/x-tcl 197850 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 19786!:mime text/x-tcl 197870 search/1 #!/usr/bin/env\ tcl Tcl script text executable 19788!:mime text/x-tcl 197890 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 19790!:mime text/x-tcl 197910 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 19792!:mime text/x-tcl 197930 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 19794!:mime text/x-tcl 197950 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 19796!:mime text/x-tcl 197970 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 19798!:mime text/x-tcl 19799 19800# check the first line 198010 search/1 package\ req 19802>0 regex \^package[\ \t]+req Tcl script 19803# not 'p', check other lines 198040 search/1 !p 19805>0 regex \^package[\ \t]+req Tcl script 19806 19807#------------------------------------------------------------------------------ 19808# $File$ 19809# teapot: file(1) magic for "teapot" spreadsheet 19810# 198110 string #!teapot\012xdr teapot work sheet (XDR format) 19812 19813#------------------------------------------------------------------------------ 19814# $File$ 19815# terminfo: file(1) magic for terminfo 19816# 19817# XXX - byte order for screen images? 19818# 198190 string \032\001 Compiled terminfo entry 198200 short 0433 Curses screen image 198210 short 0434 Curses screen image 19822 19823#------------------------------------------------------------------------------ 19824# $File: tex,v 1.19 2013/09/17 17:39:16 christos Exp $ 19825# tex: file(1) magic for TeX files 19826# 19827# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 19828# 19829# From <conklin@talisman.kaleida.com> 19830 19831# Although we may know the offset of certain text fields in TeX DVI 19832# and font files, we can't use them reliably because they are not 19833# zero terminated. [but we do anyway, christos] 198340 string \367\002 TeX DVI file 19835!:mime application/x-dvi 19836>16 string >\0 (%s) 198370 string \367\203 TeX generic font data 198380 string \367\131 TeX packed font data 19839>3 string >\0 (%s) 198400 string \367\312 TeX virtual font data 198410 search/1 This\ is\ TeX, TeX transcript text 198420 search/1 This\ is\ METAFONT, METAFONT transcript text 19843 19844# There is no way to detect TeX Font Metric (*.tfm) files without 19845# breaking them apart and reading the data. The following patterns 19846# match most *.tfm files generated by METAFONT or afm2tfm. 198472 string \000\021 TeX font metric data 19848!:mime application/x-tex-tfm 19849>33 string >\0 (%s) 198502 string \000\022 TeX font metric data 19851!:mime application/x-tex-tfm 19852>33 string >\0 (%s) 19853 19854# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 198550 search/1 \\input\ texinfo Texinfo source text 19856!:mime text/x-texinfo 198570 search/1 This\ is\ Info\ file GNU Info text 19858!:mime text/x-info 19859 19860# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 198610 search/4096 \\input TeX document text 19862!:mime text/x-tex 19863!:strength + 15 198640 search/4096 \\begin LaTeX document text 19865!:mime text/x-tex 19866!:strength + 15 198670 search/4096 \\section LaTeX document text 19868!:mime text/x-tex 19869!:strength + 18 198700 search/4096 \\setlength LaTeX document text 19871!:mime text/x-tex 19872!:strength + 15 198730 search/4096 \\documentstyle LaTeX document text 19874!:mime text/x-tex 19875!:strength + 18 198760 search/4096 \\chapter LaTeX document text 19877!:mime text/x-tex 19878!:strength + 18 198790 search/4096 \\documentclass LaTeX 2e document text 19880!:mime text/x-tex 19881!:strength + 15 198820 search/4096 \\relax LaTeX auxiliary file 19883!:mime text/x-tex 19884!:strength + 15 198850 search/4096 \\contentsline LaTeX table of contents 19886!:mime text/x-tex 19887!:strength + 15 198880 search/4096 %\ -*-latex-*- LaTeX document text 19889!:mime text/x-tex 19890 19891# Tex document, from Hendrik Scholz <hendrik@scholz.net> 198920 search/1 \\ifx TeX document text 19893 19894# Index and glossary files 198950 search/4096 \\indexentry LaTeX raw index file 198960 search/4096 \\begin{theindex} LaTeX sorted index 198970 search/4096 \\glossaryentry LaTeX raw glossary 198980 search/4096 \\begin{theglossary} LaTeX sorted glossary 198990 search/4096 This\ is\ makeindex Makeindex log file 19900 19901# End of TeX 19902 19903#------------------------------------------------------------------------------ 19904# file(1) magic for BibTex text files 19905# From Hendrik Scholz <hendrik@scholz.net> 19906 199070 search/1/c @article{ BibTeX text file 199080 search/1/c @book{ BibTeX text file 199090 search/1/c @inbook{ BibTeX text file 199100 search/1/c @incollection{ BibTeX text file 199110 search/1/c @inproceedings{ BibTeX text file 199120 search/1/c @manual{ BibTeX text file 199130 search/1/c @misc{ BibTeX text file 199140 search/1/c @preamble{ BibTeX text file 199150 search/1/c @phdthesis{ BibTeX text file 199160 search/1/c @techreport{ BibTeX text file 199170 search/1/c @unpublished{ BibTeX text file 19918 1991973 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 19920 1992173 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 19922 199230 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 19924 199250 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 19926 199270 search/1 @c\ @mapfile{ TeX font aliases text file 19928 199290 string #LyX LyX document text 19930 19931# ConTeXt documents 19932# http://wiki.contextgarden.net/ 199330 search/4096 \\setupcolors[ ConTeXt document text 19934!:strength + 15 199350 search/4096 \\definecolor[ ConTeXt document text 19936!:strength + 15 199370 search/4096 \\setupinteraction[ ConTeXt document text 19938!:strength + 15 199390 search/4096 \\useURL[ ConTeXt document text 19940!:strength + 15 199410 search/4096 \\setuppapersize[ ConTeXt document text 19942!:strength + 15 199430 search/4096 \\setuplayout[ ConTeXt document text 19944!:strength + 15 199450 search/4096 \\setupfooter[ ConTeXt document text 19946!:strength + 15 199470 search/4096 \\setupfootertexts[ ConTeXt document text 19948!:strength + 15 199490 search/4096 \\setuppagenumbering[ ConTeXt document text 19950!:strength + 15 199510 search/4096 \\setupbodyfont[ ConTeXt document text 19952!:strength + 15 199530 search/4096 \\setuphead[ ConTeXt document text 19954!:strength + 15 199550 search/4096 \\setupitemize[ ConTeXt document text 19956!:strength + 15 199570 search/4096 \\setupwhitespace[ ConTeXt document text 19958!:strength + 15 199590 search/4096 \\setupindenting[ ConTeXt document text 19960!:strength + 15 19961 19962#------------------------------------------------------------------------------ 19963# $File: tgif,v 1.6 2010/09/20 18:55:20 rrt Exp $ 19964# file(1) magic for tgif(1) files 19965# From Hendrik Scholz <hendrik@scholz.net> 199660 string %TGIF\ Tgif file version 19967>6 string x %s 19968 19969#------------------------------------------------------------------------------ 19970# $File: ti-8x,v 1.6 2009/09/19 16:28:12 christos Exp $ 19971# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 19972# 19973# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 19974# 19975# Update: Romain Lievin (roms@lpg.ticalc.org). 19976# 19977# NOTE: This list is not complete. 19978# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 19979# program/group magic numbers in here because I cannot find any. 199800 string **TI80** TI-80 Graphing Calculator File. 199810 string **TI81** TI-81 Graphing Calculator File. 19982# 19983# Magic Numbers for the TI-73 19984# 199850 string **TI73** TI-73 Graphing Calculator 19986>0x00003B byte 0x00 (real number) 19987>0x00003B byte 0x01 (list) 19988>0x00003B byte 0x02 (matrix) 19989>0x00003B byte 0x03 (equation) 19990>0x00003B byte 0x04 (string) 19991>0x00003B byte 0x05 (program) 19992>0x00003B byte 0x06 (assembly program) 19993>0x00003B byte 0x07 (picture) 19994>0x00003B byte 0x08 (gdb) 19995>0x00003B byte 0x0C (complex number) 19996>0x00003B byte 0x0F (window settings) 19997>0x00003B byte 0x10 (zoom) 19998>0x00003B byte 0x11 (table setup) 19999>0x00003B byte 0x13 (backup) 20000 20001# Magic Numbers for the TI-82 20002# 200030 string **TI82** TI-82 Graphing Calculator 20004>0x00003B byte 0x00 (real) 20005>0x00003B byte 0x01 (list) 20006>0x00003B byte 0x02 (matrix) 20007>0x00003B byte 0x03 (Y-variable) 20008>0x00003B byte 0x05 (program) 20009>0x00003B byte 0x06 (protected prgm) 20010>0x00003B byte 0x07 (picture) 20011>0x00003B byte 0x08 (gdb) 20012>0x00003B byte 0x0B (window settings) 20013>0x00003B byte 0x0C (window settings) 20014>0x00003B byte 0x0D (table setup) 20015>0x00003B byte 0x0E (screenshot) 20016>0x00003B byte 0x0F (backup) 20017# 20018# Magic Numbers for the TI-83 20019# 200200 string **TI83** TI-83 Graphing Calculator 20021>0x00003B byte 0x00 (real) 20022>0x00003B byte 0x01 (list) 20023>0x00003B byte 0x02 (matrix) 20024>0x00003B byte 0x03 (Y-variable) 20025>0x00003B byte 0x04 (string) 20026>0x00003B byte 0x05 (program) 20027>0x00003B byte 0x06 (protected prgm) 20028>0x00003B byte 0x07 (picture) 20029>0x00003B byte 0x08 (gdb) 20030>0x00003B byte 0x0B (window settings) 20031>0x00003B byte 0x0C (window settings) 20032>0x00003B byte 0x0D (table setup) 20033>0x00003B byte 0x0E (screenshot) 20034>0x00003B byte 0x13 (backup) 20035# 20036# Magic Numbers for the TI-83+ 20037# 200380 string **TI83F* TI-83+ Graphing Calculator 20039>0x00003B byte 0x00 (real number) 20040>0x00003B byte 0x01 (list) 20041>0x00003B byte 0x02 (matrix) 20042>0x00003B byte 0x03 (equation) 20043>0x00003B byte 0x04 (string) 20044>0x00003B byte 0x05 (program) 20045>0x00003B byte 0x06 (assembly program) 20046>0x00003B byte 0x07 (picture) 20047>0x00003B byte 0x08 (gdb) 20048>0x00003B byte 0x0C (complex number) 20049>0x00003B byte 0x0F (window settings) 20050>0x00003B byte 0x10 (zoom) 20051>0x00003B byte 0x11 (table setup) 20052>0x00003B byte 0x13 (backup) 20053>0x00003B byte 0x15 (application variable) 20054>0x00003B byte 0x17 (group of variable) 20055 20056# 20057# Magic Numbers for the TI-85 20058# 200590 string **TI85** TI-85 Graphing Calculator 20060>0x00003B byte 0x00 (real number) 20061>0x00003B byte 0x01 (complex number) 20062>0x00003B byte 0x02 (real vector) 20063>0x00003B byte 0x03 (complex vector) 20064>0x00003B byte 0x04 (real list) 20065>0x00003B byte 0x05 (complex list) 20066>0x00003B byte 0x06 (real matrix) 20067>0x00003B byte 0x07 (complex matrix) 20068>0x00003B byte 0x08 (real constant) 20069>0x00003B byte 0x09 (complex constant) 20070>0x00003B byte 0x0A (equation) 20071>0x00003B byte 0x0C (string) 20072>0x00003B byte 0x0D (function GDB) 20073>0x00003B byte 0x0E (polar GDB) 20074>0x00003B byte 0x0F (parametric GDB) 20075>0x00003B byte 0x10 (diffeq GDB) 20076>0x00003B byte 0x11 (picture) 20077>0x00003B byte 0x12 (program) 20078>0x00003B byte 0x13 (range) 20079>0x00003B byte 0x17 (window settings) 20080>0x00003B byte 0x18 (window settings) 20081>0x00003B byte 0x19 (window settings) 20082>0x00003B byte 0x1A (window settings) 20083>0x00003B byte 0x1B (zoom) 20084>0x00003B byte 0x1D (backup) 20085>0x00003B byte 0x1E (unknown) 20086>0x00003B byte 0x2A (equation) 20087>0x000032 string ZS4 - ZShell Version 4 File. 20088>0x000032 string ZS3 - ZShell Version 3 File. 20089# 20090# Magic Numbers for the TI-86 20091# 200920 string **TI86** TI-86 Graphing Calculator 20093>0x00003B byte 0x00 (real number) 20094>0x00003B byte 0x01 (complex number) 20095>0x00003B byte 0x02 (real vector) 20096>0x00003B byte 0x03 (complex vector) 20097>0x00003B byte 0x04 (real list) 20098>0x00003B byte 0x05 (complex list) 20099>0x00003B byte 0x06 (real matrix) 20100>0x00003B byte 0x07 (complex matrix) 20101>0x00003B byte 0x08 (real constant) 20102>0x00003B byte 0x09 (complex constant) 20103>0x00003B byte 0x0A (equation) 20104>0x00003B byte 0x0C (string) 20105>0x00003B byte 0x0D (function GDB) 20106>0x00003B byte 0x0E (polar GDB) 20107>0x00003B byte 0x0F (parametric GDB) 20108>0x00003B byte 0x10 (diffeq GDB) 20109>0x00003B byte 0x11 (picture) 20110>0x00003B byte 0x12 (program) 20111>0x00003B byte 0x13 (range) 20112>0x00003B byte 0x17 (window settings) 20113>0x00003B byte 0x18 (window settings) 20114>0x00003B byte 0x19 (window settings) 20115>0x00003B byte 0x1A (window settings) 20116>0x00003B byte 0x1B (zoom) 20117>0x00003B byte 0x1D (backup) 20118>0x00003B byte 0x1E (unknown) 20119>0x00003B byte 0x2A (equation) 20120# 20121# Magic Numbers for the TI-89 20122# 201230 string **TI89** TI-89 Graphing Calculator 20124>0x000048 byte 0x00 (expression) 20125>0x000048 byte 0x04 (list) 20126>0x000048 byte 0x06 (matrix) 20127>0x000048 byte 0x0A (data) 20128>0x000048 byte 0x0B (text) 20129>0x000048 byte 0x0C (string) 20130>0x000048 byte 0x0D (graphic data base) 20131>0x000048 byte 0x0E (figure) 20132>0x000048 byte 0x10 (picture) 20133>0x000048 byte 0x12 (program) 20134>0x000048 byte 0x13 (function) 20135>0x000048 byte 0x14 (macro) 20136>0x000048 byte 0x1C (zipped) 20137>0x000048 byte 0x21 (assembler) 20138# 20139# Magic Numbers for the TI-92 20140# 201410 string **TI92** TI-92 Graphing Calculator 20142>0x000048 byte 0x00 (expression) 20143>0x000048 byte 0x04 (list) 20144>0x000048 byte 0x06 (matrix) 20145>0x000048 byte 0x0A (data) 20146>0x000048 byte 0x0B (text) 20147>0x000048 byte 0x0C (string) 20148>0x000048 byte 0x0D (graphic data base) 20149>0x000048 byte 0x0E (figure) 20150>0x000048 byte 0x10 (picture) 20151>0x000048 byte 0x12 (program) 20152>0x000048 byte 0x13 (function) 20153>0x000048 byte 0x14 (macro) 20154>0x000048 byte 0x1D (backup) 20155# 20156# Magic Numbers for the TI-92+/V200 20157# 201580 string **TI92P* TI-92+/V200 Graphing Calculator 20159>0x000048 byte 0x00 (expression) 20160>0x000048 byte 0x04 (list) 20161>0x000048 byte 0x06 (matrix) 20162>0x000048 byte 0x0A (data) 20163>0x000048 byte 0x0B (text) 20164>0x000048 byte 0x0C (string) 20165>0x000048 byte 0x0D (graphic data base) 20166>0x000048 byte 0x0E (figure) 20167>0x000048 byte 0x10 (picture) 20168>0x000048 byte 0x12 (program) 20169>0x000048 byte 0x13 (function) 20170>0x000048 byte 0x14 (macro) 20171>0x000048 byte 0x1C (zipped) 20172>0x000048 byte 0x21 (assembler) 20173# 20174# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 20175# 201760x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 201770 string **TIFL** TI-XX Graphing Calculator (FLASH) 20178>8 byte >0 - Revision %d 20179>>9 byte x \b.%d, 20180>12 byte >0 Revision date %02x 20181>>13 byte x \b/%02x 20182>>14 beshort x \b/%04x, 20183>17 string >/0 name: '%s', 20184>48 byte 0x74 device: TI-73, 20185>48 byte 0x73 device: TI-83+, 20186>48 byte 0x98 device: TI-89, 20187>48 byte 0x88 device: TI-92+, 20188>49 byte 0x23 type: OS upgrade, 20189>49 byte 0x24 type: application, 20190>49 byte 0x25 type: certificate, 20191>49 byte 0x3e type: license, 20192>74 lelong >0 size: %d bytes 20193 20194# VTi & TiEmu skins (TI Graphing Calculators). 20195# From: Romain Lievin (roms@lpg.ticalc.org). 20196# Magic Numbers for the VTi skins 201970 string VTI Virtual TI skin 20198>3 string v - Version 20199>>4 byte >0 \b %c 20200>>6 byte x \b.%c 20201# Magic Numbers for the TiEmu skins 202020 string TiEmu TiEmu skin 20203>6 string v - Version 20204>>7 byte >0 \b %c 20205>>9 byte x \b.%c 20206>>10 byte x \b%c 20207 20208#------------------------------------------------------------------------------ 20209# $File$ 20210# timezone: file(1) magic for timezone data 20211# 20212# from Daniel Quinlan (quinlan@yggdrasil.com) 20213# this should work on Linux, SunOS, and maybe others 20214# Added new official magic number for recent versions of the Olson code 202150 string TZif timezone data 20216>4 byte 0 \b, old version 20217>4 byte >0 \b, version %c 20218>20 belong 0 \b, no gmt time flags 20219>20 belong 1 \b, 1 gmt time flag 20220>20 belong >1 \b, %d gmt time flags 20221>24 belong 0 \b, no std time flags 20222>20 belong 1 \b, 1 std time flag 20223>24 belong >1 \b, %d std time flags 20224>28 belong 0 \b, no leap seconds 20225>28 belong 1 \b, 1 leap second 20226>28 belong >1 \b, %d leap seconds 20227>32 belong 0 \b, no transition times 20228>32 belong 1 \b, 1 transition time 20229>32 belong >1 \b, %d transition times 20230>36 belong 0 \b, no abbreviation chars 20231>36 belong 1 \b, 1 abbreviation char 20232>36 belong >1 \b, %d abbreviation chars 202330 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 202340 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 202350 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 202360 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 202370 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 202380 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 20239 20240#------------------------------------------------------------------------------ 20241# $File: troff,v 1.10 2009/09/19 16:28:12 christos Exp $ 20242# troff: file(1) magic for *roff 20243# 20244# updated by Daniel Quinlan (quinlan@yggdrasil.com) 20245 20246# troff input 202470 search/1 .\\" troff or preprocessor input text 20248!:mime text/troff 202490 search/1 '\\" troff or preprocessor input text 20250!:mime text/troff 202510 search/1 '.\\" troff or preprocessor input text 20252!:mime text/troff 202530 search/1 \\" troff or preprocessor input text 20254!:mime text/troff 202550 search/1 ''' troff or preprocessor input text 20256!:mime text/troff 202570 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text 20258!:mime text/troff 202590 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text 20260!:mime text/troff 20261 20262# ditroff intermediate output text 202630 search/1 x\ T ditroff output text 20264>4 search/1 cat for the C/A/T phototypesetter 20265>4 search/1 ps for PostScript 20266>4 search/1 dvi for DVI 20267>4 search/1 ascii for ASCII 20268>4 search/1 lj4 for LaserJet 4 20269>4 search/1 latin1 for ISO 8859-1 (Latin 1) 20270>4 search/1 X75 for xditview at 75dpi 20271>>7 search/1 -12 (12pt) 20272>4 search/1 X100 for xditview at 100dpi 20273>>8 search/1 -12 (12pt) 20274 20275# output data formats 202760 string \100\357 very old (C/A/T) troff output data 20277 20278#------------------------------------------------------------------------------ 20279# $File$ 20280# tuxedo: file(1) magic for BEA TUXEDO data files 20281# 20282# from Ian Springer <ispringer@hotmail.com> 20283# 202840 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 20285 20286#------------------------------------------------------------------------------ 20287# $File$ 20288# typeset: file(1) magic for other typesetting 20289# 202900 string Interpress/Xerox Xerox InterPress data 20291>16 string / (version 20292>>17 string >\0 %s) 20293 20294#------------------------------------------------------------------------------ 20295# $File: unicode,v 1.5 2009/09/19 16:28:13 christos Exp $ 20296# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 20297# GRR: These types should be recognised in file_ascmagic so these 20298# encodings can be treated by text patterns. 20299# Missing types are already dealt with internally. 20300# 203010 string +/v8 Unicode text, UTF-7 203020 string +/v9 Unicode text, UTF-7 203030 string +/v+ Unicode text, UTF-7 203040 string +/v/ Unicode text, UTF-7 203050 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 203060 string \000\000\376\377 Unicode text, UTF-32, big-endian 203070 string \377\376\000\000 Unicode text, UTF-32, little-endian 203080 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 20309 20310#------------------------------------------------------------------------------ 20311# $File: unknown,v 1.7 2009/09/19 16:28:13 christos Exp $ 20312# unknown: file(1) magic for unknown machines 20313# 20314# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 20315# (executable, pure, and split I&D, respectively), but the PDP-11 version 20316# doesn't have the "version %ld", which may be a bogus COFFism (I don't 20317# think there was ever COFF for the PDP-11). 20318# 20319# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 20320# long, as it would be on a VAX. In any case, that could collide with 20321# VAX demand-paged files, as the magic number is little-endian on those 20322# binaries, so the first 16 bits of the file would contain 0x10B. 20323# 20324# Therefore, those entries are commented out. 20325# 20326# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 20327# 20328#0 short 0x107 unknown machine executable 20329#>8 short >0 not stripped 20330#>15 byte >0 - version %ld 20331#0 short 0x108 unknown pure executable 20332#>8 short >0 not stripped 20333#>15 byte >0 - version %ld 20334#0 short 0x109 PDP-11 separate I&D 20335#>8 short >0 not stripped 20336#>15 byte >0 - version %ld 20337#0 short 0x10b unknown pure executable 20338#>8 short >0 not stripped 20339#>15 byte >0 - version %ld 203400 long 0x10c unknown demand paged pure executable 20341>16 long >0 not stripped 203420 long 0x10e unknown readable demand paged pure executable 20343 20344#------------------------------------------------------------------------------ 20345# $File: uterus,v 1.2 2014/04/28 12:04:50 christos Exp $ 20346# file(1) magic for uterus files 20347# http://freecode.com/projects/uterus 20348# 203490 string UTE+ uterus file 20350>4 string v \b, version 20351>5 byte x %c 20352>6 string . \b. 20353>7 byte x \b%c 20354>8 string \<\> \b, big-endian 20355>>16 belong >0 \b, slut size %u 20356>8 string \>\< \b, litte-endian 20357>>16 lelong >0 \b, slut size %u 20358>10 byte &8 \b, compressed 20359 20360#------------------------------------------------------------------------------ 20361# $File$ 20362# uuencode: file(1) magic for ASCII-encoded files 20363# 20364 20365# GRR: the first line of xxencoded files is identical to that in uuencoded 20366# files, but the first character in most subsequent lines is 'h' instead of 20367# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 20368# punctuation and survives BITNET gateways better.) If regular expressions 20369# were supported, this entry could possibly be split into two with 20370# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 203710 search/1 begin\ uuencoded or xxencoded text 20372 20373# btoa(1) is an alternative to uuencode that requires less space. 203740 search/1 xbtoa\ Begin btoa'd text 20375 20376# ship(1) is another, much cooler alternative to uuencode. 20377# Greg Roelofs, newt@uchicago.edu 203780 search/1 $\012ship ship'd binary text 20379 20380# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 20381# Greg Roelofs, newt@uchicago.edu 203820 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 20383 20384# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 20385# Daniel Quinlan, quinlan@yggdrasil.com 2038611 search/1 must\ be\ converted\ with\ BinHex BinHex binary text 20387>41 search/1 x \b, version %.3s 20388 20389# GRR: handle BASE64 20390 20391#------------------------------------------------------------------------------ 20392# $File: varied.out,v 1.22 2010/07/02 00:06:27 christos Exp $ 20393# varied.out: file(1) magic for various USG systems 20394# 20395# Herewith many of the object file formats used by USG systems. 20396# Most have been moved to files for a particular processor, 20397# and deleted if they duplicate other entries. 20398# 203990 short 0610 Perkin-Elmer executable 20400# AMD 29K 204010 beshort 0572 amd 29k coff noprebar executable 204020 beshort 01572 amd 29k coff prebar executable 204030 beshort 0160007 amd 29k coff archive 20404# Cray 204056 beshort 0407 unicos (cray) executable 20406# Ultrix 4.3 20407596 string \130\337\377\377 Ultrix core file 20408>600 string >\0 from '%s' 20409# BeOS and MAcOS PEF executables 20410# From: hplus@zilker.net (Jon Watte) 204110 string Joy!peffpwpc header for PowerPC PEF executable 20412# 20413# ava assembler/linker Uros Platise <uros.platise@ijs.si> 204140 string avaobj AVR assembler object code 20415>7 string >\0 version '%s' 20416# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 204170 string gmon GNU prof performance data 20418>4 long x - version %d 20419# From: Dave Pearson <davep@davep.org> 20420# Harbour <URL:http://harbour-project.org/> HRB files. 204210 string \xc0HRB Harbour HRB file 20422>4 leshort x version %d 20423# Harbour HBV files 204240 string \xc0HBV Harbour variable dump file 20425>4 leshort x version %d 20426 20427# From: Alex Beregszaszi <alex@fsn.hu> 20428# 0 string exec BugOS executable 20429# 0 string pack BugOS archive 20430 20431# From: Jason Spence <jspence@lightconsulting.com> 20432# Generated by the "examples" in STM's ST40 devkit, and derived code. 204330 lelong 0x13a9f17e ST40 component image format 20434>4 string >\0 \b, name '%s' 20435 20436#------------------------------------------------------------------------------ 20437# $File: varied.script,v 1.9 2011/12/16 16:32:48 rrt Exp $ 20438# varied.script: file(1) magic for various interpreter scripts 20439 204400 string/t #!\ / a 20441>3 string >\0 %s script text executable 20442!:strength / 2 20443 204440 string/b #!\ / a 20445>3 string >\0 %s script executable (binary data) 20446!:strength / 2 20447 204480 string/t #!\t/ a 20449>3 string >\0 %s script text executable 20450!:strength / 2 20451 204520 string/b #!\t/ a 20453>3 string >\0 %s script executable (binary data) 20454!:strength / 2 20455 204560 string/t #!/ a 20457>2 string >\0 %s script text executable 20458!:strength / 2 20459 204600 string/b #!/ a 20461>2 string >\0 %s script executable (binary data) 20462!:strength / 2 20463 204640 string/t #!\ script text executable 20465>3 string >\0 for %s 20466!:strength / 3 20467 204680 string/b #!\ script executable 20469>3 string >\0 for %s (binary data) 20470!:strength / 3 20471 20472# using env 204730 string/t #!/usr/bin/env a 20474>15 string/t >\0 %s script text executable 20475!:strength / 10 20476 204770 string/b #!/usr/bin/env a 20478>15 string/b >\0 %s script executable (binary data) 20479!:strength / 10 20480 204810 string/t #!\ /usr/bin/env a 20482>16 string/t >\0 %s script text executable 20483!:strength / 10 20484 204850 string/b #!\ /usr/bin/env a 20486>16 string/b >\0 %s script executable (binary data) 20487!:strength / 10 20488 20489# From: arno <arenevier@fdn.fr> 20490# mozilla xpconnect typelib 20491# see http://www.mozilla.org/scriptable/typelib_file.html 204920 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 20493>0x10 byte x version %d 20494>>0x11 byte x \b.%d 20495 20496#------------------------------------------------------------------------------ 20497# $File: vax,v 1.8 2013/01/09 22:37:24 christos Exp $ 20498# vax: file(1) magic for VAX executable/object and APL workspace 20499# 205000 lelong 0101557 VAX single precision APL workspace 205010 lelong 0101556 VAX double precision APL workspace 20502 20503# 20504# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 20505# executables, and are handled in aout) 20506# 205070 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 20508>16 lelong >0 not stripped 20509 20510# 20511# VAX COFF 20512# 20513# The `versions' were commented out, but have been un-commented out. 20514# (Was the problem just one of endianness?) 20515# 205160 leshort 0570 VAX COFF executable 20517>12 lelong >0 not stripped 20518>22 leshort >0 - version %d 205190 leshort 0575 VAX COFF pure executable 20520>12 lelong >0 not stripped 20521>22 leshort >0 - version %d 20522 20523#------------------------------------------------------------------------------ 20524# $File$ 20525# vicar: file(1) magic for VICAR files. 20526# 20527# From: Ossama Othman <othman@astrosun.tn.cornell.edu 20528# VICAR is JPL's in-house spacecraft image processing program 20529# VICAR image 205300 string LBLSIZE= VICAR image data 20531>32 string BYTE \b, 8 bits = VAX byte 20532>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 20533>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 20534>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 20535>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 20536>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 20537# VICAR label file 2053843 string SFDU_LABEL VICAR label file 20539 20540#------------------------------------------------------------------------------ 20541# $File: virtual,v 1.5 2014/04/30 21:41:02 christos Exp $ 20542# From: James Nobis <quel@quelrod.net> 20543# Microsoft hard disk images for: 20544# Virtual Server 20545# Virtual PC 20546# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 20547# .vhd 205480 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 20549 20550# libvirt 20551# From: Philipp Hahn <hahn@univention.de> 205520 string LibvirtQemudSave Libvirt QEMU Suspend Image 20553>0x10 lelong x \b, version %u 20554>0x14 lelong x \b, XML length %u 20555>0x18 lelong 1 \b, running 20556>0x1c lelong 1 \b, compressed 20557 205580 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 20559# From: Alex Beregszaszi <alex@fsn.hu> 205600 string/b COWD VMWare3 20561>4 byte 3 disk image 20562>>32 lelong x (%d/ 20563>>36 lelong x \b%d/ 20564>>40 lelong x \b%d) 20565>4 byte 2 undoable disk image 20566>>32 string >\0 (%s) 20567 205680 string/b VMDK VMware4 disk image 205690 string/b KDMV VMware4 disk image 20570 20571#-------------------------------------------------------------------- 20572# Qemu Emulator Images 20573# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 20574# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 20575# Made by reading sources, reading documentation, and doing trial and error 20576# on existing QCOW files 205770 string/b QFI\xFB QEMU QCOW Image 20578 20579# Uncomment the following line to display Magic (only used for debugging 20580# this magic number) 20581#>0 string/b x , Magic: %s 20582 20583# There are currently 2 Versions: "1" and "2". 20584# http://www.gnome.org/~markmc/qcow-image-format-version-1.html 20585>4 belong 1 (v1) 20586 20587# Using the existence of the Backing File Offset to determine whether 20588# to read Backing File Information 20589>>12 belong >0 \b, has backing file ( 20590# Note that this isn't a null-terminated string; the length is actually 20591# (16.L). Assuming a null-terminated string happens to work usually, but it 20592# may spew junk until it reaches a \0 in some cases. 20593>>>(12.L) string >\0 \bpath %s 20594 20595# Modification time of the Backing File 20596# Really useful if you want to know if your backing 20597# file is still usable together with this image 20598>>>>20 bedate >0 \b, mtime %s) 20599>>>>20 default x \b) 20600 20601# Size is stored in bytes in a big-endian u64. 20602>>24 bequad x \b, %lld bytes 20603 20604# 1 for AES encryption, 0 for none. 20605>>36 belong 1 \b, AES-encrypted 20606 20607# http://www.gnome.org/~markmc/qcow-image-format.html 20608>4 belong 2 (v2) 20609# Using the existence of the Backing File Offset to determine whether 20610# to read Backing File Information 20611>>8 bequad >0 \b, has backing file 20612# Note that this isn't a null-terminated string; the length is actually 20613# (16.L). Assuming a null-terminated string happens to work usually, but it 20614# may spew junk until it reaches a \0 in some cases. Also, since there's no 20615# .Q modifier, we just use the bottom four bytes as an offset. Note that if 20616# the file is over 4G, and the backing file path is stored after the first 4G, 20617# the wrong filename will be printed. (This should be (8.Q), when that syntax 20618# is introduced.) 20619>>>(12.L) string >\0 (path %s) 20620>>24 bequad x \b, %lld bytes 20621>>32 belong 1 \b, AES-encrypted 20622 20623>4 belong 3 (v3) 20624# Using the existence of the Backing File Offset to determine whether 20625# to read Backing File Information 20626>>8 bequad >0 \b, has backing file 20627# Note that this isn't a null-terminated string; the length is actually 20628# (16.L). Assuming a null-terminated string happens to work usually, but it 20629# may spew junk until it reaches a \0 in some cases. Also, since there's no 20630# .Q modifier, we just use the bottom four bytes as an offset. Note that if 20631# the file is over 4G, and the backing file path is stored after the first 4G, 20632# the wrong filename will be printed. (This should be (8.Q), when that syntax 20633# is introduced.) 20634>>>(12.L) string >\0 (path %s) 20635>>24 bequad x \b, %lld bytes 20636>>32 belong 1 \b, AES-encrypted 20637 20638>4 default x (unknown version) 20639 206400 string/b QEVM QEMU suspend to disk image 20641 20642# QEMU QED Image 20643# http://wiki.qemu.org/Features/QED/Specification 206440 string/b QED\0 QEMU QED Image 20645 20646# VDI Image 20647# Sun xVM VirtualBox Disk Image 20648# From: Richard W.M. Jones <rich@annexia.org> 20649# VirtualBox Disk Image 206500x40 ulelong 0xbeda107f VirtualBox Disk Image 20651>0x44 uleshort >0 \b, major %u 20652>0x46 uleshort >0 \b, minor %u 20653>0 string >\0 (%s) 20654>368 lequad x \b, %lld bytes 20655 206560 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 20657>32 string x type %s, 20658>48 string x subtype %s 20659 206600 lelong 0x02468ace Bochs Sparse disk image 20661 20662 20663#------------------------------------------------------------------------------ 20664# $File$ 20665# Virtutech Compressed Random Access File Format 20666# 20667# From <gustav@virtutech.com> 206680 string \211\277\036\203 Virtutech CRAFF 20669>4 belong x v%d 20670>20 belong 0 uncompressed 20671>20 belong 1 bzipp2ed 20672>20 belong 2 gzipped 20673>24 belong 0 not clean 20674 20675#------------------------------------------------------------------------------ 20676# $File$ 20677# visx: file(1) magic for Visx format files 20678# 206790 short 0x5555 VISX image file 20680>2 byte 0 (zero) 20681>2 byte 1 (unsigned char) 20682>2 byte 2 (short integer) 20683>2 byte 3 (float 32) 20684>2 byte 4 (float 64) 20685>2 byte 5 (signed char) 20686>2 byte 6 (bit-plane) 20687>2 byte 7 (classes) 20688>2 byte 8 (statistics) 20689>2 byte 10 (ascii text) 20690>2 byte 15 (image segments) 20691>2 byte 100 (image set) 20692>2 byte 101 (unsigned char vector) 20693>2 byte 102 (short integer vector) 20694>2 byte 103 (float 32 vector) 20695>2 byte 104 (float 64 vector) 20696>2 byte 105 (signed char vector) 20697>2 byte 106 (bit plane vector) 20698>2 byte 121 (feature vector) 20699>2 byte 122 (feature vector library) 20700>2 byte 124 (chain code) 20701>2 byte 126 (bit vector) 20702>2 byte 130 (graph) 20703>2 byte 131 (adjacency graph) 20704>2 byte 132 (adjacency graph library) 20705>2 string .VISIX (ascii text) 20706 20707#------------------------------------------------------------------------------ 20708# $File: vms,v 1.8 2014/08/17 12:58:54 christos Exp $ 20709# vms: file(1) magic for VMS executables (experimental) 20710# 20711# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 20712 20713# GRR 950122: I'm just guessing on these, based on inspection of the headers 20714# of three executables each for Alpha and VAX architectures. The VAX files 20715# all had headers similar to this: 20716# 20717# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 20718# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 20719# 207200 string \xb0\0\x30\0 VMS VAX executable 20721>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 20722# 20723# The AXP files all looked like this, except that the byte at offset 0x22 20724# was 06 in some of them and 07 in others: 20725# 20726# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 20727# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 20728# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 20729# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 20730# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 20731# 20732# GRR this test is still too general as it catches example adressen.dbt 207330 belong 0x03000000 20734>8 ubelong 0xec020000 VMS Alpha executable 20735>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 20736 20737#------------------------------------------------------------------------------ 20738# $File$ 20739# VMware specific files (deducted from version 1.1 and log file entries) 20740# Anthon van der Neut (anthon@mnt.org) 207410 belong 0x4d52564e VMware nvram 20742 20743#------------------------------------------------------------------------------ 20744# $File: vorbis,v 1.20 2014/09/23 16:35:08 christos Exp $ 20745# vorbis: file(1) magic for Ogg/Vorbis files 20746# 20747# From Felix von Leitner <leitner@fefe.de> 20748# Extended by Beni Cherniavsky <cben@crosswinds.net> 20749# Further extended by Greg Wooledge <greg@wooledge.org> 20750# 20751# Most (everything but the number of channels and bitrate) is commented 20752# out with `##' as it's not interesting to the average user. The most 20753# probable things advanced users would want to uncomment are probably 20754# the number of comments and the encoder version. 20755# 20756# FIXME: The first match has been made a search, so that it can skip 20757# over prepended ID3 tags. This will work for MIME type detection, but 20758# won't work for detecting other properties of the file (they all need 20759# to be made relative to the search). In any case, if the file has ID3 20760# tags, the ID3 information will be printed, not the Ogg information, 20761# so until that's fixed, this doesn't matter. 20762# FIXME[2]: Disable the above for now, since search assumes text mode. 20763# 20764# --- Ogg Framing --- 20765#0 search/1000 OggS Ogg data 207660 string OggS Ogg data 20767>4 byte !0 UNKNOWN REVISION %u 20768##>4 byte 0 revision 0 20769>4 byte 0 20770##>>14 lelong x (Serial %lX) 20771# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 20772>>28 string \x7fFLAC \b, FLAC audio 20773# non-Vorbis content: Theora 20774!:mime audio/ogg 20775>>28 string \x80theora \b, Theora video 20776!:mime video/ogg 20777# non-Vorbis content: Kate 20778>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text) 20779!:mime application/ogg 20780>>>37 ubyte x v%u 20781>>>38 ubyte x \b.%u, 20782>>>40 byte 0 utf8 encoding, 20783>>>40 byte !0 unknown character encoding, 20784>>>60 string >\0 language %s, 20785>>>60 string \0 no language set, 20786>>>76 string >\0 category %s 20787>>>76 string \0 no category set 20788# non-Vorbis content: Skeleton 20789>>28 string fishead\0 \b, Skeleton 20790!:mime video/ogg 20791>>>36 leshort x v%u 20792>>>40 leshort x \b.%u 20793# non-Vorbis content: Speex 20794>>28 string Speex\ \ \ \b, Speex audio 20795!:mime audio/ogg 20796# non-Vorbis content: OGM 20797>>28 string \x01video\0\0\0 \b, OGM video 20798!:mime video/ogg 20799>>>37 string/c div3 (DivX 3) 20800>>>37 string/c divx (DivX 4) 20801>>>37 string/c dx50 (DivX 5) 20802>>>37 string/c xvid (XviD) 20803# --- First vorbis packet - general header --- 20804>>28 string \x01vorbis \b, Vorbis audio, 20805!:mime audio/ogg 20806>>>35 lelong !0 UNKNOWN VERSION %u, 20807##>>>35 lelong 0 version 0, 20808>>>35 lelong 0 20809>>>>39 ubyte 1 mono, 20810>>>>39 ubyte 2 stereo, 20811>>>>39 ubyte >2 %u channels, 20812>>>>40 lelong x %u Hz 20813# Minimal, nominal and maximal bitrates specified when encoding 20814>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 20815# The above tests if at least one of these is specified: 20816>>>>>52 lelong !-1 20817# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 20818# instead of -1. 20819# Vorbis 1.0 uses 0 instead of -1. 20820>>>>>>52 lelong !0 20821>>>>>>>52 lelong !-1000 20822>>>>>>>>52 lelong x <%u 20823>>>>>48 lelong !-1 20824>>>>>>48 lelong x ~%u 20825>>>>>44 lelong !-1 20826>>>>>>44 lelong !-1000 20827>>>>>>>44 lelong !0 20828>>>>>>>>44 lelong x >%u 20829>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 20830# -- Second vorbis header packet - the comments 20831# A kludge to read the vendor string. It's a counted string, not a 20832# zero-terminated one, so file(1) can't read it in a generic way. 20833# libVorbis is the only one existing currently, so I detect specifically 20834# it. The interesting value is the cvs date (8 digits decimal). 20835# Post-RC1 Ogg files have the second header packet (and thus the version) 20836# in a different place, so we must use an indirect offset. 20837>>>(84.b+85) string \x03vorbis 20838>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 20839>>>>>(84.b+120) string >00000000 20840# Map to beta version numbers: 20841>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 20842>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 20843>>>>>>(84.b+120) string >20000508 20844>>>>>>>(84.b+120) string <20001031 (beta2-3) 20845>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 20846>>>>>>(84.b+120) string >20001031 20847>>>>>>>(84.b+120) string <20010225 (beta3-4) 20848>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 20849>>>>>>(84.b+120) string >20010225 20850>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 20851>>>>>>(84.b+120) string 20010615 (1.0 RC1) 20852>>>>>>(84.b+120) string 20010813 (1.0 RC2) 20853>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 20854>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 20855>>>>>>(84.b+120) string 20011217 (1.0 RC3) 20856>>>>>>(84.b+120) string 20011231 (1.0 RC3) 20857# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 20858>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 20859# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 20860>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 20861>>>>>(84.b+117) string >00000000 20862>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 20863>>>>>>(84.b+117) string 20020717 (1.0) 20864>>>>>>(84.b+117) string 20030909 (1.0.1) 20865>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 20866 20867#------------------------------------------------------------------------------ 20868# $File$ 20869# VXL: file(1) magic for VXL binary IO data files 20870# 20871# from Ian Scott <scottim@sf.net> 20872# 20873# VXL is a collection of C++ libraries for Computer Vision. 20874# See the vsl chapter in the VXL Book for more info 20875# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 20876# http:/vxl.sf.net 20877 208782 lelong 0x472b2c4e VXL data file, 20879>0 leshort >0 schema version no %d 20880 20881#------------------------------------------------------------------------------ 20882# $File: warc,v 1.2 2009/09/19 16:28:13 christos Exp $ 20883# warc: file(1) magic for WARC files 20884 208850 string WARC/ WARC Archive 20886>5 string x version %.4s 20887!:mime application/warc 20888 20889#------------------------------------------------------------------------------ 20890# Arc File Format from Internet Archive 20891# see http://www.archive.org/web/researcher/ArcFileFormat.php 208920 string filedesc:// Internet Archive File 20893!:mime application/x-ia-arc 20894>11 search/256 \x0A \b 20895>>&0 ubyte >0 \b version %c 20896 20897#------------------------------------------------------------------------------ 20898# weak: file(1) magic for very weak magic entries, disabled by default 20899# 20900# These entries are so weak that they might interfere identification of 20901# other formats. Example include: 20902# - Only identify for 1 or 2 bytes 20903# - Match against very wide range of values 20904# - Match against generic word in some spoken languages (e.g. English) 20905 20906# Summary: Computer Graphics Metafile 20907# Extension: .cgm 20908#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 20909#0 beshort 0x3020 character Computer Graphics Metafile 20910 20911#0 string =!! Bennet Yee's "face" format 20912 20913#------------------------------------------------------------------------------ 20914# $File: windows,v 1.9 2014/09/23 23:42:44 christos Exp $ 20915# windows: file(1) magic for Microsoft Windows 20916# 20917# This file is mainly reserved for files where programs 20918# using them are run almost always on MS Windows 3.x or 20919# above, or files only used exclusively in Windows OS, 20920# where there is no better category to allocate for. 20921# For example, even though WinZIP almost run on Windows 20922# only, it is better to treat them as "archive" instead. 20923# For format usable in DOS, such as generic executable 20924# format, please specify under "msdos" file. 20925# 20926 20927 20928# Summary: Outlook Express DBX file 20929# Extension: .dbx 20930# Created by: Christophe Monniez 209310 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 20932>4 byte =0xC5 \b, message database 20933>4 byte =0xC6 \b, folder database 20934>4 byte =0xC7 \b, account information 20935>4 byte =0x30 \b, offline database 20936 20937 20938# Summary: Windows crash dump 20939# Extension: .dmp 20940# Created by: Andreas Schuster (http://computer.forensikblog.de/) 20941# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 20942# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 209430 string PAGE 20944>4 string DUMP MS Windows 32bit crash dump 20945>>0x05c byte 0 \b, no PAE 20946>>0x05c byte 1 \b, PAE 20947>>0xf88 lelong 1 \b, full dump 20948>>0xf88 lelong 2 \b, kernel dump 20949>>0xf88 lelong 3 \b, small dump 20950>>0x068 lelong x \b, %d pages 20951>4 string DU64 MS Windows 64bit crash dump 20952>>0xf98 lelong 1 \b, full dump 20953>>0xf98 lelong 2 \b, kernel dump 20954>>0xf98 lelong 3 \b, small dump 20955>>0x090 lequad x \b, %lld pages 20956 20957 20958# Summary: Vista Event Log 20959# Extension: .evtx 20960# Created by: Andreas Schuster (http://computer.forensikblog.de/) 20961# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 209620 string ElfFile\0 MS Windows Vista Event Log 20963>0x2a leshort x \b, %d chunks 20964>>0x10 lelong x \b (no. %d in use) 20965>0x18 lelong >1 \b, next record no. %d 20966>0x18 lelong =1 \b, empty 20967>0x78 lelong &1 \b, DIRTY 20968>0x78 lelong &2 \b, FULL 20969 20970 20971# Summary: Windows 3.1 group files 20972# Extension: .grp 20973# Created by: unknown 209740 string \120\115\103\103 MS Windows 3.1 group files 20975 20976 20977# Summary: Old format help files 20978# Extension: .hlp 20979# Created by: Dirk Jagdmann <doj@cubic.org> 209800 lelong 0x00035f3f MS Windows 3.x help file 20981 20982 20983# Summary: Hyper terminal 20984# Extension: .ht 20985# Created by: unknown 209860 string HyperTerminal\ 20987>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 20988 20989# http://ithreats.files.wordpress.com/2009/05/\ 20990# lnk_the_windows_shortcut_file_format.pdf 20991# Summary: Windows shortcut 20992# Extension: .lnk 20993# Created by: unknown 20994# 'L' + GUUID 209950 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 20996>20 lelong&1 1 \b, Item id list present 20997>20 lelong&2 2 \b, Points to a file or directory 20998>20 lelong&4 4 \b, Has Description string 20999>20 lelong&8 8 \b, Has Relative path 21000>20 lelong&16 16 \b, Has Working directory 21001>20 lelong&32 32 \b, Has command line arguments 21002>20 lelong&64 64 \b, Icon 21003>>56 lelong \b number=%d 21004>24 lelong&1 1 \b, Read-Only 21005>24 lelong&2 2 \b, Hidden 21006>24 lelong&4 4 \b, System 21007>24 lelong&8 8 \b, Volume Label 21008>24 lelong&16 16 \b, Directory 21009>24 lelong&32 32 \b, Archive 21010>24 lelong&64 64 \b, Encrypted 21011>24 lelong&128 128 \b, Normal 21012>24 lelong&256 256 \b, Temporary 21013>24 lelong&512 512 \b, Sparse 21014>24 lelong&1024 1024 \b, Reparse point 21015>24 lelong&2048 2048 \b, Compressed 21016>24 lelong&4096 4096 \b, Offline 21017>28 leqwdate x \b, ctime=%s 21018>36 leqwdate x \b, mtime=%s 21019>44 leqwdate x \b, atime=%s 21020>52 lelong x \b, length=%u, window= 21021>60 lelong&1 1 \bhide 21022>60 lelong&2 2 \bnormal 21023>60 lelong&4 4 \bshowminimized 21024>60 lelong&8 8 \bshowmaximized 21025>60 lelong&16 16 \bshownoactivate 21026>60 lelong&32 32 \bminimize 21027>60 lelong&64 64 \bshowminnoactive 21028>60 lelong&128 128 \bshowna 21029>60 lelong&256 256 \brestore 21030>60 lelong&512 512 \bshowdefault 21031#>20 lelong&1 0 21032#>>20 lelong&2 2 21033#>>>(72.l-64) pstring/h x \b [%s] 21034#>20 lelong&1 1 21035#>>20 lelong&2 2 21036#>>>(72.s) leshort x 21037#>>>&75 pstring/h x \b [%s] 21038 21039# Summary: Outlook Personal Folders 21040# Created by: unknown 210410 lelong 0x4E444221 Microsoft Outlook email folder 21042>10 leshort 0x0e (<=2002) 21043>10 leshort 0x17 (>=2003) 21044 21045 21046# Summary: Windows help cache 21047# Created by: unknown 210480 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 21049 21050 21051# Summary: IE cache file 21052# Created by: Christophe Monniez 210530 string Client\ UrlCache\ MMF Internet Explorer cache file 21054>20 string >\0 version %s 21055 21056 21057# Summary: Registry files 21058# Created by: unknown 21059# Modified by (1): Joerg Jenderek 210600 string regf MS Windows registry file, NT/2000 or above 210610 string CREG MS Windows 95/98/ME registry file 210620 string SHCC3 MS Windows 3.1 registry file 21063 21064 21065# Summary: Windows Registry text 21066# Extension: .reg 21067# Submitted by: Abel Cheung <abelcheung@gmail.com> 210680 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 210690 string Windows\ Registry\ Editor\ 21070>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 21071 21072# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013 21073# empty ,comment , section 21074# PR/383: remove unicode BOM because it is not portable across regex impls 210750 regex/s \\`(\\r\\n|;|[[]) 21076# left bracket in section line 21077>&0 search/8192 [ 21078# http://en.wikipedia.org/wiki/Autorun.inf 21079# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 21080>>&0 regex/c \^(autorun)]\r\n 21081>>>&0 ubyte =0x5b INItialization configuration 21082!:mime application/x-wine-extension-ini 21083# From: Pal Tamas <folti@balabit.hu> 21084# Autorun File 21085>>>&0 ubyte !0x5b Microsoft Windows Autorun file 21086!:mime application/x-setupscript 21087# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 21088# version strings ASCII coded case-independent for Windows setup information script file 21089>>&0 regex/c \^(version|strings)] Windows setup INFormation 21090!:mime application/x-setupscript 21091#!:mime application/inf 21092#!:mime application/x-wine-extension-inf 21093>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 21094!:mime text/inf 21095# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 21096# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 21097# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 21098>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 21099!:mime application/x-wine-extension-ini 21100#!:mime text/plain 21101# http://support.microsoft.com/kb/84709/ 21102>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 21103!:mime application/x-wine-extension-ini 21104>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 21105!:mime application/x-wine-extension-ini 21106# http://technet.microsoft.com/en-us/library/cc722567.aspx 21107# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 21108>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 21109!:mime application/x-wine-extension-ini 21110# http://en.wikipedia.org/wiki/SYSTEM.INI 21111>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 21112!:mime application/x-wine-extension-ini 21113# http://www.mdgx.com/newtip6.htm 21114>>&0 regex/c \^(SafeList)] Windows IOS.INI 21115!:mime application/x-wine-extension-ini 21116# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 21117>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 21118!:mime application/x-wine-extension-ini 21119>>>&0 ubyte x 21120# http://en.wikipedia.org/wiki/CONFIG.SYS 21121>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS 21122# http://support.microsoft.com/kb/118579/ 21123>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 21124# VERS string unicoded case-independent 21125>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 21126# ION] string unicoded case-independent 21127>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 21128!:mime application/x-setupscript 21129# STRI string unicoded case-independent 21130>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049 21131# NGS] string unicoded case-independent 21132>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation 21133!:mime application/x-setupscript 21134# unknown keyword after opening bracket 21135>>&0 default x 21136>>>&0 search/8192 [ 21137# version Strings FileIdentification 21138>>>>&0 string/c version Windows setup INFormation 21139!:mime application/x-setupscript 21140# VERS string unicoded case-independent 21141>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 21142# ION] string unicoded case-independent 21143>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 21144!:mime application/x-setupscript 21145# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 21146#>>>>&0 default x Generic INItialization configuration 21147#!:mime application/x-wine-extension-ini 21148 21149# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 21150# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 21151# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp 211520 leshort&0xFeFe 0x0000 21153# test for unused null bits in PNF_FLAGs 21154>4 ulelong&0xFCffFe00 0x00000000 21155# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure 21156>>68 ulelong >0x57 21157# test for zero high byte of InfValueBlockSize, followed by WinDirPath like 21158# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT 21159>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF 21160!:mime application/x-pnf 21161# currently only found Major Version=1 and Minor Version=1 21162#>>>>0 uleshort =0x0101 21163#>>>>>1 ubyte x \b, version %u 21164#>>>>>0 ubyte x \b.%u 21165>>>>0 uleshort !0x0101 21166>>>>>1 ubyte x \b, version %u 21167>>>>>0 ubyte x \b.%u 21168# 1 ,2 (windows 98 SE) 21169#>>>>2 uleshort =2 \b, InfStyle %u 21170>>>>2 uleshort !2 \b, InfStyle %u 21171# PNF_FLAG_IS_UNICODE 0x00000001 21172# PNF_FLAG_HAS_STRINGS 0x00000002 21173# PNF_FLAG_SRCPATH_IS_URL 0x00000004 21174# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 21175# PNF_FLAG_INF_VERIFIED 0x00000010 21176# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 21177# ?? 0x00000100 21178# ?? 0x01000000 21179# ?? 0x02000000 21180>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded 21181>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed 21182#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x 21183# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 21184#>>>>12 uleshort x \b, InfSubstValueCount 0x%x 21185# only < 9 found 21186#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x 21187# only found values lower 0x0000ffff 21188#>>>>16 ulelong x \b, InfVersionDataSize 0x%x 21189# only found positive values lower 0x00ffFFff for InfVersionDataOffset 21190>>>>20 ulelong x \b, at 0x%x 21191>>>>4 ulelong&0x00000001 =0x00000001 21192# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 21193>>>>>(20.l) lestring16 x "%s" 21194>>>>4 ulelong&0x00000001 !0x00000001 21195>>>>>(20.l) string x "%s" 21196# FILETIME is number of 100-nanosecond intervals since 1 January 1601 21197#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 21198# only found values lower 0x00ffFFff 21199#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x 21200#>>>>36 ulelong x \b, StringTableBlockSize 0x%x 21201#>>>>40 ulelong x \b, InfSectionCount 0x%x 21202#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x 21203#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x 21204#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x 21205#>>>>56 ulelong x \b, InfLineBlockSize 0x%x 21206#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x 21207#>>>>64 ulelong x \b, InfValueBlockSize 0x%x 21208# WinDirPathOffset 21209#>>>>68 ulelong x \b, at 0x%x 21210>>>>68 ulelong >0x57 21211>>>>>4 ulelong&0x00000001 =0x00000001 21212>>>>>>(68.l) ubequad =0x43003a005c005700 21213# normally unicoded C:\Windows 21214#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 21215>>>>>>(68.l) ubequad !0x43003a005c005700 21216>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 21217>>>>>4 ulelong&0x00000001 !0x00000001 21218# normally ASCII C:\WINDOWS 21219#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 21220>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s" 21221# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 21222#>>>>72 ulelong >0 \b, at 0x%x 21223>>>>72 ulelong >0 \b, 21224>>>>>4 ulelong&0x00000001 =0x00000001 21225>>>>>>(72.l) lestring16 x OsLoaderPath "%s" 21226>>>>>4 ulelong&0x00000001 !0x00000001 21227# seldom C:\ instead empty 21228>>>>>>(72.l) string x OsLoaderPath "%s" 21229# 1fdh 21230#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 21231>>>>78 uleshort !0x407 \b, LanguageId %x 21232# only 407h found 21233#>>>>78 uleshort =0x407 \b, LanguageId %x 21234# InfSourcePathOffset often 0 21235#>>>>80 ulelong >0 \b, at 0x%x 21236>>>>80 ulelong >0 \b, 21237>>>>>4 ulelong&0x00000001 =0x00000001 21238>>>>>>(80.l) lestring16 x SourcePath "%s" 21239>>>>>4 ulelong&0x00000001 !0x00000001 21240>>>>>>(80.l) string >\0 SourcePath "%s" 21241# OriginalInfNameOffset often 0 21242#>>>>84 ulelong >0 \b, at 0x%x 21243>>>>84 ulelong >0 \b, 21244>>>>>4 ulelong&0x00000001 =0x00000001 21245>>>>>>(84.l) lestring16 x InfName "%s" 21246>>>>>4 ulelong&0x00000001 !0x00000001 21247>>>>>>(84.l) string >\0 InfName "%s" 21248 21249 21250#------------------------------------------------------------------------------ 21251# $File$ 21252# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 21253# 212540 string RGDB CRDA wireless regulatory database file 21255>4 belong 19 (Version 1) 21256 21257#------------------------------------------------------------------------------ 21258# $File: wordprocessors,v 1.17 2013/02/06 14:18:52 christos Exp $ 21259# wordprocessors: file(1) magic fo word processors. 21260# 21261####### PWP file format used on Smith Corona Personal Word Processors: 212622 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 21263>24 byte 2 \b, single spaced 21264>24 byte 3 \b, 1.5 spaced 21265>24 byte 4 \b, double spaced 21266>25 byte 0x42 \b, letter 21267>25 byte 0x54 \b, legal 21268>26 byte 0x46 \b, A4 21269 21270#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 212710 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable file 21272>15 byte 0 Optimized for Intel 21273>15 byte 1 Optimized for Non-Intel 212741 string WPC (Corel/WP) 21275>8 short 257 WordPerfect macro 21276>8 short 258 WordPerfect help file 21277>8 short 259 WordPerfect keyboard file 21278>8 short 266 WordPerfect document 21279>8 short 267 WordPerfect dictionary 21280>8 short 268 WordPerfect thesaurus 21281>8 short 269 WordPerfect block 21282>8 short 270 WordPerfect rectangular block 21283>8 short 271 WordPerfect column block 21284>8 short 272 WordPerfect printer data 21285>8 short 275 WordPerfect printer data 21286>8 short 276 WordPerfect driver resource data 21287>8 short 279 WordPerfect hyphenation code 21288>8 short 280 WordPerfect hyphenation data 21289>8 short 281 WordPerfect macro resource data 21290>8 short 283 WordPerfect hyphenation lex 21291>8 short 285 WordPerfect wordlist 21292>8 short 286 WordPerfect equation resource data 21293>8 short 289 WordPerfect spell rules 21294>8 short 290 WordPerfect dictionary rules 21295>8 short 295 WordPerfect spell rules (Microlytics) 21296>8 short 299 WordPerfect settings file 21297>8 short 301 WordPerfect 4.2 document 21298>8 short 325 WordPerfect dialog file 21299>8 short 332 WordPerfect button bar 21300>8 short 513 Shell macro 21301>8 short 522 Shell definition 21302>8 short 769 Notebook macro 21303>8 short 770 Notebook help file 21304>8 short 771 Notebook keyboard file 21305>8 short 778 Notebook definition 21306>8 short 1026 Calculator help file 21307>8 short 1538 Calendar help file 21308>8 short 1546 Calendar data file 21309>8 short 1793 Editor macro 21310>8 short 1794 Editor help file 21311>8 short 1795 Editor keyboard file 21312>8 short 1817 Editor macro resource file 21313>8 short 2049 Macro editor macro 21314>8 short 2050 Macro editor help file 21315>8 short 2051 Macro editor keyboard file 21316>8 short 2305 PlanPerfect macro 21317>8 short 2306 PlanPerfect help file 21318>8 short 2307 PlanPerfect keyboard file 21319>8 short 2314 PlanPerfect worksheet 21320>8 short 2319 PlanPerfect printer definition 21321>8 short 2322 PlanPerfect graphic definition 21322>8 short 2323 PlanPerfect data 21323>8 short 2324 PlanPerfect temporary printer 21324>8 short 2329 PlanPerfect macro resource data 21325>8 byte 11 Mail 21326>8 short 2818 help file 21327>8 short 2821 distribution list 21328>8 short 2826 out box 21329>8 short 2827 in box 21330>8 short 2836 users archived mailbox 21331>8 short 2837 archived message database 21332>8 short 2838 archived attachments 21333>8 short 3083 Printer temporary file 21334>8 short 3330 Scheduler help file 21335>8 short 3338 Scheduler in file 21336>8 short 3339 Scheduler out file 21337>8 short 3594 GroupWise settings file 21338>8 short 3601 GroupWise directory services 21339>8 short 3627 GroupWise settings file 21340>8 short 4362 Terminal resource data 21341>8 short 4363 Terminal resource data 21342>8 short 4395 Terminal resource data 21343>8 short 4619 GUI loadable text 21344>8 short 4620 graphics resource data 21345>8 short 4621 printer settings file 21346>8 short 4622 port definition file 21347>8 short 4623 print queue parameters 21348>8 short 4624 compressed file 21349>8 short 5130 Network service msg file 21350>8 short 5131 Network service msg file 21351>8 short 5132 Async gateway login msg 21352>8 short 5134 GroupWise message file 21353>8 short 7956 GroupWise admin domain database 21354>8 short 7957 GroupWise admin host database 21355>8 short 7959 GroupWise admin remote host database 21356>8 short 7960 GroupWise admin ADS deferment data file 21357>8 short 8458 IntelliTAG (SGML) compiled DTD 21358>8 long 18219264 WordPerfect graphic image (1.0) 21359>8 long 18219520 WordPerfect graphic image (2.0) 21360#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE 21361 21362# Hangul (Korean) Word Processor File 213630 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 21364# From: Won-Kyu Park <wkpark@kldp.org> 21365512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 21366!:mime application/x-hwp 21367 21368# CosmicBook, from Benoit Rouits 213690 string CSBK Ted Neslson's CosmicBook hypertext file 21370 213712 string EYWR AmigaWriter file 21372 21373# chi: file(1) magic for ChiWriter files 213740 string \\1cw\ ChiWriter file 21375>5 string >\0 version %s 213760 string \\1cw ChiWriter file 21377 21378# Quark Express from http://www.garykessler.net/library/file_sigs.html 213792 string IIXPR3 Intel Quark Express Document (English) 213802 string IIXPRa Intel Quark Express Document (Korean) 213812 string MMXPR3 Motorola Quark Express Document (English) 21382!:mime application/x-quark-xpress-3 213832 string MMXPRa Motorola Quark Express Document (Korean) 21384 21385# adobe indesign (document, whatever...) from querkan 213860 belong 0x0606edf5 Adobe InDesign 21387>16 string DOCUMENT Document 21388 21389#------------------------------------------------------------------------------ 21390# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 21391# 21392# Contributor kenzo-: 21393# Reversed-engineered JS Ichitaro magic numbers 21394# 21395 213960 string DOC 21397>43 byte 0x14 Just System Word Processor Ichitaro v4 21398!:mime application/x-ichitaro4 21399>144 string JDASH application/x-ichitaro4 21400 214010 string DOC 21402>43 byte 0x15 Just System Word Processor Ichitaro v5 21403!:mime application/x-ichitaro5 21404 214050 string DOC 21406>43 byte 0x16 Just System Word Processor Ichitaro v6 21407!:mime application/x-ichitaro6 21408 21409# Type: Freemind mindmap documents 21410# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 214110 string/w \<map\ version Freemind document 21412!:mime application/x-freemind 21413 21414# Type: Freeplane mindmap documents 21415# From: Felix Natter <fnatter@gmx.net> 214160 string/w \<map\ version="freeplane Freeplane document 21417!:mime application/x-freeplane 21418 21419# Type: Scribus 21420# From: Werner Fink <werner@suse.de> 214210 string \<SCRIBUSUTF8\ Version Scribus Document 214220 string \<SCRIBUSUTF8NEW\ Version Scribus Document 21423!:mime application/x-scribus 21424 21425# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 21426# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 214270 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 21428 21429#------------------------------------------------------------------------------ 21430# $File: wsdl,v 1.2 2013/02/05 15:20:47 christos Exp $ 21431# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php 21432# Cache format extracted from source: 21433# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 21434# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html 21435# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 214360 string wsdl PHP WSDL cache, 21437>4 byte x version 0x%02x 21438>6 ledate x \b, created %s 21439 21440# uri 21441>10 lelong <0x7fffffff 21442>>10 pstring/l x \b, uri: "%s" 21443 21444# source 21445>>>&0 lelong <0x7fffffff 21446>>>>&-4 pstring/l x \b, source: "%s" 21447 21448# target_ns 21449>>>>>&0 lelong <0x7fffffff 21450>>>>>>&-4 pstring/l x \b, target_ns: "%s" 21451 21452#------------------------------------------------------------------------------ 21453# $File: xdelta,v 1.4 2009/09/19 16:28:13 christos Exp $ 21454# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 21455# 214560 string %XDELTA% XDelta binary patch file 0.14 214570 string %XDZ000% XDelta binary patch file 0.18 214580 string %XDZ001% XDelta binary patch file 0.20 214590 string %XDZ002% XDelta binary patch file 1.0 214600 string %XDZ003% XDelta binary patch file 1.0.4 214610 string %XDZ004% XDelta binary patch file 1.1 21462 214630 string \xD6\xC3\xC4\x00 VCDIFF binary diff 21464 21465#------------------------------------------------------------------------------ 21466# $File$ 21467# xenix: file(1) magic for Microsoft Xenix 21468# 21469# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 21470# model" lifted from "magic.xenix", with comment "derived empirically; 21471# treat as folklore until proven" 21472# 21473# "small model", "large model", "huge model" stuff lifted from XXX 21474# 21475# XXX - "x.out" collides with PDP-11 archives 21476# 214770 string core core file (Xenix) 214780 byte 0x80 8086 relocatable (Microsoft) 214790 leshort 0xff65 x.out 21480>2 string __.SYMDEF randomized 21481>0 byte x archive 214820 leshort 0x206 Microsoft a.out 21483>8 leshort 1 Middle model 21484>0x1e leshort &0x10 overlay 21485>0x1e leshort &0x2 separate 21486>0x1e leshort &0x4 pure 21487>0x1e leshort &0x800 segmented 21488>0x1e leshort &0x400 standalone 21489>0x1e leshort &0x8 fixed-stack 21490>0x1c byte &0x80 byte-swapped 21491>0x1c byte &0x40 word-swapped 21492>0x10 lelong >0 not-stripped 21493>0x1e leshort ^0xc000 pre-SysV 21494>0x1e leshort &0x4000 V2.3 21495>0x1e leshort &0x8000 V3.0 21496>0x1c byte &0x4 86 21497>0x1c byte &0xb 186 21498>0x1c byte &0x9 286 21499>0x1c byte &0xa 386 21500>0x1f byte <0x040 small model 21501>0x1f byte =0x048 large model 21502>0x1f byte =0x049 huge model 21503>0x1e leshort &0x1 executable 21504>0x1e leshort ^0x1 object file 21505>0x1e leshort &0x40 Large Text 21506>0x1e leshort &0x20 Large Data 21507>0x1e leshort &0x120 Huge Objects Enabled 21508>0x10 lelong >0 not stripped 21509 215100 leshort 0x140 old Microsoft 8086 x.out 21511>0x3 byte &0x4 separate 21512>0x3 byte &0x2 pure 21513>0 byte &0x1 executable 21514>0 byte ^0x1 relocatable 21515>0x14 lelong >0 not stripped 21516 215170 lelong 0x206 b.out 21518>0x1e leshort &0x10 overlay 21519>0x1e leshort &0x2 separate 21520>0x1e leshort &0x4 pure 21521>0x1e leshort &0x800 segmented 21522>0x1e leshort &0x400 standalone 21523>0x1e leshort &0x1 executable 21524>0x1e leshort ^0x1 object file 21525>0x1e leshort &0x4000 V2.3 21526>0x1e leshort &0x8000 V3.0 21527>0x1c byte &0x4 86 21528>0x1c byte &0xb 186 21529>0x1c byte &0x9 286 21530>0x1c byte &0x29 286 21531>0x1c byte &0xa 386 21532>0x1e leshort &0x4 Large Text 21533>0x1e leshort &0x2 Large Data 21534>0x1e leshort &0x102 Huge Objects Enabled 21535 215360 leshort 0x580 XENIX 8086 relocatable or 80286 small model 21537 21538#------------------------------------------------------------------------------ 21539# $File: xilinx,v 1.6 2013/11/19 23:15:13 christos Exp $ 21540# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 21541# Xilinx-Magic@RevRagnarok.com 21542# Got the info from FPGA-FAQ 0026 21543# 21544# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 21545# fixes at least reading of bitfiles from Spartan 2, 3, 6. 21546# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 21547# 21548# First there is the sync header and its length 215490 beshort 0x0009 21550>2 belong =0x0ff00ff0 21551>>&0 belong =0x0ff00ff0 21552>>>&0 byte =0x00 21553>>>&1 beshort =0x0001 21554>>>&3 string a Xilinx BIT data 21555# Next is a Pascal-style string with the NCD name. We want to capture that. 21556>>>>&0 pstring/H x - from %s 21557# And then 'b' 21558>>>>>&1 string b 21559# Then the model / part number: 21560>>>>>>&0 pstring/H x - for %s 21561# Then 'c' 21562>>>>>>>&1 string c 21563# Then the build-date 21564>>>>>>>>&0 pstring/H x - built %s 21565# Then 'd' 21566>>>>>>>>>&1 string d 21567# Then the build-time 21568>>>>>>>>>>&0 pstring/H x \b(%s) 21569# Then 'e' 21570>>>>>>>>>>>&1 string e 21571# And length of data 21572>>>>>>>>>>>>&0 belong x - data length 0x%x 21573 21574# Raw bitstream files 215750 long 0xffffffff 21576>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 21577 21578#------------------------------------------------------------------------------ 21579# $File$ 21580# xo65 object files 21581# From: "Ullrich von Bassewitz" <uz@cc65.org> 21582# 215830 string \x55\x7A\x6E\x61 xo65 object, 21584>4 leshort x version %d, 21585>6 leshort&0x0001 =0x0001 with debug info 21586>6 leshort&0x0001 =0x0000 no debug info 21587 21588# xo65 library files 215890 string \x6E\x61\x55\x7A xo65 library, 21590>4 leshort x version %d 21591 21592# o65 object files 215930 string \x01\x00\x6F\x36\x35 o65 21594>6 leshort&0x1000 =0x0000 executable, 21595>6 leshort&0x1000 =0x1000 object, 21596>5 byte x version %d, 21597>6 leshort&0x8000 =0x8000 65816, 21598>6 leshort&0x8000 =0x0000 6502, 21599>6 leshort&0x2000 =0x2000 32 bit, 21600>6 leshort&0x2000 =0x0000 16 bit, 21601>6 leshort&0x4000 =0x4000 page reloc, 21602>6 leshort&0x4000 =0x0000 byte reloc, 21603>6 leshort&0x0003 =0x0000 alignment 1 21604>6 leshort&0x0003 =0x0001 alignment 2 21605>6 leshort&0x0003 =0x0002 alignment 4 21606>6 leshort&0x0003 =0x0003 alignment 256 21607 21608#------------------------------------------------------------------------------ 21609# $File: xwindows,v 1.8 2013/02/08 17:25:57 christos Exp $ 21610# xwindows: file(1) magic for various X/Window system file formats. 21611 21612# Compiled X Keymap 21613# XKM (compiled X keymap) files (including version and byte ordering) 216141 string mkx Compiled XKB Keymap: lsb, 21615>0 byte >0 version %d 21616>0 byte =0 obsolete 216170 string xkm Compiled XKB Keymap: msb, 21618>3 byte >0 version %d 21619>3 byte =0 obsolete 21620 21621# xfsdump archive 216220 string xFSdump0 xfsdump archive 21623>8 belong x (version %d) 21624 21625# Jaleo XFS files 216260 long 395726 Jaleo XFS file 21627>4 long x - version %d 21628>8 long x - [%d - 21629>20 long x \b%dx 21630>24 long x \b%dx 21631>28 long 1008 \bYUV422] 21632>28 long 1000 \bRGB24] 21633 21634# Xcursor data 21635# X11 mouse cursor format defined in libXcursor, see 21636# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 21637# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 216380 string Xcur Xcursor data 21639!:mime image/x-xcursor 21640>10 leshort x version %d 21641>>8 leshort x \b.%d 21642#------------------------------------------------------------------------------ 21643# zfs: file(1) magic for ZFS dumps 21644# 21645# From <rea-fbsd@codelabs.ru> 21646# ZFS dump header has the following structure (as per zfs_ioctl.h 21647# in FreeBSD with drr_type is set to DRR_BEGIN) 21648# 21649# enum { 21650# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 21651# DRR_WRITE, DRR_FREE, DRR_END, 21652# } drr_type; 21653# uint32_t drr_pad; 21654# uint64_t drr_magic; 21655# uint64_t drr_version; 21656# uint64_t drr_creation_time; 21657# dmu_objset_type_t drr_type; 21658# uint32_t drr_pad; 21659# uint64_t drr_toguid; 21660# uint64_t drr_fromguid; 21661# char drr_toname[MAXNAMELEN]; 21662# 21663# Backup magic is 0x00000002f5bacbac (quad word) 21664# The drr_type is defined as 21665# typedef enum dmu_objset_type { 21666# DMU_OST_NONE, 21667# DMU_OST_META, 21668# DMU_OST_ZFS, 21669# DMU_OST_ZVOL, 21670# DMU_OST_OTHER, /* For testing only! */ 21671# DMU_OST_ANY, /* Be careful! */ 21672# DMU_OST_NUMTYPES 21673# } dmu_objset_type_t; 21674# 21675# Almost all uint64_t fields are printed as the 32-bit ones (with high 21676# 32 bits zeroed), because there is no simple way to print them as the 21677# full 64-bit values. 21678 21679# Big-endian values 216808 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 21681>20 belong x version %u, 21682>32 belong 0 type: NONE, 21683>32 belong 1 type: META, 21684>32 belong 2 type: ZFS, 21685>32 belong 3 type: ZVOL, 21686>32 belong 4 type: OTHER, 21687>32 belong 5 type: ANY, 21688>32 belong >5 type: UNKNOWN (%u), 21689>40 byte x destination GUID: %02X 21690>41 byte x %02X 21691>42 byte x %02X 21692>43 byte x %02X 21693>44 byte x %02X 21694>45 byte x %02X 21695>46 byte x %02X 21696>47 byte x %02X, 21697>48 ulong >0 21698>>52 ulong >0 21699>>>48 byte x source GUID: %02X 21700>>>49 byte x %02X 21701>>>50 byte x %02X 21702>>>51 byte x %02X 21703>>>52 byte x %02X 21704>>>53 byte x %02X 21705>>>54 byte x %02X 21706>>>55 byte x %02X, 21707>56 string >\0 name: '%s' 21708 21709# Little-endian values 217108 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 21711>16 lelong x version %u, 21712>32 lelong 0 type: NONE, 21713>32 lelong 1 type: META, 21714>32 lelong 2 type: ZFS, 21715>32 lelong 3 type: ZVOL, 21716>32 lelong 4 type: OTHER, 21717>32 lelong 5 type: ANY, 21718>32 lelong >5 type: UNKNOWN (%u), 21719>47 byte x destination GUID: %02X 21720>46 byte x %02X 21721>45 byte x %02X 21722>44 byte x %02X 21723>43 byte x %02X 21724>42 byte x %02X 21725>41 byte x %02X 21726>40 byte x %02X, 21727>48 ulong >0 21728>>52 ulong >0 21729>>>55 byte x source GUID: %02X 21730>>>54 byte x %02X 21731>>>53 byte x %02X 21732>>>52 byte x %02X 21733>>>51 byte x %02X 21734>>>50 byte x %02X 21735>>>49 byte x %02X 21736>>>48 byte x %02X, 21737>56 string >\0 name: '%s' 21738 21739#------------------------------------------------------------------------------ 21740# $File$ 21741# zilog: file(1) magic for Zilog Z8000. 21742# 21743# Was it big-endian or little-endian? My Product Specification doesn't 21744# say. 21745# 217460 long 0xe807 object file (z8000 a.out) 217470 long 0xe808 pure object file (z8000 a.out) 217480 long 0xe809 separate object file (z8000 a.out) 217490 long 0xe805 overlay object file (z8000 a.out) 21750 21751#------------------------------------------------------------------------------ 21752# $File$ 21753# zyxel: file(1) magic for ZyXEL modems 21754# 21755# From <rob@pe1chl.ampr.org> 21756# These are the /etc/magic entries to decode datafiles as used for the 21757# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 21758# ZyXEL-defined standard) 21759 217600 string ZyXEL\002 ZyXEL voice data 21761>10 byte 0 - CELP encoding 21762>10 byte&0x0B 1 - ADPCM2 encoding 21763>10 byte&0x0B 2 - ADPCM3 encoding 21764>10 byte&0x0B 3 - ADPCM4 encoding 21765>10 byte&0x0B 8 - New ADPCM3 encoding 21766>10 byte&0x04 4 with resync 21767
