1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@mx.gw.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83#------------------------------------------------------------------------------ 84# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 85# adi: file(1) magic for ADi's objects 86# From Gregory McGarry <g.mcgarry@ieee.org> 87# 880 leshort 0x521c COFF DSP21k 89>18 lelong &02 executable, 90>18 lelong ^02 91>>18 lelong &01 static object, 92>>18 lelong ^01 relocatable object, 93>18 lelong &010 stripped 94>18 lelong ^010 not stripped 95 96#------------------------------------------------------------------------------ 97# $File: adventure,v 1.16 2017/03/17 21:35:28 christos Exp $ 98# adventure: file(1) magic for Adventure game files 99# 100# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 101# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 102# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 103# 104# ALAN 105# I assume there are other, lower versions, but these are the only ones I 106# saw in the archive. 1070 beshort 0x0206 ALAN game data 108>2 byte <10 version 2.6%d 109 110 111# Infocom (see z-machine) 112#------------------------------------------------------------------------------ 113# Z-machine: file(1) magic for Z-machine binaries. 114# Sanity checks by David Griffith <dave@661.org> 115# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 116# 117#http://www.gnelson.demon.co.uk/zspec/sect11.html 118#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 119#http://en.wikipedia.org/wiki/Z-machine 120# The first byte is the Z-machine revision; it is always between 1 and 8. We 121# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 122# well as an occasional MP3 file), so we sanity-check the version number. 123# 124# It might be possible to sanity-check the release number as well, as it seems 125# (at least in classic Infocom games) to always be a relatively small number, 126# always under 150 or so, but as this isn't rigorous, we'll wait on that until 127# it becomes clear that it's needed. 128# 1290 ubyte >0 130>0 ubyte <9 131>>16 belong&0xfe00f0f0 0x3030 132>>>0 ubyte < 10 133>>>>2 ubeshort < 10 134>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 135>>>>>>0 ubyte < 10 Infocom (Z-machine %d, 136>>>>>>>2 ubeshort < 10 Release %d / 137>>>>>>>>18 string >\0 Serial %.6s) 138!:strength + 40 139!:mime application/x-zmachine 140 141#------------------------------------------------------------------------------ 142# Glulx: file(1) magic for Glulx binaries. 143# 144# David Griffith <dave@661.org> 145# I haven't checked for false matches yet. 146# 1470 string Glul Glulx game data 148>4 beshort x (Version %d 149>>6 byte x \b.%d 150>>8 byte x \b.%d) 151>36 string Info Compiled by Inform 152!:mime application/x-glulx 153 154 155# For Quetzal and blorb magic see iff 156 157 158# TADS (Text Adventure Development System) version 2 159# All files are machine-independent (games compile to byte-code) and are tagged 160# with a version string of the form "V2.<digit>.<digit>\0". 161# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1620 string TADS2\ bin TADS 163>9 belong !0x0A0D1A00 game data, CORRUPTED 164>9 belong 0x0A0D1A00 165>>13 string >\0 %s game data 166!:mime application/x-tads 167# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 1680 string TADS2\ rsc TADS 169>9 belong !0x0A0D1A00 resource data, CORRUPTED 170>9 belong 0x0A0D1A00 171>>13 string >\0 %s resource data 172!:mime application/x-tads 173# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 174# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 175# "TADS2 save\n\r\032\0" and the interpreter version. 1760 string TADS2\ save/g TADS 177>12 belong !0x0A0D1A00 saved game data, CORRUPTED 178>12 belong 0x0A0D1A00 179>>(16.s+32) string >\0 %s saved game data 180!:mime application/x-tads 181# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 182# version. 1830 string TADS2\ save TADS 184>10 belong !0x0A0D1A00 saved game data, CORRUPTED 185>10 belong 0x0A0D1A00 186>>14 string >\0 %s saved game data 187!:mime application/x-tads 188 189# TADS (Text Adventure Development System) version 3 190# Game files start with "T3-image\015\012\032" 1910 string T3-image\015\012\032 192>11 leshort x TADS 3 game data (format version %d) 193# Saved game files start with "T3-state-v####\015\012\032" 194# where #### is a format version number 1950 string T3-state-v 196>14 string \015\012\032 TADS 3 saved game data (format version 197>>10 byte x %c 198>>11 byte x \b%c 199>>12 byte x \b%c 200>>13 byte x \b%c) 201!:mime application/x-t3vm-image 202 203# edited by David Griffith <dave@661.org> 204# Danny Milosavljevic <danny.milo@gmx.net> 205# These are ADRIFT (adventure game standard) game files, extension .taf 206# Checked from source at (http://www.adrift.co/) and various taf files 207# found at the Interactive Fiction Archive (http://ifarchive.org/) 2080 belong 0x3C423FC9 209>4 belong 0x6A87C2CF Adrift game file version 210>>8 belong 0x94453661 3.80 211>>8 belong 0x94453761 3.90 212>>8 belong 0x93453E61 4.0 213>>8 belong 0x92453E61 5.0 214>>8 default x unknown 215!:mime application/x-adrift 216 217#------------------------------------------------------------------------------ 218# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $ 219# algol68: file(1) magic for Algol 68 source 220# 2210 search/8192 (input, Algol 68 source text 222!:mime text/x-Algol68 2230 regex \^PROC Algol 68 source text 224!:mime text/x-Algol68 2250 regex MODE[\t\ ] Algol 68 source text 226!:mime text/x-Algol68 2270 regex REF[\t\ ] Algol 68 source text 228!:mime text/x-Algol68 2290 regex FLEX[\t\ ]\*\\[ Algol 68 source text 230!:mime text/x-Algol68 231#0 regex [\t\ ]OD Algol 68 source text 232#!:mime text/x-Algol68 233#0 regex [\t\ ]FI Algol 68 source text 234#!:mime text/x-Algol68 235 236#------------------------------------------------------------------------------ 237# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 238# allegro: file(1) magic for Allegro datafiles 239# Toby Deshane <hac@shoelace.digivill.net> 240# 2410 belong 0x736C6821 Allegro datafile (packed) 2420 belong 0x736C682E Allegro datafile (not packed/autodetect) 2430 belong 0x736C682B Allegro datafile (appended exe data) 244 245#------------------------------------------------------------------------------ 246# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 247# alliant: file(1) magic for Alliant FX series a.out files 248# 249# If the FX series is the one that had a processor with a 68K-derived 250# instruction set, the "short" should probably become "beshort" and the 251# "long" should probably become "belong". 252# If it's the i860-based one, they should probably become either the 253# big-endian or little-endian versions, depending on the mode they ran 254# the 860 in.... 255# 2560 short 0420 0420 Alliant virtual executable 257>2 short &0x0020 common library 258>16 long >0 not stripped 2590 short 0421 0421 Alliant compact executable 260>2 short &0x0020 common library 261>16 long >0 not stripped 262 263#------------------------------------------------------------------------------ 264# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $ 265# amanda: file(1) magic for amanda file format 266# 2670 string AMANDA:\ AMANDA 268>8 string TAPESTART\ DATE tape header file, 269>>23 string X 270>>>25 string >\ Unused %s 271>>23 string >\ DATE %s 272>8 string FILE\ dump file, 273>>13 string >\ DATE %s 274 275#------------------------------------------------------------------------------ 276# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $ 277# amigaos: file(1) magic for AmigaOS binary formats: 278 279# 280# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 281# 2820 belong 0x000003fa AmigaOS shared library 2830 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 2840 belong 0x000003e7 AmigaOS object/library data 285# 2860 beshort 0xe310 Amiga Workbench 287>2 beshort 1 288>>48 byte 1 disk icon 289>>48 byte 2 drawer icon 290>>48 byte 3 tool icon 291>>48 byte 4 project icon 292>>48 byte 5 garbage icon 293>>48 byte 6 device icon 294>>48 byte 7 kickstart icon 295>>48 byte 8 workbench application icon 296>2 beshort >1 icon, vers. %d 297# 298# various sound formats from the Amiga 299# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 300# 3010 string FC14 Future Composer 1.4 Module sound file 3020 string SMOD Future Composer 1.3 Module sound file 3030 string AON4artofnoise Art Of Noise Module sound file 3041 string MUGICIAN/SOFTEYES Mugician Module sound file 30558 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 3060 string Synth4.0 Synthesis Module sound file 3070 string ARP. The Holy Noise Module sound file 3080 string BeEp\0 JamCracker Module sound file 3090 string COSO\0 Hippel-COSO Module sound file 310# Too simple (short, pure ASCII, deep), MPi 311#26 string V.3 Brian Postma's Soundmon Module sound file v3 312#26 string BPSM Brian Postma's Soundmon Module sound file v3 313#26 string V.2 Brian Postma's Soundmon Module sound file v2 314 315# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 3160 beshort 0x0f00 AmigaOS bitmap font 3170 beshort 0x0f03 AmigaOS outline font 3180 belong 0x80001001 AmigaOS outline tag 3190 string ##\ version catalog translation 3200 string EMOD\0 Amiga E module 3218 string ECXM\0 ECX module 3220 string/c @database AmigaGuide file 323 324# Amiga disk types 325# 3260 string RDSK Rigid Disk Block 327>160 string x on %.24s 3280 string DOS\0 Amiga DOS disk 3290 string DOS\1 Amiga FFS disk 3300 string DOS\2 Amiga Inter DOS disk 3310 string DOS\3 Amiga Inter FFS disk 3320 string DOS\4 Amiga Fastdir DOS disk 3330 string DOS\5 Amiga Fastdir FFS disk 3340 string KICK Kickstart disk 335 336# From: Alex Beregszaszi <alex@fsn.hu> 3370 string LZX LZX compressed archive (Amiga) 338 339# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 3400 string .KEY AmigaDOS script 3410 string .key AmigaDOS script 342 343#------------------------------------------------------------ 344# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $ 345# Various android related magic entries 346#------------------------------------------------------------ 347 348# Dalvik .dex format. http://retrodev.com/android/dexformat.html 349# From <mkf@google.com> "Mike Fleming" 350# Fixed to avoid regexec 17 errors on some dex files 351# From <diff@lookout.com> "Tim Strazzere" 3520 string dex\n 353>0 regex dex\n[0-9]{2}\0 Dalvik dex file 354>4 string >000 version %s 3550 string dey\n 356>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 357>4 string >000 version %s 358 359# Android bootimg format 360# From https://android.googlesource.com/\ 361# platform/system/core/+/master/mkbootimg/bootimg.h 3620 string ANDROID! Android bootimg 363>1024 string LOKI\01 \b, LOKI'd 364>8 lelong >0 \b, kernel 365>>12 lelong >0 \b (0x%x) 366>16 lelong >0 \b, ramdisk 367>>20 lelong >0 \b (0x%x) 368>24 lelong >0 \b, second stage 369>>28 lelong >0 \b (0x%x) 370>36 lelong >0 \b, page size: %d 371>38 string >0 \b, name: %s 372>64 string >0 \b, cmdline (%s) 373 374# Android Backup archive 375# From: Ariel Shkedi 376# File extension: .ab 377# No mime-type defined 378# URL: https://github.com/android/platform_frameworks_base/blob/\ 379# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 380# android/server/BackupManagerService.java#L2367 381# After the header comes a tar file 382# If compressed, the entire tar file is compressed with JAVA deflate 383# 384# Include the version number hardcoded with the magic string to avoid 385# false positives 3860 string/b ANDROID\ BACKUP\n1\n Android Backup 387>17 string 0\n \b, Not-Compressed 388>17 string 1\n \b, Compressed 389# any string as long as it's not the word none (which is matched below) 390>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 391>>19 string none\n \b, Not-Encrypted 392# Commented out because they don't seem useful to print 393# (but they are part of the header - the tar file comes after them): 394#>>>&1 regex/1l .* \b, Password salt: %s 395#>>>>&1 regex/1l .* \b, Master salt: %s 396#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 397#>>>>>>&1 regex/1l .* \b, IV: %s 398#>>>>>>>&1 regex/1l .* \b, Key: %s 399 400# *.pit files by Joerg Jenderek 401# http://forum.xda-developers.com/showthread.php?p=9122369 402# http://forum.xda-developers.com/showthread.php?t=816449 403# Partition Information Table for Samsung's smartphone with Android 404# used by flash software Odin 4050 ulelong 0x12349876 406# 1st pit entry marker 407>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 408# minimal 13 and maximal 18 PIT entries found 409>>4 ulelong <128 Partition Information Table for Samsung smartphone 410>>>4 ulelong x \b, %d entries 411# 1. pit entry 412>>>4 ulelong >0 \b; #1 413>>>0x01C use PIT-entry 414>>>4 ulelong >1 \b; #2 415>>>0x0A0 use PIT-entry 416>>>4 ulelong >2 \b; #3 417>>>0x124 use PIT-entry 418>>>4 ulelong >3 \b; #4 419>>>0x1A8 use PIT-entry 420>>>4 ulelong >4 \b; #5 421>>>0x22C use PIT-entry 422>>>4 ulelong >5 \b; #6 423>>>0x2B0 use PIT-entry 424>>>4 ulelong >6 \b; #7 425>>>0x334 use PIT-entry 426>>>4 ulelong >7 \b; #8 427>>>0x3B8 use PIT-entry 428>>>4 ulelong >8 \b; #9 429>>>0x43C use PIT-entry 430>>>4 ulelong >9 \b; #10 431>>>0x4C0 use PIT-entry 432>>>4 ulelong >10 \b; #11 433>>>0x544 use PIT-entry 434>>>4 ulelong >11 \b; #12 435>>>0x5C8 use PIT-entry 436>>>4 ulelong >12 \b; #13 437>>>>0x64C use PIT-entry 438# 14. pit entry 439>>>4 ulelong >13 \b; #14 440>>>>0x6D0 use PIT-entry 441>>>4 ulelong >14 \b; #15 442>>>0x754 use PIT-entry 443>>>4 ulelong >15 \b; #16 444>>>0x7D8 use PIT-entry 445>>>4 ulelong >16 \b; #17 446>>>0x85C use PIT-entry 447# 18. pit entry 448>>>4 ulelong >17 \b; #18 449>>>0x8E0 use PIT-entry 450 4510 name PIT-entry 452# garbage value implies end of pit entries 453>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 454# skip empty partition name 455>>0x24 ubyte !0 456# partition name 457>>>0x24 string >\0 %-.32s 458# flags 459>>>0x0C ulelong&0x00000002 2 \b+RW 460# partition ID: 461# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER 462# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 463>>>0x08 ulelong x (0x%x) 464# filename 465>>>0x44 string >\0 "%-.64s" 466#>>>0x18 ulelong >0 467# blocksize in 512 byte units ? 468#>>>>0x18 ulelong x \b, %db 469# partition size in blocks ? 470#>>>>0x22 ulelong x \b*%d 471 472# Android sparse img format 473# From https://android.googlesource.com/\ 474# platform/system/core/+/master/libsparse/sparse_format.h 4750 lelong 0xed26ff3a Android sparse image 476>4 leshort x \b, version: %d 477>6 leshort x \b.%d 478>16 lelong x \b, Total of %d 479>12 lelong x \b %d-byte output blocks in 480>20 lelong x \b %d input chunks. 481 482# Android binary XML magic 483# In include/androidfw/ResourceTypes.h: 484# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), 485# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 4860 lelong 0x00080003 Android binary XML 487 488#------------------------------------------------------------------------------ 489# $File: animation,v 1.61 2017/04/01 18:26:03 christos Exp $ 490# animation: file(1) magic for animation/movie formats 491# 492# animation formats 493# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 494# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 495 496# SGI and Apple formats 4970 string MOVI Silicon Graphics movie file 498!:mime video/x-sgi-movie 4994 string moov Apple QuickTime 500!:mime video/quicktime 501>12 string mvhd \b movie (fast start) 502>12 string mdra \b URL 503>12 string cmov \b movie (fast start, compressed header) 504>12 string rmra \b multiple URLs 5054 string mdat Apple QuickTime movie (unoptimized) 506!:mime video/quicktime 507#4 string wide Apple QuickTime movie (unoptimized) 508#!:mime video/quicktime 509#4 string skip Apple QuickTime movie (modified) 510#!:mime video/quicktime 511#4 string free Apple QuickTime movie (modified) 512#!:mime video/quicktime 5134 string idsc Apple QuickTime image (fast start) 514!:mime image/x-quicktime 515#4 string idat Apple QuickTime image (unoptimized) 516#!:mime image/x-quicktime 5174 string pckg Apple QuickTime compressed archive 518!:mime application/x-quicktime-player 5194 string/W jP JPEG 2000 image 520!:mime image/jp2 521# http://www.ftyps.com/ with local additions 5224 string ftyp ISO Media 523# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ 524>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec 525>>96 string x \b, Audio "%.4s" 526>>118 beshort x at %dHz 527>>140 string x \b, Video "%.4s" 528>>168 beshort x %d 529>>170 beshort x \bx%d 530>8 string 3g2 \b, MPEG v4 system, 3GPP2 531!:mime video/3gpp2 532>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 533>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 534>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 535>>11 byte a \b C.S0050-0 V1.0 536>>11 byte b \b C.S0050-0-A V1.0.0 537>>11 byte c \b C.S0050-0-B V1.0 538>8 string 3ge \b, MPEG v4 system, 3GPP 539!:mime video/3gpp 540>>11 byte 6 \b, Release 6 MBMS Extended Presentations 541>>11 byte 7 \b, Release 7 MBMS Extended Presentations 542>8 string 3gg \b, MPEG v4 system, 3GPP 543>11 byte 6 \b, Release 6 General Profile 544!:mime video/3gpp 545>8 string 3gp \b, MPEG v4 system, 3GPP 546>11 byte 1 \b, Release %d (non existent) 547>11 byte 2 \b, Release %d (non existent) 548>11 byte 3 \b, Release %d (non existent) 549>11 byte 4 \b, Release %d 550>11 byte 5 \b, Release %d 551>11 byte 6 \b, Release %d 552>11 byte 7 \b, Release %d Streaming Servers 553!:mime video/3gpp 554>8 string 3gs \b, MPEG v4 system, 3GPP 555>11 byte 7 \b, Release %d Streaming Servers 556!:mime video/3gpp 557>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] 558!:mime video/mp4 559>8 string/W qt \b, Apple QuickTime movie 560!:mime video/quicktime 561>8 string CAEP \b, Canon Digital Camera 562>8 string caqv \b, Casio Digital Camera 563>8 string CDes \b, Convergent Design 564>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG 565>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP 566>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images 567>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP 568>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG 569>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP 570>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images 571>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP 572>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP 573!:mime video/mp4 574>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec 575>8 string dmpf \b, Digital Media Project 576>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4) 577>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS 578>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP 579>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS 580>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP 581>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS 582>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP 583>8 string dvr1 \b, DVB (.DVB) over RTP 584!:mime video/vnd.dvb.file 585>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream 586!:mime video/vnd.dvb.file 587>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V) 588!:mime video/mp4 589>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P) 590!:mime video/mp4 591>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A) 592!:mime audio/mp4 593>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B) 594!:mime audio/mp4 595>8 string isc2 \b, ISMACryp 2.0 Encrypted File 596# ?/enc-isoff-generic 597>8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005] 598!:mime video/mp4 599>8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003] 600!:mime video/mp4 601>8 string/W jp2 \b, JPEG 2000 602!:mime image/jp2 603>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?] 604!:mime image/jp2 605>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent) 606>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6] 607!:mime image/jpm 608>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2] 609!:mime image/jpx 610>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones 611!:mime video/3gpp2 612>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio 613!:mime audio/x-m4a 614>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book 615!:mime audio/mp4 616>8 string M4P \b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio 617!:mime video/mp4 618>8 string M4V \b, Apple iTunes Video (.M4V) Video 619!:mime video/x-m4v 620>8 string M4VH \b, Apple TV (.M4V) 621!:mime video/x-m4v 622>8 string M4VP \b, Apple iPhone (.M4V) 623!:mime video/x-m4v 624>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile 625!:mime video/mj2 626>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile 627!:mime video/mj2 628>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT) 629!:mime video/mp4 630>8 string mobi \b, MPEG-4, MOBI format 631!:mime video/mp4 632>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9] 633>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13] 634!:mime video/mp4 635>8 string mp42 \b, MP4 v2 [ISO 14496-14] 636!:mime video/mp4 637>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12] 638>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 639>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 640>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 641!:mime video/mp4 642>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3] 643>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 644!:mime video/quicktime 645>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP 646!:mime audio/mp4 647>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio 648!:mime audio/mp4 649>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile 650!:mime video/mp4 651>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile 652!:mime video/mp4 653>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile 654!:mime video/mp4 655>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile 656!:mime video/mp4 657>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile 658!:mime video/mp4 659>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile 660!:mime video/mp4 661>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile 662!:mime video/mp4 663>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile 664!:mime video/mp4 665>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile 666!:mime video/mp4 667>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile 668!:mime video/mp4 669>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A) 670>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C) 671>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C) 672>8 string pana \b, Panasonic Digital Camera 673>8 string qt \b, Apple QuickTime (.MOV/QT) 674!:mime video/quicktime 675>8 string ROSS \b, Ross Video 676>8 string sdv \b, SD Memory Card Video 677>8 string ssc1 \b, Samsung stereo, single stream (patent pending) 678>8 string ssc2 \b, Samsung stereo, dual stream (patent pending) 679 680# MPEG sequences 681# Scans for all common MPEG header start codes 6820 belong 0x00000001 683>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 684>>5 byte 66 \b, baseline 685>>5 byte 77 \b, main 686>>5 byte 88 \b, extended 687>>7 byte x \b @ L %u 6880 belong&0xFFFFFF00 0x00000100 689>3 byte 0xBA MPEG sequence 690!:mime video/mpeg 691>>4 byte &0x40 \b, v2, program multiplex 692>>4 byte ^0x40 \b, v1, system multiplex 693>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 694>3 byte&0x1F 0x07 MPEG sequence, H.264 video 695>>4 byte 66 \b, baseline 696>>4 byte 77 \b, main 697>>4 byte 88 \b, extended 698>>6 byte x \b @ L %u 699# GRR too general as it catches also FoxPro Memo example NG.FPT 700>3 byte 0xB0 MPEG sequence, v4 701# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 702#>>4 byte !0 MPEG sequence, v4 703!:mime video/mpeg4-generic 704>>5 belong 0x000001B5 705>>>9 byte &0x80 706>>>>10 byte&0xF0 16 \b, video 707>>>>10 byte&0xF0 32 \b, still texture 708>>>>10 byte&0xF0 48 \b, mesh 709>>>>10 byte&0xF0 64 \b, face 710>>>9 byte&0xF8 8 \b, video 711>>>9 byte&0xF8 16 \b, still texture 712>>>9 byte&0xF8 24 \b, mesh 713>>>9 byte&0xF8 32 \b, face 714>>4 byte 1 \b, simple @ L1 715>>4 byte 2 \b, simple @ L2 716>>4 byte 3 \b, simple @ L3 717>>4 byte 4 \b, simple @ L0 718>>4 byte 17 \b, simple scalable @ L1 719>>4 byte 18 \b, simple scalable @ L2 720>>4 byte 33 \b, core @ L1 721>>4 byte 34 \b, core @ L2 722>>4 byte 50 \b, main @ L2 723>>4 byte 51 \b, main @ L3 724>>4 byte 53 \b, main @ L4 725>>4 byte 66 \b, n-bit @ L2 726>>4 byte 81 \b, scalable texture @ L1 727>>4 byte 97 \b, simple face animation @ L1 728>>4 byte 98 \b, simple face animation @ L2 729>>4 byte 99 \b, simple face basic animation @ L1 730>>4 byte 100 \b, simple face basic animation @ L2 731>>4 byte 113 \b, basic animation text @ L1 732>>4 byte 114 \b, basic animation text @ L2 733>>4 byte 129 \b, hybrid @ L1 734>>4 byte 130 \b, hybrid @ L2 735>>4 byte 145 \b, advanced RT simple @ L! 736>>4 byte 146 \b, advanced RT simple @ L2 737>>4 byte 147 \b, advanced RT simple @ L3 738>>4 byte 148 \b, advanced RT simple @ L4 739>>4 byte 161 \b, core scalable @ L1 740>>4 byte 162 \b, core scalable @ L2 741>>4 byte 163 \b, core scalable @ L3 742>>4 byte 177 \b, advanced coding efficiency @ L1 743>>4 byte 178 \b, advanced coding efficiency @ L2 744>>4 byte 179 \b, advanced coding efficiency @ L3 745>>4 byte 180 \b, advanced coding efficiency @ L4 746>>4 byte 193 \b, advanced core @ L1 747>>4 byte 194 \b, advanced core @ L2 748>>4 byte 209 \b, advanced scalable texture @ L1 749>>4 byte 210 \b, advanced scalable texture @ L2 750>>4 byte 211 \b, advanced scalable texture @ L3 751>>4 byte 225 \b, simple studio @ L1 752>>4 byte 226 \b, simple studio @ L2 753>>4 byte 227 \b, simple studio @ L3 754>>4 byte 228 \b, simple studio @ L4 755>>4 byte 229 \b, core studio @ L1 756>>4 byte 230 \b, core studio @ L2 757>>4 byte 231 \b, core studio @ L3 758>>4 byte 232 \b, core studio @ L4 759>>4 byte 240 \b, advanced simple @ L0 760>>4 byte 241 \b, advanced simple @ L1 761>>4 byte 242 \b, advanced simple @ L2 762>>4 byte 243 \b, advanced simple @ L3 763>>4 byte 244 \b, advanced simple @ L4 764>>4 byte 245 \b, advanced simple @ L5 765>>4 byte 247 \b, advanced simple @ L3b 766>>4 byte 248 \b, FGS @ L0 767>>4 byte 249 \b, FGS @ L1 768>>4 byte 250 \b, FGS @ L2 769>>4 byte 251 \b, FGS @ L3 770>>4 byte 252 \b, FGS @ L4 771>>4 byte 253 \b, FGS @ L5 772>3 byte 0xB5 MPEG sequence, v4 773!:mime video/mpeg4-generic 774>>4 byte &0x80 775>>>5 byte&0xF0 16 \b, video (missing profile header) 776>>>5 byte&0xF0 32 \b, still texture (missing profile header) 777>>>5 byte&0xF0 48 \b, mesh (missing profile header) 778>>>5 byte&0xF0 64 \b, face (missing profile header) 779>>4 byte&0xF8 8 \b, video (missing profile header) 780>>4 byte&0xF8 16 \b, still texture (missing profile header) 781>>4 byte&0xF8 24 \b, mesh (missing profile header) 782>>4 byte&0xF8 32 \b, face (missing profile header) 783>3 byte 0xB3 MPEG sequence 784!:mime video/mpeg 785>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 786>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 787>>12 belong 0x000001B5 \b, v2, 788>>>16 byte&0x0F 1 \b HP 789>>>16 byte&0x0F 2 \b Spt 790>>>16 byte&0x0F 3 \b SNR 791>>>16 byte&0x0F 4 \b MP 792>>>16 byte&0x0F 5 \b SP 793>>>17 byte&0xF0 64 \b@HL 794>>>17 byte&0xF0 96 \b@H-14 795>>>17 byte&0xF0 128 \b@ML 796>>>17 byte&0xF0 160 \b@LL 797>>>17 byte &0x08 \b progressive 798>>>17 byte ^0x08 \b interlaced 799>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 800>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 801>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 802>>11 byte &0x02 803>>>75 byte &0x01 804>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 805>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 806>>>>140 belong 0x000001B5 \b, v2, 807>>>>>144 byte&0x0F 1 \b HP 808>>>>>144 byte&0x0F 2 \b Spt 809>>>>>144 byte&0x0F 3 \b SNR 810>>>>>144 byte&0x0F 4 \b MP 811>>>>>144 byte&0x0F 5 \b SP 812>>>>>145 byte&0xF0 64 \b@HL 813>>>>>145 byte&0xF0 96 \b@H-14 814>>>>>145 byte&0xF0 128 \b@ML 815>>>>>145 byte&0xF0 160 \b@LL 816>>>>>145 byte &0x08 \b progressive 817>>>>>145 byte ^0x08 \b interlaced 818>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 819>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 820>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 821>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 822>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 823>>76 belong 0x000001B5 \b, v2, 824>>>80 byte&0x0F 1 \b HP 825>>>80 byte&0x0F 2 \b Spt 826>>>80 byte&0x0F 3 \b SNR 827>>>80 byte&0x0F 4 \b MP 828>>>80 byte&0x0F 5 \b SP 829>>>81 byte&0xF0 64 \b@HL 830>>>81 byte&0xF0 96 \b@H-14 831>>>81 byte&0xF0 128 \b@ML 832>>>81 byte&0xF0 160 \b@LL 833>>>81 byte &0x08 \b progressive 834>>>81 byte ^0x08 \b interlaced 835>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 836>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 837>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 838>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 839>>>7 byte&0xF0 0x10 \b, 16:9 840>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 841>>>7 byte&0xF0 0x10 \b, 16:9 842>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 843>>>7 byte&0xF0 0x10 \b, 4:3 844>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 845>>>5 beshort&0x0FFF 0x01E0 \b NTSC 846>>>5 beshort&0x0FFF 0x0240 \b PAL 847>>>7 byte&0xF0 0x20 \b, 4:3 848>>>7 byte&0xF0 0x30 \b, 16:9 849>>>7 byte&0xF0 0x40 \b, 11:5 850>>>7 byte&0xF0 0x80 \b, PAL 4:3 851>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 852>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 853>>>7 byte&0xF0 0x10 \b, 4:3 854>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 855>>>7 byte&0xF0 0x10 \b, 4:3 856>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 857>>>7 byte&0xF0 0x10 \b, 4:3 858>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 859>>>7 byte&0xF0 0x10 \b, 4:3 860>>4 beshort&0xFFF0 0x1600 \b, CIF 861>>>5 beshort&0x0FFF 0x00F0 \b NTSC 862>>>5 beshort&0x0FFF 0x0120 \b PAL 863>>>7 byte&0xF0 0x20 \b, 4:3 864>>>7 byte&0xF0 0x30 \b, 16:9 865>>>7 byte&0xF0 0x40 \b, 11:5 866>>>7 byte&0xF0 0x80 \b, PAL 4:3 867>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 868>>>5 beshort&0x0FFF 0x0240 \b PAL 625 869>>>>7 byte&0xF0 0x20 \b, 4:3 870>>>>7 byte&0xF0 0x30 \b, 16:9 871>>>>7 byte&0xF0 0x40 \b, 11:5 872>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 873>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 874>>>5 beshort&0x0FFF 0x0240 \b PAL 625 875>>>7 byte&0xF0 0x20 \b, 4:3 876>>>7 byte&0xF0 0x30 \b, 16:9 877>>>7 byte&0xF0 0x40 \b, 11:5 878>>4 beshort&0xFFF0 0x1E00 \b, SVCD 879>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 880>>>5 beshort&0x0FFF 0x0240 \b PAL 625 881>>>7 byte&0xF0 0x20 \b, 4:3 882>>>7 byte&0xF0 0x30 \b, 16:9 883>>>7 byte&0xF0 0x40 \b, 11:5 884>>7 byte&0x0F 1 \b, 23.976 fps 885>>7 byte&0x0F 2 \b, 24 fps 886>>7 byte&0x0F 3 \b, 25 fps 887>>7 byte&0x0F 4 \b, 29.97 fps 888>>7 byte&0x0F 5 \b, 30 fps 889>>7 byte&0x0F 6 \b, 50 fps 890>>7 byte&0x0F 7 \b, 59.94 fps 891>>7 byte&0x0F 8 \b, 60 fps 892>>11 byte &0x04 \b, Constrained 893 894# MPEG ADTS Audio (*.mpx/mxa/aac) 895# from dreesen@math.fu-berlin.de 896# modified to fully support MPEG ADTS 897 898# MP3, M1A 899# modified by Joerg Jenderek 900# GRR the original test are too common for many DOS files 901# so don't accept as MP3 until we've tested the rate 9020 beshort&0xFFFE 0xFFFA 903# rates 904>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps 905!:mime audio/mpeg 906>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps 907!:mime audio/mpeg 908>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps 909!:mime audio/mpeg 910>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps 911!:mime audio/mpeg 912>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps 913!:mime audio/mpeg 914>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps 915!:mime audio/mpeg 916>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps 917!:mime audio/mpeg 918>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps 919!:mime audio/mpeg 920>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps 921!:mime audio/mpeg 922>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps 923!:mime audio/mpeg 924>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps 925!:mime audio/mpeg 926>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps 927!:mime audio/mpeg 928>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps 929!:mime audio/mpeg 930>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps 931!:mime audio/mpeg 932# timing 933>2 byte&0x0C 0x00 \b, 44.1 kHz 934>2 byte&0x0C 0x04 \b, 48 kHz 935>2 byte&0x0C 0x08 \b, 32 kHz 936# channels/options 937>3 byte&0xC0 0x00 \b, Stereo 938>3 byte&0xC0 0x40 \b, JntStereo 939>3 byte&0xC0 0x80 \b, 2x Monaural 940>3 byte&0xC0 0xC0 \b, Monaural 941#>1 byte ^0x01 \b, Data Verify 942#>2 byte &0x02 \b, Packet Pad 943#>2 byte &0x01 \b, Custom Flag 944#>3 byte &0x08 \b, Copyrighted 945#>3 byte &0x04 \b, Original Source 946#>3 byte&0x03 1 \b, NR: 50/15 ms 947#>3 byte&0x03 3 \b, NR: CCIT J.17 948 949# MP2, M1A 9500 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 951!:mime audio/mpeg 952# rates 953>2 byte&0xF0 0x10 \b, 32 kbps 954>2 byte&0xF0 0x20 \b, 48 kbps 955>2 byte&0xF0 0x30 \b, 56 kbps 956>2 byte&0xF0 0x40 \b, 64 kbps 957>2 byte&0xF0 0x50 \b, 80 kbps 958>2 byte&0xF0 0x60 \b, 96 kbps 959>2 byte&0xF0 0x70 \b, 112 kbps 960>2 byte&0xF0 0x80 \b, 128 kbps 961>2 byte&0xF0 0x90 \b, 160 kbps 962>2 byte&0xF0 0xA0 \b, 192 kbps 963>2 byte&0xF0 0xB0 \b, 224 kbps 964>2 byte&0xF0 0xC0 \b, 256 kbps 965>2 byte&0xF0 0xD0 \b, 320 kbps 966>2 byte&0xF0 0xE0 \b, 384 kbps 967# timing 968>2 byte&0x0C 0x00 \b, 44.1 kHz 969>2 byte&0x0C 0x04 \b, 48 kHz 970>2 byte&0x0C 0x08 \b, 32 kHz 971# channels/options 972>3 byte&0xC0 0x00 \b, Stereo 973>3 byte&0xC0 0x40 \b, JntStereo 974>3 byte&0xC0 0x80 \b, 2x Monaural 975>3 byte&0xC0 0xC0 \b, Monaural 976#>1 byte ^0x01 \b, Data Verify 977#>2 byte &0x02 \b, Packet Pad 978#>2 byte &0x01 \b, Custom Flag 979#>3 byte &0x08 \b, Copyrighted 980#>3 byte &0x04 \b, Original Source 981#>3 byte&0x03 1 \b, NR: 50/15 ms 982#>3 byte&0x03 3 \b, NR: CCIT J.17 983 984# MPA, M1A 985# updated by Joerg Jenderek 986# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 987# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 988# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 989#0 beshort&0xFFFE 0xFFFE 990#>2 ubyte&0xF0 >0x0F 991#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 992## rate 993#>>>2 byte&0xF0 0x10 \b, 32 kbps 994#>>>2 byte&0xF0 0x20 \b, 64 kbps 995#>>>2 byte&0xF0 0x30 \b, 96 kbps 996#>>>2 byte&0xF0 0x40 \b, 128 kbps 997#>>>2 byte&0xF0 0x50 \b, 160 kbps 998#>>>2 byte&0xF0 0x60 \b, 192 kbps 999#>>>2 byte&0xF0 0x70 \b, 224 kbps 1000#>>>2 byte&0xF0 0x80 \b, 256 kbps 1001#>>>2 byte&0xF0 0x90 \b, 288 kbps 1002#>>>2 byte&0xF0 0xA0 \b, 320 kbps 1003#>>>2 byte&0xF0 0xB0 \b, 352 kbps 1004#>>>2 byte&0xF0 0xC0 \b, 384 kbps 1005#>>>2 byte&0xF0 0xD0 \b, 416 kbps 1006#>>>2 byte&0xF0 0xE0 \b, 448 kbps 1007## timing 1008#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 1009#>>>2 byte&0x0C 0x04 \b, 48 kHz 1010#>>>2 byte&0x0C 0x08 \b, 32 kHz 1011## channels/options 1012#>>>3 byte&0xC0 0x00 \b, Stereo 1013#>>>3 byte&0xC0 0x40 \b, JntStereo 1014#>>>3 byte&0xC0 0x80 \b, 2x Monaural 1015#>>>3 byte&0xC0 0xC0 \b, Monaural 1016##>1 byte ^0x01 \b, Data Verify 1017##>2 byte &0x02 \b, Packet Pad 1018##>2 byte &0x01 \b, Custom Flag 1019##>3 byte &0x08 \b, Copyrighted 1020##>3 byte &0x04 \b, Original Source 1021##>3 byte&0x03 1 \b, NR: 50/15 ms 1022##>3 byte&0x03 3 \b, NR: CCIT J.17 1023 1024# MP3, M2A 10250 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 1026!:mime audio/mpeg 1027# rate 1028>2 byte&0xF0 0x10 \b, 8 kbps 1029>2 byte&0xF0 0x20 \b, 16 kbps 1030>2 byte&0xF0 0x30 \b, 24 kbps 1031>2 byte&0xF0 0x40 \b, 32 kbps 1032>2 byte&0xF0 0x50 \b, 40 kbps 1033>2 byte&0xF0 0x60 \b, 48 kbps 1034>2 byte&0xF0 0x70 \b, 56 kbps 1035>2 byte&0xF0 0x80 \b, 64 kbps 1036>2 byte&0xF0 0x90 \b, 80 kbps 1037>2 byte&0xF0 0xA0 \b, 96 kbps 1038>2 byte&0xF0 0xB0 \b, 112 kbps 1039>2 byte&0xF0 0xC0 \b, 128 kbps 1040>2 byte&0xF0 0xD0 \b, 144 kbps 1041>2 byte&0xF0 0xE0 \b, 160 kbps 1042# timing 1043>2 byte&0x0C 0x00 \b, 22.05 kHz 1044>2 byte&0x0C 0x04 \b, 24 kHz 1045>2 byte&0x0C 0x08 \b, 16 kHz 1046# channels/options 1047>3 byte&0xC0 0x00 \b, Stereo 1048>3 byte&0xC0 0x40 \b, JntStereo 1049>3 byte&0xC0 0x80 \b, 2x Monaural 1050>3 byte&0xC0 0xC0 \b, Monaural 1051#>1 byte ^0x01 \b, Data Verify 1052#>2 byte &0x02 \b, Packet Pad 1053#>2 byte &0x01 \b, Custom Flag 1054#>3 byte &0x08 \b, Copyrighted 1055#>3 byte &0x04 \b, Original Source 1056#>3 byte&0x03 1 \b, NR: 50/15 ms 1057#>3 byte&0x03 3 \b, NR: CCIT J.17 1058 1059# MP2, M2A 10600 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 1061!:mime audio/mpeg 1062# rate 1063>2 byte&0xF0 0x10 \b, 8 kbps 1064>2 byte&0xF0 0x20 \b, 16 kbps 1065>2 byte&0xF0 0x30 \b, 24 kbps 1066>2 byte&0xF0 0x40 \b, 32 kbps 1067>2 byte&0xF0 0x50 \b, 40 kbps 1068>2 byte&0xF0 0x60 \b, 48 kbps 1069>2 byte&0xF0 0x70 \b, 56 kbps 1070>2 byte&0xF0 0x80 \b, 64 kbps 1071>2 byte&0xF0 0x90 \b, 80 kbps 1072>2 byte&0xF0 0xA0 \b, 96 kbps 1073>2 byte&0xF0 0xB0 \b, 112 kbps 1074>2 byte&0xF0 0xC0 \b, 128 kbps 1075>2 byte&0xF0 0xD0 \b, 144 kbps 1076>2 byte&0xF0 0xE0 \b, 160 kbps 1077# timing 1078>2 byte&0x0C 0x00 \b, 22.05 kHz 1079>2 byte&0x0C 0x04 \b, 24 kHz 1080>2 byte&0x0C 0x08 \b, 16 kHz 1081# channels/options 1082>3 byte&0xC0 0x00 \b, Stereo 1083>3 byte&0xC0 0x40 \b, JntStereo 1084>3 byte&0xC0 0x80 \b, 2x Monaural 1085>3 byte&0xC0 0xC0 \b, Monaural 1086#>1 byte ^0x01 \b, Data Verify 1087#>2 byte &0x02 \b, Packet Pad 1088#>2 byte &0x01 \b, Custom Flag 1089#>3 byte &0x08 \b, Copyrighted 1090#>3 byte &0x04 \b, Original Source 1091#>3 byte&0x03 1 \b, NR: 50/15 ms 1092#>3 byte&0x03 3 \b, NR: CCIT J.17 1093 1094# MPA, M2A 10950 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 1096!:mime audio/mpeg 1097# rate 1098>2 byte&0xF0 0x10 \b, 32 kbps 1099>2 byte&0xF0 0x20 \b, 48 kbps 1100>2 byte&0xF0 0x30 \b, 56 kbps 1101>2 byte&0xF0 0x40 \b, 64 kbps 1102>2 byte&0xF0 0x50 \b, 80 kbps 1103>2 byte&0xF0 0x60 \b, 96 kbps 1104>2 byte&0xF0 0x70 \b, 112 kbps 1105>2 byte&0xF0 0x80 \b, 128 kbps 1106>2 byte&0xF0 0x90 \b, 144 kbps 1107>2 byte&0xF0 0xA0 \b, 160 kbps 1108>2 byte&0xF0 0xB0 \b, 176 kbps 1109>2 byte&0xF0 0xC0 \b, 192 kbps 1110>2 byte&0xF0 0xD0 \b, 224 kbps 1111>2 byte&0xF0 0xE0 \b, 256 kbps 1112# timing 1113>2 byte&0x0C 0x00 \b, 22.05 kHz 1114>2 byte&0x0C 0x04 \b, 24 kHz 1115>2 byte&0x0C 0x08 \b, 16 kHz 1116# channels/options 1117>3 byte&0xC0 0x00 \b, Stereo 1118>3 byte&0xC0 0x40 \b, JntStereo 1119>3 byte&0xC0 0x80 \b, 2x Monaural 1120>3 byte&0xC0 0xC0 \b, Monaural 1121#>1 byte ^0x01 \b, Data Verify 1122#>2 byte &0x02 \b, Packet Pad 1123#>2 byte &0x01 \b, Custom Flag 1124#>3 byte &0x08 \b, Copyrighted 1125#>3 byte &0x04 \b, Original Source 1126#>3 byte&0x03 1 \b, NR: 50/15 ms 1127#>3 byte&0x03 3 \b, NR: CCIT J.17 1128 1129# MP3, M25A 11300 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 1131!:mime audio/mpeg 1132# rate 1133>2 byte&0xF0 0x10 \b, 8 kbps 1134>2 byte&0xF0 0x20 \b, 16 kbps 1135>2 byte&0xF0 0x30 \b, 24 kbps 1136>2 byte&0xF0 0x40 \b, 32 kbps 1137>2 byte&0xF0 0x50 \b, 40 kbps 1138>2 byte&0xF0 0x60 \b, 48 kbps 1139>2 byte&0xF0 0x70 \b, 56 kbps 1140>2 byte&0xF0 0x80 \b, 64 kbps 1141>2 byte&0xF0 0x90 \b, 80 kbps 1142>2 byte&0xF0 0xA0 \b, 96 kbps 1143>2 byte&0xF0 0xB0 \b, 112 kbps 1144>2 byte&0xF0 0xC0 \b, 128 kbps 1145>2 byte&0xF0 0xD0 \b, 144 kbps 1146>2 byte&0xF0 0xE0 \b, 160 kbps 1147# timing 1148>2 byte&0x0C 0x00 \b, 11.025 kHz 1149>2 byte&0x0C 0x04 \b, 12 kHz 1150>2 byte&0x0C 0x08 \b, 8 kHz 1151# channels/options 1152>3 byte&0xC0 0x00 \b, Stereo 1153>3 byte&0xC0 0x40 \b, JntStereo 1154>3 byte&0xC0 0x80 \b, 2x Monaural 1155>3 byte&0xC0 0xC0 \b, Monaural 1156#>1 byte ^0x01 \b, Data Verify 1157#>2 byte &0x02 \b, Packet Pad 1158#>2 byte &0x01 \b, Custom Flag 1159#>3 byte &0x08 \b, Copyrighted 1160#>3 byte &0x04 \b, Original Source 1161#>3 byte&0x03 1 \b, NR: 50/15 ms 1162#>3 byte&0x03 3 \b, NR: CCIT J.17 1163 1164# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 1165 1166# Stored AAC streams (instead of the MP4 format) 11670 string ADIF MPEG ADIF, AAC 1168!:mime audio/x-hx-aac-adif 1169>4 byte &0x80 1170>>13 byte &0x10 \b, VBR 1171>>13 byte ^0x10 \b, CBR 1172>>16 byte&0x1E 0x02 \b, single stream 1173>>16 byte&0x1E 0x04 \b, 2 streams 1174>>16 byte&0x1E 0x06 \b, 3 streams 1175>>16 byte &0x08 \b, 4 or more streams 1176>>16 byte &0x10 \b, 8 or more streams 1177>>4 byte &0x80 \b, Copyrighted 1178>>13 byte &0x40 \b, Original Source 1179>>13 byte &0x20 \b, Home Flag 1180>4 byte ^0x80 1181>>4 byte &0x10 \b, VBR 1182>>4 byte ^0x10 \b, CBR 1183>>7 byte&0x1E 0x02 \b, single stream 1184>>7 byte&0x1E 0x04 \b, 2 streams 1185>>7 byte&0x1E 0x06 \b, 3 streams 1186>>7 byte &0x08 \b, 4 or more streams 1187>>7 byte &0x10 \b, 8 or more streams 1188>>4 byte &0x40 \b, Original Stream(s) 1189>>4 byte &0x20 \b, Home Source 1190 1191# Live or stored single AAC stream (used with MPEG-2 systems) 11920 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 1193!:mime audio/x-hx-aac-adts 1194>1 byte &0x08 \b, v2 1195>1 byte ^0x08 \b, v4 1196# profile 1197>>2 byte &0xC0 \b LTP 1198>2 byte&0xc0 0x00 \b Main 1199>2 byte&0xc0 0x40 \b LC 1200>2 byte&0xc0 0x80 \b SSR 1201# timing 1202>2 byte&0x3c 0x00 \b, 96 kHz 1203>2 byte&0x3c 0x04 \b, 88.2 kHz 1204>2 byte&0x3c 0x08 \b, 64 kHz 1205>2 byte&0x3c 0x0c \b, 48 kHz 1206>2 byte&0x3c 0x10 \b, 44.1 kHz 1207>2 byte&0x3c 0x14 \b, 32 kHz 1208>2 byte&0x3c 0x18 \b, 24 kHz 1209>2 byte&0x3c 0x1c \b, 22.05 kHz 1210>2 byte&0x3c 0x20 \b, 16 kHz 1211>2 byte&0x3c 0x24 \b, 12 kHz 1212>2 byte&0x3c 0x28 \b, 11.025 kHz 1213>2 byte&0x3c 0x2c \b, 8 kHz 1214# channels 1215>2 beshort&0x01c0 0x0040 \b, monaural 1216>2 beshort&0x01c0 0x0080 \b, stereo 1217>2 beshort&0x01c0 0x00c0 \b, stereo + center 1218>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1219>2 beshort&0x01c0 0x0140 \b, surround 1220>2 beshort&0x01c0 0x0180 \b, surround + LFE 1221>2 beshort &0x01C0 \b, surround + side 1222#>1 byte ^0x01 \b, Data Verify 1223#>2 byte &0x02 \b, Custom Flag 1224#>3 byte &0x20 \b, Original Stream 1225#>3 byte &0x10 \b, Home Source 1226#>3 byte &0x08 \b, Copyrighted 1227 1228# Live MPEG-4 audio streams (instead of RTP FlexMux) 12290 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1230!:mime audio/x-mp4a-latm 1231#>1 beshort&0x1FFF x \b, %hu byte packet 1232>3 byte&0xE0 0x40 1233>>4 byte&0x3C 0x04 \b, single stream 1234>>4 byte&0x3C 0x08 \b, 2 streams 1235>>4 byte&0x3C 0x0C \b, 3 streams 1236>>4 byte &0x08 \b, 4 or more streams 1237>>4 byte &0x20 \b, 8 or more streams 1238>3 byte&0xC0 0 1239>>4 byte&0x78 0x08 \b, single stream 1240>>4 byte&0x78 0x10 \b, 2 streams 1241>>4 byte&0x78 0x18 \b, 3 streams 1242>>4 byte &0x20 \b, 4 or more streams 1243>>4 byte &0x40 \b, 8 or more streams 1244# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1245#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1246#!:mime audio/x-mp4a-latm 1247 1248# Summary: FLI animation format 1249# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1250# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 12514 leshort 0xAF11 1252# standard FLI always has 320x200 resolution and 8 bit color 1253>8 leshort 320 1254>>10 leshort 200 1255>>>12 leshort 8 FLI animation, 320x200x8 1256!:mime video/x-fli 1257>>>>6 leshort x \b, %d frames 1258# frame speed is multiple of 1/70s 1259>>>>16 leshort x \b, %d/70s per frame 1260 1261# Summary: FLC animation format 1262# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1263# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 12644 leshort 0xAF12 1265# standard FLC always use 8 bit color 1266>12 leshort 8 FLC animation 1267!:mime video/x-flc 1268>>8 leshort x \b, %d 1269>>10 leshort x \bx%dx8 1270>>6 uleshort x \b, %d frames 1271>>16 uleshort x \b, %dms per frame 1272 1273# DL animation format 1274# XXX - collision with most `mips' magic 1275# 1276# I couldn't find a real magic number for these, however, this 1277# -appears- to work. Note that it might catch other files, too, so be 1278# careful! 1279# 1280# Note that title and author appear in the two 20-byte chunks 1281# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1282# 255 (hex FF)! The DL format is really bad. 1283# 1284#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1285#!:mime video/x-unknown 1286#>42 byte x - %d screens, 1287#>43 byte x %d commands 1288#0 byte 2 DL version 2 1289#!:mime video/x-unknown 1290#>1 byte 1 - large format (320x200,1 image/screen), 1291#>1 byte 2 - medium format (160x100,4 images/screen), 1292#>1 byte >2 - unknown format, 1293#>42 byte x %d screens, 1294#>43 byte x %d commands 1295# Based on empirical evidence, DL version 3 have several nulls following the 1296# \003. Most of them start with non-null values at hex offset 0x34 or so. 1297#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1298 1299# iso 13818 transport stream 1300# 1301# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1302# syncbyte 8 bit 0x47 1303# error_ind 1 bit - 1304# payload_start 1 bit 1 1305# priority 1 bit - 1306# PID 13 bit 0x0000 1307# scrambling 2 bit - 1308# adaptfld_ctrl 2 bit 1 or 3 1309# conti_count 4 bit - 13100 belong&0xFF5FFF10 0x47400010 1311>188 byte 0x47 MPEG transport stream data 1312 1313# DIF digital video file format <mpruett@sgi.com> 13140 belong&0xffffff00 0x1f070000 DIF 1315>4 byte &0x01 (DVCPRO) movie file 1316>4 byte ^0x01 (DV) movie file 1317>3 byte &0x80 (PAL) 1318>3 byte ^0x80 (NTSC) 1319 1320# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 13210 belong 0x3026b275 Microsoft ASF 1322!:mime video/x-ms-asf 1323 1324# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 13250 string \x8aMNG MNG video data, 1326!:mime video/x-mng 1327>4 belong !0x0d0a1a0a CORRUPTED, 1328>4 belong 0x0d0a1a0a 1329>>16 belong x %d x 1330>>20 belong x %d 1331 1332# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 13330 string \x8bJNG JNG video data, 1334!:mime video/x-jng 1335>4 belong !0x0d0a1a0a CORRUPTED, 1336>4 belong 0x0d0a1a0a 1337>>16 belong x %d x 1338>>20 belong x %d 1339 1340# Vivo video (Wolfram Kleff) 13413 string \x0D\x0AVersion:Vivo Vivo video data 1342 1343# VRML (Virtual Reality Modelling Language) 13440 string/w #VRML\ V1.0\ ascii VRML 1 file 1345!:mime model/vrml 13460 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1347!:mime model/vrml 1348 1349# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd] 1350# From Michel Briand <michelbriand@free.fr> 1351# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml 1352# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 13530 string/w \<?xml\ version= 1354!:strength + 5 1355>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1356!:mime model/x3d+xml 1357 1358#--------------------------------------------------------------------------- 1359# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1360# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1361# 13620 string HVQM4 %s 1363>6 string >\0 v%s 1364>0 byte x GameCube movie, 1365>0x34 ubeshort x %d x 1366>0x36 ubeshort x %d, 1367>0x26 ubeshort x %dus, 1368>0x42 ubeshort 0 no audio 1369>0x42 ubeshort >0 %dHz audio 1370 1371# From: "Stefan A. Haubenthal" <polluks@web.de> 13720 string DVDVIDEO-VTS Video title set, 1373>0x21 byte x v%x 13740 string DVDVIDEO-VMG Video manager, 1375>0x21 byte x v%x 1376 1377# From: Behan Webster <behanw@websterwood.com> 1378# NuppelVideo used by Mythtv (*.nuv) 1379# Note: there are two identical stanzas here differing only in the 1380# initial string matched. It used to be done with a regex, but we're 1381# trying to get rid of those. 13820 string NuppelVideo MythTV NuppelVideo 1383>12 string x v%s 1384>20 lelong x (%d 1385>24 lelong x \bx%d), 1386>36 string P \bprogressive, 1387>36 string I \binterlaced, 1388>40 ledouble x \baspect:%.2f, 1389>48 ledouble x \bfps:%.2f 13900 string MythTV MythTV NuppelVideo 1391>12 string x v%s 1392>20 lelong x (%d 1393>24 lelong x \bx%d), 1394>36 string P \bprogressive, 1395>36 string I \binterlaced, 1396>40 ledouble x \baspect:%.2f, 1397>48 ledouble x \bfps:%.2f 1398 1399# MPEG file 1400# MPEG sequences 1401# FIXME: This section is from the old magic.mime file and needs 1402# integrating with the rest 1403#0 belong 0x000001BA 1404#>4 byte &0x40 1405#!:mime video/mp2p 1406#>4 byte ^0x40 1407#!:mime video/mpeg 1408#0 belong 0x000001BB 1409#!:mime video/mpeg 1410#0 belong 0x000001B0 1411#!:mime video/mp4v-es 1412#0 belong 0x000001B5 1413#!:mime video/mp4v-es 1414#0 belong 0x000001B3 1415#!:mime video/mpv 1416#0 belong&0xFF5FFF10 0x47400010 1417#!:mime video/mp2t 1418#0 belong 0x00000001 1419#>4 byte&0x1F 0x07 1420#!:mime video/h264 1421 1422# Type: Bink Video 1423# Extension: .bik 1424# URL: http://wiki.multimedia.cx/index.php?title=Bink_Container 1425# From: <hoehle@users.sourceforge.net> 2008-07-18 14260 string BIK Bink Video 1427>3 regex =[a-z] rev.%s 1428#>4 ulelong x size %d 1429>20 ulelong x \b, %d 1430>24 ulelong x \bx%d 1431>8 ulelong x \b, %d frames 1432>32 ulelong x at rate %d/ 1433>28 ulelong >1 \b%d 1434>40 ulelong =0 \b, no audio 1435>40 ulelong !0 \b, %d audio track 1436>>40 ulelong !1 \bs 1437# follow properties of the first audio track only 1438>>48 uleshort x %dHz 1439>>51 byte&0x20 0 mono 1440>>51 byte&0x20 !0 stereo 1441#>>51 byte&0x10 0 FFT 1442#>>51 byte&0x10 !0 DCT 1443 1444# Type: NUT Container 1445# URL: http://wiki.multimedia.cx/index.php?title=NUT 1446# From: Adam Buchbinder <adam.buchbinder@gmail.com> 14470 string nut/multimedia\ container\0 NUT multimedia container 1448 1449# Type: Nullsoft Video (NSV) 1450# URL: http://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1451# From: Mike Melanson <mike@multimedia.cx> 14520 string NSVf Nullsoft Video 1453 1454# Type: REDCode Video 1455# URL: http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode 1456# From: Mike Melanson <mike@multimedia.cx> 14574 string RED1 REDCode Video 1458 1459# Type: MTV Multimedia File 1460# URL: http://wiki.multimedia.cx/index.php?title=MTV 1461# From: Mike Melanson <mike@multimedia.cx> 14620 string AMVS MTV Multimedia File 1463 1464# Type: ARMovie 1465# URL: http://wiki.multimedia.cx/index.php?title=ARMovie 1466# From: Mike Melanson <mike@multimedia.cx> 14670 string ARMovie\012 ARMovie 1468 1469# Type: Interplay MVE Movie 1470# URL: http://wiki.multimedia.cx/index.php?title=Interplay_MVE 1471# From: Mike Melanson <mike@multimedia.cx> 14720 string Interplay\040MVE\040File\032 Interplay MVE Movie 1473 1474# Type: Windows Television DVR File 1475# URL: http://wiki.multimedia.cx/index.php?title=WTV 1476# From: Mike Melanson <mike@mutlimedia.cx> 1477# This takes the form of a Windows-style GUID 14780 bequad 0xB7D800203749DA11 1479>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1480 1481# Type: Sega FILM/CPK Multimedia 1482# URL: http://wiki.multimedia.cx/index.php?title=Sega_FILM 1483# From: Mike Melanson <mike@multimedia.cx> 14840 string FILM Sega FILM/CPK Multimedia, 1485>32 belong x %d x 1486>28 belong x %d 1487 1488# Type: Nintendo THP Multimedia 1489# URL: http://wiki.multimedia.cx/index.php?title=THP 1490# From: Mike Melanson <mike@multimedia.cx> 14910 string THP\0 Nintendo THP Multimedia 1492 1493# Type: BBC Dirac Video 1494# URL: http://wiki.multimedia.cx/index.php?title=Dirac 1495# From: Mike Melanson <mike@multimedia.cx> 14960 string BBCD BBC Dirac Video 1497 1498# Type: RAD Game Tools Smacker Multimedia 1499# URL: http://wiki.multimedia.cx/index.php?title=Smacker 1500# From: Mike Melanson <mike@multimedia.cx> 15010 string SMK RAD Game Tools Smacker Multimedia 1502>3 byte x version %c, 1503>4 lelong x %d x 1504>8 lelong x %d, 1505>12 lelong x %d frames 1506 1507# Material Exchange Format 1508# More information: 1509# https://en.wikipedia.org/wiki/Material_Exchange_Format 1510# http://www.freemxf.org/ 15110 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format 1512!:ext mxf 1513!:mime application/mxf 1514 1515#------------------------------------------------------------------------------ 1516# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1517# aout: file(1) magic for a.out executable/object/etc entries that 1518# handle executables on multiple platforms. 1519# 1520 1521# 1522# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1523# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1524# 1525# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1526# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1527# works only for binaries using shared libraries. Grabbing the entry 1528# point from the a.out header, using it to find the first code executed 1529# in the program, and looking at that might help. 1530# 15310 lelong 0407 a.out little-endian 32-bit executable 1532>16 lelong >0 not stripped 1533>32 byte 0x6a (uses BSD/OS shared libs) 1534 15350 lelong 0410 a.out little-endian 32-bit pure executable 1536>16 lelong >0 not stripped 1537>32 byte 0x6a (uses BSD/OS shared libs) 1538 15390 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1540>16 lelong >0 not stripped 1541>32 byte 0x6a (uses BSD/OS shared libs) 1542 1543# 1544# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1545# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1546# 1547# XXX - is there anything we can look at to distinguish old SunOS 68010 1548# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1549# the first instruction or instructions in the program. 1550# 15510 belong 0407 a.out big-endian 32-bit executable 1552>16 belong >0 not stripped 1553 15540 belong 0410 a.out big-endian 32-bit pure executable 1555>16 belong >0 not stripped 1556 15570 belong 0413 a.out big-endian 32-bit demand paged executable 1558>16 belong >0 not stripped 1559 1560 1561#------------------------------------------------------------------------------ 1562# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $ 1563# apache: file(1) magic for Apache Big Data formats 1564 1565# Avro files 15660 string Obj Apache Avro 1567>3 byte x version %d 1568 1569# ORC files 1570# Important information is in file footer, which we can't index to :( 15710 string ORC Apache ORC 1572 1573# Parquet files 15740 string PAR1 Apache Parquet 1575 1576# Hive RC files 15770 string RCF Apache Hive RC file 1578>3 byte x version %d 1579 1580# Sequence files (and the careless first version of RC file) 1581 15820 string SEQ 1583>3 byte <6 Apache Hadoop Sequence file version %d 1584>3 byte >6 Apache Hadoop Sequence file version %d 1585>3 byte =6 1586>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0 1587>>3 default x Apache Hadoop Sequence file version 6 1588 1589#------------------------------------------------------------------------------ 1590# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1591# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1592# workspaces) 1593# 15940 long 0100554 APL workspace (Ken's original?) 1595 1596#------------------------------------------------------------------------------ 1597# $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $ 1598# apple: file(1) magic for Apple file formats 1599# 16000 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 16010 string \x0aGL Binary II (apple ][) data 16020 string \x76\xff Squeezed (apple ][) data 16030 string NuFile NuFile archive (apple ][) data 16040 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 16050 belong 0x00051600 AppleSingle encoded Macintosh file 16060 belong 0x00051607 AppleDouble encoded Macintosh file 1607 1608# Type: Apple Emulator 2IMG format 1609# From: Radek Vokal <rvokal@redhat.com> 16100 string 2IMG Apple ][ 2IMG Disk Image 1611>4 string XGS! \b, XGS 1612>4 string CTKG \b, Catakig 1613>4 string ShIm \b, Sheppy's ImageMaker 1614>4 string WOOF \b, Sweet 16 1615>4 string B2TR \b, Bernie ][ the Rescue 1616>4 string !nfc \b, ASIMOV2 1617>4 string x \b, Unknown Format 1618>0xc byte 00 \b, DOS 3.3 sector order 1619>>0x10 byte 00 \b, Volume 254 1620>>0x10 byte&0x7f x \b, Volume %u 1621>0xc byte 01 \b, ProDOS sector order 1622>>0x14 short x \b, %u Blocks 1623>0xc byte 02 \b, NIB data 1624 1625# magic for Newton PDA package formats 1626# from Ruda Moura <ruda@helllabs.org> 16270 string package0 Newton package, NOS 1.x, 1628>12 belong &0x80000000 AutoRemove, 1629>12 belong &0x40000000 CopyProtect, 1630>12 belong &0x10000000 NoCompression, 1631>12 belong &0x04000000 Relocation, 1632>12 belong &0x02000000 UseFasterCompression, 1633>16 belong x version %d 1634 16350 string package1 Newton package, NOS 2.x, 1636>12 belong &0x80000000 AutoRemove, 1637>12 belong &0x40000000 CopyProtect, 1638>12 belong &0x10000000 NoCompression, 1639>12 belong &0x04000000 Relocation, 1640>12 belong &0x02000000 UseFasterCompression, 1641>16 belong x version %d 1642 16430 string package4 Newton package, 1644>8 byte 8 NOS 1.x, 1645>8 byte 9 NOS 2.x, 1646>12 belong &0x80000000 AutoRemove, 1647>12 belong &0x40000000 CopyProtect, 1648>12 belong &0x10000000 NoCompression, 1649 1650# The following entries for the Apple II are for files that have 1651# been transferred as raw binary data from an Apple, without having 1652# been encapsulated by any of the above archivers. 1653# 1654# In general, Apple II formats are hard to identify because Apple DOS 1655# and especially Apple ProDOS have strong typing in the file system and 1656# therefore programmers never felt much need to include type information 1657# in the files themselves. 1658# 1659# Eric Fischer <enf@pobox.com> 1660 1661# AppleWorks word processor: 1662# URL: https://en.wikipedia.org/wiki/AppleWorks 1663# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 1664# Update: Joerg Jenderek 1665# NOTE: 1666# The "O" is really the magic number, but that's so common that it's 1667# necessary to check the tab stops that follow it to avoid false positives. 1668# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 1669# the newer AppleWorks is from claris with extension CWK 16704 string O 1671# test for unused bits of zoom- , paginated-boolean bytes 1672>84 ubequad ^0x00Fe00000000Fe00 1673# look for tabstop definitions "=" no tab, "|" no tab 1674# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 1675# unofficial "!" other , "\x8a" other 1676# official only if SFMinVers is nonzero 1677>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 1678# AppleWorks Word Processor File (Apple II) 1679# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 1680# application/x-appleworks is mime type for claris version with cwk extension 1681!:mime application/x-appleworks3 1682# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 1683# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 1684# $70 $1A $F8 $FF is this the apple type ? 1685#:apple pdosp�� 1686!:ext awp 1687# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 1688>>>183 ubyte 30 3.0 1689>>>183 ubyte !30 1690>>>>183 ubyte !0 0x%x 1691# usual tabstop start sequence "=====<" 1692>>>5 string x \b, tabstop ruler "%6.6s" 1693# tabstop ruler 1694#>>>5 string >\0 \b, tabstops "%-79s" 1695# zoom switch 1696>>>85 byte&0x01 >0 \b, zoomed 1697# whether paginated 1698>>>90 byte&0x01 >0 \b, paginated 1699# contains any mail-merge commands 1700>>>92 byte&0x01 >0 \b, with mail merge 1701# left margin in 1/10 inches ( normally 0 or 10 ) 1702>>>91 ubyte >0 1703>>>>91 ubyte x \b, %d/10 inch left margin 1704 1705# AppleWorks database: 1706# 1707# This isn't really a magic number, but it's the closest thing to one 1708# that I could find. The 1 and 2 really mean "order in which you defined 1709# categories" and "left to right, top to bottom," respectively; the D and R 1710# mean that the cursor should move either down or right when you press Return. 1711 1712#30 string \x01D AppleWorks database data 1713#30 string \x02D AppleWorks database data 1714#30 string \x01R AppleWorks database data 1715#30 string \x02R AppleWorks database data 1716 1717# AppleWorks spreadsheet: 1718# 1719# Likewise, this isn't really meant as a magic number. The R or C means 1720# row- or column-order recalculation; the A or M means automatic or manual 1721# recalculation. 1722 1723#131 string RA AppleWorks spreadsheet data 1724#131 string RM AppleWorks spreadsheet data 1725#131 string CA AppleWorks spreadsheet data 1726#131 string CM AppleWorks spreadsheet data 1727 1728# Applesoft BASIC: 1729# 1730# This is incredibly sloppy, but will be true if the program was 1731# written at its usual memory location of 2048 and its first line 1732# number is less than 256. Yuck. 1733# update by Joerg Jenderek at Feb 2013 1734 1735# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 1736#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 17370 belong&0x00ff00ff 0x00080000 1738# assuming that line number must be positive 1739>2 leshort >0 Applesoft BASIC program data, first line number %d 1740#>2 leshort x \b, first line number %d 1741 1742# ORCA/EZ assembler: 1743# 1744# This will not identify ORCA/M source files, since those have 1745# some sort of date code instead of the two zero bytes at 6 and 7 1746# XXX Conflicts with ELF 1747#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1748#>5 byte x \b, build number %d 1749 1750# Broderbund Fantavision 1751# 1752# I don't know what these values really mean, but they seem to recur. 1753# Will they cause too many conflicts? 1754 1755# Probably :-) 1756#2 belong&0xFF00FF 0x040008 Fantavision movie data 1757 1758# Some attempts at images. 1759# 1760# These are actually just bit-for-bit dumps of the frame buffer, so 1761# there's really no reasonably way to distinguish them except for their 1762# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1763# or, occasionally, 8184. 1764# 1765# Nevertheless this will manage to catch a lot of images that happen 1766# to have a solid-colored line at the bottom of the screen. 1767 1768# GRR: Magic too weak 1769#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1770#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 1771#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 1772#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 1773#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 1774 1775# Beagle Bros. Apple Mechanic fonts 1776 17770 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 1778 1779# Apple Universal Disk Image Format (UDIF) - dmg files. 1780# From Johan Gade. 1781# These entries are disabled for now until we fix the following issues. 1782# 1783# Note there might be some problems with the "VAX COFF executable" 1784# entry. Note this entry should be placed before the mac filesystem section, 1785# particularly the "Apple Partition data" entry. 1786# 1787# The intended meaning of these tests is, that the file is only of the 1788# specified type if both of the lines are correct - i.e. if the first 1789# line matches and the second doesn't then it is not of that type. 1790# 1791#0 long 0x7801730d 1792#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 1793# 1794# Note that this entry is recognized correctly by the "Apple Partition 1795# data" entry - however since this entry is more specific - this 1796# information seems to be more useful. 1797#0 long 0x45520200 1798#>0x410 string disk\ image UDIF read/write image (UDRW) 1799 1800# From: Toby Peterson <toby@apple.com> 18010 string bplist00 Apple binary property list 1802 1803# Apple binary property list (bplist) 1804# Assumes version bytes are hex. 1805# Provides content hints for version 0 files. Assumes that the root 1806# object is the first object (true for CoreFoundation implementation). 1807# From: David Remahl <dremahl@apple.com> 18080 string bplist 1809>6 byte x \bCoreFoundation binary property list data, version 0x%c 1810>>7 byte x \b%c 1811>6 string 00 \b 1812>>8 byte&0xF0 0x00 \b 1813>>>8 byte&0x0F 0x00 \b, root type: null 1814>>>8 byte&0x0F 0x08 \b, root type: false boolean 1815>>>8 byte&0x0F 0x09 \b, root type: true boolean 1816>>8 byte&0xF0 0x10 \b, root type: integer 1817>>8 byte&0xF0 0x20 \b, root type: real 1818>>8 byte&0xF0 0x30 \b, root type: date 1819>>8 byte&0xF0 0x40 \b, root type: data 1820>>8 byte&0xF0 0x50 \b, root type: ascii string 1821>>8 byte&0xF0 0x60 \b, root type: unicode string 1822>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 1823>>8 byte&0xF0 0xa0 \b, root type: array 1824>>8 byte&0xF0 0xd0 \b, root type: dictionary 1825 1826# Apple/NeXT typedstream data 1827# Serialization format used by NeXT and Apple for various 1828# purposes in YellowStep/Cocoa, including some nib files. 1829# From: David Remahl <dremahl@apple.com> 18302 string typedstream NeXT/Apple typedstream data, big endian 1831>0 byte x \b, version %d 1832>0 byte <5 \b 1833>>13 byte 0x81 \b 1834>>>14 ubeshort x \b, system %d 18352 string streamtyped NeXT/Apple typedstream data, little endian 1836>0 byte x \b, version %d 1837>0 byte <5 \b 1838>>13 byte 0x81 \b 1839>>>14 uleshort x \b, system %d 1840 1841#------------------------------------------------------------------------------ 1842# CAF: Apple CoreAudio File Format 1843# 1844# Container format for high-end audio purposes. 1845# From: David Remahl <dremahl@apple.com> 1846# 18470 string caff CoreAudio Format audio file 1848>4 beshort <10 version %d 1849>6 beshort x 1850 1851 1852#------------------------------------------------------------------------------ 1853# Keychain database files 18540 string kych Mac OS X Keychain File 1855 1856#------------------------------------------------------------------------------ 1857# Code Signing related file types 18580 belong 0xfade0c00 Mac OS X Code Requirement 1859>8 belong 1 (opExpr) 1860>4 belong x - %d bytes 1861 18620 belong 0xfade0c01 Mac OS X Code Requirement Set 1863>8 belong >1 containing %d items 1864>4 belong x - %d bytes 1865 18660 belong 0xfade0c02 Mac OS X Code Directory 1867>8 belong x version %x 1868>12 belong >0 flags 0x%x 1869>4 belong x - %d bytes 1870 18710 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 1872>4 belong x - %d bytes 1873 18740 belong 0xfade0cc1 Mac OS X Detached Code Signature 1875>8 belong >1 (%d elements) 1876>4 belong x - %d bytes 1877 1878# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 1879# .vdi 18804 string innotek\ VirtualBox\ Disk\ Image %s 1881 1882# Apple disk partition stuff 1883# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 1884# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 1885# Update: Joerg Jenderek 1886# "ER" is APPLE_DRVR_MAP_MAGIC signature 18870 beshort 0x4552 1888# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 1889#!:strength +0 1890# strengthen the magic by looking for used blocksizes 512 2048 1891>2 ubeshort&0xf1FF 0 Apple Driver Map 1892# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 1893#>>504 ubequad&0x0000FFffFFff0000 0 1894!:mime application/x-apple-diskimage 1895!:apple ????devr 1896# https://en.wikipedia.org/wiki/Apple_Disk_Image 1897!:ext dmg/iso 1898# sbBlkSize for driver descriptor map 512 2048 1899>>2 beshort x \b, blocksize %d 1900# sbBlkCount sometimes garbish like 1901# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 1902# 0xf2720100 for bunziped Firefox 48.0-2.dmg 1903# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 1904# 0x00009090 by syslinux-6.03/utils/isohybrid.c 1905>>4 ubelong x \b, blockcount %u 1906# following device/driver information not very useful 1907# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 1908>>8 ubeshort x \b, devtype %u 1909# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 1910>>10 ubeshort x \b, devid %u 1911# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 1912>>12 ubelong >0 1913>>>12 ubelong x \b, driver data %u 1914# number of driver descriptors sbDrvrCount <= 61 1915# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 1916>>16 ubeshort x \b, driver count %u 1917# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 1918# >>18 use apple-driver-map 1919# >>26 use apple-driver-map 1920# # ... 1921# >>500 use apple-driver-map 1922# number of partitions is always same in every partition (map block count) 1923#>>0x0204 ubelong x \b, %u partitions 1924>>0x0204 ubelong >0 \b, contains[@0x200]: 1925>>>0x0200 use apple-apm 1926>>0x0204 ubelong >1 \b, contains[@0x400]: 1927>>>0x0400 use apple-apm 1928>>0x0204 ubelong >2 \b, contains[@0x600]: 1929>>>0x0600 use apple-apm 1930>>0x0204 ubelong >3 \b, contains[@0x800]: 1931>>>0x0800 use apple-apm 1932>>0x0204 ubelong >4 \b, contains[@0xA00]: 1933>>>0x0A00 use apple-apm 1934>>0x0204 ubelong >5 \b, contains[@0xC00]: 1935>>>0x0C00 use apple-apm 1936>>0x0204 ubelong >6 \b, contains[@0xE00]: 1937>>>0x0E00 use apple-apm 1938>>0x0204 ubelong >7 \b, contains[@0x1000]: 1939>>>0x1000 use apple-apm 1940# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 19410 name apple-driver-map 1942>0 ubequad !0 1943# descBlock first block of driver 1944>>0 ubelong x \b, driver start block %u 1945# descSize driver size in blocks 1946>>4 ubeshort x \b, size %u 1947# descType driver system type 1 701h F8FFh FFFFh 1948>>6 ubeshort x \b, type 0x%x 1949 1950# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 1951# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 1952# Update: Joerg Jenderek 1953# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 1954# magic stronger. 1955# for apple partition map stored as a single file 19560 belong 0x504d0000 1957# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 1958#!:strength +0 1959>0 use apple-apm 1960# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 1961# file: could not find any valid magic files! 1962#!:ext bin 1963# display apple partition map. Normally called after Apple driver map 19640 name apple-apm 1965>0 belong 0x504d0000 Apple Partition Map 1966# number of partitions 1967>>4 ubelong x \b, map block count %u 1968# logical block (512 bytes) start of partition 1969>>8 ubelong x \b, start block %u 1970>>12 ubelong x \b, block count %u 1971>>16 string >0 \b, name %s 1972>>48 string >0 \b, type %s 1973# processor type dpme_process_id[16] e.g. "68000" "68020" 1974>>120 string >0 \b, processor %s 1975# A/UX boot arguments BootArgs[128] 1976>>136 string >0 \b, boot arguments %s 1977# status of partition dpme_flags 1978>>88 belong & 1 \b, valid 1979>>88 belong & 2 \b, allocated 1980>>88 belong & 4 \b, in use 1981>>88 belong & 8 \b, has boot info 1982>>88 belong & 16 \b, readable 1983>>88 belong & 32 \b, writable 1984>>88 belong & 64 \b, pic boot code 1985>>88 belong & 128 \b, chain compatible driver 1986>>88 belong & 256 \b, real driver 1987>>88 belong & 512 \b, chain driver 1988# mount automatically at startup APPLE_PS_AUTO_MOUNT 1989>>88 ubelong &0x40000000 \b, mount at startup 1990# is the startup partition APPLE_PS_STARTUP 1991>>88 ubelong &0x80000000 \b, is the startup partition 1992 1993#http://wiki.mozilla.org/DS_Store_File_Format 1994#http://en.wikipedia.org/wiki/.DS_Store 19950 string \0\0\0\1Bud1\0 Apple Desktop Services Store 1996 1997# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 1998# Usually not in separate files, but have either filename rsrc with 1999# no extension, or a filename corresponding to another file, with 2000# extensions rsr/rsrc 20010 string \000\000\001\000 2002>4 leshort 0 2003>>16 lelong 0 Apple HFS/HFS+ resource fork 2004 2005#https://en.wikipedia.org/wiki/AppleScript 20060 string FasdUAS AppleScript compiled 2007 2008# AppleWorks/ClarisWorks 2009# https://github.com/joshenders/appleworks_format 2010# http://fileformats.archiveteam.org/wiki/AppleWorks 20110 name appleworks 2012>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 2013>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 2014>0 default x 2015>>0 belong x AppleWorks/ClarisWorks CWK Document 2016>0 byte x \b, version %d 2017>30 beshort x \b, %d 2018>32 beshort x \bx%d 2019!:ext cwk 2020 20214 string BOBO 2022>0 byte >4 2023>>12 belong 0 2024>>>26 belong 0 2025>>>>0 use appleworks 2026>0 belong 0x0481ad00 2027>>0 use appleworks 2028 2029#------------------------------------------------------------------------------ 2030# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $ 2031# application: file(1) magic for applications on small devices 2032# 2033# Pebble Application 20340 string PBLAPP\000\000 Pebble application 2035 2036#------------------------------------------------------------------------------ 2037# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2038# applix: file(1) magic for Applixware 2039# From: Peter Soos <sp@osb.hu> 2040# 20410 string *BEGIN Applixware 2042>7 string WORDS Words Document 2043>7 string GRAPHICS Graphic 2044>7 string RASTER Bitmap 2045>7 string SPREADSHEETS Spreadsheet 2046>7 string MACRO Macro 2047>7 string BUILDER Builder Object 2048 2049#------------------------------------------------------------------------------ 2050# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $ 2051# apt: file(1) magic for APT Cache files 2052# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html> 2053# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292> 2054 2055# before version 10 ("old format"), data was in arch-specific long/short 2056 2057# old format 64 bit 20580 name apt-cache-64bit-be 2059>12 beshort 1 \b, dirty 2060>40 bequad x \b, %llu packages 2061>48 bequad x \b, %llu versions 2062 2063# old format 32 bit 20640 name apt-cache-32bit-be 2065>8 beshort 1 \b, dirty 2066>40 belong x \b, %u packages 2067>44 belong x \b, %u versions 2068 2069# new format 20700 name apt-cache-be 2071>6 byte 1 \b, dirty 2072>24 belong x \b, %u packages 2073>28 belong x \b, %u versions 2074 20750 bequad 0x98FE76DC 2076>8 ubeshort <10 APT cache data, version %u 2077>>10 beshort x \b.%u, 64 bit big-endian 2078>>0 use apt-cache-64bit-be 2079 20800 lequad 0x98FE76DC 2081>8 uleshort <10 APT cache data, version %u 2082>>10 leshort x \b.%u, 64 bit little-endian 2083>>0 use \^apt-cache-64bit-be 2084 20850 belong 0x98FE76DC 2086>4 ubeshort <10 APT cache data, version %u 2087>>6 ubeshort x \b.%u, 32 bit big-endian 2088>>0 use apt-cache-32bit-be 2089>4 ubyte >9 APT cache data, version %u 2090>>5 ubyte x \b.%u, big-endian 2091>>0 use apt-cache-be 2092 20930 lelong 0x98FE76DC 2094>4 uleshort <10 APT cache data, version %u 2095>>6 uleshort x \b.%u, 32 bit little-endian 2096>>0 use \^apt-cache-32bit-be 2097>4 ubyte >9 APT cache data, version %u 2098>>5 ubyte x \b.%u, little-endian 2099>>0 use \^apt-cache-be 2100#------------------------------------------------------------------------------ 2101# $File: archive,v 1.107 2017/03/20 19:51:15 christos Exp $ 2102# archive: file(1) magic for archive formats (see also "msdos" for self- 2103# extracting compressed archives) 2104# 2105# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 2106# pre-POSIX "tar" archives are handled in the C code. 2107 2108# POSIX tar archives 2109257 string ustar\0 POSIX tar archive 2110!:mime application/x-tar # encoding: posix 2111257 string ustar\040\040\0 GNU tar archive 2112!:mime application/x-tar # encoding: gnu 2113 2114# Incremental snapshot gnu-tar format from: 2115# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 21160 string GNU\ tar- GNU tar incremental snapshot data 2117>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 2118 2119# cpio archives 2120# 2121# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 2122# The idea is to indicate archives produced on machines with the same 2123# byte order as the machine running "file" with "cpio archive", and 2124# to indicate archives produced on machines with the opposite byte order 2125# from the machine running "file" with "byte-swapped cpio archive". 2126# 2127# The SVR4 "cpio(4)" hints that there are additional formats, but they 2128# are defined as "short"s; I think all the new formats are 2129# character-header formats and thus are strings, not numbers. 21300 short 070707 cpio archive 2131!:mime application/x-cpio 21320 short 0143561 byte-swapped cpio archive 2133!:mime application/x-cpio # encoding: swapped 21340 string 070707 ASCII cpio archive (pre-SVR4 or odc) 21350 string 070701 ASCII cpio archive (SVR4 with no CRC) 21360 string 070702 ASCII cpio archive (SVR4 with CRC) 2137 2138# 2139# Various archive formats used by various versions of the "ar" 2140# command. 2141# 2142 2143# 2144# Original UNIX archive formats. 2145# They were written with binary values in host byte order, and 2146# the magic number was a host "int", which might have been 16 bits 2147# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 2148# been ports to little-endian 16-bit-int or 32-bit-int platforms 2149# (x86?) using some of those formats; if none existed, feel free 2150# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 2151# 32-bit. There might have been big-endian ports of that sort as 2152# well. 2153# 21540 leshort 0177555 very old 16-bit-int little-endian archive 21550 beshort 0177555 very old 16-bit-int big-endian archive 21560 lelong 0177555 very old 32-bit-int little-endian archive 21570 belong 0177555 very old 32-bit-int big-endian archive 2158 21590 leshort 0177545 old 16-bit-int little-endian archive 2160>2 string __.SYMDEF random library 21610 beshort 0177545 old 16-bit-int big-endian archive 2162>2 string __.SYMDEF random library 21630 lelong 0177545 old 32-bit-int little-endian archive 2164>4 string __.SYMDEF random library 21650 belong 0177545 old 32-bit-int big-endian archive 2166>4 string __.SYMDEF random library 2167 2168# 2169# From "pdp" (but why a 4-byte quantity?) 2170# 21710 lelong 0x39bed PDP-11 old archive 21720 lelong 0x39bee PDP-11 4.0 archive 2173 2174# 2175# XXX - what flavor of APL used this, and was it a variant of 2176# some ar archive format? It's similar to, but not the same 2177# as, the APL workspace magic numbers in pdp. 2178# 21790 long 0100554 apl workspace 2180 2181# 2182# System V Release 1 portable(?) archive format. 2183# 21840 string =<ar> System V Release 1 ar archive 2185!:mime application/x-archive 2186 2187# 2188# Debian package; it's in the portable archive format, and needs to go 2189# before the entry for regular portable archives, as it's recognized as 2190# a portable archive whose first member has a name beginning with 2191# "debian". 2192# 21930 string =!<arch>\ndebian 2194>8 string debian-split part of multipart Debian package 2195!:mime application/vnd.debian.binary-package 2196>8 string debian-binary Debian binary package 2197!:mime application/vnd.debian.binary-package 2198>8 string !debian 2199>68 string >\0 (format %s) 2200# These next two lines do not work, because a bzip2 Debian archive 2201# still uses gzip for the control.tar (first in the archive). Only 2202# data.tar varies, and the location of its filename varies too. 2203# file/libmagic does not current have support for ascii-string based 2204# (offsets) as of 2005-09-15. 2205#>81 string bz2 \b, uses bzip2 compression 2206#>84 string gz \b, uses gzip compression 2207#>136 ledate x created: %s 2208 2209# 2210# MIPS archive; they're in the portable archive format, and need to go 2211# before the entry for regular portable archives, as it's recognized as 2212# a portable archive whose first member has a name beginning with 2213# "__________E". 2214# 22150 string =!<arch>\n__________E MIPS archive 2216!:mime application/x-archive 2217>20 string U with MIPS Ucode members 2218>21 string L with MIPSEL members 2219>21 string B with MIPSEB members 2220>19 string L and an EL hash table 2221>19 string B and an EB hash table 2222>22 string X -- out of date 2223 22240 search/1 -h- Software Tools format archive text 2225 2226# 2227# BSD/SVR2-and-later portable archive formats. 2228# 22290 string =!<arch> current ar archive 2230!:mime application/x-archive 2231>8 string __.SYMDEF random library 2232>68 string __.SYMDEF\ SORTED random library 2233 2234# 2235# "Thin" archive, as can be produced by GNU ar. 2236# 22370 string =!<thin>\n thin archive with 2238>68 belong 0 no symbol entries 2239>68 belong 1 %d symbol entry 2240>68 belong >1 %d symbol entries 2241 2242# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 2243# 2244# The first byte is the magic (0x1a), byte 2 is the compression type for 2245# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 2246# filename of the first file (null terminated). Since some types collide 2247# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 2248# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 22490 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 2250!:mime application/x-arc 22510 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 2252!:mime application/x-arc 22530 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 2254!:mime application/x-arc 22550 lelong&0x8080ffff 0x0000031a ARC archive data, packed 2256!:mime application/x-arc 22570 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 2258!:mime application/x-arc 22590 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 2260!:mime application/x-arc 2261# [JW] stuff taken from idarc, obviously ARC successors: 22620 lelong&0x8080ffff 0x00000a1a PAK archive data 2263!:mime application/x-arc 22640 lelong&0x8080ffff 0x0000141a ARC+ archive data 2265!:mime application/x-arc 22660 lelong&0x8080ffff 0x0000481a HYP archive data 2267!:mime application/x-arc 2268 2269# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 2270# I can't create either SPARK or ArcFS archives so I have not tested this stuff 2271# [GRR: the original entries collide with ARC, above; replaced with combined 2272# version (not tested)] 2273#0 byte 0x1a RISC OS archive (spark format) 22740 string \032archive RISC OS archive (ArcFS format) 22750 string Archive\000 RISC OS archive (ArcFS format) 2276 2277# All these were taken from idarc, many could not be verified. Unfortunately, 2278# there were many low-quality sigs, i.e. easy to trigger false positives. 2279# Please notify me of any real-world fishy/ambiguous signatures and I'll try 2280# to get my hands on the actual archiver and see if I find something better. [JW] 2281# probably many can be enhanced by finding some 0-byte or control char near the start 2282 2283# idarc calls this Crush/Uncompressed... *shrug* 22840 string CRUSH Crush archive data 2285# Squeeze It (.sqz) 22860 string HLSQZ Squeeze It archive data 2287# SQWEZ 22880 string SQWEZ SQWEZ archive data 2289# HPack (.hpk) 22900 string HPAK HPack archive data 2291# HAP 22920 string \x91\x33HF HAP archive data 2293# MD/MDCD 22940 string MDmd MDCD archive data 2295# LIM 22960 string LIM\x1a LIM archive data 2297# SAR 22983 string LH5 SAR archive data 2299# BSArc/BS2 23000 string \212\3SB\020\0 BSArc/BS2 archive data 2301# Bethesda Softworks Archive (Oblivion) 23020 string BSA\0 BSArc archive data 2303>4 lelong x version %d 2304# MAR 23052 string =-ah MAR archive data 2306# ACB 2307#0 belong&0x00f800ff 0x00800000 ACB archive data 2308# CPZ 2309# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 2310# JRC 23110 string JRchive JRC archive data 2312# Quantum 23130 string DS\0 Quantum archive data 2314# ReSOF 23150 string PK\3\6 ReSOF archive data 2316# QuArk 23170 string 7\4 QuArk archive data 2318# YAC 231914 string YC YAC archive data 2320# X1 23210 string X1 X1 archive data 23220 string XhDr X1 archive data 2323# CDC Codec (.dqt) 23240 belong&0xffffe000 0x76ff2000 CDC Codec archive data 2325# AMGC 23260 string \xad6" AMGC archive data 2327# NuLIB 23280 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 2329# PakLeo 23300 string LEOLZW PAKLeo archive data 2331# ChArc 23320 string SChF ChArc archive data 2333# PSA 23340 string PSA PSA archive data 2335# CrossePAC 23360 string DSIGDCC CrossePAC archive data 2337# Freeze 23380 string \x1f\x9f\x4a\x10\x0a Freeze archive data 2339# KBoom 23400 string \xc2\xa8MP\xc2\xa8 KBoom archive data 2341# NSQ, must go after CDC Codec 23420 string \x76\xff NSQ archive data 2343# DPA 23440 string Dirk\ Paehl DPA archive data 2345# BA 2346# TODO: idarc says "bytes 0-2 == bytes 3-5" 2347# TTComp 2348# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 2349# Update: Joerg Jenderek 2350# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 23510 string \0\6 2352# look for first keyword of Panorama database *.pan 2353>12 search/261 DESIGN 2354# skip keyword with low entropy 2355>12 default x TTComp archive, binary, 4K dictionary 2356# (version 5.25) labeled the above entry as "TTComp archive data" 2357# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 23580 string ESP ESP archive data 2359# ZPack 23600 string \1ZPK\1 ZPack archive data 2361# Sky 23620 string \xbc\x40 Sky archive data 2363# UFA 23640 string UFA UFA archive data 2365# Dry 23660 string =-H2O DRY archive data 2367# FoxSQZ 23680 string FOXSQZ FoxSQZ archive data 2369# AR7 23700 string ,AR7 AR7 archive data 2371# PPMZ 23720 string PPMZ PPMZ archive data 2373# MS Compress 23744 string \x88\xf0\x27 MS Compress archive data 2375# updated by Joerg Jenderek 2376>9 string \0 2377>>0 string KWAJ 2378>>>7 string \321\003 MS Compress archive data 2379>>>>14 ulong >0 \b, original size: %d bytes 2380>>>>18 ubyte >0x65 2381>>>>>18 string x \b, was %.8s 2382>>>>>(10.b-4) string x \b.%.3s 2383# MP3 (archiver, not lossy audio compression) 23840 string MP3\x1a MP3-Archiver archive data 2385# ZET 23860 string OZ\xc3\x9d ZET archive data 2387# TSComp 23880 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 2389# ARQ 23900 string gW\4\1 ARQ archive data 2391# Squash 23923 string OctSqu Squash archive data 2393# Terse 23940 string \5\1\1\0 Terse archive data 2395# PUCrunch 23960 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 2397# UHarc 23980 string UHA UHarc archive data 2399# ABComp 24000 string \2AB ABComp archive data 24010 string \3AB2 ABComp archive data 2402# CMP 24030 string CO\0 CMP archive data 2404# Splint 24050 string \x93\xb9\x06 Splint archive data 2406# InstallShield 24070 string \x13\x5d\x65\x8c InstallShield Z archive Data 2408# Gather 24091 string GTH Gather archive data 2410# BOA 24110 string BOA BOA archive data 2412# RAX 24130 string ULEB\xa RAX archive data 2414# Xtreme 24150 string ULEB\0 Xtreme archive data 2416# Pack Magic 24170 string @\xc3\xa2\1\0 Pack Magic archive data 2418# BTS 24190 belong&0xfeffffff 0x1a034465 BTS archive data 2420# ELI 5750 24210 string Ora\ ELI 5750 archive data 2422# QFC 24230 string \x1aFC\x1a QFC archive data 24240 string \x1aQF\x1a QFC archive data 2425# PRO-PACK 24260 string RNC PRO-PACK archive data 2427# 777 24280 string 777 777 archive data 2429# LZS221 24300 string sTaC LZS221 archive data 2431# HPA 24320 string HPA HPA archive data 2433# Arhangel 24340 string LG Arhangel archive data 2435# EXP1, uses bzip2 24360 string 0123456789012345BZh EXP1 archive data 2437# IMP 24380 string IMP\xa IMP archive data 2439# NRV 24400 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 2441# Squish 24420 string \x73\xb2\x90\xf4 Squish archive data 2443# Par 24440 string PHILIPP Par archive data 24450 string PAR Par archive data 2446# HIT 24470 string UB HIT archive data 2448# SBX 24490 belong&0xfffff000 0x53423000 SBX archive data 2450# NaShrink 24510 string NSK NaShrink archive data 2452# SAPCAR 24530 string #\ CAR\ archive\ header SAPCAR archive data 24540 string CAR\ 2.00RG SAPCAR archive data 2455# Disintegrator 24560 string DST Disintegrator archive data 2457# ASD 24580 string ASD ASD archive data 2459# InstallShield CAB 24600 string ISc( InstallShield CAB 2461# TOP4 24620 string T4\x1a TOP4 archive data 2463# BatComp left out: sig looks like COM executable 2464# so TODO: get real 4dos batcomp file and find sig 2465# BlakHole 24660 string BH\5\7 BlakHole archive data 2467# BIX 24680 string BIX0 BIX archive data 2469# ChiefLZA 24700 string ChfLZ ChiefLZA archive data 2471# Blink 24720 string Blink Blink archive data 2473# Logitech Compress 24740 string \xda\xfa Logitech Compress archive data 2475# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 24761 string (C)\ STEPANYUK ARS-Sfx archive data 2477# AKT/AKT32 24780 string AKT32 AKT32 archive data 24790 string AKT AKT archive data 2480# NPack 24810 string MSTSM NPack archive data 2482# PFT 24830 string \0\x50\0\x14 PFT archive data 2484# SemOne 24850 string SEM SemOne archive data 2486# PPMD 24870 string \x8f\xaf\xac\x84 PPMD archive data 2488# FIZ 24890 string FIZ FIZ archive data 2490# MSXiE 24910 belong&0xfffff0f0 0x4d530000 MSXiE archive data 2492# DeepFreezer 24930 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 2494# DC 24950 string =<DC- DC archive data 2496# TPac 24970 string \4TPAC\3 TPac archive data 2498# Ai 24990 string Ai\1\1\0 Ai archive data 25000 string Ai\1\0\0 Ai archive data 2501# Ai32 25020 string Ai\2\0 Ai32 archive data 25030 string Ai\2\1 Ai32 archive data 2504# SBC 25050 string SBC SBC archive data 2506# Ybs 25070 string YBS Ybs archive data 2508# DitPack 25090 string \x9e\0\0 DitPack archive data 2510# DMS 25110 string DMS! DMS archive data 2512# EPC 25130 string \x8f\xaf\xac\x8c EPC archive data 2514# VSARC 25150 string VS\x1a VSARC archive data 2516# PDZ 25170 string PDZ PDZ archive data 2518# ReDuq 25190 string rdqx ReDuq archive data 2520# GCA 25210 string GCAX GCA archive data 2522# PPMN 25230 string pN PPMN archive data 2524# WinImage 25253 string WINIMAGE WinImage archive data 2526# Compressia 25270 string CMP0CMP Compressia archive data 2528# UHBC 25290 string UHB UHBC archive data 2530# WinHKI 25310 string \x61\x5C\x04\x05 WinHKI archive data 2532# WWPack data file 25330 string WWP WWPack archive data 2534# BSN (BSA, PTS-DOS) 25350 string \xffBSG BSN archive data 25361 string \xffBSG BSN archive data 25373 string \xffBSG BSN archive data 25381 string \0\xae\2 BSN archive data 25391 string \0\xae\3 BSN archive data 25401 string \0\xae\7 BSN archive data 2541# AIN 25420 string \x33\x18 AIN archive data 25430 string \x33\x17 AIN archive data 2544# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 2545# SZip (TODO: doesn't catch all versions) 25460 string SZ\x0a\4 SZip archive data 2547# XPack DiskImage 2548# *.XDI updated by Joerg Jenderek Sep 2015 2549# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 2550# GRR: this test is still too general as it catches also text files starting with jm 25510 string jm 2552# only found examples with this additional characteristic 2 bytes 2553>2 string \x2\x4 Xpack DiskImage archive data 2554#!:ext xdi 2555# XPack Data 2556# *.xpa updated by Joerg Jenderek Sep 2015 2557# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 25580 string xpa XPA 2559!:ext xpa 2560# XPA32 2561# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 2562# created by XPA32.EXE version 1.0.2 for Windows 2563>0 string xpa\0\1 \b32 archive data 2564# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 2565>3 ubeshort !0x0001 \bck archive data 2566# XPack Single Data 2567# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 2568# letter 'I'+ acute accent is equivalent to \xcd 25690 string \xcd\ jm Xpack single archive data 2570#!:mime application/x-xpa-compressed 2571!:ext xpa 2572 2573# TODO: missing due to unknown magic/magic at end of file: 2574#DWC 2575#ARG 2576#ZAR 2577#PC/3270 2578#InstallIt 2579#RKive 2580#RK 2581#XPack Diskimage 2582 2583# These were inspired by idarc, but actually verified 2584# Dzip archiver (.dz) 25850 string DZ Dzip archive data 2586>2 byte x \b, version %i 2587>3 byte x \b.%i 2588# ZZip archiver (.zz) 25890 string ZZ\ \0\0 ZZip archive data 25900 string ZZ0 ZZip archive data 2591# PAQ archiver (.paq) 25920 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 25930 string PAQ PAQ archive data 2594>3 byte&0xf0 0x30 2595>>3 byte x (v%c) 2596# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 25970xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 25980 string JARCS JAR (ARJ Software, Inc.) archive data 2599 2600# ARJ archiver (jason@jarthur.Claremont.EDU) 26010 leshort 0xea60 ARJ archive data 2602!:mime application/x-arj 2603>5 byte x \b, v%d, 2604>8 byte &0x04 multi-volume, 2605>8 byte &0x10 slash-switched, 2606>8 byte &0x20 backup, 2607>34 string x original name: %s, 2608>7 byte 0 os: MS-DOS 2609>7 byte 1 os: PRIMOS 2610>7 byte 2 os: Unix 2611>7 byte 3 os: Amiga 2612>7 byte 4 os: Macintosh 2613>7 byte 5 os: OS/2 2614>7 byte 6 os: Apple ][ GS 2615>7 byte 7 os: Atari ST 2616>7 byte 8 os: NeXT 2617>7 byte 9 os: VAX/VMS 2618>3 byte >0 %d] 2619# [JW] idarc says this is also possible 26202 leshort 0xea60 ARJ archive data 2621 2622# HA archiver (Greg Roelofs, newt@uchicago.edu) 2623# This is a really bad format. A file containing HAWAII will match this... 2624#0 string HA HA archive data, 2625#>2 leshort =1 1 file, 2626#>2 leshort >1 %hu files, 2627#>4 byte&0x0f =0 first is type CPY 2628#>4 byte&0x0f =1 first is type ASC 2629#>4 byte&0x0f =2 first is type HSC 2630#>4 byte&0x0f =0x0e first is type DIR 2631#>4 byte&0x0f =0x0f first is type SPECIAL 2632# suggestion: at least identify small archives (<1024 files) 26330 belong&0xffff00fc 0x48410000 HA archive data 2634>2 leshort =1 1 file, 2635>2 leshort >1 %u files, 2636>4 byte&0x0f =0 first is type CPY 2637>4 byte&0x0f =1 first is type ASC 2638>4 byte&0x0f =2 first is type HSC 2639>4 byte&0x0f =0x0e first is type DIR 2640>4 byte&0x0f =0x0f first is type SPECIAL 2641 2642# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 26430 string HPAK HPACK archive data 2644 2645# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 26460 string \351,\001JAM\ JAM archive, 2647>7 string >\0 version %.4s 2648>0x26 byte =0x27 - 2649>>0x2b string >\0 label %.11s, 2650>>0x27 lelong x serial %08x, 2651>>0x36 string >\0 fstype %.8s 2652 2653# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 2654# Update: Joerg Jenderek 2655# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 2656# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 2657# 2658# check and display information of lharc (LHa,PMarc) file 26590 name lharc-file 2660# check 1st character of method id like -lz4- -lh5- or -pm2- 2661>2 string - 2662# check 5th character of method id 2663>>6 string - 2664# check header level 0 1 2 3 2665>>>20 ubyte <4 2666# check 2nd, 3th and 4th character of method id 2667>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b\040 2668!:mime application/x-lzh-compressed 2669# creator type "LHA " 2670!:apple ????LHA 2671# display archive type name like "LHa/LZS archive data" or "LArc archive" 2672>>>>>2 string -lz \b\040 2673!:ext lzs 2674# already known -lzs- -lz4- -lz5- with old names 2675>>>>>>2 string -lzs LHa/LZS archive data 2676>>>>>>3 regex \^lz[45] LHarc 1.x archive data 2677# missing -lz?- with wikipedia names 2678>>>>>>3 regex \^lz[2378] LArc archive 2679# display archive type name like "LHa (2.x) archive data" 2680>>>>>2 string -lh \b 2681# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 2682>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 2683# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 2684# FOOBAR archiver use ".foo" as name extension instead usual one 2685# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 2686>>>>>>>2 string -lh1 \b\040 2687!:ext lha/lzh/ice 2688>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 2689>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 2690>>>>>>3 regex \^lh[456] LHa (2.x) archive data 2691>>>>>>>2 string -lh5 \b\040 2692# https://en.wikipedia.org/wiki/BIOS 2693# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like 2694# bios.rom , kd7_v14.bin, 1010.004, ... 2695!:ext lha/lzh/rom/bin 2696# missing -lh?- variants (Joe Jared) 2697>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 2698# UNLHA32 2.67a 2699>>>>>>2 string -lhx LHa (UNLHA32) archive 2700# lha archives with standard file name extensions ".lha" ".lzh" 2701>>>>>>3 regex !\^(lh1|lh5) \b\040 2702!:ext lha/lzh 2703# this should not happen if all -lh variants are described 2704>>>>>>2 default x LHa (unknown) archive 2705#!:ext lha 2706# PMarc 2707>>>>>3 regex \^pm[012] PMarc archive data 2708!:ext pma 2709# append method id without leading and trailing minus character 2710>>>>>3 string x [%3.3s] 2711>>>>>>0 use lharc-header 2712# 2713# check and display information of lharc header 27140 name lharc-header 2715# header size 0x4 , 0x1b-0x61 2716>0 ubyte x 2717# compressed data size != compressed file size 2718#>7 ulelong x \b, data size %d 2719# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 2720#>19 ubyte x \b, 19_0x%x 2721# level identifier 0 1 2 3 2722#>20 ubyte x \b, level %d 2723# time stamp 2724#>15 ubelong x DATE 0x%8.8x 2725# OS ID for level 1 2726>20 ubyte 1 2727# 0x20 types find for *.rom files 2728>>(21.b+24) ubyte <0x21 \b, 0x%x OS 2729# ascii type like M for MSDOS 2730>>(21.b+24) ubyte >0x20 \b, '%c' OS 2731# OS ID for level 2 2732>20 ubyte 2 2733#>>23 ubyte x \b, OS ID 0x%x 2734>>23 ubyte <0x21 \b, 0x%x OS 2735>>23 ubyte >0x20 \b, '%c' OS 2736# filename only for level 0 and 1 2737>20 ubyte <2 2738# length of filename 2739>>21 ubyte >0 \b, with 2740# filename 2741>>>21 pstring x "%s" 2742# 2743#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 2744#!:mime application/x-lharc 27452 string -lh0- 2746>0 use lharc-file 2747#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 2748#!:mime application/x-lharc 27492 string -lh1- 2750>0 use lharc-file 2751# NEW -lz2- ... -lz8- 27522 string -lz2- 2753>0 use lharc-file 27542 string -lz3- 2755>0 use lharc-file 27562 string -lz4- 2757>0 use lharc-file 27582 string -lz5- 2759>0 use lharc-file 27602 string -lz7- 2761>0 use lharc-file 27622 string -lz8- 2763>0 use lharc-file 2764# [never seen any but the last; -lh4- reported in comp.compression:] 2765#2 string -lzs- LHa/LZS archive data [lzs] 27662 string -lzs- 2767>0 use lharc-file 2768# According to wikipedia and others such a version does not exist 2769#2 string -lh\40- LHa 2.x? archive data [lh ] 2770#2 string -lhd- LHa 2.x? archive data [lhd] 27712 string -lhd- 2772>0 use lharc-file 2773#2 string -lh2- LHa 2.x? archive data [lh2] 27742 string -lh2- 2775>0 use lharc-file 2776#2 string -lh3- LHa 2.x? archive data [lh3] 27772 string -lh3- 2778>0 use lharc-file 2779#2 string -lh4- LHa (2.x) archive data [lh4] 27802 string -lh4- 2781>0 use lharc-file 2782#2 string -lh5- LHa (2.x) archive data [lh5] 27832 string -lh5- 2784>0 use lharc-file 2785#2 string -lh6- LHa (2.x) archive data [lh6] 27862 string -lh6- 2787>0 use lharc-file 2788#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 27892 string -lh7- 2790# !:mime application/x-lha 2791# >20 byte x - header level %d 2792>0 use lharc-file 2793# NEW -lh8- ... -lhe- , -lhx- 27942 string -lh8- 2795>0 use lharc-file 27962 string -lh9- 2797>0 use lharc-file 27982 string -lha- 2799>0 use lharc-file 28002 string -lhb- 2801>0 use lharc-file 28022 string -lhc- 2803>0 use lharc-file 28042 string -lhe- 2805>0 use lharc-file 28062 string -lhx- 2807>0 use lharc-file 2808# taken from idarc [JW] 28092 string -lZ PUT archive data 2810# already done by LHarc magics 2811# this should never happen if all sub types of LZS archive are identified 2812#2 string -lz LZS archive data 28132 string -sw1- Swag archive data 2814 28150 name rar-file-header 2816>24 byte 15 \b, v1.5 2817>24 byte 20 \b, v2.0 2818>24 byte 29 \b, v4 2819>15 byte 0 \b, os: MS-DOS 2820>15 byte 1 \b, os: OS/2 2821>15 byte 2 \b, os: Win32 2822>15 byte 3 \b, os: Unix 2823>15 byte 4 \b, os: Mac OS 2824>15 byte 5 \b, os: BeOS 2825 28260 name rar-archive-header 2827>3 leshort&0x1ff >0 \b, flags: 2828>>3 leshort &0x01 ArchiveVolume 2829>>3 leshort &0x02 Commented 2830>>3 leshort &0x04 Locked 2831>>3 leshort &0x10 NewVolumeNaming 2832>>3 leshort &0x08 Solid 2833>>3 leshort &0x20 Authenticated 2834>>3 leshort &0x40 RecoveryRecordPresent 2835>>3 leshort &0x80 EncryptedBlockHeader 2836>>3 leshort &0x100 FirstVolume 2837 2838# RAR (Roshal Archive) archive 28390 string Rar!\x1a\7\0 RAR archive data 2840!:mime application/x-rar 2841!:ext rar/cbr 2842# file header 2843>(0xc.l+9) byte 0x74 2844>>(0xc.l+7) use rar-file-header 2845# subblock seems to share information with file header 2846>(0xc.l+9) byte 0x7a 2847>>(0xc.l+7) use rar-file-header 2848>9 byte 0x73 2849>>7 use rar-archive-header 2850 28510 string Rar!\x1a\7\1\0 RAR archive data, v5 2852!:mime application/x-rar 2853!:ext rar 2854 2855# Very old RAR archive 2856# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 28570 string RE\x7e\x5e RAR archive data (<v1.5) 2858!:mime application/x-rar 2859!:ext rar/cbr 2860 2861# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 28620 string SQSH squished archive data (Acorn RISCOS) 2863 2864# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 2865# [JW] see exe section for self-extracting version 28660 string UC2\x1a UC2 archive data 2867 2868# PKZIP multi-volume archive 28690 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 2870!:mime application/zip 2871!:ext zip/cbz 2872 2873# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 28740 string PK\005\006 Zip archive data (empty) 2875!:mime application/zip 2876!:ext zip/cbz 28770 string PK\003\004 2878 2879# Specialised zip formats which start with a member named 'mimetype' 2880# (stored uncompressed, with no 'extra field') containing the file's MIME type. 2881# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 2882# contents starting with "application/": 2883>26 string \x8\0\0\0mimetypeapplication/ 2884 2885# KOffice / OpenOffice & StarOffice / OpenDocument formats 2886# From: Abel Cheung <abel@oaka.org> 2887 2888# KOffice (1.2 or above) formats 2889# (mimetype contains "application/vnd.kde.<SUBTYPE>") 2890>>50 string vnd.kde. KOffice (>=1.2) 2891>>>58 string karbon Karbon document 2892>>>58 string kchart KChart document 2893>>>58 string kformula KFormula document 2894>>>58 string kivio Kivio document 2895>>>58 string kontour Kontour document 2896>>>58 string kpresenter KPresenter document 2897>>>58 string kspread KSpread document 2898>>>58 string kword KWord document 2899 2900# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 2901# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 2902>>50 string vnd.sun.xml. OpenOffice.org 1.x 2903>>>62 string writer Writer 2904>>>>68 byte !0x2e document 2905>>>>68 string .template template 2906>>>>68 string .global global document 2907>>>62 string calc Calc 2908>>>>66 byte !0x2e spreadsheet 2909>>>>66 string .template template 2910>>>62 string draw Draw 2911>>>>66 byte !0x2e document 2912>>>>66 string .template template 2913>>>62 string impress Impress 2914>>>>69 byte !0x2e presentation 2915>>>>69 string .template template 2916>>>62 string math Math document 2917>>>62 string base Database file 2918 2919# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 2920# http://lists.oasis-open.org/archives/office/200505/msg00006.html 2921# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 2922>>50 string vnd.oasis.opendocument. OpenDocument 2923>>>73 string text 2924>>>>77 byte !0x2d Text 2925!:mime application/vnd.oasis.opendocument.text 2926>>>>77 string -template Text Template 2927!:mime application/vnd.oasis.opendocument.text-template 2928>>>>77 string -web HTML Document Template 2929!:mime application/vnd.oasis.opendocument.text-web 2930>>>>77 string -master Master Document 2931!:mime application/vnd.oasis.opendocument.text-master 2932>>>73 string graphics 2933>>>>81 byte !0x2d Drawing 2934!:mime application/vnd.oasis.opendocument.graphics 2935>>>>81 string -template Template 2936!:mime application/vnd.oasis.opendocument.graphics-template 2937>>>73 string presentation 2938>>>>85 byte !0x2d Presentation 2939!:mime application/vnd.oasis.opendocument.presentation 2940>>>>85 string -template Template 2941!:mime application/vnd.oasis.opendocument.presentation-template 2942>>>73 string spreadsheet 2943>>>>84 byte !0x2d Spreadsheet 2944!:mime application/vnd.oasis.opendocument.spreadsheet 2945>>>>84 string -template Template 2946!:mime application/vnd.oasis.opendocument.spreadsheet-template 2947>>>73 string chart 2948>>>>78 byte !0x2d Chart 2949!:mime application/vnd.oasis.opendocument.chart 2950>>>>78 string -template Template 2951!:mime application/vnd.oasis.opendocument.chart-template 2952>>>73 string formula 2953>>>>80 byte !0x2d Formula 2954!:mime application/vnd.oasis.opendocument.formula 2955>>>>80 string -template Template 2956!:mime application/vnd.oasis.opendocument.formula-template 2957>>>73 string database Database 2958!:mime application/vnd.oasis.opendocument.database 2959>>>73 string image 2960>>>>78 byte !0x2d Image 2961!:mime application/vnd.oasis.opendocument.image 2962>>>>78 string -template Template 2963!:mime application/vnd.oasis.opendocument.image-template 2964 2965# EPUB (OEBPS) books using OCF (OEBPS Container Format) 2966# http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 2967# From: Ralf Brown <ralf.brown@gmail.com> 2968>>50 string epub+zip EPUB document 2969!:mime application/epub+zip 2970 2971# Catch other ZIP-with-mimetype formats 2972# In a ZIP file, the bytes immediately after a member's contents are 2973# always "PK". The 2 regex rules here print the "mimetype" member's 2974# contents up to the first 'P'. Luckily, most MIME types don't contain 2975# any capital 'P's. This is a kludge. 2976# (mimetype contains "application/<OTHER>") 2977>>50 string !epub+zip 2978>>>50 string !vnd.oasis.opendocument. 2979>>>>50 string !vnd.sun.xml. 2980>>>>>50 string !vnd.kde. 2981>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 2982!:mime application/zip 2983# (mimetype contents other than "application/*") 2984>26 string \x8\0\0\0mimetype 2985>>38 string !application/ 2986>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 2987!:mime application/zip 2988 2989# Java Jar files 2990>(26.s+30) leshort 0xcafe Java archive data (JAR) 2991!:mime application/java-archive 2992 2993# iOS App 2994>(26.s+30) leshort !0xcafe 2995>>26 string !\x8\0\0\0mimetype 2996>>>30 string Payload/ 2997>>>>38 search/64 .app/ iOS App 2998!:mime application/x-ios-app 2999 3000 3001# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 3002# Next line excludes specialized formats: 3003>(26.s+30) leshort !0xcafe 3004>>26 string !\x8\0\0\0mimetype Zip archive data 3005!:mime application/zip 3006>>>4 byte 0x09 \b, at least v0.9 to extract 3007>>>4 byte 0x0a \b, at least v1.0 to extract 3008>>>4 byte 0x0b \b, at least v1.1 to extract 3009>>>4 byte 0x14 \b, at least v2.0 to extract 3010>>>4 byte 0x15 \b, at least v2.1 to extract 3011>>>4 byte 0x19 \b, at least v2.5 to extract 3012>>>4 byte 0x1b \b, at least v2.7 to extract 3013>>>4 byte 0x2d \b, at least v4.5 to extract 3014>>>4 byte 0x2e \b, at least v4.6 to extract 3015>>>4 byte 0x32 \b, at least v5.0 to extract 3016>>>4 byte 0x33 \b, at least v5.1 to extract 3017>>>4 byte 0x34 \b, at least v5.2 to extract 3018>>>4 byte 0x3d \b, at least v6.1 to extract 3019>>>4 byte 0x3e \b, at least v6.2 to extract 3020>>>4 byte 0x3f \b, at least v6.3 to extract 3021>>>0x161 string WINZIP \b, WinZIP self-extracting 3022 3023# StarView Metafile 3024# From Pierre Ducroquet <pinaraf@pinaraf.info> 30250 string VCLMTF StarView MetaFile 3026>6 beshort x \b, version %d 3027>8 belong x \b, size %d 3028 3029# Zoo archiver 303020 lelong 0xfdc4a7dc Zoo archive data 3031!:mime application/x-zoo 3032>4 byte >48 \b, v%c. 3033>>6 byte >47 \b%c 3034>>>7 byte >47 \b%c 3035>32 byte >0 \b, modify: v%d 3036>>33 byte x \b.%d+ 3037>42 lelong 0xfdc4a7dc \b, 3038>>70 byte >0 extract: v%d 3039>>>71 byte x \b.%d+ 3040 3041# Shell archives 304210 string #\ This\ is\ a\ shell\ archive shell archive text 3043!:mime application/octet-stream 3044 3045# 3046# LBR. NB: May conflict with the questionable 3047# "binary Computer Graphics Metafile" format. 3048# 30490 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 3050# 3051# PMA (CP/M derivative of LHA) 3052# Update: Joerg Jenderek 3053# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3054# 3055#2 string -pm0- PMarc archive data [pm0] 30562 string -pm0- 3057>0 use lharc-file 3058#2 string -pm1- PMarc archive data [pm1] 30592 string -pm1- 3060>0 use lharc-file 3061#2 string -pm2- PMarc archive data [pm2] 30622 string -pm2- 3063>0 use lharc-file 30642 string -pms- PMarc SFX archive (CP/M, DOS) 3065#!:mime application/x-foobar-exec 3066!:ext com 30675 string -pc1- PopCom compressed executable (CP/M) 3068#!:mime application/x- 3069#!:ext com 3070 3071# From Rafael Laboissiere <rafael@laboissiere.net> 3072# The Project Revision Control System (see 3073# http://prcs.sourceforge.net) generates a packaged project 3074# file which is recognized by the following entry: 30750 leshort 0xeb81 PRCS packaged project 3076 3077# Microsoft cabinets 3078# by David Necas (Yeti) <yeti@physics.muni.cz> 3079#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 3080#>25 byte x v%d 3081#>24 byte x \b.%d 3082# MPi: All CABs have version 1.3, so this is pointless. 3083# Better magic in debian-additions. 3084 3085# GTKtalog catalogs 3086# by David Necas (Yeti) <yeti@physics.muni.cz> 30874 string gtktalog\ GTKtalog catalog data, 3088>13 string 3 version 3 3089>>14 beshort 0x677a (gzipped) 3090>>14 beshort !0x677a (not gzipped) 3091>13 string >3 version %s 3092 3093############################################################################ 3094# Parity archive reconstruction file, the 'par' file format now used on Usenet. 30950 string PAR\0 PARity archive data 3096>48 leshort =0 - Index file 3097>48 leshort >0 - file number %d 3098 3099# Felix von Leitner <felix-file@fefe.de> 31000 string d8:announce BitTorrent file 3101!:mime application/x-bittorrent 3102# Durval Menezes, <jmgthbfile at durval dot com> 31030 string d13:announce-list BitTorrent file 3104!:mime application/x-bittorrent 3105 3106# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 31070 beshort 0x0e0f Atari MSA archive data 3108>2 beshort x \b, %d sectors per track 3109>4 beshort 0 \b, 1 sided 3110>4 beshort 1 \b, 2 sided 3111>6 beshort x \b, starting track: %d 3112>8 beshort x \b, ending track: %d 3113 3114# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 31150 string PK00PK\003\004 Zip archive data 3116 3117# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 3118# by Stefan `Sec` Zehl <sec@42.org> 31197 string **ACE** ACE archive data 3120>15 byte >0 version %d 3121>16 byte =0x00 \b, from MS-DOS 3122>16 byte =0x01 \b, from OS/2 3123>16 byte =0x02 \b, from Win/32 3124>16 byte =0x03 \b, from Unix 3125>16 byte =0x04 \b, from MacOS 3126>16 byte =0x05 \b, from WinNT 3127>16 byte =0x06 \b, from Primos 3128>16 byte =0x07 \b, from AppleGS 3129>16 byte =0x08 \b, from Atari 3130>16 byte =0x09 \b, from Vax/VMS 3131>16 byte =0x0A \b, from Amiga 3132>16 byte =0x0B \b, from Next 3133>14 byte x \b, version %d to extract 3134>5 leshort &0x0080 \b, multiple volumes, 3135>>17 byte x \b (part %d), 3136>5 leshort &0x0002 \b, contains comment 3137>5 leshort &0x0200 \b, sfx 3138>5 leshort &0x0400 \b, small dictionary 3139>5 leshort &0x0800 \b, multi-volume 3140>5 leshort &0x1000 \b, contains AV-String 3141>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 3142>5 leshort &0x2000 \b, with recovery record 3143>5 leshort &0x4000 \b, locked 3144>5 leshort &0x8000 \b, solid 3145# Date in MS-DOS format (whatever that is) 3146#>18 lelong x Created on 3147 3148# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 3149# <doj@cubic.org> 31500x1A string sfArk sfArk compressed Soundfont 3151>0x15 string 2 3152>>0x1 string >\0 Version %s 3153>>0x2A string >\0 : %s 3154 3155# DR-DOS 7.03 Packed File *.??_ 31560 string Packed\ File\ Personal NetWare Packed File 3157>12 string x \b, was "%.12s" 3158 3159# EET archive 3160# From: Tilman Sauerbeck <tilman@code-monkey.de> 31610 belong 0x1ee7ff00 EET archive 3162!:mime application/x-eet 3163 3164# rzip archives 31650 string RZIP rzip compressed data 3166>4 byte x - version %d 3167>5 byte x \b.%d 3168>6 belong x (%d bytes) 3169 3170# From: "Robert Dale" <robdale@gmail.com> 31710 belong 123 dar archive, 3172>4 belong x label "%.8x 3173>>8 belong x %.8x 3174>>>12 beshort x %.4x" 3175>14 byte 0x54 end slice 3176>14 beshort 0x4e4e multi-part 3177>14 beshort 0x4e53 multi-part, with -S 3178 3179# Symbian installation files 3180# http://www.thouky.co.uk/software/psifs/sis.html 3181# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 31828 lelong 0x10000419 Symbian installation file 3183!:mime application/vnd.symbian.install 3184>4 lelong 0x1000006D (EPOC release 3/4/5) 3185>4 lelong 0x10003A12 (EPOC release 6) 31860 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 3187!:mime x-epoc/x-sisx-app 3188 3189# From "Nelson A. de Oliveira" <naoliv@gmail.com> 31900 string MPQ\032 MoPaQ (MPQ) archive 3191 3192# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 3193# .kgb 31940 string KGB_arch KGB Archiver file 3195>10 string x with compression level %.1s 3196 3197# xar (eXtensible ARchiver) archive 3198# xar archive format: http://code.google.com/p/xar/ 3199# From: "David Remahl" <dremahl@apple.com> 32000 string xar! xar archive 3201!:mime application/x-xar 3202#>4 beshort x header size %d 3203>6 beshort x version %d, 3204#>8 quad x compressed TOC: %d, 3205#>16 quad x uncompressed TOC: %d, 3206>24 belong 0 no checksum 3207>24 belong 1 SHA-1 checksum 3208>24 belong 2 MD5 checksum 3209 3210# Type: Parity Archive 3211# From: Daniel van Eeden <daniel_e@dds.nl> 32120 string PAR2 Parity Archive Volume Set 3213 3214# Bacula volume format. (Volumes always start with a block header.) 3215# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 3216# From: Adam Buchbinder <adam.buchbinder@gmail.com> 321712 string BB02 Bacula volume 3218>20 bedate x \b, started %s 3219 3220# ePub is XHTML + XML inside a ZIP archive. The first member of the 3221# archive must be an uncompressed file called 'mimetype' with contents 3222# 'application/epub+zip' 3223 3224 3225# From: "Michael Gorny" <mgorny@gentoo.org> 3226# ZPAQ: http://mattmahoney.net/dc/zpaq.html 32270 string zPQ ZPAQ stream 3228>3 byte x \b, level %d 3229# From: Barry Carter <carter.barry@gmail.com> 3230# http://encode.ru/threads/456-zpaq-updates/page32 32310 string 7kSt ZPAQ file 3232 3233# BBeB ebook, unencrypted (LRF format) 3234# URL: http://www.sven.de/librie/Librie/LrfFormat 3235# From: Adam Buchbinder <adam.buchbinder@gmail.com> 32360 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 3237>8 beshort x \b, version %d 3238>36 byte 1 \b, front-to-back 3239>36 byte 16 \b, back-to-front 3240>42 beshort x \b, (%dx, 3241>44 beshort x %d) 3242 3243# Symantec GHOST image by Joerg Jenderek at May 2014 3244# http://us.norton.com/ghost/ 3245# http://www.garykessler.net/library/file_sigs.html 32460 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 3247# *.GHO 3248>2 ubyte&0x08 0x00 \b, first file 3249# *.GHS or *.[0-9] with cns program option 3250>2 ubyte&0x08 0x08 \b, split file 3251# part of split index interesting for *.ghs 3252>>4 ubyte x id=0x%x 3253# compression tag minus one equals numeric compression command line switch z[1-9] 3254>3 ubyte 0 \b, no compression 3255>3 ubyte 2 \b, fast compression (Z1) 3256>3 ubyte 3 \b, medium compression (Z2) 3257>3 ubyte >3 3258>>3 ubyte <11 \b, compression (Z%d-1) 3259>2 ubyte&0x08 0x00 3260# ~ 30 byte password field only for *.gho 3261>>12 ubequad !0 \b, password protected 3262>>44 ubyte !1 3263# 1~Image All, sector-by-sector only for *.gho 3264>>>10 ubyte 1 \b, sector copy 3265# 1~Image Boot track only for *.gho 3266>>>43 ubyte 1 \b, boot track 3267# 1~Image Disc only for *.gho implies Image Boot track and sector copy 3268>>44 ubyte 1 \b, disc sector copy 3269# optional image description only *.gho 3270>>0xff string >\0 "%-.254s" 3271# look for DOS sector end sequence 3272>0xE08 search/7776 \x55\xAA 3273>>&-512 indirect x \b; contains 3274 3275# Google Chrome extensions 3276# https://developer.chrome.com/extensions/crx 3277# https://developer.chrome.com/extensions/hosting 32780 string Cr24 Google Chrome extension 3279!:mime application/x-chrome-extension 3280>4 ulong x \b, version %u 3281 3282# SeqBox - Sequenced container 3283# ext: sbx, seqbox 3284# Marco Pontello marcopon@gmail.com 3285# reference: https://github.com/MarcoPon/SeqBox 32860 string SBx SeqBox, 3287>3 byte x version %d 3288#------------------------------------------------------------------------------ 3289# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $ 3290# make: file(1) magic for assembler source 3291# 32920 regex \^[\040\t]{0,50}\\.asciiz assembler source text 3293!:mime text/x-asm 32940 regex \^[\040\t]{0,50}\\.byte assembler source text 3295!:mime text/x-asm 32960 regex \^[\040\t]{0,50}\\.even assembler source text 3297!:mime text/x-asm 32980 regex \^[\040\t]{0,50}\\.globl assembler source text 3299!:mime text/x-asm 33000 regex \^[\040\t]{0,50}\\.text assembler source text 3301!:mime text/x-asm 33020 regex \^[\040\t]{0,50}\\.file assembler source text 3303!:mime text/x-asm 33040 regex \^[\040\t]{0,50}\\.type assembler source text 3305!:mime text/x-asm 3306 3307#------------------------------------------------------------------------------ 3308# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 3309# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 3310# strings as "long" - we assume they're just strings: 3311# From: guy@netapp.com (Guy Harris) 3312# 33130 string *STA Aster*x 3314>7 string WORD Words Document 3315>7 string GRAP Graphic 3316>7 string SPRE Spreadsheet 3317>7 string MACR Macro 33180 string 2278 Aster*x Version 2 3319>29 byte 0x36 Words Document 3320>29 byte 0x35 Graphic 3321>29 byte 0x32 Spreadsheet 3322>29 byte 0x38 Macro 3323 3324 3325#------------------------------------------------------------------------------ 3326# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $ 3327# att3b: file(1) magic for AT&T 3B machines 3328# 3329# The `versions' should be un-commented if they work for you. 3330# (Was the problem just one of endianness?) 3331# 3332# 3B20 3333# 3334# The 3B20 conflicts with SCCS. 3335#0 beshort 0550 3b20 COFF executable 3336#>12 belong >0 not stripped 3337#>22 beshort >0 - version %d 3338#0 beshort 0551 3b20 COFF executable (TV) 3339#>12 belong >0 not stripped 3340#>22 beshort >0 - version %d 3341# 3342# WE32K 3343# 33440 beshort 0560 WE32000 COFF 3345>18 beshort ^00000020 object 3346>18 beshort &00000020 executable 3347>12 belong >0 not stripped 3348>18 beshort ^00010000 N/A on 3b2/300 w/paging 3349>18 beshort &00020000 32100 required 3350>18 beshort &00040000 and MAU hardware required 3351>20 beshort 0407 (impure) 3352>20 beshort 0410 (pure) 3353>20 beshort 0413 (demand paged) 3354>20 beshort 0443 (target shared library) 3355>22 beshort >0 - version %d 33560 beshort 0561 WE32000 COFF executable (TV) 3357>12 belong >0 not stripped 3358#>18 beshort &00020000 - 32100 required 3359#>18 beshort &00040000 and MAU hardware required 3360#>22 beshort >0 - version %d 3361# 3362# core file for 3b2 33630 string \000\004\036\212\200 3b2 core file 3364>364 string >\0 of '%s' 3365 3366#------------------------------------------------------------------------------ 3367# $File: audio,v 1.79 2017/03/17 22:20:22 christos Exp $ 3368# audio: file(1) magic for sound formats (see also "iff") 3369# 3370# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 3371# and others 3372# 3373 3374# Sun/NeXT audio data 33750 string .snd Sun/NeXT audio data: 3376>12 belong 1 8-bit ISDN mu-law, 3377!:mime audio/basic 3378>12 belong 2 8-bit linear PCM [REF-PCM], 3379!:mime audio/basic 3380>12 belong 3 16-bit linear PCM, 3381!:mime audio/basic 3382>12 belong 4 24-bit linear PCM, 3383!:mime audio/basic 3384>12 belong 5 32-bit linear PCM, 3385!:mime audio/basic 3386>12 belong 6 32-bit IEEE floating point, 3387!:mime audio/basic 3388>12 belong 7 64-bit IEEE floating point, 3389!:mime audio/basic 3390>12 belong 8 Fragmented sample data, 3391>12 belong 10 DSP program, 3392>12 belong 11 8-bit fixed point, 3393>12 belong 12 16-bit fixed point, 3394>12 belong 13 24-bit fixed point, 3395>12 belong 14 32-bit fixed point, 3396>12 belong 18 16-bit linear with emphasis, 3397>12 belong 19 16-bit linear compressed, 3398>12 belong 20 16-bit linear with emphasis and compression, 3399>12 belong 21 Music kit DSP commands, 3400>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 3401!:mime audio/x-adpcm 3402>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 3403>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 3404>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 3405>12 belong 27 8-bit A-law (CCITT G.711), 3406>20 belong 1 mono, 3407>20 belong 2 stereo, 3408>20 belong 4 quad, 3409>16 belong >0 %d Hz 3410 3411# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 3412# that uses little-endian encoding and has a different magic number 34130 lelong 0x0064732E DEC audio data: 3414>12 lelong 1 8-bit ISDN mu-law, 3415!:mime audio/x-dec-basic 3416>12 lelong 2 8-bit linear PCM [REF-PCM], 3417!:mime audio/x-dec-basic 3418>12 lelong 3 16-bit linear PCM, 3419!:mime audio/x-dec-basic 3420>12 lelong 4 24-bit linear PCM, 3421!:mime audio/x-dec-basic 3422>12 lelong 5 32-bit linear PCM, 3423!:mime audio/x-dec-basic 3424>12 lelong 6 32-bit IEEE floating point, 3425!:mime audio/x-dec-basic 3426>12 lelong 7 64-bit IEEE floating point, 3427!:mime audio/x-dec-basic 3428>12 belong 8 Fragmented sample data, 3429>12 belong 10 DSP program, 3430>12 belong 11 8-bit fixed point, 3431>12 belong 12 16-bit fixed point, 3432>12 belong 13 24-bit fixed point, 3433>12 belong 14 32-bit fixed point, 3434>12 belong 18 16-bit linear with emphasis, 3435>12 belong 19 16-bit linear compressed, 3436>12 belong 20 16-bit linear with emphasis and compression, 3437>12 belong 21 Music kit DSP commands, 3438>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 3439!:mime audio/x-dec-basic 3440>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 3441>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 3442>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 3443>12 belong 27 8-bit A-law (CCITT G.711), 3444>20 lelong 1 mono, 3445>20 lelong 2 stereo, 3446>20 lelong 4 quad, 3447>16 lelong >0 %d Hz 3448 3449# Creative Labs AUDIO stuff 34500 string MThd Standard MIDI data 3451!:mime audio/midi 3452>8 beshort x (format %d) 3453>10 beshort x using %d track 3454>10 beshort >1 \bs 3455>12 beshort&0x7fff x at 1/%d 3456>12 beshort&0x8000 >0 SMPTE 3457 34580 string CTMF Creative Music (CMF) data 3459!:mime audio/x-unknown 34600 string SBI SoundBlaster instrument data 3461!:mime audio/x-unknown 34620 string Creative\ Voice\ File Creative Labs voice data 3463!:mime audio/x-unknown 3464# is this next line right? it came this way... 3465>19 byte 0x1A 3466>23 byte >0 - version %d 3467>22 byte >0 \b.%d 3468 3469# first entry is also the string "NTRK" 34700 belong 0x4e54524b MultiTrack sound data 3471>4 belong x - version %d 3472 3473# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 3474# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 34750 string EMOD Extended MOD sound data, 3476>4 byte&0xf0 x version %d 3477>4 byte&0x0f x \b.%d, 3478>45 byte x %d instruments 3479>83 byte 0 (module) 3480>83 byte 1 (song) 3481 3482# Real Audio (Magic .ra\0375) 34830 belong 0x2e7261fd RealAudio sound file 3484!:mime audio/x-pn-realaudio 34850 string .RMF\0\0\0 RealMedia file 3486!:mime application/vnd.rn-realmedia 3487#video/x-pn-realvideo 3488#video/vnd.rn-realvideo 3489#application/vnd.rn-realmedia 3490# sigh, there are many mimes for that but the above are the most common. 3491 3492# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 3493# Oct 31, 1995 3494# fixed by <doj@cubic.org> 2003-06-24 3495# Too short... 3496#0 string MTM MultiTracker Module sound file 3497#0 string if Composer 669 Module sound data 3498#0 string JN Composer 669 Module sound data (extended format) 34990 string MAS_U ULT(imate) Module sound data 3500 3501#0 string FAR Module sound data 3502#>4 string >\15 Title: "%s" 3503 35040x2c string SCRM ScreamTracker III Module sound data 3505>0 string >\0 Title: "%s" 3506 3507# Gravis UltraSound patches 3508# From <ache@nagual.ru> 3509 35100 string GF1PATCH110\0ID#000002\0 GUS patch 35110 string GF1PATCH100\0ID#000002\0 Old GUS patch 3512 3513# mime types according to http://www.geocities.com/nevilo/mod.htm: 3514# audio/it .it 3515# audio/x-zipped-it .itz 3516# audio/xm fasttracker modules 3517# audio/x-s3m screamtracker modules 3518# audio/s3m screamtracker modules 3519# audio/x-zipped-mod mdz 3520# audio/mod mod 3521# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 3522 3523# 3524# Taken from loader code from mikmod version 2.14 3525# by Steve McIntyre (stevem@chiark.greenend.org.uk) 3526# <doj@cubic.org> added title printing on 2003-06-24 35270 string MAS_UTrack_V00 3528>14 string >/0 ultratracker V1.%.1s module sound data 3529!:mime audio/x-mod 3530#audio/x-tracker-module 3531 35320 string UN05 MikMod UNI format module sound data 3533 35340 string Extended\ Module: Fasttracker II module sound data 3535!:mime audio/x-mod 3536#audio/x-tracker-module 3537>17 string >\0 Title: "%s" 3538 353921 string/c =!SCREAM! Screamtracker 2 module sound data 3540!:mime audio/x-mod 3541#audio/x-screamtracker-module 354221 string BMOD2STM Screamtracker 2 module sound data 3543!:mime audio/x-mod 3544#audio/x-screamtracker-module 35451080 string M.K. 4-channel Protracker module sound data 3546!:mime audio/x-mod 3547#audio/x-protracker-module 3548>0 string >\0 Title: "%s" 35491080 string M!K! 4-channel Protracker module sound data 3550!:mime audio/x-mod 3551#audio/x-protracker-module 3552>0 string >\0 Title: "%s" 35531080 string FLT4 4-channel Startracker module sound data 3554!:mime audio/x-mod 3555#audio/x-startracker-module 3556>0 string >\0 Title: "%s" 35571080 string FLT8 8-channel Startracker module sound data 3558!:mime audio/x-mod 3559#audio/x-startracker-module 3560>0 string >\0 Title: "%s" 35611080 string 4CHN 4-channel Fasttracker module sound data 3562!:mime audio/x-mod 3563#audio/x-fasttracker-module 3564>0 string >\0 Title: "%s" 35651080 string 6CHN 6-channel Fasttracker module sound data 3566!:mime audio/x-mod 3567#audio/x-fasttracker-module 3568>0 string >\0 Title: "%s" 35691080 string 8CHN 8-channel Fasttracker module sound data 3570!:mime audio/x-mod 3571#audio/x-fasttracker-module 3572>0 string >\0 Title: "%s" 35731080 string CD81 8-channel Octalyser module sound data 3574!:mime audio/x-mod 3575#audio/x-octalysertracker-module 3576>0 string >\0 Title: "%s" 35771080 string OKTA 8-channel Octalyzer module sound data 3578!:mime audio/x-mod 3579#audio/x-octalysertracker-module 3580>0 string >\0 Title: "%s" 3581# Not good enough. 3582#1082 string CH 3583#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 35841080 string 16CN 16-channel Taketracker module sound data 3585!:mime audio/x-mod 3586#audio/x-taketracker-module 3587>0 string >\0 Title: "%s" 35881080 string 32CN 32-channel Taketracker module sound data 3589!:mime audio/x-mod 3590#audio/x-taketracker-module 3591>0 string >\0 Title: "%s" 3592 3593# TOC sound files -Trevor Johnson <trevor@jpj.net> 3594# 35950 string TOC TOC sound file 3596 3597# sidfiles <pooka@iki.fi> 3598# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 35990 string SIDPLAY\ INFOFILE Sidplay info file 3600 36010 string PSID PlaySID v2.2+ (AMIGA) sidtune 3602>4 beshort >0 w/ header v%d, 3603>14 beshort =1 single song, 3604>14 beshort >1 %d songs, 3605>16 beshort >0 default song: %d 3606>0x16 string >\0 name: "%s" 3607>0x36 string >\0 author: "%s" 3608>0x56 string >\0 copyright: "%s" 3609 36100 string RSID RSID sidtune PlaySID compatible 3611>4 beshort >0 w/ header v%d, 3612>14 beshort =1 single song, 3613>14 beshort >1 %d songs, 3614>16 beshort >0 default song: %d 3615>0x16 string >\0 name: "%s" 3616>0x36 string >\0 author: "%s" 3617>0x56 string >\0 copyright: "%s" 3618 3619# IRCAM sound files - Michael Pruett <michael@68k.org> 3620# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 36210 belong 0x64a30100 IRCAM file (VAX little-endian) 36220 belong 0x0001a364 IRCAM file (VAX big-endian) 36230 belong 0x64a30200 IRCAM file (Sun big-endian) 36240 belong 0x0002a364 IRCAM file (Sun little-endian) 36250 belong 0x64a30300 IRCAM file (MIPS little-endian) 36260 belong 0x0003a364 IRCAM file (MIPS big-endian) 36270 belong 0x64a30400 IRCAM file (NeXT big-endian) 36280 belong 0x64a30400 IRCAM file (NeXT big-endian) 36290 belong 0x0004a364 IRCAM file (NeXT little-endian) 3630 3631# NIST SPHERE <mpruett@sgi.com> 36320 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 3633 3634# Sample Vision <mpruett@sgi.com> 36350 string SOUND\ SAMPLE\ DATA\ Sample Vision file 3636 3637# Audio Visual Research <tonigonenstein@users.sourceforge.net> 36380 string 2BIT Audio Visual Research file, 3639>12 beshort =0 mono, 3640>12 beshort =-1 stereo, 3641>14 beshort x %d bits 3642>16 beshort =0 unsigned, 3643>16 beshort =-1 signed, 3644>22 belong&0x00ffffff x %d Hz, 3645>18 beshort =0 no loop, 3646>18 beshort =-1 loop, 3647>21 ubyte <128 note %d, 3648>22 byte =0 replay 5.485 KHz 3649>22 byte =1 replay 8.084 KHz 3650>22 byte =2 replay 10.971 KHz 3651>22 byte =3 replay 16.168 KHz 3652>22 byte =4 replay 21.942 KHz 3653>22 byte =5 replay 32.336 KHz 3654>22 byte =6 replay 43.885 KHz 3655>22 byte =7 replay 47.261 KHz 3656 3657# SGI SoundTrack <mpruett@sgi.com> 36580 string _SGI_SoundTrack SGI SoundTrack project file 3659# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 36600 string ID3 Audio file with ID3 version 2 3661>3 byte x \b.%d 3662>4 byte x \b.%d 3663>>5 byte &0x80 \b, unsynchronized frames 3664>>5 byte &0x40 \b, extended header 3665>>5 byte &0x20 \b, experimental 3666>>5 byte &0x10 \b, footer present 3667>(6.I+10) indirect x \b, contains: 3668 3669# NSF (NES sound file) magic 36700 string NESM\x1a NES Sound File 3671>14 string >\0 ("%s" by 3672>46 string >\0 %s, copyright 3673>78 string >\0 %s), 3674>5 byte x version %d, 3675>6 byte x %d tracks, 3676>122 byte&0x2 =1 dual PAL/NTSC 3677>122 byte&0x1 =1 PAL 3678>122 byte&0x1 =0 NTSC 3679 3680# NSFE (Extended NES sound file) magic 3681# http://slickproductions.org/docs/NSF/nsfespec.txt 3682# From: David Pflug <david@pflug.email> 36830 string NSFE Extended NES Sound File 3684>48 search/0x1000 auth 3685>>&0 string >\0 ("%s" 3686>>>&1 string >\0 by %s 3687>>>>&1 string >\0 \b, copyright %s 3688>>>>>&1 string >\0 \b, ripped by %s 3689>20 byte x \b), %d tracks, 3690>18 byte&0x2 =1 dual PAL/NTSC 3691>18 byte&0x2 =0 3692>>18 byte&0x1 =1 PAL 3693>>18 byte&0x1 =0 NTSC 3694 3695# Type: SNES SPC700 sound files 3696# From: Josh Triplett <josh@freedesktop.org> 36970 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 3698>&0 string 0.30 \b, version %s 3699>>0x23 byte 0x1B \b, without ID666 tag 3700>>0x23 byte 0x1A \b, with ID666 tag 3701>>>0x2E string >\0 \b, song "%.32s" 3702>>>0x4E string >\0 \b, game "%.32s" 3703 3704# Impulse tracker module (audio/x-it) 37050 string IMPM Impulse Tracker module sound data - 3706!:mime audio/x-mod 3707>4 string >\0 "%s" 3708>40 leshort !0 compatible w/ITv%x 3709>42 leshort !0 created w/ITv%x 3710 3711# Imago Orpheus module (audio/x-imf) 371260 string IM10 Imago Orpheus module sound data - 3713>0 string >\0 "%s" 3714 3715# From <collver1@attbi.com> 3716# These are the /etc/magic entries to decode modules, instruments, and 3717# samples in Impulse Tracker's native format. 3718 37190 string IMPS Impulse Tracker Sample 3720>18 byte &2 16 bit 3721>18 byte ^2 8 bit 3722>18 byte &4 stereo 3723>18 byte ^4 mono 37240 string IMPI Impulse Tracker Instrument 3725>28 leshort !0 ITv%x 3726>30 byte !0 %d samples 3727 3728# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 3729# From <collver1@attbi.com> 37300 string LM8953 Yamaha TX Wave 3731>22 byte 0x49 looped 3732>22 byte 0xC9 non-looped 3733>23 byte 1 33kHz 3734>23 byte 2 50kHz 3735>23 byte 3 16kHz 3736 3737# scream tracker: file(1) magic for Scream Tracker sample files 3738# 3739# From <collver1@attbi.com> 374076 string SCRS Scream Tracker Sample 3741>0 byte 1 sample 3742>0 byte 2 adlib melody 3743>0 byte >2 adlib drum 3744>31 byte &2 stereo 3745>31 byte ^2 mono 3746>31 byte &4 16bit little endian 3747>31 byte ^4 8bit 3748>30 byte 0 unpacked 3749>30 byte 1 packed 3750 3751# audio 3752# From: Cory Dikkers <cdikkers@swbell.net> 37530 string MMD0 MED music file, version 0 37540 string MMD1 OctaMED Pro music file, version 1 37550 string MMD3 OctaMED Soundstudio music file, version 3 37560 string OctaMEDCmpr OctaMED Soundstudio compressed file 37570 string MED MED_Song 37580 string SymM Symphonie SymMOD music file 3759# 37600 string THX AHX version 3761>3 byte =0 1 module data 3762>3 byte =1 2 module data 3763# 37640 string OKTASONG Oktalyzer module data 3765# 37660 string DIGI\ Booster\ module\0 %s 3767>20 byte >0 %c 3768>>21 byte >0 \b%c 3769>>>22 byte >0 \b%c 3770>>>>23 byte >0 \b%c 3771>610 string >\0 \b, "%s" 3772# 37730 string DBM0 DIGI Booster Pro Module 3774>4 byte >0 V%X. 3775>>5 byte x \b%02X 3776>16 string >\0 \b, "%s" 3777# 37780 string FTMN FaceTheMusic module 3779>16 string >\0d \b, "%s" 3780 3781# From: <doj@cubic.org> 2003-06-24 37820 string AMShdr\32 Velvet Studio AMS Module v2.2 37830 string Extreme Extreme Tracker AMS Module v1.3 37840 string DDMF Xtracker DMF Module 3785>4 byte x v%i 3786>0xD string >\0 Title: "%s" 3787>0x2B string >\0 Composer: "%s" 37880 string DSM\32 Dynamic Studio Module DSM 37890 string SONG DigiTrekker DTM Module 37900 string DMDL DigiTrakker MDL Module 37910 string PSM\32 Protracker Studio PSM Module 379244 string PTMF Poly Tracker PTM Module 3793>0 string >\32 Title: "%s" 37940 string MT20 MadTracker 2.0 Module MT2 37950 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 37960 string RTMM RTM Module 37970x426 string MaDoKaN96 XMS Adlib Module 3798>0 string >\0 Composer: "%s" 37990 string AMF AMF Module 3800>4 string >\0 Title: "%s" 38010 string MODINFO1 Open Cubic Player Module Inforation MDZ 38020 string Extended\40Instrument: Fast Tracker II Instrument 3803 3804# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 3805# NOA Nancy Codec file 38060 string \210NOA\015\012\032 NOA Nancy Codec Movie file 3807# Yamaha SMAF format 38080 string MMMD Yamaha SMAF file 3809# Sharp Jisaku Melody format for PDC 38100 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 3811>20 string Ver01.00 Ver. 1.00 3812>>32 byte x , %d tracks 3813 3814# Free lossless audio codec <http://flac.sourceforge.net> 3815# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 38160 string fLaC FLAC audio bitstream data 3817!:mime audio/x-flac 3818>4 byte&0x7f >0 \b, unknown version 3819>4 byte&0x7f 0 \b 3820# some common bits/sample values 3821>>20 beshort&0x1f0 0x030 \b, 4 bit 3822>>20 beshort&0x1f0 0x050 \b, 6 bit 3823>>20 beshort&0x1f0 0x070 \b, 8 bit 3824>>20 beshort&0x1f0 0x0b0 \b, 12 bit 3825>>20 beshort&0x1f0 0x0f0 \b, 16 bit 3826>>20 beshort&0x1f0 0x170 \b, 24 bit 3827>>20 byte&0xe 0x0 \b, mono 3828>>20 byte&0xe 0x2 \b, stereo 3829>>20 byte&0xe 0x4 \b, 3 channels 3830>>20 byte&0xe 0x6 \b, 4 channels 3831>>20 byte&0xe 0x8 \b, 5 channels 3832>>20 byte&0xe 0xa \b, 6 channels 3833>>20 byte&0xe 0xc \b, 7 channels 3834>>20 byte&0xe 0xe \b, 8 channels 3835# some common sample rates 3836>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz 3837>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz 3838>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 3839>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 3840>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 3841>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 3842>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 3843>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 3844>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 3845>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz 3846>>17 belong&0xfffff0 0x01f400 \b, 8 kHz 3847>>17 belong&0xfffff0 0x177000 \b, 96 kHz 3848>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 3849>>21 byte&0xf >0 \b, >4G samples 3850>>21 byte&0xf 0 \b 3851>>>22 belong >0 \b, %u samples 3852>>>22 belong 0 \b, length unknown 3853 3854# (ISDN) VBOX voice message file (Wolfram Kleff) 38550 string VBOX VBOX voice message data 3856 3857# ReBorn Song Files (.rbs) 3858# David J. Singer <doc@deadvirgins.org.uk> 38598 string RB40 RBS Song file 3860>29 string ReBorn created by ReBorn 3861>37 string Propellerhead created by ReBirth 3862 3863# Synthesizer Generator and Kimwitu share their file format 38640 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 3865# Kimwitu++ uses a slightly different magic 38660 string A#S#C#S#S#L#HUB Kimwitu++ data 3867 3868# From "Simon Hosie 38690 string TFMX-SONG TFMX module sound data 3870 3871# Monkey's Audio compressed audio format (.ape) 3872# From danny.milo@gmx.net (Danny Milosavljevic) 3873# New version from Abel Cheung <abel (@) oaka.org> 38740 string MAC\040 Monkey's Audio compressed format 3875!:mime audio/x-ape 3876>4 uleshort >0x0F8B version %d 3877>>(0x08.l) uleshort =1000 with fast compression 3878>>(0x08.l) uleshort =2000 with normal compression 3879>>(0x08.l) uleshort =3000 with high compression 3880>>(0x08.l) uleshort =4000 with extra high compression 3881>>(0x08.l) uleshort =5000 with insane compression 3882>>(0x08.l+18) uleshort =1 \b, mono 3883>>(0x08.l+18) uleshort =2 \b, stereo 3884>>(0x08.l+20) ulelong x \b, sample rate %d 3885>4 uleshort <0x0F8C version %d 3886>>6 uleshort =1000 with fast compression 3887>>6 uleshort =2000 with normal compression 3888>>6 uleshort =3000 with high compression 3889>>6 uleshort =4000 with extra high compression 3890>>6 uleshort =5000 with insane compression 3891>>10 uleshort =1 \b, mono 3892>>10 uleshort =2 \b, stereo 3893>>12 ulelong x \b, sample rate %d 3894 3895# adlib sound files 3896# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu 38970 string RAWADATA RdosPlay RAW 3898 38991068 string RoR AMUSIC Adlib Tracker 3900 39010 string JCH EdLib 3902 39030 string mpu401tr MPU-401 Trakker 3904 39050 string SAdT Surprise! Adlib Tracker 3906>4 byte x Version %d 3907 39080 string XAD! eXotic ADlib 3909 39100 string ofTAZ! eXtra Simple Music 3911 3912# Spectrum 128 tunes (.ay files). 3913# From: Emanuel Haupt <ehaupt@critical.ch> 39140 string ZXAYEMUL Spectrum 128 tune 3915 39160 string \0BONK BONK, 3917#>5 byte x version %d 3918>14 byte x %d channel(s), 3919>15 byte =1 lossless, 3920>15 byte =0 lossy, 3921>16 byte x mid-side 3922 3923384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 3924 3925# format VQF (proprietary codec for sound) 3926# some infos on the header file available at : 3927# http://www.twinvq.org/english/technology_format.html 39280 string TWIN97012000 VQF data 3929>27 short 0 \b, Mono 3930>27 short 1 \b, Stereo 3931>31 short >0 \b, %d kbit/s 3932>35 short >0 \b, %d kHz 3933 3934# Nelson A. de Oliveira (naoliv@gmail.com) 3935# .eqf 39360 string Winamp\ EQ\ library\ file %s 3937# it will match only versions like v<digit>.<digit> 3938# Since I saw only eqf files with version v1.1 I think that it's OK 3939>23 string x \b%.4s 3940# .preset 39410 string [Equalizer\ preset] XMMS equalizer preset 3942# .m3u 39430 search/1 #EXTM3U M3U playlist text 3944# .pls 39450 search/1 [playlist] PLS playlist text 3946# licq.conf 39471 string [licq] LICQ configuration file 3948 3949# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 39500 string ICE! SNDH Atari ST music 39510 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 3952 3953# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 39540 string MP+ Musepack audio (MP+) 3955!:mime audio/x-musepack 3956>3 byte 255 \b, SV pre8 3957>3 byte&0xF 0x6 \b, SV 6 3958>3 byte&0xF 0x8 \b, SV 8 3959>3 byte&0xF 0x7 \b, SV 7 3960>>3 byte&0xF0 0x0 \b.0 3961>>3 byte&0xF0 0x10 \b.1 3962>>3 byte&0xF0 240 \b.15 3963>>10 byte&0xF0 0x0 \b, no profile 3964>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 3965>>10 byte&0xF0 0x50 \b, quality 0 3966>>10 byte&0xF0 0x60 \b, quality 1 3967>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 3968>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 3969>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 3970>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 3971>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 3972>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 3973>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 3974>>10 byte&0xF0 0xE0 \b, quality 9 3975>>10 byte&0xF0 0xF0 \b, quality 10 3976>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 3977>>27 byte 102 \b, Beta 1.02 3978>>27 byte 104 \b, Beta 1.04 3979>>27 byte 105 \b, Alpha 1.05 3980>>27 byte 106 \b, Beta 1.06 3981>>27 byte 110 \b, Release 1.1 3982>>27 byte 111 \b, Alpha 1.11 3983>>27 byte 112 \b, Beta 1.12 3984>>27 byte 113 \b, Alpha 1.13 3985>>27 byte 114 \b, Beta 1.14 3986>>27 byte 115 \b, Alpha 1.15 3987 39880 string MPCK Musepack audio (MPCK) 3989!:mime audio/x-musepack 3990 3991# IMY 3992# from http://filext.com/detaillist.php?extdetail=IMY 3993# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 3994# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 3995# http://www.wx800.com/msg/download/irda/iMelody.pdf 39960 string BEGIN:IMELODY iMelody Ringtone Format 3997 3998# From: "Mateus Caruccio" <mateus@caruccio.com> 3999# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 40000 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 4001 4002# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 400360 string SONG SoundFX Module sound file 4004 4005# Type: Adaptive Multi-Rate Codec 4006# URL: http://filext.com/detaillist.php?extdetail=AMR 4007# From: Russell Coker <russell@coker.com.au> 40080 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 4009 4010# Type: SuperCollider 3 Synth Definition File Format 4011# From: Mario Lang <mlang@debian.org> 40120 string SCgf SuperCollider3 Synth Definition file, 4013>4 belong x version %d 4014 4015# Type: True Audio Lossless Audio 4016# URL: http://wiki.multimedia.cx/index.php?title=True_Audio 4017# From: Mike Melanson <mike@multimedia.cx> 40180 string TTA1 True Audio Lossless Audio 4019 4020# Type: WavPack Lossless Audio 4021# URL: http://wiki.multimedia.cx/index.php?title=WavPack 4022# From: Mike Melanson <mike@multimedia.cx> 40230 string wvpk WavPack Lossless Audio 4024 4025# From Fabio R. Schmidlin <frs@pop.com.br> 4026# VGM music file 40270 string Vgm\040 4028>9 ubyte >0 VGM Video Game Music dump v 4029>>9 ubyte/16 >0 \b%d 4030>>9 ubyte&0x0F x \b%d 4031>>8 ubyte/16 x \b.%d 4032>>8 ubyte&0x0F >0 \b%d 4033#Get soundchips 4034>>8 ubyte x \b, soundchip(s)= 4035>>0x0C ulelong >0 SN76489, 4036>>0x10 ulelong >0 YM2413, 4037>>0x2C ulelong >0 YM2612, 4038>>0x30 ulelong >0 YM2151, 4039>>0x38 ulelong >0 Sega PCM, 4040>>0x34 ulelong >0xC 4041>>>0x40 ulelong >0 RF5C68, 4042>>0x34 ulelong >0x10 4043>>>0x44 ulelong >0 YM2203, 4044>>0x34 ulelong >0x14 4045>>>0x48 ulelong >0 YM2608, 4046>>0x34 ulelong >0x18 4047>>>0x4C lelong >0 YM2610, 4048>>>0x4C lelong <0 YM2610B, 4049>>0x34 ulelong >0x1C 4050>>>0x50 ulelong >0 YM3812, 4051>>0x34 ulelong >0x20 4052>>>0x54 ulelong >0 YM3526, 4053>>0x34 ulelong >0x24 4054>>>0x58 ulelong >0 Y8950, 4055>>0x34 ulelong >0x28 4056>>>0x5C ulelong >0 YMF262, 4057>>0x34 ulelong >0x2C 4058>>>0x60 ulelong >0 YMF278B, 4059>>0x34 ulelong >0x30 4060>>>0x64 ulelong >0 YMF271, 4061>>0x34 ulelong >0x34 4062>>>0x68 ulelong >0 YMZ280B, 4063>>0x34 ulelong >0x38 4064>>>0x6C ulelong >0 RF5C164, 4065>>0x34 ulelong >0x3C 4066>>>0x70 ulelong >0 PWM, 4067>>0x34 ulelong >0x40 4068>>>0x74 ulelong >0 4069>>>>0x78 ubyte 0x00 AY-3-8910, 4070>>>>0x78 ubyte 0x01 AY-3-8912, 4071>>>>0x78 ubyte 0x02 AY-3-8913, 4072>>>>0x78 ubyte 0x03 AY-3-8930, 4073>>>>0x78 ubyte 0x10 YM2149, 4074>>>>0x78 ubyte 0x11 YM3439, 4075 4076# GVOX Encore file format 4077# Since this is a proprietary file format and there is no publicly available 4078# format specification, this is just based on induction 4079# 40800 string SCOW 4081>4 byte 0xc4 GVOX Encore music, version 5.0 or above 4082>4 byte 0xc2 GVOX Encore music, version < 5.0 4083 40840 string ZBOT 4085>4 byte 0xc5 GVOX Encore music, version < 5.0 4086 4087# Summary: Garmin Voice Processing Module (WAVE audios) 4088# From: Joerg Jenderek 4089# URL: http://www.garmin.com/ 4090# Reference: http://turboccc.wikispaces.com/share/view/28622555 4091# NOTE: there exist 2 other Garmin VPM formats 40920 string AUDIMG 4093# skip text files starting with string "AUDIMG" 4094>13 ubyte <13 Garmin Voice Processing Module 4095!:mime audio/x-vpm-wav-garmin 4096!:ext vpm 4097# 3 bytes indicating the voice version (200,220) 4098>>6 string x \b, version %3.3s 4099# day of release (01-31) 4100>>12 ubyte x \b, %.2d 4101# month of release (01-12) 4102>>13 ubyte x \b.%.2d 4103# year of release (like 2006, 2007, 2008) 4104>>14 uleshort x \b.%.4d 4105# hour of release (0-23) 4106>>11 ubyte x %.2d 4107# minute of release (0-59) 4108>>10 ubyte x \b:%.2d 4109# second of release (0-59) 4110>>9 ubyte x \b:%.2d 4111# if you select a language like german on your garmin device 4112# you can only select voice modules with correponding language byte ID like 1 4113>>18 ubyte x \b, language ID %d 4114# pointer to 1st audio WAV sample 4115>>16 uleshort >0 4116>>>(16.s) ulelong >0 \b, at offset 0x%x 4117# WAV length 4118>>>>(16.s+4) ulelong >0 %d Bytes 4119# look for magic 4120>>>>>(&-8.l) string RIFF 4121# determine type by ./riff 4122>>>>>>&-4 indirect x \b 4123# 2 - ~ 131 WAV samples following same way 4124 4125# From Martin Mueller Skarbiniks Pedersen 41260 string GDM 4127>0x3 byte 0xFE General Digital Music. 4128>0x4 string >\0 title: "%s" 4129>0x24 string >\0 musician: "%s" 4130>>0x44 beshort 0x0D0A 4131>>>0x46 byte 0x1A 4132>>>>0x47 string GMFS Version 4133>>>>0x4B byte x %d. 4134>>>>0x4C byte x \b%02d 4135>>>>0x4D beshort 0x000 (2GDM v 4136>>>>0x4F byte x \b%d. 4137>>>>>0x50 byte x \b%d) 4138 41390 string MTM Multitracker 4140>0x3 byte/16 x Version %d. 4141>0x3 byte&0x0F x \b%02d 4142>>0x4 string >\0 title: "%s" 4143 41440 string HVL 4145>3 byte <2 Hively Tracker Song 4146>3 byte 0 1 module data 4147>3 byte 1 2 module data 4148 41490 string MO3 4150>3 ubyte <6 MOdule with MP3 4151>>3 byte 0 Version 0 (With MP3 and lossless) 4152>>3 byte 1 Version 1 (With ogg and lossless) 4153>>3 byte 3 Version 2.2 4154>>3 byte 4 (With no LAME header) 4155>>3 byte 5 Version 2.4 4156 41570 string ADRVPACK AProSys module 4158 4159# ftp://ftp.modland.com/pub/documents/format_documentation/\ 4160# Art%20Of%20Noise%20(.aon).txt 41610 string AON 4162>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)" 4163>0x2e string NAME Art of Noise Tracker Song 4164>3 string <9 4165>3 string 4 (4 voices) 4166>3 string 8 (8 voices) 4167>>0x36 string >\0 Title: "%s" 4168 41690 string FAR 4170>0x2c byte 0x0d 4171>0x2d byte 0x0a 4172>0x2e byte 0x1a 4173>>0x3 byte 0xFE Farandole Tracker Song 4174>>>0x31 byte/16 x Version %d. 4175>>>0x31 byte&0x0F x \b%02d 4176>>>>0x4 string >\0 \b, title: "%s" 4177 4178#---------------------------------------------------------------- 4179# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $ 4180# basis: file(1) magic for BBx/Pro5-files 4181# Oliver Dammer <dammer@olida.de> 2005/11/07 4182# http://www.basis.com business-basic-files. 4183# 41840 string \074\074bbx\076\076 BBx 4185>7 string \000 indexed file 4186>7 string \001 serial file 4187>7 string \002 keyed file 4188>>13 short 0 (sort) 4189>7 string \004 program 4190>>18 byte x (LEVEL %d) 4191>>>23 string >\000 psaved 4192>7 string \006 mkeyed file 4193>>13 short 0 (sort) 4194>>8 string \000 (mkey) 4195 4196#------------------------------------------------------------------------------ 4197# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $ 4198# ber: file(1) magic for several BER formats used in the mobile 4199# telecommunications industry (Georg Sauthoff) 4200 4201# The file formats are standardized by the GSMA (GSM association). 4202# They are specified via ASN.1 schemas and some prose. Basic encoding 4203# rules (BER) is the used encoding. The formats are used for exchanging 4204# call data records (CDRs) between mobile operators and associated 4205# parties for roaming clearing purposes and fraud detection. 4206 4207# The magic file covers: 4208 4209# - TAP files (TD.57) - CDR batches and notifications 4210# - RAP files (TD.32) - return batches and acknowledgements 4211# - NRT files (TD.35) - CDR batches for 'near real time' processing 4212 4213# 4214# TAP 3 Files 4215# TAP -> Transferred Account Procedure 4216# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf 4217# TransferBatch short tag 42180 byte 0x61 4219# BatchControlInfo short tag 4220>&1 search/b5 \x64 4221# Sender long tag #TAP 3.x (BER encoded) 4222>>&1 search/b8 \x5f\x81\x44 4223# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 4224>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 4225>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account) 4226 4227# Notification short tag 42280 byte 0x62 4229# Sender long tag 4230>2 search/b8 \x5f\x81\x44 4231# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 4232>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 4233>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account) 4234 4235 4236# NRT Files 4237# NRT a.k.a. NRTRDE 42380 byte 0x61 4239# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block 4240>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01 4241>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) 4242 4243# RAP Files 4244# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf 4245# Long ReturnBatch tag 42460 string \x7f\x84\x16 4247# Long RapBatchControlInfo tag 4248>&1 search/b8 \x7f\x84\x19 4249# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 4250>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 4251# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block 4252>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01 4253>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure), 4254>>>&0 byte x TAP 3.%d 4255 4256# Long Acknowledgement tag 42570 string \x7f\x84\x17 4258# Long Sender tag 4259>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure) 4260 4261#------------------------------------------------------------------------------ 4262# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $ 4263# bFLT: file(1) magic for BFLT uclinux binary files 4264# 4265# From Philippe De Muyter <phdm@macqel.be> 4266# 42670 string bFLT BFLT executable 4268>4 belong x - version %d 4269>4 belong 4 4270>>36 belong&0x1 0x1 ram 4271>>36 belong&0x2 0x2 gotpic 4272>>36 belong&0x4 0x4 gzip 4273>>36 belong&0x8 0x8 gzdata 4274 4275#------------------------------------------------------------------------------ 4276# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $ 4277# bioinfomatics: file(1) magic for Bioinfomatics file formats 4278 4279############################################################################### 4280# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable 4281# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 4282############################################################################### 42830 string \037\213 4284>3 byte &0x04 4285>>12 string BC 4286>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible) 4287>>>>16 leshort x \b, block length %d 4288!:mime application/x-gzip 4289 4290 4291############################################################################### 4292# Tabix index file 4293# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 4294############################################################################### 42950 string TBI\1 SAMtools TBI (Tabix index format) 4296>0x04 lelong =1 \b, with %d reference sequence 4297>0x04 lelong >1 \b, with %d reference sequences 4298>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style) 4299>0x08 lelong ^0x10000 4300>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style) 4301>>0x08 lelong =1 \b, using SAM format 4302>>0x08 lelong =2 \b, using VCF format 4303>0x0c lelong x \b, sequence name column: %d 4304>0x10 lelong x \b, region start column: %d 4305>0x08 lelong =0 4306>>0x14 lelong x \b, region end column: %d 4307>0x18 byte x \b, comment character: %c 4308>0x1c lelong x \b, skip line count: %d 4309 4310 4311############################################################################### 4312# BAM (Binary Sequence Alignment/Map format) 4313# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 4314# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 4315############################################################################### 43160 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map) 4317>0x04 lelong >0 4318>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header 4319>>>&0 regex =[0-9.]+ \b version %s 4320>>&(0x04) lelong >0 \b, with %d reference sequences 4321 4322 4323############################################################################### 4324# BAI (BAM indexing format) 4325# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 4326############################################################################### 43270 string BAI\1 SAMtools BAI (BAM indexing format) 4328>0x04 lelong >0 \b, with %d reference sequences 4329 4330 4331############################################################################### 4332# CRAM (Binary Sequence Alignment/Map format) 4333############################################################################### 43340 string CRAM CRAM 4335>0x04 byte >-1 version %d. 4336>0x05 byte >-1 \b%d 4337>0x06 string >\0 (identified as %s) 4338 4339 4340############################################################################### 4341# BCF (Binary Call Format), version 1 4342# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf) 4343# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 4344############################################################################### 43450 string BCF\4 4346# length of seqnm data in bytes is positive 4347>&0x00 lelong >0 4348# length of smpl data in bytes is positive 4349>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format) 4350# length of meta in bytes 4351>>>&(&-0x04) lelong >0 4352# have meta text string 4353>>>>&0x00 search ##samtoolsVersion= 4354>>>>>&0x00 string x \b, generated by SAMtools version %s 4355 4356 4357############################################################################### 4358# BCF (Binary Call Format), version 2.1 4359# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf) 4360# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 4361############################################################################### 43620 string BCF\2\1 Binary Call Format (BCF) version 2.1 4363# length of header text 4364>&0x00 lelong >0 4365# have header string 4366>>&0x00 search ##samtoolsVersion= 4367>>>&0x00 string x \b, generated by SAMtools version %s 4368 4369 4370############################################################################### 4371# BCF (Binary Call Format), version 2.2 4372# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf) 4373# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 4374############################################################################### 43750 string BCF\2\2 Binary Call Format (BCF) version 2.2 4376# length of header text 4377>&0x00 lelong >0 4378# have header string 4379>>&0x00 search ##samtoolsVersion= 4380>>>&0x00 string x \b, generated by SAMtools version %s 4381 4382############################################################################### 4383# VCF (Variant Call Format) 4384# used by VCFtools (http://vcftools.sourceforge.net/) 4385############################################################################### 43860 search ##fileformat=VCFv Variant Call Format (VCF) 4387>&0 string x \b version %s 4388 4389############################################################################### 4390# FASTQ 4391# used by MAQ (http://maq.sourceforge.net/fastq.shtml) 4392############################################################################### 4393# XXX Broken? 4394# @<seqname> 4395#0 regex =^@[A-Za-z0-9_.:-]+\?\n 4396# <seq> 4397#>&1 regex =^[A-Za-z\n.~]++ 4398# +[<seqname>] 4399#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n 4400# <qual> 4401#>>>&1 regex =^[!-~\n]+\n FASTQ 4402 4403############################################################################### 4404# FASTA 4405# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) 4406############################################################################### 4407#0 byte 0x3e 4408# q>0 regex =^[>][!-~\t\ ]+$ 4409# Amino Acid codes: [A-IK-Z*-]+ 4410#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA 4411# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+ 4412# not in IUPAC codes/gaps: [EFIJLOPQZ] 4413#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes 4414#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes 4415 4416############################################################################### 4417# SAM (Sequence Alignment/Map format) 4418# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 4419############################################################################### 4420# Short-cut version to recognise SAM files with (optional) header at beginning 4421############################################################################### 44220 string @HD\t 4423>4 search VN: Sequence Alignment/Map (SAM), with header 4424>>&0 regex [0-9.]+ \b version %s 4425############################################################################### 4426# Longer version to recognise SAM alignment lines using (many) regexes 4427############################################################################### 4428# SAM Alignment QNAME 44290 regex =^[!-?A-~]{1,255}(\t[^\t]+){11} 4430# SAM Alignment FLAG 4431>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t 4432# SAM Alignment RNAME 4433>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t 4434# SAM Alignment POS 4435>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t 4436# SAM Alignment MAPQ 4437>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t 4438# SAM Alignment CIGAR 4439>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t 4440# SAM Alignment RNEXT 4441>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t 4442# SAM Alignment PNEXT 4443>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t 4444# SAM Alignment TLEN 4445>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t 4446# SAM Alignment SEQ 4447>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t 4448# SAM Alignment QUAL 4449>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM) 4450>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header 4451>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s 4452 4453#------------------------------------------------------------------------------ 4454# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $ 4455# blackberry: file(1) magic for BlackBerry file formats 4456# 44575 belong 0 4458>8 belong 010010010 BlackBerry RIM ETP file 4459>>22 string x \b for %s 4460# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 4461# http://ftg.lbl.gov/checkpoint 44620 string C\0\0\0R\0\0\0 BLCR 4463>16 lelong 1 x86 4464>16 lelong 3 alpha 4465>16 lelong 5 x86-64 4466>16 lelong 7 ARM 4467>8 lelong x context data (little endian, version %d) 4468# Uncomment the following only of your "file" program supports "search" 4469#>0 search/1024 VMA\06 for kernel 4470#>>&1 byte x %d. 4471#>>&2 byte x %d. 4472#>>&3 byte x %d 44730 string \0\0\0C\0\0\0R BLCR 4474>16 belong 2 SPARC 4475>16 belong 4 ppc 4476>16 belong 6 ppc64 4477>16 belong 7 ARMEB 4478>16 belong 8 SPARC64 4479>8 belong x context data (big endian, version %d) 4480# Uncomment the following only of your "file" program supports "search" 4481#>0 search/1024 VMA\06 for kernel 4482#>>&1 byte x %d. 4483#>>&2 byte x \b%d. 4484#>>&3 byte x \b%d 4485 4486#------------------------------------------------------------------------------ 4487# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $ 4488# blender: file(1) magic for Blender 3D related files 4489# 4490# Native format rule v1.2. For questions use the developers list 4491# http://lists.blender.org/mailman/listinfo/bf-committers 4492# GLOB chunk was moved near start and provides subversion info since 2.42 4493 44940 string =BLENDER Blender3D, 4495>7 string =_ saved as 32-bits 4496>>8 string =v little endian 4497>>>9 byte x with version %c. 4498>>>10 byte x \b%c 4499>>>11 byte x \b%c 4500>>>0x40 string =GLOB \b. 4501>>>>0x58 leshort x \b%.4d 4502>>8 string =V big endian 4503>>>9 byte x with version %c. 4504>>>10 byte x \b%c 4505>>>11 byte x \b%c 4506>>>0x40 string =GLOB \b. 4507>>>>0x58 beshort x \b%.4d 4508>7 string =- saved as 64-bits 4509>>8 string =v little endian 4510>>9 byte x with version %c. 4511>>10 byte x \b%c 4512>>11 byte x \b%c 4513>>0x44 string =GLOB \b. 4514>>>0x60 leshort x \b%.4d 4515>>8 string =V big endian 4516>>>9 byte x with version %c. 4517>>>10 byte x \b%c 4518>>>11 byte x \b%c 4519>>>0x44 string =GLOB \b. 4520>>>>0x60 beshort x \b%.4d 4521 4522# Scripts that run in the embedded Python interpreter 45230 string #!BPY Blender3D BPython script 4524 4525#------------------------------------------------------------------------------ 4526# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 4527# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 4528# 4529# Note that this 0407 conflicts with several other a.out formats... 4530# 4531# XXX - should this be redone with "be" and "le", so that it works on 4532# little-endian machines as well? If so, what's the deal with 4533# "VAX-order" and "VAX-order2"? 4534# 4535#0 long 0407 68K Blit (standalone) executable 4536#0 short 0407 VAX-order2 68K Blit (standalone) executable 45370 short 03401 VAX-order 68K Blit (standalone) executable 45380 long 0406 68k Blit mpx/mux executable 45390 short 0406 VAX-order2 68k Blit mpx/mux executable 45400 short 03001 VAX-order 68k Blit mpx/mux executable 4541# Need more values for WE32 DMD executables. 4542# Note that 0520 is the same as COFF 4543#0 short 0520 tty630 layers executable 4544 4545#------------------------------------------------------------------------------ 4546# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 4547# i80960 b.out objects and archives 4548# 45490 long 0x10d i960 b.out relocatable object 4550>16 long >0 not stripped 4551# 4552# b.out archive (hp-rt on i960) 45530 string =!<bout> b.out archive 4554>8 string __.SYMDEF random library 4555 4556#------------------------------------------------------------------------------ 4557# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $ 4558# bsdi: file(1) magic for BSD/OS (from BSDI) objects 4559# Some object/executable formats use the same magic numbers as are used 4560# in other OSes; those are handled by entries in aout. 4561# 4562 45630 lelong 0314 386 compact demand paged pure executable 4564>16 lelong >0 not stripped 4565>32 byte 0x6a (uses shared libs) 4566 4567# same as in SunOS 4.x, except for static shared libraries 45680 belong&077777777 0600413 SPARC demand paged 4569>0 byte &0x80 4570>>20 belong <4096 shared library 4571>>20 belong =4096 dynamically linked executable 4572>>20 belong >4096 dynamically linked executable 4573>0 byte ^0x80 executable 4574>16 belong >0 not stripped 4575>36 belong 0xb4100001 (uses shared libs) 4576 45770 belong&077777777 0600410 SPARC pure 4578>0 byte &0x80 dynamically linked executable 4579>0 byte ^0x80 executable 4580>16 belong >0 not stripped 4581>36 belong 0xb4100001 (uses shared libs) 4582 45830 belong&077777777 0600407 SPARC 4584>0 byte &0x80 dynamically linked executable 4585>0 byte ^0x80 executable 4586>16 belong >0 not stripped 4587>36 belong 0xb4100001 (uses shared libs) 4588# Chiasmus is a encryption standard developed by the German Federal 4589# Office for Information Security (Bundesamt fuer Sicherheit in der 4590# Informationstechnik). 4591 4592# Extension: .xia 45930 string XIA1 Chiasmus encrypted data 4594 4595# Extension: .xis 45960 string XIS Chiasmus key 4597 4598#------------------------------------------------------------------------------ 4599# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 4600# BTSnoop: file(1) magic for BTSnoop files 4601# 4602# From <marcel@holtmann.org> 46030 string btsnoop\0 BTSnoop 4604>8 belong x version %d, 4605>12 belong 1001 Unencapsulated HCI 4606>12 belong 1002 HCI UART (H4) 4607>12 belong 1003 HCI BCSP 4608>12 belong 1004 HCI Serial (H5) 4609>>12 belong x type %d 4610 4611#------------------------------------------------------------------------------ 4612# $File: c64,v 1.6 2015/08/24 05:17:42 christos Exp $ 4613# c64: file(1) magic for various commodore 64 related files 4614# 4615# From: Dirk Jagdmann <doj@cubic.org> 4616 46170x16500 belong 0x12014100 D64 Image 46180x16500 belong 0x12014180 D71 Image 46190x61800 belong 0x28034400 D81 Image 46200 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 46210 belong 0x43154164 X64 Image 4622 46230 string GCR-1541 GCR Image 4624>8 byte x version: %i 4625>9 byte x tracks: %i 4626 46279 string PSUR ARC archive (c64) 46282 string -LH1- LHA archive (c64) 4629 46300 string C64File PC64 Emulator file 4631>8 string >\0 "%s" 46320 string C64Image PC64 Freezer Image 4633 46340 beshort 0x38CD C64 PCLink Image 46350 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 4636 46370 belong 0xFF424CFF WRAptor packer (c64) 4638 46390 string C64S\x20tape\x20file T64 tape Image 4640>32 leshort x Version:0x%x 4641>36 leshort !0 Entries:%i 4642>40 string x Name:%.24s 4643 46440 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 4645>32 leshort x Version:0x%x 4646>36 leshort !0 Entries:%i 4647>40 string x Name:%.24s 4648 46490 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 4650>32 leshort x Version:0x%x 4651>36 leshort !0 Entries:%i 4652>40 string x Name:%.24s 4653 4654# Raw tape file format (.tap files) 4655# Esa Hyyti <esa@netlab.tkk.fi> 46560 string C64-TAPE-RAW C64 Raw Tape File (.tap), 4657>0x0c byte x Version:%u, 4658>0x10 lelong x Length:%u cycles 4659 4660#------------------------------------------------------------------------------ 4661# $File: cad,v 1.14 2017/03/17 21:35:28 christos Exp $ 4662# autocad: file(1) magic for cad files 4663# 4664 4665# Microstation DGN/CIT Files (www.bentley.com) 4666# Last updated July 29, 2005 by Lester Hightower 4667# DGN is the default file extension of Microstation/Intergraph CAD files. 4668# CIT is the proprietary raster format (similar to TIFF) used to attach 4669# raster underlays to Microstation DGN (vector) drawings. 4670# 4671# http://www.wotsit.org/search.asp 4672# http://filext.com/detaillist.php?extdetail=DGN 4673# http://filext.com/detaillist.php?extdetail=CIT 4674# 4675# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 4676# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 4677# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 4678# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 46790 string \010\011\376 Microstation 4680>3 string \002 4681>>30 string \026\105 DGNFile 4682>>30 string \034\105 DGNFile 4683>>30 string \073\107 DGNFile 4684>>30 string \073\110 DGNFile 4685>>30 string \106\107 DGNFile 4686>>30 string \110\103 DGNFile 4687>>30 string \120\104 DGNFile 4688>>30 string \172\104 DGNFile 4689>>30 string \172\105 DGNFile 4690>>30 string \172\106 DGNFile 4691>>30 string \234\106 DGNFile 4692>>30 string \273\105 DGNFile 4693>>30 string \306\106 DGNFile 4694>>30 string \310\104 DGNFile 4695>>30 string \341\104 DGNFile 4696>>30 string \372\103 DGNFile 4697>>30 string \372\104 DGNFile 4698>>30 string \372\106 DGNFile 4699>>30 string \376\103 DGNFile 4700>4 string \030\000\000 CITFile 4701>4 string \030\000\003 CITFile 4702 4703# AutoCAD 4704# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg 4705# and http://www.iana.org/assignments/media-types/image/vnd.dwg 47060 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 4707!:mime image/vnd.dwg 47080 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 4709!:mime image/vnd.dwg 47100 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 4711!:mime image/vnd.dwg 47120 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 4713!:mime image/vnd.dwg 47140 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 4715!:mime image/vnd.dwg 47160 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 4717!:mime image/vnd.dwg 47180 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 4719!:mime image/vnd.dwg 47200 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 4721!:mime image/vnd.dwg 47220 string AC1001 DWG AutoDesk AutoCAD Release 2.22 4723!:mime image/vnd.dwg 47240 string AC1002 DWG AutoDesk AutoCAD Release 2.50 4725!:mime image/vnd.dwg 47260 string AC1003 DWG AutoDesk AutoCAD Release 2.60 4727!:mime image/vnd.dwg 47280 string AC1004 DWG AutoDesk AutoCAD Release 9 4729!:mime image/vnd.dwg 47300 string AC1006 DWG AutoDesk AutoCAD Release 10 4731!:mime image/vnd.dwg 47320 string AC1009 DWG AutoDesk AutoCAD Release 11/12 4733!:mime image/vnd.dwg 4734# AutoCAD DWG versions R13/R14 (www.autodesk.com) 4735# Written December 01, 2003 by Lester Hightower 4736# Based on the DWG File Format Specifications at http://www.opendwg.org/ 4737# AutoCad, from Nahuel Greco 4738# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 47390 string AC1012 DWG AutoDesk AutoCAD Release 13 4740!:mime image/vnd.dwg 47410 string AC1014 DWG AutoDesk AutoCAD Release 14 4742!:mime image/vnd.dwg 47430 string AC1015 DWG AutoDesk AutoCAD 2000/2002 4744!:mime image/vnd.dwg 4745 4746# A new version of AutoCAD DWG 4747# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 4748# ICQ 358572321) 4749# From various sources like: 4750# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html 47510 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 4752!:mime image/vnd.dwg 47530 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 4754!:mime image/vnd.dwg 47550 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 4756!:mime image/vnd.dwg 47570 string AC1027 DWG AutoDesk AutoCAD 2013/2014 4758!:mime image/vnd.dwg 4759 4760# KOMPAS 2D drawing from ASCON 4761# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 4762# gathered nor specification 4763# ASCON http://ascon.net/main/ in English, 4764# http://ascon.ru/ main site in Russian 4765# Extension is CDW for drawing and FRW for fragment of drawing 4766# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 4767# ICQ 358572321, http://vkontakte.ru/id16076543) 4768# From: 4769# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 4770# (in russian) and my experiments 47710 string KF 4772>2 belong 0x4E00000C Kompas drawing 12.0 SP1 4773>2 belong 0x4D00000C Kompas drawing 12.0 4774>2 belong 0x3200000B Kompas drawing 11.0 SP1 4775>2 belong 0x3100000B Kompas drawing 11.0 4776>2 belong 0x2310000A Kompas drawing 10.0 SP1 4777>2 belong 0x2110000A Kompas drawing 10.0 4778>2 belong 0x08000009 Kompas drawing 9.0 SP1 4779>2 belong 0x05000009 Kompas drawing 9.0 4780>2 belong 0x33010008 Kompas drawing 8+ 4781>2 belong 0x1A000008 Kompas drawing 8.0 4782>2 belong 0x2C010107 Kompas drawing 7+ 4783>2 belong 0x05000007 Kompas drawing 7.0 4784>2 belong 0x32000006 Kompas drawing 6+ 4785>2 belong 0x09000006 Kompas drawing 6.0 4786>2 belong 0x5C009005 Kompas drawing 5.11R03 4787>2 belong 0x54009005 Kompas drawing 5.11R02 4788>2 belong 0x51009005 Kompas drawing 5.11R01 4789>2 belong 0x22009005 Kompas drawing 5.10R03 4790>2 belong 0x22009005 Kompas drawing 5.10R02 mar 4791>2 belong 0x21009005 Kompas drawing 5.10R02 febr 4792>2 belong 0x19009005 Kompas drawing 5.10R01 4793>2 belong 0xF4008005 Kompas drawing 5.9R01.003 4794>2 belong 0x1C008005 Kompas drawing 5.9R01.002 4795>2 belong 0x11008005 Kompas drawing 5.8R01.003 4796 4797# CAD: file(1) magic for computer aided design files 4798# Phillip Griffith <phillip dot griffith at gmail dot com> 4799# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 4800# 48010 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library 48020 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD 48030 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD 48040 beshort 0x0809 Bentley/Intergraph MicroStation 4805>0x02 byte 0xfe 4806>>0x04 beshort 0x1800 CIT raster CAD 4807 4808# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' 4809#16 beshort 0x3d3d image/x-3ds 4810 4811# MegaCAD 2D/3D drawing (.prt) 4812# http://megacad.de/ 4813# From: Markus Heidelberg <markus.heidelberg@web.de> 48140 string MegaCad23\0 MegaCAD 2D/3D drawing 4815 4816#------------------------------------------------------------------------------ 4817# $File: cafebabe,v 1.22 2017/03/17 21:35:28 christos Exp $ 4818# Cafe Babes unite! 4819# 4820# Since Java bytecode and Mach-O universal binaries have the same magic number, 4821# the test must be performed in the same "magic" sequence to get both right. 4822# The long at offset 4 in a Mach-O universal binary tells the number of 4823# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 4824# version and the short at offset 6 is the JVM major version. Since there are only 4825# only 18 labeled Mach-O architectures at current, and the first released 4826# Java class format was version 43.0, we can safely choose any number 4827# between 18 and 39 to test the number of architectures against 4828# (and use as a hack). Let's not use 18, because the Mach-O people 4829# might add another one or two as time goes by... 4830# 4831### JAVA START ### 48320 belong 0xcafebabe 4833>4 belong >30 compiled Java class data, 4834!:mime application/x-java-applet 4835>>6 beshort x version %d. 4836>>4 beshort x \b%d 4837# Which is which? 4838#>>4 belong 0x032d (Java 1.0) 4839#>>4 belong 0x032d (Java 1.1) 4840>>4 belong 0x002e (Java 1.2) 4841>>4 belong 0x002f (Java 1.3) 4842>>4 belong 0x0030 (Java 1.4) 4843>>4 belong 0x0031 (Java 1.5) 4844>>4 belong 0x0032 (Java 1.6) 4845>>4 belong 0x0033 (Java 1.7) 4846>>4 belong 0x0034 (Java 1.8) 4847 48480 belong 0xcafed00d JAR compressed with pack200, 4849>5 byte x version %d. 4850>4 byte x \b%d 4851!:mime application/x-java-pack200 4852 4853 48540 belong 0xcafed00d JAR compressed with pack200, 4855>5 byte x version %d. 4856>4 byte x \b%d 4857!:mime application/x-java-pack200 4858 4859### JAVA END ### 4860### MACH-O START ### 4861 48620 name mach-o \b [ 4863>0 use mach-o-cpu \b 4864>(8.L) indirect \b: 4865>0 belong x \b] 4866 48670 belong 0xcafebabe 4868>4 belong 1 Mach-O universal binary with 1 architecture: 4869!:mime application/x-mach-binary 4870>>8 use mach-o \b 4871>4 belong >1 4872>>4 belong <20 Mach-O universal binary with %d architectures: 4873!:mime application/x-mach-binary 4874>>>8 use mach-o \b 4875>>4 belong 2 4876>>>28 use mach-o \b 4877>>4 belong 3 4878>>>48 use mach-o \b 4879>>4 belong 4 4880>>>68 use mach-o \b 4881>>4 belong 5 4882>>>88 use mach-o \b 4883>>4 belong 6 4884>>>108 use mach-o \b 4885 4886### MACH-O END ### 4887 4888#------------------------------------------------------------------------------ 4889# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $ 4890# cbor: file(1) magic for CBOR files as defined in RFC 7049 4891 48920 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container 4893!:mime application/cbor 4894>3 ubyte <0x20 (positive integer) 4895>3 ubyte <0x40 4896>>3 ubyte >0x1f (negative integer) 4897>3 ubyte <0x60 4898>>3 ubyte >0x3f (byte string) 4899>3 ubyte <0x80 4900>>3 ubyte >0x5f (text string) 4901>3 ubyte <0xa0 4902>3 ubyte >0x7f (array) 4903>3 ubyte <0xc0 4904>>3 ubyte >0x9f (map) 4905>3 ubyte <0xe0 4906>>3 ubyte >0xbf (tagged) 4907>3 ubyte >0xdf (other) 4908 4909#------------------------------------------------------------------------------ 4910# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 4911# CDDB: file(1) magic for CDDB(tm) format CD text data files 4912# 4913# From <steve@gracenote.com> 4914# 4915# This is the /etc/magic entry to decode datafiles as used by 4916# CDDB-enabled CD player applications. 4917# 4918 49190 search/1/w #\040xmcd CDDB(tm) format CD text data 4920 4921#------------------------------------------------------------------------------ 4922# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 4923# chord: file(1) magic for Chord music sheet typesetting utility input files 4924# 4925# From Philippe De Muyter <phdm@macqel.be> 4926# File format is actually free, but many distributed files begin with `{title' 4927# 49280 string {title Chord text file 4929 4930# Type: PowerTab file format 4931# URL: http://www.power-tab.net/ 4932# From: Jelmer Vernooij <jelmer@samba.org> 49330 string ptab\003\000 Power-Tab v3 Tablature File 49340 string ptab\004\000 Power-Tab v4 Tablature File 4935 4936#------------------------------------------------------------------------------ 4937# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 4938# cisco: file(1) magic for cisco Systems routers 4939# 4940# Most cisco file-formats are covered by the generic elf code 4941# 4942# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 49430 belong&0xffffff00 0x85011400 cisco IOS microcode 4944>7 string >\0 for '%s' 49450 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 4946>7 string >\0 for '%s' 4947 4948#------------------------------------------------------------------------------ 4949# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ 4950# citrus locale declaration 4951# 4952 49530 string RuneCT Citrus locale declaration for LC_CTYPE 4954 4955#------------------------------------------------------------------------------ 4956# $File: c-lang,v 1.25 2017/03/17 21:35:28 christos Exp $ 4957# c-lang: file(1) magic for C and related languages programs 4958# 4959# The strength is to beat standard HTML 4960 4961# BCPL 49620 search/8192 "libhdr" BCPL source text 4963!:mime text/x-bcpl 49640 search/8192 "LIBHDR" BCPL source text 4965!:mime text/x-bcpl 4966 4967# C 49680 regex \^#include C source text 4969!:strength +25 4970!:mime text/x-c 49710 regex \^char[\ \t\n]+ C source text 4972!:mime text/x-c 49730 regex \^double[\ \t\n]+ C source text 4974!:mime text/x-c 49750 regex \^extern[\ \t\n]+ C source text 4976!:mime text/x-c 49770 regex \^float[\ \t\n]+ C source text 4978!:mime text/x-c 49790 regex \^struct[\ \t\n]+ C source text 4980!:mime text/x-c 49810 regex \^union[\ \t\n]+ C source text 4982!:mime text/x-c 49830 search/8192 main( C source text 4984!:mime text/x-c 4985 4986# C++ 4987# The strength of these rules is increased so they beat the C rules above 49880 regex \^template[\ \t]+<.*>[\ \t\n]+ C++ source text 4989!:strength + 30 4990!:mime text/x-c++ 49910 regex \^virtual[\ \t\n]+ C++ source text 4992!:strength + 30 4993!:mime text/x-c++ 49940 regex \^class[\ \t\n]+ C++ source text 4995# But class is reduced to avoid beating php (Jens Schleusener) 4996!:strength + 13 4997!:mime text/x-c++ 49980 regex \^public: C++ source text 4999!:strength + 30 5000!:mime text/x-c++ 50010 regex \^private: C++ source text 5002!:strength + 30 5003!:mime text/x-c++ 5004 5005# Objective-C 50060 regex \^#import Objective-C source text 5007!:strength +25 5008!:mime text/x-objective-c 5009 5010# From: Mikhail Teterin <mi@aldan.algebra.com> 50110 string cscope cscope reference data 5012>7 string x version %.2s 5013# We skip the path here, because it is often long (so file will 5014# truncate it) and mostly redundant. 5015# The inverted index functionality was added some time between 5016# versions 11 and 15, so look for -q if version is above 14: 5017>7 string >14 5018>>10 search/100 \ -q\ with inverted index 5019>10 search/100 \ -c\ text (non-compressed) 5020 5021#------------------------------------------------------------------------------ 5022# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $ 5023# clarion: file(1) magic for # Clarion Personal/Professional Developer 5024# (v2 and above) 5025# From: Julien Blache <jb@jblache.org> 5026 5027# Database files 5028# signature 50290 leshort 0x3343 Clarion Developer (v2 and above) data file 5030# attributes 5031>2 leshort &0x0001 \b, locked 5032>2 leshort &0x0004 \b, encrypted 5033>2 leshort &0x0008 \b, memo file exists 5034>2 leshort &0x0010 \b, compressed 5035>2 leshort &0x0040 \b, read only 5036# number of records 5037>5 lelong x \b, %d records 5038 5039# Memo files 50400 leshort 0x334d Clarion Developer (v2 and above) memo data 5041 5042# Key/Index files 5043# No magic? :( 5044 5045# Help files 50460 leshort 0x49e0 Clarion Developer (v2 and above) help data 5047 5048#------------------------------------------------------------------------------ 5049# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $ 5050# claris: file(1) magic for claris 5051# "H. Nanosecond" <aldomel@ix.netcom.com> 5052# Claris Works a word processor, etc. 5053# Version 3.0 5054 5055# .pct claris works clip art files 5056#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 5057#* 5058#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 5059#null to byte 1000 octal 5060514 string \377\377\377\377\000 5061>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 5062514 string \377\377\377\377\001 5063>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 5064 5065# Claris works files 5066# .cwk 5067# Moved to Apple AppleWorks document 5068#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 5069# .plt 50700 string \020\341\000\000\010\010 Claris Works palette files .plt 5071 5072# .msp a dictionary file I am not sure about this I have only one .msp file 50730 string \002\271\262\000\040\002\000\164 Claris works dictionary 5074 5075# .usp are user dictionary bits 5076# I am not sure about a magic header: 5077#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 5078# soh S p f 8 U D sp ^ S cr nl p o d i 5079#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 5080# a t r i s t sp ^ S cr nl d i v sp # 5081 5082# .mth Thesaurus 5083# starts with \0 but no magic header 5084 5085# .chy Hyphenation file 5086# I am not sure: 000 210 034 000 000 5087 5088# other claris files 5089#./windows/claris/useng.ndx: data 5090#./windows/claris/xtndtran.l32: data 5091#./windows/claris/xtndtran.lst: data 5092#./windows/claris/clworks.lbl: data 5093#./windows/claris/clworks.prf: data 5094#./windows/claris/userd.spl: data 5095 5096#------------------------------------------------------------------------------ 5097# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $ 5098# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 5099# 5100# XXX - what byte order does the Clipper use? 5101# 5102# XXX - what's the "!" stuff: 5103# 5104# >18 short !074000,000000 C1 R1 5105# >18 short !074000,004000 C2 R1 5106# >18 short !074000,010000 C3 R1 5107# >18 short !074000,074000 TEST 5108# 5109# I shall assume it's ANDing the field with the first value and 5110# comparing it with the second, and rewrite it as: 5111# 5112# >18 short&074000 000000 C1 R1 5113# >18 short&074000 004000 C2 R1 5114# >18 short&074000 010000 C3 R1 5115# >18 short&074000 074000 TEST 5116# 5117# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 5118# sort, nor does SunOS 4.x, so either it's something Intergraph added 5119# in CLIX, or something AT&T added in SVR3.2 or later, or something 5120# somebody else thought was a good idea; it's not documented in the 5121# man page for this version of "magic", nor does it appear to be 5122# implemented (at least not after I blew off the bogus code to turn 5123# old-style "&"s into new-style "&"s, which just didn't work at all). 5124# 51250 short 0575 CLIPPER COFF executable (VAX #) 5126>20 short 0407 (impure) 5127>20 short 0410 (5.2 compatible) 5128>20 short 0411 (pure) 5129>20 short 0413 (demand paged) 5130>20 short 0443 (target shared library) 5131>12 long >0 not stripped 5132>22 short >0 - version %d 51330 short 0577 CLIPPER COFF executable 5134>18 short&074000 000000 C1 R1 5135>18 short&074000 004000 C2 R1 5136>18 short&074000 010000 C3 R1 5137>18 short&074000 074000 TEST 5138>20 short 0407 (impure) 5139>20 short 0410 (pure) 5140>20 short 0411 (separate I&D) 5141>20 short 0413 (paged) 5142>20 short 0443 (target shared library) 5143>12 long >0 not stripped 5144>22 short >0 - version %d 5145>48 long&01 01 alignment trap enabled 5146>52 byte 1 -Ctnc 5147>52 byte 2 -Ctsw 5148>52 byte 3 -Ctpw 5149>52 byte 4 -Ctcb 5150>53 byte 1 -Cdnc 5151>53 byte 2 -Cdsw 5152>53 byte 3 -Cdpw 5153>53 byte 4 -Cdcb 5154>54 byte 1 -Csnc 5155>54 byte 2 -Cssw 5156>54 byte 3 -Cspw 5157>54 byte 4 -Cscb 51584 string pipe CLIPPER instruction trace 51594 string prof CLIPPER instruction profile 5160 5161#------------------------------------------------------------------------------ 5162# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $ 5163# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures 5164# 5165# COFF 5166# 5167# by Joerg Jenderek at Oct 2015 5168# https://en.wikipedia.org/wiki/COFF 5169# https://de.wikipedia.org/wiki/Common_Object_File_Format 5170# http://www.delorie.com/djgpp/doc/coff/filhdr.html 5171 5172# display name+variables+flags of Common Object Files Format (32bit) 5173# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel, 5174# mips,motorola,msdos,osf1,sharc,varied.out,vax 51750 name display-coff 5176# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 5177>18 uleshort&0x8E80 0 5178>>0 clear x 5179# f_magic - magic number 5180# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel) 5181>>0 uleshort 0x014C Intel 80386 5182# Hitachi SH big-endian COFF (./hitachi-sh) 5183>>0 uleshort 0x0500 Hitachi SH big-endian 5184# Hitachi SH little-endian COFF (./hitachi-sh) 5185>>0 uleshort 0x0550 Hitachi SH little-endian 5186# executable (RISC System/6000 V3.1) or obj module (./ibm6000) 5187#>>0 uleshort 0x01DF 5188# TODO for other COFFs 5189#>>0 uleshort 0xABCD COFF_TEMPLATE 5190>>0 default x 5191>>>0 uleshort x type 0x%04x 5192>>0 uleshort x COFF 5193# F_EXEC flag bit 5194>>18 leshort ^0x0002 object file 5195#!:mime application/x-coff 5196#!:ext cof/o/obj/lib 5197>>18 leshort &0x0002 executable 5198#!:mime application/x-coffexec 5199# F_RELFLG flag bit,static object 5200>>18 leshort &0x0001 \b, no relocation info 5201# F_LNNO flag bit 5202>>18 leshort &0x0004 \b, no line number info 5203# F_LSYMS flag bit 5204>>18 leshort &0x0008 \b, stripped 5205>>18 leshort ^0x0008 \b, not stripped 5206# flags in other COFF versions 5207#0x0010 F_FDPR_PROF 5208#0x0020 F_FDPR_OPTI 5209#0x0040 F_DSA 5210# F_AR32WR flag bit 5211#>>>18 leshort &0x0100 \b, 32 bit little endian 5212#0x1000 F_DYNLOAD 5213#0x2000 F_SHROBJ 5214#0x4000 F_LOADONLY 5215# f_nscns - number of sections 5216>>2 uleshort <2 \b, %d section 5217>>2 uleshort >1 \b, %d sections 5218# f_timdat - file time & date stamp only for little endian 5219#>>4 date x \b, %s 5220# f_symptr - symbol table pointer, only for not stripped 5221>>8 ulelong >0 \b, symbol offset=0x%x 5222# f_nsyms - number of symbols, only for not stripped 5223>>12 ulelong >0 \b, %d symbols 5224# f_opthdr - optional header size 5225>>16 uleshort >0 \b, optional header size %d 5226# at offset 20 can be optional header, extra bytes FILHSZ-20 because 5227# do not rely on sizeof(FILHDR) to give the correct size for header. 5228# or first section header 5229# additional variables for other COFF files 5230# >20 beshort 0407 (impure) 5231# >20 beshort 0410 (pure) 5232# >20 beshort 0413 (demand paged) 5233# >20 beshort 0421 (standalone) 5234# >22 leshort >0 - version %d 5235# >168 string .lowmem Apple toolbox 5236 5237 5238#------------------------------------------------------------------------------ 5239# $File: commands,v 1.57 2017/04/04 20:34:24 christos Exp $ 5240# commands: file(1) magic for various shells and interpreters 5241# 5242#0 string/w : shell archive or script for antique kernel text 52430 string/wt #!\ /bin/sh POSIX shell script text executable 5244!:mime text/x-shellscript 52450 string/wb #!\ /bin/sh POSIX shell script executable (binary data) 5246!:mime text/x-shellscript 5247 52480 string/wt #!\ /bin/csh C shell script text executable 5249!:mime text/x-shellscript 5250 5251# korn shell magic, sent by George Wu, gwu@clyde.att.com 52520 string/wt #!\ /bin/ksh Korn shell script text executable 5253!:mime text/x-shellscript 52540 string/wb #!\ /bin/ksh Korn shell script executable (binary data) 5255!:mime text/x-shellscript 5256 52570 string/wt #!\ /bin/tcsh Tenex C shell script text executable 5258!:mime text/x-shellscript 52590 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 5260!:mime text/x-shellscript 52610 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 5262!:mime text/x-shellscript 52630 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 5264!:mime text/x-shellscript 5265 5266# 5267# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 52680 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 5269!:mime text/x-shellscript 52700 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 5271!:mime text/x-shellscript 52720 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 5273!:mime text/x-shellscript 52740 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 5275!:mime text/x-shellscript 52760 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 5277!:mime text/x-shellscript 52780 string/wt #!\ /bin/nawk new awk script text executable 5279!:mime text/x-nawk 52800 string/wt #!\ /usr/bin/nawk new awk script text executable 5281!:mime text/x-nawk 52820 string/wt #!\ /usr/local/bin/nawk new awk script text executable 5283!:mime text/x-nawk 52840 string/wt #!\ /bin/gawk GNU awk script text executable 5285!:mime text/x-gawk 52860 string/wt #!\ /usr/bin/gawk GNU awk script text executable 5287!:mime text/x-gawk 52880 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 5289!:mime text/x-gawk 5290# 52910 string/wt #!\ /bin/awk awk script text executable 5292!:mime text/x-awk 52930 string/wt #!\ /usr/bin/awk awk script text executable 5294!:mime text/x-awk 52950 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text 5296 5297# AT&T Bell Labs' Plan 9 shell 52980 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 5299 5300# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 53010 string/wt #!\ /bin/bash Bourne-Again shell script text executable 5302!:mime text/x-shellscript 53030 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data) 5304!:mime text/x-shellscript 53050 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 5306!:mime text/x-shellscript 53070 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data) 5308!:mime text/x-shellscript 53090 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 5310!:mime text/x-shellscript 53110 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data) 5312!:mime text/x-shellscript 53130 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 5314!:mime text/x-shellscript 53150 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data) 5316!:mime text/x-shellscript 53170 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable 5318!:mime text/x-shellscript 5319 5320# PHP scripts 5321# Ulf Harnhammar <ulfh@update.uu.se> 53220 search/1/c =<?php PHP script text 5323!:strength + 10 5324!:mime text/x-php 53250 search/1 =<?\n PHP script text 5326!:mime text/x-php 53270 search/1 =<?\r PHP script text 5328!:mime text/x-php 53290 search/1/w #!\ /usr/local/bin/php PHP script text executable 5330!:strength + 10 5331!:mime text/x-php 53320 search/1/w #!\ /usr/bin/php PHP script text executable 5333!:strength + 10 5334!:mime text/x-php 5335# Smarty compiled template, http://www.smarty.net/ 5336# Elan Ruusamae <glen@delfi.ee> 53370 string =<?php 5338>5 regex [\ \n] 5339>>6 string /*\ Smarty\ version Smarty compiled template 5340>>>24 regex [0-9.]+ \b, version %s 5341!:mime text/x-php 5342 53430 string Zend\x00 PHP script Zend Optimizer data 5344 53450 string/t $! DCL command file 5346 5347# Type: Pdmenu 5348# URL: http://packages.debian.org/pdmenu 5349# From: Edward Betts <edward@debian.org> 53500 string #!/usr/bin/pdmenu Pdmenu configuration file text 5351 5352# From Danny Weldon 53530 string \x0b\x13\x08\x00 5354>0x04 uleshort <4 ksh byte-code version %d 5355 5356#---------------------------------------------------------------------------- 5357# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 5358# communication 5359 5360# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 5361# It is used for conformance testing of communication protocols. 5362# Added by W. Borgert <debacle@debian.org>. 53630 string $Suite TTCN Abstract Test Suite 5364>&1 string $SuiteId 5365>>&1 string >\n %s 5366>&2 string $SuiteId 5367>>&1 string >\n %s 5368>&3 string $SuiteId 5369>>&1 string >\n %s 5370 5371# MSC (message sequence charts) are a formal description technique, 5372# described in ITU-T Z.120, mainly used for communication protocols. 5373# Added by W. Borgert <debacle@debian.org>. 53740 string mscdocument Message Sequence Chart (document) 53750 string msc Message Sequence Chart (chart) 53760 string submsc Message Sequence Chart (subchart) 5377#------------------------------------------------------------------------------ 5378# $File: compress,v 1.67 2017/03/17 21:35:28 christos Exp $ 5379# compress: file(1) magic for pure-compression formats (no archives) 5380# 5381# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 5382# 5383# Formats for various forms of compressed data 5384# Formats for "compress" proper have been moved into "compress.c", 5385# because it tries to uncompress it to figure out what's inside. 5386 5387# standard unix compress 53880 string \037\235 compress'd data 5389!:mime application/x-compress 5390!:apple LZIVZIVU 5391>2 byte&0x80 >0 block compressed 5392>2 byte&0x1f x %d bits 5393 5394# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 5395# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 5396# * Original filename is only at offset 10 if "extra field" absent 5397# * Produce shorter output - notably, only report compression methods 5398# other than 8 ("deflate", the only method defined in RFC 1952). 53990 string \037\213 gzip compressed data 5400!:mime application/x-gzip 5401!:strength * 2 5402>2 byte <8 \b, reserved method 5403>2 byte >8 \b, unknown method 5404>3 byte &0x01 \b, ASCII 5405>3 byte &0x02 \b, has CRC 5406>3 byte &0x04 \b, extra field 5407>3 byte&0xC =0x08 5408>>10 string x \b, was "%s" 5409>3 byte &0x10 \b, has comment 5410>3 byte &0x20 \b, encrypted 5411>4 ledate >0 \b, last modified: %s 5412>8 byte 2 \b, max compression 5413>8 byte 4 \b, max speed 5414>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 5415>9 byte =0x01 \b, from Amiga 5416>9 byte =0x02 \b, from VMS 5417>9 byte =0x03 \b, from Unix 5418>9 byte =0x04 \b, from VM/CMS 5419>9 byte =0x05 \b, from Atari 5420>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 5421>9 byte =0x07 \b, from MacOS 5422>9 byte =0x08 \b, from Z-System 5423>9 byte =0x09 \b, from CP/M 5424>9 byte =0x0A \b, from TOPS/20 5425>9 byte =0x0B \b, from NTFS filesystem (NT) 5426>9 byte =0x0C \b, from QDOS 5427>9 byte =0x0D \b, from Acorn RISCOS 5428 5429# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 54300 string \037\036 packed data 5431!:mime application/octet-stream 5432>2 belong >1 \b, %d characters originally 5433>2 belong =1 \b, %d character originally 5434# 5435# This magic number is byte-order-independent. 54360 short 0x1f1f old packed data 5437!:mime application/octet-stream 5438 5439# XXX - why *two* entries for "compacted data", one of which is 5440# byte-order independent, and one of which is byte-order dependent? 5441# 54420 short 0x1fff compacted data 5443!:mime application/octet-stream 5444# This string is valid for SunOS (BE) and a matching "short" is listed 5445# in the Ultrix (LE) magic file. 54460 string \377\037 compacted data 5447!:mime application/octet-stream 54480 short 0145405 huf output 5449!:mime application/octet-stream 5450 5451# bzip2 54520 string BZh bzip2 compressed data 5453!:mime application/x-bzip2 5454>3 byte >47 \b, block size = %c00k 5455 5456# lzip 54570 string LZIP lzip compressed data 5458!:mime application/x-lzip 5459>4 byte x \b, version: %d 5460 5461# squeeze and crunch 5462# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 54630 beshort 0x76FF squeezed data, 5464>4 string x original name %s 54650 beshort 0x76FE crunched data, 5466>2 string x original name %s 54670 beshort 0x76FD LZH compressed data, 5468>2 string x original name %s 5469 5470# Freeze 54710 string \037\237 frozen file 2.1 54720 string \037\236 frozen file 1.0 (or gzip 0.5) 5473 5474# SCO compress -H (LZH) 54750 string \037\240 SCO compress -H (LZH) data 5476 5477# European GSM 06.10 is a provisional standard for full-rate speech 5478# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 5479# excitation/long term prediction) coding at 13 kbit/s. 5480# 5481# There's only a magic nibble (4 bits); that nibble repeats every 33 5482# bytes. This isn't suited for use, but maybe we can use it someday. 5483# 5484# This will cause very short GSM files to be declared as data and 5485# mismatches to be declared as data too! 5486#0 byte&0xF0 0xd0 data 5487#>33 byte&0xF0 0xd0 5488#>66 byte&0xF0 0xd0 5489#>99 byte&0xF0 0xd0 5490#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 5491 5492# bzip a block-sorting file compressor 5493# by Julian Seward <sewardj@cs.man.ac.uk> and others 5494# 5495#0 string BZ bzip compressed data 5496#>2 byte x \b, version: %c 5497#>3 string =1 \b, compression block size 100k 5498#>3 string =2 \b, compression block size 200k 5499#>3 string =3 \b, compression block size 300k 5500#>3 string =4 \b, compression block size 400k 5501#>3 string =5 \b, compression block size 500k 5502#>3 string =6 \b, compression block size 600k 5503#>3 string =7 \b, compression block size 700k 5504#>3 string =8 \b, compression block size 800k 5505#>3 string =9 \b, compression block size 900k 5506 5507# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 55080 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 5509>9 beshort <0x0940 5510>>9 byte&0xf0 =0x00 - version 0. 5511>>9 beshort&0x0fff x \b%03x, 5512>>13 byte 1 LZO1X-1, 5513>>13 byte 2 LZO1X-1(15), 5514>>13 byte 3 LZO1X-999, 5515## >>22 bedate >0 last modified: %s, 5516>>14 byte =0x00 os: MS-DOS 5517>>14 byte =0x01 os: Amiga 5518>>14 byte =0x02 os: VMS 5519>>14 byte =0x03 os: Unix 5520>>14 byte =0x05 os: Atari 5521>>14 byte =0x06 os: OS/2 5522>>14 byte =0x07 os: MacOS 5523>>14 byte =0x0A os: Tops/20 5524>>14 byte =0x0B os: WinNT 5525>>14 byte =0x0E os: Win32 5526>9 beshort >0x0939 5527>>9 byte&0xf0 =0x00 - version 0. 5528>>9 byte&0xf0 =0x10 - version 1. 5529>>9 byte&0xf0 =0x20 - version 2. 5530>>9 beshort&0x0fff x \b%03x, 5531>>15 byte 1 LZO1X-1, 5532>>15 byte 2 LZO1X-1(15), 5533>>15 byte 3 LZO1X-999, 5534## >>25 bedate >0 last modified: %s, 5535>>17 byte =0x00 os: MS-DOS 5536>>17 byte =0x01 os: Amiga 5537>>17 byte =0x02 os: VMS 5538>>17 byte =0x03 os: Unix 5539>>17 byte =0x05 os: Atari 5540>>17 byte =0x06 os: OS/2 5541>>17 byte =0x07 os: MacOS 5542>>17 byte =0x0A os: Tops/20 5543>>17 byte =0x0B os: WinNT 5544>>17 byte =0x0E os: Win32 5545 5546# 4.3BSD-Quasijarus Strong Compression 5547# http://minnie.tuhs.org/Quasijarus/compress.html 55480 string \037\241 Quasijarus strong compressed data 5549 5550# From: Cory Dikkers <cdikkers@swbell.net> 55510 string XPKF Amiga xpkf.library compressed data 55520 string PP11 Power Packer 1.1 compressed data 55530 string PP20 Power Packer 2.0 compressed data, 5554>4 belong 0x09090909 fast compression 5555>4 belong 0x090A0A0A mediocre compression 5556>4 belong 0x090A0B0B good compression 5557>4 belong 0x090A0C0C very good compression 5558>4 belong 0x090A0C0D best compression 5559 5560# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 5561# http://www.7-zip.org or DOC/7zFormat.txt 5562# 55630 string 7z\274\257\047\034 7-zip archive data, 5564>6 byte x version %d 5565>7 byte x \b.%d 5566!:mime application/x-7z-compressed 5567!:ext 7z/cb7 5568 5569# Type: LZMA 55700 lelong&0xffffff =0x5d 5571>12 leshort 0xff LZMA compressed data, 5572!:mime application/x-lzma 5573>>5 lequad =0xffffffffffffffff streamed 5574>>5 lequad !0xffffffffffffffff non-streamed, size %lld 5575>12 leshort 0 LZMA compressed data, 5576>>5 lequad =0xffffffffffffffff streamed 5577>>5 lequad !0xffffffffffffffff non-streamed, size %lld 5578 5579# http://tukaani.org/xz/xz-file-format.txt 55800 ustring \xFD7zXZ\x00 XZ compressed data 5581!:strength * 2 5582!:mime application/x-xz 5583 5584# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 55850 string LRZI LRZIP compressed data 5586>4 byte x - version %d 5587>5 byte x \b.%d 5588!:mime application/x-lrzip 5589 5590# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 55910 lelong 0x184d2204 LZ4 compressed data (v1.4+) 5592!:mime application/x-lz4 5593# Added by osm0sis@xda-developers.com 55940 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3) 5595!:mime application/x-lz4 55960 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9) 5597!:mime application/x-lz4 5598 5599# Zstandard/LZ4 skippable frames 5600# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 56010 lelong&0xFFFFFFF0 0x184D2A50 5602>(4.l+8) indirect 5603 5604# Zstandard Dictionary ID subroutine 56050 name zstd-dictionary-id 5606# Single Segment = True 5607>0 byte &0x20 \b, Dictionary ID: 5608>>0 byte&0x03 0 None 5609>>0 byte&0x03 1 5610>>>1 byte x %u 5611>>0 byte&0x03 2 5612>>>1 leshort x %u 5613>>0 byte&0x03 3 5614>>>1 lelong x %u 5615# Single Segment = False 5616>0 byte ^0x20 \b, Dictionary ID: 5617>>0 byte&0x03 0 None 5618>>0 byte&0x03 1 5619>>>2 byte x %u 5620>>0 byte&0x03 2 5621>>>2 leshort x %u 5622>>0 byte&0x03 3 5623>>>2 lelong x %u 5624 5625# Zstandard compressed data 5626# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 56270 lelong 0xFD2FB522 Zstandard compressed data (v0.2) 5628!:mime application/x-zstd 56290 lelong 0xFD2FB523 Zstandard compressed data (v0.3) 5630!:mime application/x-zstd 56310 lelong 0xFD2FB524 Zstandard compressed data (v0.4) 5632!:mime application/x-zstd 56330 lelong 0xFD2FB525 Zstandard compressed data (v0.5) 5634!:mime application/x-zstd 56350 lelong 0xFD2FB526 Zstandard compressed data (v0.6) 5636!:mime application/x-zstd 56370 lelong 0xFD2FB527 Zstandard compressed data (v0.7) 5638!:mime application/x-zstd 5639>4 use zstd-dictionary-id 56400 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) 5641!:mime application/x-zstd 5642>4 use zstd-dictionary-id 5643 5644# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 56450 lelong 0xEC30A437 Zstandard dictionary 5646!:mime application/x-zstd-dictionary 5647>4 lelong x (ID %u) 5648 5649# AFX compressed files (Wolfram Kleff) 56502 string -afx- AFX compressed file data 5651 5652# Supplementary magic data for the file(1) command to support 5653# rzip(1). The format is described in magic(5). 5654# 5655# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 5656# this file. 5657# 56580 string RZIP rzip compressed data 5659>4 byte x - version %d 5660>5 byte x \b.%d 5661>6 belong x (%d bytes) 5662 56630 string ArC\x01 FreeArc archive <http://freearc.org> 5664 5665# Type: DACT compressed files 56660 long 0x444354C3 DACT compressed data 5667>4 byte >-1 (version %i. 5668>5 byte >-1 %i. 5669>6 byte >-1 %i) 5670>7 long >0 , original size: %i bytes 5671>15 long >30 , block size: %i bytes 5672 5673# Valve Pack (VPK) files 56740 lelong 0x55aa1234 Valve Pak file 5675>0x4 lelong x \b, version %u 5676>0x8 lelong x \b, %u entries 5677 5678# Snappy framing format 5679# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 56800 string \377\006\0\0sNaPpY snappy framed data 5681!:mime application/x-snappy-framed 5682 5683# qpress, http://www.quicklz.com/ 56840 string qpress10 qpress compressed data 5685!:mime application/x-qpress 5686 5687# Zlib https://www.ietf.org/rfc/rfc6713.txt 56880 string/b x 5689>0 beshort%31 =0 5690>>0 byte&0xf =8 5691>>>0 byte&0x80 =0 zlib compressed data 5692!:mime application/zlib 5693 5694#------------------------------------------------------------------------------ 5695# $File: console,v 1.30 2017/03/17 21:35:28 christos Exp $ 5696# Console game magic 5697# Toby Deshane <hac@shoelace.digivill.net> 5698 5699# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format 5700# Updated by David Korth <gerbilsoft@gerbilsoft.com> 5701# References: 5702# - http://wiki.nesdev.com/w/index.php/INES 5703# - http://wiki.nesdev.com/w/index.php/NES_2.0 5704 5705# Common header for iNES, NES 2.0, and Wii U iNES. 57060 name nes-rom-image-ines 5707>7 byte&0x0C =0x8 (NES 2.0) 5708>4 byte x \b: %ux16k PRG 5709>5 byte x \b, %ux8k CHR 5710>6 byte&0x08 =0x8 [4-Scr] 5711>6 byte&0x09 =0x0 [H-mirror] 5712>6 byte&0x09 =0x1 [V-mirror] 5713>6 byte&0x02 =0x2 [SRAM] 5714>6 byte&0x04 =0x4 [Trainer] 5715>7 byte&0x03 =0x2 [PC10] 5716>7 byte&0x03 =0x1 [VS] 5717>>7 byte&0x0C =0x8 5718# NES 2.0: VS PPU 5719>>>13 byte&0x0F =0x0 \b, RP2C03B 5720>>>13 byte&0x0F =0x1 \b, RP2C03G 5721>>>13 byte&0x0F =0x2 \b, RP2C04-0001 5722>>>13 byte&0x0F =0x3 \b, RP2C04-0002 5723>>>13 byte&0x0F =0x4 \b, RP2C04-0003 5724>>>13 byte&0x0F =0x5 \b, RP2C04-0004 5725>>>13 byte&0x0F =0x6 \b, RP2C03B 5726>>>13 byte&0x0F =0x7 \b, RP2C03C 5727>>>13 byte&0x0F =0x8 \b, RP2C05-01 5728>>>13 byte&0x0F =0x9 \b, RP2C05-02 5729>>>13 byte&0x0F =0xA \b, RP2C05-03 5730>>>13 byte&0x0F =0xB \b, RP2C05-04 5731>>>13 byte&0x0F =0xC \b, RP2C05-05 5732# TODO: VS protection hardware? 5733>>7 byte x \b] 5734# NES 2.0-specific flags. 5735>7 byte&0x0C =0x8 5736>>12 byte&0x03 =0x0 [NTSC] 5737>>12 byte&0x03 =0x1 [PAL] 5738>>12 byte&0x02 =0x2 [NTSC+PAL] 5739 5740# Standard iNES ROM header. 57410 string NES\x1A NES ROM image (iNES) 5742>0 use nes-rom-image-ines 5743 5744# Wii U Virtual Console iNES ROM header. 57450 belong 0x4E455300 NES ROM image (Wii U Virtual Console) 5746>0 use nes-rom-image-ines 5747 5748#------------------------------------------------------------------------------ 5749# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images 5750# Reference: http://wiki.nesdev.com/w/index.php/UNIF 5751# From: David Korth <gerbilsoft@gerbilsoft.com> 5752# 5753# NOTE: The UNIF format uses chunks instead of a fixed header, 5754# so most of the data isn't easily parseable. 5755# 57560 string UNIF 5757>4 lelong <16 NES ROM image (UNIF v%d format) 5758 5759#------------------------------------------------------------------------------ 5760# fds: file(1) magic for Famciom Disk System disk images 5761# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format 5762# From: David Korth <gerbilsoft@gerbilsoft.com> 5763# TODO: Check "Disk info block" and get info from that in addition to the optional header. 5764 5765# Disk info block. (block 1) 57660 name nintendo-fds-disk-info-block 5767>23 byte !1 FMC- 5768>23 byte 1 FSC- 5769>16 string x \b%.3s 5770>15 byte x \b, mfr %02X 5771>20 byte x (Rev.%02u) 5772 5773# Headered version. 57740 string FDS\x1A 5775>0x11 string *NINTENDO-HVC* Famicom Disk System disk image: 5776>>0x10 use nintendo-fds-disk-info-block 5777>4 byte 1 (%u side) 5778>4 byte !1 (%u sides) 5779 5780# Unheadered version. 57811 string *NINTENDO-HVC* Famicom Disk System disk image: 5782>0 use nintendo-fds-disk-info-block 5783 5784#------------------------------------------------------------------------------ 5785# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images 5786# Used by Nintendo 3DS NES Virtual Console games. 5787# From: David Korth <gerbilsoft@gerbilsoft.com> 5788# 57890 string TNES NES ROM image (Nintendo 3DS Virtual Console) 5790>4 byte 100 \b: FDS, 5791>>0x2010 use nintendo-fds-disk-info-block 5792>4 byte !100 \b: TNES mapper %u 5793>>5 byte x \b, %ux8k PRG 5794>>6 byte x \b, %ux8k CHR 5795>>7 byte&0x08 =1 [WRAM] 5796>>8 byte&0x09 =1 [H-mirror] 5797>>8 byte&0x09 =2 [V-mirror] 5798>>8 byte&0x02 =3 [VRAM] 5799 5800#------------------------------------------------------------------------------ 5801# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 5802# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header 5803# 58040x104 bequad 0xCEED6666CC0D000B Game Boy ROM image 5805>0x143 byte&0x80 0x80 5806>>0x134 string >\0 \b: "%.15s" 5807>0x143 byte&0x80 !0x80 5808>>0x134 string >\0 \b: "%.16s" 5809>0x14c byte x (Rev.%02u) 5810 5811# Machine type. (SGB, CGB, SGB+CGB) 5812>0x14b byte 0x33 5813>>0x146 byte 0x03 5814>>>0x143 byte&0x80 0x80 [SGB+CGB] 5815>>>0x143 byte&0x80 !0x80 [SGB] 5816>>0x146 byte !0x03 5817>>>0x143 byte&0xC0 0x80 [CGB] 5818>>>0x143 byte&0xC0 0xC0 [CGB ONLY] 5819 5820# Mapper. 5821>0x147 byte 0x00 [ROM ONLY] 5822>0x147 byte 0x01 [MBC1] 5823>0x147 byte 0x02 [MBC1+RAM] 5824>0x147 byte 0x03 [MBC1+RAM+BATT] 5825>0x147 byte 0x05 [MBC2] 5826>0x147 byte 0x06 [MBC2+BATTERY] 5827>0x147 byte 0x08 [ROM+RAM] 5828>0x147 byte 0x09 [ROM+RAM+BATTERY] 5829>0x147 byte 0x0B [MMM01] 5830>0x147 byte 0x0C [MMM01+SRAM] 5831>0x147 byte 0x0D [MMM01+SRAM+BATT] 5832>0x147 byte 0x0F [MBC3+TIMER+BATT] 5833>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT] 5834>0x147 byte 0x11 [MBC3] 5835>0x147 byte 0x12 [MBC3+RAM] 5836>0x147 byte 0x13 [MBC3+RAM+BATT] 5837>0x147 byte 0x19 [MBC5] 5838>0x147 byte 0x1A [MBC5+RAM] 5839>0x147 byte 0x1B [MBC5+RAM+BATT] 5840>0x147 byte 0x1C [MBC5+RUMBLE] 5841>0x147 byte 0x1D [MBC5+RUMBLE+SRAM] 5842>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT] 5843>0x147 byte 0xFC [Pocket Camera] 5844>0x147 byte 0xFD [Bandai TAMA5] 5845>0x147 byte 0xFE [Hudson HuC-3] 5846>0x147 byte 0xFF [Hudson HuC-1] 5847 5848# ROM size. 5849>0x148 byte 0 \b, ROM: 256Kbit 5850>0x148 byte 1 \b, ROM: 512Kbit 5851>0x148 byte 2 \b, ROM: 1Mbit 5852>0x148 byte 3 \b, ROM: 2Mbit 5853>0x148 byte 4 \b, ROM: 4Mbit 5854>0x148 byte 5 \b, ROM: 8Mbit 5855>0x148 byte 6 \b, ROM: 16Mbit 5856>0x148 byte 7 \b, ROM: 32Mbit 5857>0x148 byte 0x52 \b, ROM: 9Mbit 5858>0x148 byte 0x53 \b, ROM: 10Mbit 5859>0x148 byte 0x54 \b, ROM: 12Mbit 5860 5861# RAM size. 5862>0x149 byte 1 \b, RAM: 16Kbit 5863>0x149 byte 2 \b, RAM: 64Kbit 5864>0x149 byte 3 \b, RAM: 128Kbit 5865>0x149 byte 4 \b, RAM: 1Mbit 5866>0x149 byte 5 \b, RAM: 512Kbit 5867 5868#------------------------------------------------------------------------------ 5869# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats 5870# Updated by David Korth <gerbilsoft@gerbilsoft.com> 5871# References: 5872# - http://www.retrodev.com/segacd.html 5873# - http://devster.monkeeh.com/sega/32xguide1.txt 5874# 5875 5876# Common Sega Mega Drive header format. 5877# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s. 58780 name sega-mega-drive-header 5879# ROM title. (Use domestic if present; if not, use international.) 5880>0x120 byte >0x20 5881>>0x120 string >\0 \b: "%.16s" 5882>0x120 byte <0x21 5883>>0x150 string >\0 \b: "%.16s" 5884# Other information. 5885>0x180 string >\0 (%.14s 5886>>0x110 string >\0 \b, %.16s 5887>0x180 byte 0 5888>>0x110 string >\0 (%.16s 5889>0 byte x \b) 5890 5891# TODO: Check for 32X CD? 5892# Sega Mega CD disc images: 2048-byte sectors. 58930 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 5894>0 use sega-mega-drive-header 5895>0 byte x \b, 2048-byte sectors 58960 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 5897>0 use sega-mega-drive-header 5898>0 byte x \b, 2048-byte sectors 5899# Sega Mega CD disc images: 2352-byte sectors. 59000x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 5901>0x10 use sega-mega-drive-header 5902>0 byte x \b, 2352-byte sectors 59030x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 5904>0x10 use sega-mega-drive-header 5905>0 byte x \b, 2352-byte sectors 5906 5907# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images. 59080x100 string SEGA 5909>0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image 5910>>0 use sega-mega-drive-header 5911>0x3C0 bequad !0x4D41525320434845 5912>>0x105 belong 0x5049434F Sega Pico ROM image 5913>>>0 use sega-mega-drive-header 5914>>0x105 belong !0x5049434F 5915>>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image 5916>>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image 5917>>>0 use sega-mega-drive-header 5918 5919#------------------------------------------------------------------------------ 5920# genesis: file(1) magic for the Super MegaDrive ROM dump format 5921# 5922 5923# NOTE: Due to interleaving, we can't display anything 5924# other than the copier header information. 59250 name sega-genesis-smd-header 5926>0 byte x %dx16k blocks 5927>2 byte 0 \b, last in series or standalone 5928>2 byte >0 \b, split ROM 5929 5930# "Sega Genesis" header. 59310x280 string EAGN 5932>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 5933>>0 use sega-genesis-smd-header 5934 5935# "Sega Mega Drive" header. 59360x280 string EAMG 5937>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 5938>>0 use sega-genesis-smd-header 5939 5940#------------------------------------------------------------------------------ 5941# smsgg: file(1) magic for Sega Master System and Game Gear ROM images 5942# Detects all Game Gear and export Sega Master System ROM images, 5943# and some Japanese Sega Master System ROM images. 5944# From: David Korth <gerbilsoft@gerbilsoft.com> 5945# Reference: http://www.smspower.org/Development/ROMHeader 5946# 5947 5948# General SMS header rule. 5949# The SMS boot ROM checks the header at three locations. 59500 name sega-master-system-rom-header 5951# Machine type. 5952>0x0F byte&0xF0 0x30 Sega Master System 5953>0x0F byte&0xF0 0x40 Sega Master System 5954>0x0F byte&0xF0 0x50 Sega Game Gear 5955>0x0F byte&0xF0 0x60 Sega Game Gear 5956>0x0F byte&0xF0 0x70 Sega Game Gear 5957>0x0F byte&0xF0 <0x30 Sega Master System / Game Gear 5958>0x0F byte&0xF0 >0x70 Sega Master System / Game Gear 5959>0 byte x ROM image: 5960# Product code. 5961>0x0E byte&0xF0 0x10 1 5962>0x0E byte&0xF0 0x20 2 5963>0x0E byte&0xF0 0x30 3 5964>0x0E byte&0xF0 0x40 4 5965>0x0E byte&0xF0 0x50 5 5966>0x0E byte&0xF0 0x60 6 5967>0x0E byte&0xF0 0x70 7 5968>0x0E byte&0xF0 0x80 8 5969>0x0E byte&0xF0 0x90 9 5970>0x0E byte&0xF0 0xA0 10 5971>0x0E byte&0xF0 0xB0 11 5972>0x0E byte&0xF0 0xC0 12 5973>0x0E byte&0xF0 0xD0 13 5974>0x0E byte&0xF0 0xE0 14 5975>0x0E byte&0xF0 0xF0 15 5976# If the product code is 5 digits, we'll need to backspace here. 5977>0x0E byte&0xF0 !0 5978>>0x0C leshort x \b%04x 5979>0x0E byte&0xF0 0 5980>>0x0C leshort x %04x 5981# Revision. 5982>0x0E byte&0x0F x (Rev.%02d) 5983# ROM size. (Used for the boot ROM checksum routine.) 5984>0x0F byte&0x0F 0x0A (8 KB) 5985>0x0F byte&0x0F 0x0B (16 KB) 5986>0x0F byte&0x0F 0x0C (32 KB) 5987>0x0F byte&0x0F 0x0D (48 KB) 5988>0x0F byte&0x0F 0x0E (64 KB) 5989>0x0F byte&0x0F 0x0F (128 KB) 5990>0x0F byte&0x0F 0x00 (256 KB) 5991>0x0F byte&0x0F 0x01 (512 KB) 5992>0x0F byte&0x0F 0x02 (1 MB) 5993 5994# SMS/GG header locations. 59950x7FF0 string TMR\ SEGA 5996>0x7FF0 use sega-master-system-rom-header 59970x3FF0 string TMR\ SEGA 5998>0x3FF0 use sega-master-system-rom-header 59990x1FF0 string TMR\ SEGA 6000>0x1FF0 use sega-master-system-rom-header 6001 6002#------------------------------------------------------------------------------ 6003# saturn: file(1) magic for the Sega Saturn disc image format. 6004# From: David Korth <gerbilsoft@gerbilsoft.com> 6005# 6006 6007# Common Sega Saturn disc header format. 6008# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding. 6009# TODO: Release date, device information, region code, others? 60100 name sega-saturn-disc-header 6011>0x60 string >\0 \b: "%.32s" 6012>0x20 string >\0 (%.10s 6013>>0x2A string >\0 \b, %.6s) 6014>>0x2A byte 0 \b) 6015 6016# 2048-byte sector version. 60170 string SEGA\ SEGASATURN\ Sega Saturn disc image 6018>0 use sega-saturn-disc-header 6019>0 byte x (2048-byte sectors) 6020# 2352-byte sector version. 60210x10 string SEGA\ SEGASATURN\ Sega Saturn disc image 6022>0x10 use sega-saturn-disc-header 6023>0 byte x (2352-byte sectors) 6024 6025#------------------------------------------------------------------------------ 6026# dreamcast: file(1) magic for the Sega Dreamcast disc image format. 6027# From: David Korth <gerbilsoft@gerbilsoft.com> 6028# Reference: http://mc.pp.se/dc/ip0000.bin.html 6029# 6030 6031# Common Sega Dreamcast disc header format. 6032# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding. 6033# TODO: Release date, device information, region code, others? 60340 name sega-dreamcast-disc-header 6035>0x80 string >\0 \b: "%.32s" 6036>0x40 string >\0 (%.10s 6037>>0x4A string >\0 \b, %.6s) 6038>>0x4A byte 0 \b) 6039 6040# 2048-byte sector version. 60410 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 6042>0 use sega-dreamcast-disc-header 6043>0 byte x (2048-byte sectors) 6044# 2352-byte sector version. 60450x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 6046>0x10 use sega-dreamcast-disc-header 6047>0 byte x (2352-byte sectors) 6048 6049#------------------------------------------------------------------------------ 6050# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 6051# 60520 belong 0x21068028 Sega Dreamcast VMU game image 60530 string LCDi Dream Animator file 6054 6055#------------------------------------------------------------------------------ 6056# z64: file(1) magic for the Z64 format N64 ROM dumps 6057# Reference: http://forum.pj64-emu.com/showthread.php?t=2239 6058# From: David Korth <gerbilsoft@gerbilsoft.com> 6059# 60600 bequad 0x803712400000000F Nintendo 64 ROM image 6061>0x20 string >\0 \b: "%.20s" 6062>0x3B string x (%.4s 6063>0x3F byte x \b, Rev.%02u) 6064 6065#------------------------------------------------------------------------------ 6066# v64: file(1) magic for the V64 format N64 ROM dumps 6067# Same as z64 format, but with 16-bit byteswapping. 6068# 60690 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64) 6070 6071#------------------------------------------------------------------------------ 6072# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps 6073# Same as z64 format, but with swapped 16-bit words. 6074# 60750 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped) 6076 6077#------------------------------------------------------------------------------ 6078# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps 6079# Same as z64 format, but with 32-bit byteswapping. 6080# 60810 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped) 6082 6083#------------------------------------------------------------------------------ 6084# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format 6085# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader 6086# 6087# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 6088# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 6089# 60904 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image 6091>0xA0 string >\0 \b: "%.12s" 6092>0xAC string x (%.6s 6093>0xBC byte x \b, Rev.%02u) 6094 6095#------------------------------------------------------------------------------ 6096# nds: file(1) magic for the Nintendo DS(i) raw ROM format 6097# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader 6098# 6099# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 6100# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 6101# 61020xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image 6103>0x00 string >\0 \b: "%.12s" 6104>0x0C string x (%.6s 6105>0x1E byte x \b, Rev.%02u) 6106>0x12 byte 2 (DSi enhanced) 6107>0x12 byte 3 (DSi only) 6108 6109#------------------------------------------------------------------------------ 6110# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot. 6111# This is also used for loading .nds files using the MSET exploit on 3DS. 6112# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp 61130xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe) 6114 6115#------------------------------------------------------------------------------ 6116# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format. 6117# From: David Korth <gerbilsoft@gerbilsoft.com> 6118# References: 6119# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp 6120# - http://www.devrs.com/ngp/files/ngpctech.txt 6121# 61220x0A string BY\ SNK\ CORPORATION Neo Geo Pocket 6123>0x23 byte 0x10 Color 6124>0 byte x ROM image 6125>0x24 string >\0 \b: "%.12s" 6126>0x1F byte 0xFF (debug mode enabled) 6127 6128#------------------------------------------------------------------------------ 6129# msx: file(1) magic for MSX game cartridge dumps 6130# Too simple - MPi 6131#0 beshort 0x4142 MSX game cartridge dump 6132 6133#------------------------------------------------------------------------------ 6134# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 61350 string PS-X\ EXE Sony Playstation executable 6136>16 lelong x PC=0x%08x, 6137>20 lelong !0 GP=0x%08x, 6138>24 lelong !0 .text=[0x%08x, 6139>>28 lelong x \b0x%x], 6140>32 lelong !0 .data=[0x%08x, 6141>>36 lelong x \b0x%x], 6142>40 lelong !0 .bss=[0x%08x, 6143>>44 lelong x \b0x%x], 6144>48 lelong !0 Stack=0x%08x, 6145>48 lelong =0 No Stack!, 6146>52 lelong !0 StackSize=0x%x, 6147#>76 string >\0 (%s) 6148# Area: 6149>113 string x (%s) 6150 6151# CPE executables 61520 string CPE CPE executable 6153>3 byte x (version %d) 6154 6155#------------------------------------------------------------------------------ 6156# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 61570 string XBEH XBE, Microsoft Xbox executable 6158# probabilistic checks whether signed or not 6159>0x0004 ulelong =0x0 6160>>&2 ulelong =0x0 6161>>>&2 ulelong =0x0 \b, not signed 6162>0x0004 ulelong >0 6163>>&2 ulelong >0 6164>>>&2 ulelong >0 \b, signed 6165# expect base address of 0x10000 6166>0x0104 ulelong =0x10000 6167>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 6168>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007 6169>>>(0x0118-0x0FF60) ulelong >0 (regions: 6170>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA 6171>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan 6172>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World 6173>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer 6174>>>(0x0118-0x0FF60) ulelong >0 \b) 6175 6176# -------------------------------- 6177# Microsoft Xbox data file formats 61780 string XIP0 XIP, Microsoft Xbox data 61790 string XTF0 XTF, Microsoft Xbox data 6180 6181# Atari Lynx cartridge dump (EXE/BLL header) 6182# From: "Stefan A. Haubenthal" <polluks@web.de> 6183 6184# Double-check that the image type matches too, 0x8008 conflicts with 6185# 8 character OMF-86 object file headers. 61860 beshort 0x8008 6187>6 string BS93 Lynx homebrew cartridge 6188>>2 beshort x \b, RAM start $%04x 6189>6 string LYNX Lynx cartridge 6190>>2 beshort x \b, RAM start $%04x 6191 6192# Opera file system that is used on the 3DO console 6193# From: Serge van den Boom <svdb@stack.nl> 61940 string \x01ZZZZZ\x01 3DO "Opera" file system 6195 6196# From: Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 6197# From: David Pflug <david@pflug.email> 6198# is the offset 12 or the offset 16 correct? 6199# GBS (Game Boy Sound) magic 6200# ftp://ftp.modland.com/pub/documents/format_documentation/\ 6201# Gameboy%20Sound%20System%20(.gbs).txt 62020 string GBS Nintendo Gameboy Music/Audio Data 6203#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 6204>16 string >\0 ("%s" by 6205>48 string >\0 %s, copyright 6206>80 string >\0 %s), 6207>3 byte x version %d, 6208>4 byte x %d tracks 6209 6210# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at> 6211# see http://zerosoft.zophar.net/ips.php 62120 string PATCH IPS patch file 6213 6214# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 62150 string PPF30 Playstation Patch File version 3.0 6216>5 byte 0 \b, PPF 1.0 patch 6217>5 byte 1 \b, PPF 2.0 patch 6218>5 byte 2 \b, PPF 3.0 patch 6219>>56 byte 0 \b, Imagetype BIN (any) 6220>>56 byte 1 \b, Imagetype GI (PrimoDVD) 6221>>57 byte 0 \b, Blockcheck disabled 6222>>57 byte 1 \b, Blockcheck enabled 6223>>58 byte 0 \b, Undo data not available 6224>>58 byte 1 \b, Undo data available 6225>6 string x \b, description: %s 6226 62270 string PPF20 Playstation Patch File version 2.0 6228>5 byte 0 \b, PPF 1.0 patch 6229>5 byte 1 \b, PPF 2.0 patch 6230>>56 lelong >0 \b, size of file to patch %d 6231>6 string x \b, description: %s 6232 62330 string PPF10 Playstation Patch File version 1.0 6234>5 byte 0 \b, Simple Encoding 6235>6 string x \b, description: %s 6236 6237# From: Daniel Dawson <ddawson@icehouse.net> 6238# SNES9x .smv "movie" file format. 62390 string SMV\x1A SNES9x input recording 6240>0x4 lelong x \b, version %d 6241# version 4 is latest so far 6242>0x4 lelong <5 6243>>0x8 ledate x \b, recorded at %s 6244>>0xc lelong >0 \b, rerecorded %d times 6245>>0x10 lelong x \b, %d frames long 6246>>0x14 byte >0 \b, data for controller(s): 6247>>>0x14 byte &0x1 #1 6248>>>0x14 byte &0x2 #2 6249>>>0x14 byte &0x4 #3 6250>>>0x14 byte &0x8 #4 6251>>>0x14 byte &0x10 #5 6252>>0x15 byte ^0x1 \b, begins from snapshot 6253>>0x15 byte &0x1 \b, begins from reset 6254>>0x15 byte ^0x2 \b, NTSC standard 6255>>0x15 byte &0x2 \b, PAL standard 6256>>0x17 byte &0x1 \b, settings: 6257# WIP1Timing not used as of version 4 6258>>>0x4 lelong <4 6259>>>>0x17 byte &0x2 WIP1Timing 6260>>>0x17 byte &0x4 Left+Right 6261>>>0x17 byte &0x8 VolumeEnvX 6262>>>0x17 byte &0x10 FakeMute 6263>>>0x17 byte &0x20 SyncSound 6264# New flag as of version 4 6265>>>0x4 lelong >3 6266>>>>0x17 byte &0x80 NoCPUShutdown 6267>>0x4 lelong <4 6268>>>0x18 lelong >0x23 6269>>>>0x20 leshort !0 6270>>>>>0x20 lestring16 x \b, metadata: "%s" 6271>>0x4 lelong >3 6272>>>0x24 byte >0 \b, port 1: 6273>>>>0x24 byte 1 joypad 6274>>>>0x24 byte 2 mouse 6275>>>>0x24 byte 3 SuperScope 6276>>>>0x24 byte 4 Justifier 6277>>>>0x24 byte 5 multitap 6278>>>0x24 byte >0 \b, port 2: 6279>>>>0x25 byte 1 joypad 6280>>>>0x25 byte 2 mouse 6281>>>>0x25 byte 3 SuperScope 6282>>>>0x25 byte 4 Justifier 6283>>>>0x25 byte 5 multitap 6284>>>0x18 lelong >0x43 6285>>>>0x40 leshort !0 6286>>>>>0x40 lestring16 x \b, metadata: "%s" 6287>>0x17 byte &0x40 \b, ROM: 6288>>>(0x18.l-26) lelong x CRC32 0x%08x 6289>>>(0x18.l-23) string x "%s" 6290 6291# Type: scummVM savegame files 6292# From: Sven Hartge <debian@ds9.argh.org> 62930 string SCVM ScummVM savegame 6294>12 string >\0 "%s" 6295 6296#------------------------------------------------------------------------------ 6297# Nintendo GameCube / Wii file formats. 6298# 6299 6300# Type: Nintendo GameCube/Wii common disc header data. 6301# From: David Korth <gerbilsoft@gerbilsoft.com> 6302# Reference: http://wiibrew.org/wiki/Wii_Disc 63030 name nintendo-gcn-disc-common 6304>0x20 string x "%.64s" 6305>0x00 string x (%.6s 6306>0x06 byte >0 6307>>0x06 byte 1 \b, Disc 2 6308>>0x06 byte 2 \b, Disc 3 6309>>0x06 byte 3 \b, Disc 4 6310>0x07 byte x \b, Rev.%02u) 6311 6312# Type: Nintendo GameCube disc image 6313# From: David Korth <gerbilsoft@gerbilsoft.com> 6314# Reference: http://wiibrew.org/wiki/Wii_Disc 63150x1C belong 0xC2339F3D Nintendo GameCube disc image: 6316>0 use nintendo-gcn-disc-common 6317 6318# Type: Nintendo GameCube embedded disc image 6319# Commonly found on demo discs. 6320# From: David Korth <gerbilsoft@gerbilsoft.com> 6321# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8 63220 belong 0xAE0F38A2 6323>0x0C belong 0x00100000 6324>>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image: 6325>>>(8.L) use nintendo-gcn-disc-common 6326 6327# Type: Nintendo Wii disc image 6328# From: David Korth <gerbilsoft@gerbilsoft.com> 6329# Reference: http://wiibrew.org/wiki/Wii_Disc 63300x18 belong 0x5D1C9EA3 Nintendo Wii disc image: 6331>0 use nintendo-gcn-disc-common 6332 6333# Type: Nintendo Wii disc image (WBFS format) 6334# From: David Korth <gerbilsoft@gerbilsoft.com> 6335# Reference: http://wiibrew.org/wiki/Wii_Disc 63360 string WBFS 6337>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): 6338>>0x200 use nintendo-gcn-disc-common 6339 6340# Type: Nintendo GameCube/Wii disc image (CISO format) 6341# NOTE: This is NOT the same as Compact ISO or PSP CISO, 6342# though it has the same magic number. 63430 string CISO 6344# Other fields are used to determine what type of CISO this is: 6345# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 6346# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 6347# - None of the above: Compact ISO. 6348>4 lelong 0x200000 6349>>8 byte 1 6350>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format): 6351>>>>0x8000 use nintendo-gcn-disc-common 6352>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format): 6353>>>>0x8000 use nintendo-gcn-disc-common 6354 6355# Type: Nintendo GameCube/Wii disc image (GCZ format) 6356# Due to zlib compression, we can't get the actual disc information. 63570 lelong 0xB10BC001 6358>4 lelong 0 Nintendo GameCube disc image (GCZ format) 6359>4 lelong 1 Nintendo Wii disc image (GCZ format) 6360>4 lelong >1 Nintendo GameCube/Wii disc image (GCZ format) 6361 6362# Type: Nintendo GameCube/Wii disc image (WDF format) 63630 string WII\001DISC 6364>8 belong 1 6365# WDFv1 6366>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format): 6367>>>0x38 use nintendo-gcn-disc-common 6368>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format): 6369>>>0x38 use nintendo-gcn-disc-common 6370>8 belong 2 6371# WDFv2 6372>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format): 6373>>>(12.L) use nintendo-gcn-disc-common 6374>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format): 6375>>>(12.L) use nintendo-gcn-disc-common 6376 6377# Type: Nintendo GameCube/Wii disc image (WIA format) 63780 string WIA\001 Nintendo 6379>0x48 belong 0 GameCube/Wii 6380>0x48 belong 1 GameCube 6381>0x48 belong 2 Wii 6382>0x48 belong >2 GameCube/Wii 6383>0x48 belong x disc image (WIA format): 6384>>0x58 use nintendo-gcn-disc-common 6385 6386#------------------------------------------------------------------------------ 6387# Nintendo 3DS file formats. 6388# 6389 6390# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC) 6391# From: David Korth <gerbilsoft@gerbilsoft.com> 6392# Reference: https://www.3dbrew.org/wiki/NCSD 63930x100 string NCSD 6394>0x118 lequad 0 Nintendo 3DS Game Card image 6395# NCCH header for partition 0. (game data) 6396>>0x1150 string >\0 \b: "%.16s" 6397>>0x312 byte x (Rev.%02u) 6398>>0x118C byte 2 (New3DS only) 6399>>0x18D byte 0 (inner device) 6400>>0x18D byte 1 (Card1) 6401>>0x18D byte 2 (Card2) 6402>>0x18D byte 3 (extended device) 6403>0x118 bequad 0x0102020202000000 Nintendo 3DS eMMC dump (Old3DS) 6404>0x118 bequad 0x0102020203000000 Nintendo 3DS eMMC dump (New3DS) 6405 6406# Nintendo 3DS version code. 6407# Reference: https://www.3dbrew.org/wiki/Titles 6408# Format: leshort containing three fields: 6409# - 6-bit: Major 6410# - 6-bit: Minor 6411# - 4-bit: Revision 6412# NOTE: Only supporting major/minor versions from 0-15 right now. 6413# NOTE: Should be prefixed with "v". 64140 name nintendo-3ds-version-code 6415# Raw version. 6416>0 leshort x \b%u, 6417# Major version. 6418>0 leshort&0xFC00 0x0000 0 6419>0 leshort&0xFC00 0x0400 1 6420>0 leshort&0xFC00 0x0800 2 6421>0 leshort&0xFC00 0x0C00 3 6422>0 leshort&0xFC00 0x1000 4 6423>0 leshort&0xFC00 0x1400 5 6424>0 leshort&0xFC00 0x1800 6 6425>0 leshort&0xFC00 0x1C00 7 6426>0 leshort&0xFC00 0x2000 8 6427>0 leshort&0xFC00 0x2400 9 6428>0 leshort&0xFC00 0x2800 10 6429>0 leshort&0xFC00 0x2C00 11 6430>0 leshort&0xFC00 0x3000 12 6431>0 leshort&0xFC00 0x3400 13 6432>0 leshort&0xFC00 0x3800 14 6433>0 leshort&0xFC00 0x3C00 15 6434# Minor version. 6435>0 leshort&0x03F0 0x0000 \b.0 6436>0 leshort&0x03F0 0x0010 \b.1 6437>0 leshort&0x03F0 0x0020 \b.2 6438>0 leshort&0x03F0 0x0030 \b.3 6439>0 leshort&0x03F0 0x0040 \b.4 6440>0 leshort&0x03F0 0x0050 \b.5 6441>0 leshort&0x03F0 0x0060 \b.6 6442>0 leshort&0x03F0 0x0070 \b.7 6443>0 leshort&0x03F0 0x0080 \b.8 6444>0 leshort&0x03F0 0x0090 \b.9 6445>0 leshort&0x03F0 0x00A0 \b.10 6446>0 leshort&0x03F0 0x00B0 \b.11 6447>0 leshort&0x03F0 0x00C0 \b.12 6448>0 leshort&0x03F0 0x00D0 \b.13 6449>0 leshort&0x03F0 0x00E0 \b.14 6450>0 leshort&0x03F0 0x00F0 \b.15 6451# Revision. 6452>0 leshort&0x000F x \b.%u 6453 6454# Type: Nintendo 3DS "NCCH" container. 6455# https://www.3dbrew.org/wiki/NCCH 64560x100 string NCCH Nintendo 3DS 6457>0x18D byte&2 0 File Archive (CFA) 6458>0x18D byte&2 2 Executable Image (CXI) 6459>0x150 string >\0 \b: "%.16s" 6460>0x18D byte 0x05 6461>>0x10E leshort x (Old3DS System Update v 6462>>0x10E use nintendo-3ds-version-code 6463>>0x10E leshort x \b) 6464>0x18D byte 0x15 6465>>0x10E leshort x (New3DS System Update v 6466>>0x10E use nintendo-3ds-version-code 6467>>0x10E leshort x \b) 6468>0x18D byte !0x05 6469>>0x18D byte !0x15 6470>>>0x112 byte x (v 6471>>>0x112 use nintendo-3ds-version-code 6472>>>0x112 byte x \b) 6473>0x18C byte 2 (New3DS only) 6474 6475# Type: Nintendo 3DS "SMDH" file. (application description) 6476# From: David Korth <gerbilsoft@gerbilsoft.com> 6477# Reference: https://3dbrew.org/wiki/SMDH 64780 string SMDH Nintendo 3DS SMDH file 6479>0x208 leshort !0 6480>>0x208 lestring16 x \b: "%.128s" 6481>>0x388 leshort !0 6482>>>0x388 lestring16 x by %.128s 6483>0x208 leshort 0 6484>>0x008 leshort !0 6485>>>0x008 lestring16 x \b: "%.128s" 6486>>>0x188 leshort !0 6487>>>>0x188 lestring16 x by %.128s 6488 6489# Type: Nintendo 3DS Homebrew Application. 6490# From: David Korth <gerbilsoft@gerbilsoft.com> 6491# Refernece: https://3dbrew.org/wiki/3DSX_Format 64920 string 3DSX Nintendo 3DS Homebrew Application (3DSX) 6493 6494#------------------------------------------------------------------------------ 6495# a7800: file(1) magic for the Atari 7800 raw ROM format. 6496# From: David Korth <gerbilsoft@gerbilsoft.com> 6497# Reference: https://sites.google.com/site/atari7800wiki/a78-header 6498 64990 byte >0 6500>0 byte <3 6501>>1 string ATARI7800 Atari 7800 ROM image 6502>>>0x11 string >\0 \b: "%.32s" 6503# Display type. 6504>>>0x39 byte 0 (NTSC) 6505>>>0x39 byte 1 (PAL) 6506>>>0x36 byte&1 1 (POKEY) 6507 6508#------------------------------------------------------------------------------ 6509# vectrex: file(1) magic for the GCE Vectrex raw ROM format. 6510# From: David Korth <gerbilsoft@gerbilsoft.com> 6511# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm 6512# 6513# NOTE: Title is terminated with 0x80, not 0. 6514# The header is terminated with a 0, so that will 6515# terminate the title as well. 6516# 65170 string g\ GCE Vectrex ROM image 6518>0x11 string >\0 \b: "%.16s" 6519 6520#------------------------------------------------------------------------------ 6521# amiibo: file(1) magic for Nintendo amiibo NFC dumps. 6522# From: David Korth <gerbilsoft@gerbilsoft.com> 6523# Reference: https://www.3dbrew.org/wiki/Amiibo 65240x00 byte 0x04 6525>0x0A beshort 0x0FE0 6526>>0x0C belong 0xF110FFEE 6527>>>0x208 beshort 0x0100 6528>>>>0x020A byte 0x0F 6529>>>>>0x020C bequad 0x000000045F000000 6530>>>>>>0x5B byte 0x02 6531>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X- 6532>>>>>>>0x58 belong x \b%08X 6533 6534#------------------------------------------------------------------------------ 6535# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 6536# convex: file(1) magic for Convex boxes 6537# 6538# Convexes are big-endian. 6539# 6540# /*\ 6541# * Below are the magic numbers and tests added for Convex. 6542# * Added at beginning, because they are expected to be used most. 6543# \*/ 65440 belong 0507 Convex old-style object 6545>16 belong >0 not stripped 65460 belong 0513 Convex old-style demand paged executable 6547>16 belong >0 not stripped 65480 belong 0515 Convex old-style pre-paged executable 6549>16 belong >0 not stripped 65500 belong 0517 Convex old-style pre-paged, non-swapped executable 6551>16 belong >0 not stripped 65520 belong 0x011257 Core file 6553# 6554# The following are a series of dump format magic numbers. Each one 6555# corresponds to a drastically different dump format. The first on is 6556# the original dump format on a 4.1 BSD or earlier file system. The 6557# second marks the change between the 4.1 file system and the 4.2 file 6558# system. The Third marks the changing of the block size from 1K 6559# to 2K to be compatible with an IDC file system. The fourth indicates 6560# a dump that is dependent on Convex Storage Manager, because data in 6561# secondary storage is not physically contained within the dump. 6562# The restore program uses these number to determine how the data is 6563# to be extracted. 6564# 656524 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 656624 belong =60014 dump format, Convex Storage Manager by-reference dump 6567# 6568# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 6569# If there is no `=' sign, assume just checking for whether the bit is set? 6570# 65710 belong 0601 Convex SOFF 6572>88 belong&0x000f0000 =0x00000000 c1 6573>88 belong &0x00010000 c2 6574>88 belong &0x00020000 c2mp 6575>88 belong &0x00040000 parallel 6576>88 belong &0x00080000 intrinsic 6577>88 belong &0x00000001 demand paged 6578>88 belong &0x00000002 pre-paged 6579>88 belong &0x00000004 non-swapped 6580>88 belong &0x00000008 POSIX 6581# 6582>84 belong &0x80000000 executable 6583>84 belong &0x40000000 object 6584>84 belong&0x20000000 =0 not stripped 6585>84 belong&0x18000000 =0x00000000 native fpmode 6586>84 belong&0x18000000 =0x10000000 ieee fpmode 6587>84 belong&0x18000000 =0x18000000 undefined fpmode 6588# 65890 belong 0605 Convex SOFF core 6590# 65910 belong 0607 Convex SOFF checkpoint 6592>88 belong&0x000f0000 =0x00000000 c1 6593>88 belong &0x00010000 c2 6594>88 belong &0x00020000 c2mp 6595>88 belong &0x00040000 parallel 6596>88 belong &0x00080000 intrinsic 6597>88 belong &0x00000008 POSIX 6598# 6599>84 belong&0x18000000 =0x00000000 native fpmode 6600>84 belong&0x18000000 =0x10000000 ieee fpmode 6601>84 belong&0x18000000 =0x18000000 undefined fpmode 6602 6603#------------------------------------------------------------------------------ 6604# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $ 6605# xoverage: file(1) magic for test coverage data 6606 6607# File formats used to store test coverage data 6608# 2016-05-21, Georg Sauthoff <mail@georg.so> 6609 6610 6611# - GCC gcno - written by GCC at compile time when compiling with 6612# gcc -ftest-coverage 6613# - GCC gcda - written by a program that was compiled with 6614# gcc -fprofile-arcs 6615# - LLVM raw profiles - generated by a program compiled with 6616# clang -fprofile-instr-generate -fcoverage-mapping ... 6617# - LLVM indexed profiles - generated by 6618# llvm-profdata 6619# - GCOV reports, i.e. the annotated source code 6620# - LCOV trace files, i.e. aggregated GCC profiles 6621# 6622# GCC coverage tracefiles 6623# .gcno file are created during compile time, 6624# while data collected during runtime is stored in .gcda files 6625# cf. gcov-io.h 6626# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html 6627# Examples: 6628# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35 6629# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a 66300 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage), 6631>&3 byte x version %c. 6632>&1 byte x \b%c 6633 6634# big endian 66350 belong 0x67636e6f GCC gcno coverage (-ftest-coverage), 6636>&0 byte x version %c. 6637>&2 byte x \b%c (big-endian) 6638 6639# Examples: 6640# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35 6641# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a 66420 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs), 6643>&3 byte x version %c. 6644>&1 byte x \b%c 6645 6646# big endian 66470 belong 0x67636461 GCC gcda coverage (-fprofile-arcs), 6648>&0 byte x version %c. 6649>&2 byte x \b%c (big-endian) 6650 6651 6652# LCOV tracefiles 6653# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php 66540 string TN: 6655>&0 search/64 \nSF:/ LCOV coverage tracefile 6656 6657 6658# Coverage reports generated by gcov 6659# i.e. source code annoted with coverage information 66600 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source: 6661>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph: 6662>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report 6663 6664 6665# LLVM coverage files 6666 6667# raw data after running a program compiled with: 6668# `clang -fprofile-instr-generate -fcoverage-mapping ...` 6669# default name: default.profraw 6670# magic is: \xFF lprofr \x81 6671# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 66720 lequad 0xff6c70726f667281 LLVM raw profile data, 6673>&0 byte x version %d 6674 6675# big endian 66760 bequad 0xff6c70726f667281 LLVM raw profile data, 6677>&7 byte x version %d (big-endian) 6678 6679 6680# LLVM indexed instruction profile (as generated by llvm-profdata) 6681# magic is: reverse(\xFF lprofi \x81) 6682# cf. http://llvm.org/docs/CoverageMappingFormat.html 6683# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html 6684# http://llvm.org/docs/CommandGuide/llvm-cov.html 6685# http://llvm.org/docs/CommandGuide/llvm-profdata.html 66860 lequad 0x8169666f72706cff LLVM indexed profile data, 6687>&0 byte x version %d 6688 6689# big endian 66900 bequad 0x8169666f72706cff LLVM indexed profile data, 6691>&7 byte x version %d (big-endian) 6692 6693 6694#------------------------------------------------------------------------------ 6695# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 6696# cracklib: file (1) magic for cracklib v2.7 6697 66980 lelong 0x70775631 Cracklib password index, little endian 6699>4 long >0 (%i words) 6700>4 long 0 ("64-bit") 6701>>8 long >-1 (%i words) 67020 belong 0x70775631 Cracklib password index, big endian 6703>4 belong >-1 (%i words) 6704# really bellong 0x0000000070775631 67050 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 6706>12 belong >0 (%i words) 6707 6708# ---------------------------------------------------------------------------- 6709# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 6710# ctags: file (1) magic for Exuberant Ctags files 6711# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 67120 search/1 =!_TAG Exuberant Ctags tag file text 6713 6714#-------------------------------------------------------------- 6715# ctf: file(1) magic for CTF (Common Trace Format) trace files 6716# 6717# Specs. available here: <http://www.efficios.com/ctf> 6718#-------------------------------------------------------------- 6719 6720# CTF trace data 67210 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 67220 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 6723 6724# CTF metadata (packetized) 67250 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 6726>35 byte x \b, v%d 6727>36 byte x \b.%d 67280 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 6729>35 byte x \b, v%d 6730>36 byte x \b.%d 6731 6732# CTF metadata (plain text) 67330 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 6734!:strength + 5 # this is to make sure we beat C 6735>&0 regex [0-9]+\.[0-9]+ \b, v%s 6736 6737#------------------------------------------------------------------------------ 6738# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 6739# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 6740# 67410 string ACMP Map file for the AssaultCube FPS game 67420 string CUBE Map file for cube and cube2 engine games 67430 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 6744 6745#------------------------------------------------------------------------------ 6746# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $ 6747# Cups: file(1) magic for the cups raster file format 6748# From: Laurent Martelli <martellilaurent@gmail.com> 6749# http://www.cups.org/documentation.php/spec-raster.html 6750# 6751 67520 name cups-le 6753>280 lelong x \b, %d 6754>284 lelong x \bx%d dpi 6755>376 lelong x \b, %dx 6756>380 lelong x \b%d pixels 6757>388 lelong x %d bits/color 6758>392 lelong x %d bits/pixel 6759>400 lelong 0 ColorOrder=Chunky 6760>400 lelong 1 ColorOrder=Banded 6761>400 lelong 2 ColorOrder=Planar 6762>404 lelong 0 ColorSpace=gray 6763>404 lelong 1 ColorSpace=RGB 6764>404 lelong 2 ColorSpace=RGBA 6765>404 lelong 3 ColorSpace=black 6766>404 lelong 4 ColorSpace=CMY 6767>404 lelong 5 ColorSpace=YMC 6768>404 lelong 6 ColorSpace=CMYK 6769>404 lelong 7 ColorSpace=YMCK 6770>404 lelong 8 ColorSpace=KCMY 6771>404 lelong 9 ColorSpace=KCMYcm 6772>404 lelong 10 ColorSpace=GMCK 6773>404 lelong 11 ColorSpace=GMCS 6774>404 lelong 12 ColorSpace=WHITE 6775>404 lelong 13 ColorSpace=GOLD 6776>404 lelong 14 ColorSpace=SILVER 6777>404 lelong 15 ColorSpace=CIE XYZ 6778>404 lelong 16 ColorSpace=CIE Lab 6779>404 lelong 17 ColorSpace=RGBW 6780>404 lelong 18 ColorSpace=sGray 6781>404 lelong 19 ColorSpace=sRGB 6782>404 lelong 20 ColorSpace=AdobeRGB 6783 6784# Cups Raster image format, Big Endian 67850 string RaS 6786>3 string t Cups Raster version 1, Big Endian 6787>3 string 2 Cups Raster version 2, Big Endian 6788>3 string 3 Cups Raster version 3, Big Endian 6789!:mime application/vnd.cups-raster 6790>0 use \^cups-le 6791 6792 6793# Cups Raster image format, Little Endian 67941 string SaR 6795>0 string t Cups Raster version 1, Little Endian 6796>0 string 2 Cups Raster version 2, Little Endian 6797>0 string 3 Cups Raster version 3, Little Endian 6798!:mime application/vnd.cups-raster 6799>0 use cups-le 6800 6801#------------------------------------------------------------------------------ 6802# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 6803# dact: file(1) magic for DACT compressed files 6804# 68050 long 0x444354C3 DACT compressed data 6806>4 byte >-1 (version %i. 6807>5 byte >-1 $BS%i. 6808>6 byte >-1 $BS%i) 6809>7 long >0 $BS, original size: %i bytes 6810>15 long >30 $BS, block size: %i bytes 6811 6812#------------------------------------------------------------------------------ 6813# $File: database,v 1.51 2017/04/28 16:28:16 christos Exp $ 6814# database: file(1) magic for various databases 6815# 6816# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 6817# 6818# 6819# GDBM magic numbers 6820# Will be maintained as part of the GDBM distribution in the future. 6821# <downsj@teeny.org> 68220 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 6823!:mime application/x-gdbm 68240 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 6825!:mime application/x-gdbm 68260 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 6827!:mime application/x-gdbm 68280 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 6829!:mime application/x-gdbm 68300 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 6831!:mime application/x-gdbm 68320 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 6833!:mime application/x-gdbm 68340 string GDBM GNU dbm 2.x database 6835!:mime application/x-gdbm 6836# 6837# Berkeley DB 6838# 6839# Ian Darwin's file /etc/magic files: big/little-endian version. 6840# 6841# Hash 1.85/1.86 databases store metadata in network byte order. 6842# Btree 1.85/1.86 databases store the metadata in host byte order. 6843# Hash and Btree 2.X and later databases store the metadata in host byte order. 6844 68450 long 0x00061561 Berkeley DB 6846!:mime application/x-dbm 6847>8 belong 4321 6848>>4 belong >2 1.86 6849>>4 belong <3 1.85 6850>>4 belong >0 (Hash, version %d, native byte-order) 6851>8 belong 1234 6852>>4 belong >2 1.86 6853>>4 belong <3 1.85 6854>>4 belong >0 (Hash, version %d, little-endian) 6855 68560 belong 0x00061561 Berkeley DB 6857>8 belong 4321 6858>>4 belong >2 1.86 6859>>4 belong <3 1.85 6860>>4 belong >0 (Hash, version %d, big-endian) 6861>8 belong 1234 6862>>4 belong >2 1.86 6863>>4 belong <3 1.85 6864>>4 belong >0 (Hash, version %d, native byte-order) 6865 68660 long 0x00053162 Berkeley DB 1.85/1.86 6867>4 long >0 (Btree, version %d, native byte-order) 68680 belong 0x00053162 Berkeley DB 1.85/1.86 6869>4 belong >0 (Btree, version %d, big-endian) 68700 lelong 0x00053162 Berkeley DB 1.85/1.86 6871>4 lelong >0 (Btree, version %d, little-endian) 6872 687312 long 0x00061561 Berkeley DB 6874>16 long >0 (Hash, version %d, native byte-order) 687512 belong 0x00061561 Berkeley DB 6876>16 belong >0 (Hash, version %d, big-endian) 687712 lelong 0x00061561 Berkeley DB 6878>16 lelong >0 (Hash, version %d, little-endian) 6879 688012 long 0x00053162 Berkeley DB 6881>16 long >0 (Btree, version %d, native byte-order) 688212 belong 0x00053162 Berkeley DB 6883>16 belong >0 (Btree, version %d, big-endian) 688412 lelong 0x00053162 Berkeley DB 6885>16 lelong >0 (Btree, version %d, little-endian) 6886 688712 long 0x00042253 Berkeley DB 6888>16 long >0 (Queue, version %d, native byte-order) 688912 belong 0x00042253 Berkeley DB 6890>16 belong >0 (Queue, version %d, big-endian) 689112 lelong 0x00042253 Berkeley DB 6892>16 lelong >0 (Queue, version %d, little-endian) 6893 6894# From Max Bowsher. 689512 long 0x00040988 Berkeley DB 6896>16 long >0 (Log, version %d, native byte-order) 689712 belong 0x00040988 Berkeley DB 6898>16 belong >0 (Log, version %d, big-endian) 689912 lelong 0x00040988 Berkeley DB 6900>16 lelong >0 (Log, version %d, little-endian) 6901 6902# 6903# 6904# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 69050 string/b RRD\0 RRDTool DB 6906>4 string/b x version %s 6907 6908>>10 short !0 16bit aligned 6909>>>10 bedouble 8.642135e+130 big-endian 6910>>>>18 short x 32bit long (m68k) 6911 6912>>10 short 0 6913>>>12 long !0 32bit aligned 6914>>>>12 bedouble 8.642135e+130 big-endian 6915>>>>>20 long 0 64bit long 6916>>>>>20 long !0 32bit long 6917>>>>12 ledouble 8.642135e+130 little-endian 6918>>>>>24 long 0 64bit long 6919>>>>>24 long !0 32bit long (i386) 6920>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 6921>>>>>24 short !0 32bit long (arm) 6922 6923>>8 quad 0 64bit aligned 6924>>>16 bedouble 8.642135e+130 big-endian 6925>>>>24 long 0 64bit long (s390x) 6926>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 6927>>>16 ledouble 8.642135e+130 little-endian 6928>>>>28 long 0 64bit long (alpha/amd64/ia64) 6929>>>>28 long !0 32bit long (armel/mipsel) 6930 6931#---------------------------------------------------------------------- 6932# ROOT: file(1) magic for ROOT databases 6933# 69340 string root\0 ROOT file 6935>4 belong x Version %d 6936>33 belong x (Compression: %d) 6937 6938# XXX: Weak magic. 6939# Alex Ott <ott@jet.msk.su> 6940## Paradox file formats 6941#2 leshort 0x0800 Paradox 6942#>0x39 byte 3 v. 3.0 6943#>0x39 byte 4 v. 3.5 6944#>0x39 byte 9 v. 4.x 6945#>0x39 byte 10 v. 5.x 6946#>0x39 byte 11 v. 5.x 6947#>0x39 byte 12 v. 7.x 6948#>>0x04 byte 0 indexed .DB data file 6949#>>0x04 byte 1 primary index .PX file 6950#>>0x04 byte 2 non-indexed .DB data file 6951#>>0x04 byte 3 non-incrementing secondary index .Xnn file 6952#>>0x04 byte 4 secondary index .Ynn file 6953#>>0x04 byte 5 incrementing secondary index .Xnn file 6954#>>0x04 byte 6 non-incrementing secondary index .XGn file 6955#>>0x04 byte 7 secondary index .YGn file 6956#>>>0x04 byte 8 incrementing secondary index .XGn file 6957 6958## XBase database files 6959# updated by Joerg Jenderek at Feb 2013 6960# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 6961# http://www.clicketyclick.dk/databases/xbase/format/dbf.html 6962# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 6963# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 69640 ubelong&0x0000FFFF <0x00000C20 6965# skip Infocom game Z-machine 6966>2 ubyte >0 6967# skip Androids *.xml 6968>>3 ubyte >0 6969>>>3 ubyte <32 6970# 1 < version VV 6971>>>>0 ubyte >1 6972# skip HELP.CA3 by test for reserved byte ( NULL ) 6973>>>>>27 ubyte 0 6974# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 6975#>>>>>30 ubeshort x 30NULL?%x 6976# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 6977>>>>>>24 ubelong&0xffFFFFff >0x01302000 6978# .DBF or .MDX 6979>>>>>>24 ubelong&0xffFFFFff <0x01302001 6980# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 6981>>>>>>>24 ubelong&0xffFFFFff =0 6982# test for 2 reserved NULL bytes,transaction and encryption byte flag 6983>>>>>>>>12 ubelong&0xFFFFfEfE 0 6984# test for MDX flag 6985>>>>>>>>>28 ubyte x 6986>>>>>>>>>28 ubyte&0xf8 0 6987# header size >= 32 6988>>>>>>>>>>8 uleshort >31 6989# skip PIC15736.PCX by test for language driver name or field name 6990>>>>>>>>>>>32 ubyte >0 6991#!:mime application/x-dbf; charset=unknown-8bit ?? 6992#!:mime application/x-dbase 6993>>>>>>>>>>>>0 use xbase-type 6994# database file 6995>>>>>>>>>>>>0 ubyte x \b DBF 6996>>>>>>>>>>>>4 lelong 0 \b, no records 6997>>>>>>>>>>>>4 lelong >0 \b, %d record 6998# plural s appended 6999>>>>>>>>>>>>>4 lelong >1 \bs 7000# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 7001# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 7002>>>>>>>>>>>>10 uleshort x * %d 7003# file size = records * record size + header size 7004>>>>>>>>>>>>1 ubyte x \b, update-date 7005>>>>>>>>>>>>1 use xbase-date 7006# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 7007#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 7008# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 7009>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 7010#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 7011>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 7012>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 7013>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 7014# 1st record offset + 1 = header size 7015>>>>>>>>>>>>8 uleshort >0 7016>>>>>>>>>>>>(8.s+1) ubyte >0 7017>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 7018>>>>>>>>>>>>>(8.s+1) ubyte >0 7019>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 7020# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) 7021>>>>>>>24 ubelong&0x0133f7ff >0 7022# test for reserved NULL byte 7023>>>>>>>>47 ubyte 0 7024# test for valid TAG key format (0x10 or 0) 7025>>>>>>>>>559 ubyte&0xeF 0 7026# test MM <= 12 7027>>>>>>>>>>45 ubeshort <0x0C20 7028>>>>>>>>>>>45 ubyte >0 7029>>>>>>>>>>>>46 ubyte <32 7030>>>>>>>>>>>>>46 ubyte >0 7031#!:mime application/x-mdx 7032>>>>>>>>>>>>>>0 use xbase-type 7033>>>>>>>>>>>>>>0 ubyte x \b MDX 7034>>>>>>>>>>>>>>1 ubyte x \b, creation-date 7035>>>>>>>>>>>>>>1 use xbase-date 7036>>>>>>>>>>>>>>44 ubyte x \b, update-date 7037>>>>>>>>>>>>>>44 use xbase-date 7038# No.of tags in use (1,2,5,12) 7039>>>>>>>>>>>>>>28 uleshort x \b, %d 7040# No. of entries in tag (0x30) 7041>>>>>>>>>>>>>>25 ubyte x \b/%d tags 7042# Length of tag 7043>>>>>>>>>>>>>>26 ubyte x * %d 7044# 1st tag name_ 7045>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 7046# 2nd tag name 7047#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 7048# 7049# Print the xBase names of different version variants 70500 name xbase-type 7051>0 ubyte <2 7052# 1 < version 7053>0 ubyte >1 7054>>0 ubyte 0x02 FoxBase 7055# FoxBase+/dBaseIII+, no memo 7056>>0 ubyte 0x03 FoxBase+/dBase III 7057!:mime application/x-dbf 7058# dBASE IV no memo file 7059>>0 ubyte 0x04 dBase IV 7060!:mime application/x-dbf 7061# dBASE V no memo file 7062>>0 ubyte 0x05 dBase V 7063!:mime application/x-dbf 7064>>0 ubyte 0x30 Visual FoxPro 7065!:mime application/x-dbf 7066>>0 ubyte 0x31 Visual FoxPro, autoincrement 7067!:mime application/x-dbf 7068# Visual FoxPro, with field type Varchar or Varbinary 7069>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 7070!:mime application/x-dbf 7071# dBASE IV SQL, no memo;dbv memo var size (Flagship) 7072>>0 ubyte 0x43 dBase IV, with SQL table 7073!:mime application/x-dbf 7074# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7075#>>0 ubyte 0x62 dBase IV, with SQL table 7076#!:mime application/x-dbf 7077# dBASE IV, with memo!! 7078>>0 ubyte 0x7b dBase IV, with memo 7079!:mime application/x-dbf 7080# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7081#>>0 ubyte 0x82 dBase IV, with SQL system 7082#!:mime application/x-dbf 7083# FoxBase+/dBaseIII+ with memo .DBT! 7084>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 7085!:mime application/x-dbf 7086# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 7087>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 7088!:mime application/x-dbf 7089# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7090#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 7091#!:mime application/x-dbf 7092# dBASE IV with memo! 7093>>0 ubyte 0x8B dBase IV, with memo .DBT 7094!:mime application/x-dbf 7095# dBase IV with SQL Table,no memo? 7096>>0 ubyte 0x8E dBase IV, with SQL table 7097!:mime application/x-dbf 7098# .dbv and .dbt memo (Flagship)? 7099>>0 ubyte 0xB3 Flagship 7100# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7101#>>0 ubyte 0xCA dBase IV with memo .DBT 7102#!:mime application/x-dbf 7103# dBASE IV with SQL table, with memo .DBT 7104>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 7105!:mime application/x-dbf 7106# HiPer-Six format;Clipper SIX, with SMT memo file 7107>>0 ubyte 0xE5 Clipper SIX with memo 7108!:mime application/x-dbf 7109# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7110#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 7111#!:mime application/x-dbf 7112>>0 ubyte 0xF5 FoxPro with memo 7113!:mime application/x-dbf 7114# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 7115#>>0 ubyte 0xFA FoxPro 2.x, with memo 7116#!:mime application/x-dbf 7117# unknown version (should not happen) 7118>>0 default x xBase 7119!:mime application/x-dbf 7120>>>0 ubyte x (0x%x) 7121# flags in version byte 7122# DBT flag (with dBASE III memo .DBT)!! 7123# >>0 ubyte&0x80 >0 DBT_FLAG=%x 7124# memo flag ?? 7125# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 7126# SQL flag ?? 7127# >>0 ubyte&0x70 >0 SQL_FLAG=%x 7128# test and print the date of xBase .DBF .MDX 71290 name xbase-date 7130# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 7131>0 ubelong x 7132>1 ubyte <13 7133>>1 ubyte >0 7134>>>2 ubyte >0 7135>>>>2 ubyte <32 7136>>>>>0 ubyte x 7137# YY is interpreted as 20YY or 19YY 7138>>>>>>0 ubyte <100 \b %.2d 7139# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 7140>>>>>>0 ubyte >99 \b %d 7141>>>>>1 ubyte x \b-%d 7142>>>>>2 ubyte x \b-%d 7143 7144# dBase memo files .DBT or .FPT 7145# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 714616 ubyte <4 7147>16 ubyte !2 7148>>16 ubyte !1 7149# next free block index is positive 7150>>>0 ulelong >0 7151# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 7152>>>>17 ubelong&0xFFfdFE00 0x00000000 7153# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 7154>>>>>20 ubelong&0xFF01209B 0x00000000 7155# dBASE III 7156>>>>>>16 ubyte 3 7157# dBASE III DBT 7158>>>>>>>0 use dbase3-memo-print 7159# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 7160>>>>>>16 ubyte 0 7161# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 7162>>>>>>>20 uleshort 0 7163# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 7164>>>>>>>>8 ulong =0 7165>>>>>>>>>6 ubeshort >0 7166# skip emacs.PIF 7167>>>>>>>>>>4 ushort 0 7168>>>>>>>>>>>0 use foxpro-memo-print 7169# dBASE III DBT , garbage 7170>>>>>>>>>6 ubeshort 0 7171# skip MM*DD*.bin by test for for reserved NULL byte 7172>>>>>>>>>>510 ubeshort 0 7173# skip TK-DOS11.img image by looking for memo text 7174>>>>>>>>>>>512 ubelong <0xfeffff03 7175# skip EFI executables by looking for memo text 7176>>>>>>>>>>>>512 ubelong >0x1F202020 7177>>>>>>>>>>>>>513 ubyte >0 7178# unusual dBASE III DBT like adressen.dbt 7179>>>>>>>>>>>>>>0 use dbase3-memo-print 7180# dBASE III DBT like angest.dbt, or garbage PCX DBF 7181>>>>>>>>8 ubelong !0 7182# skip PCX and some DBF by test for for reserved NULL bytes 7183>>>>>>>>>510 ubeshort 0 7184# skip some DBF by test of invalid version 7185>>>>>>>>>>0 ubyte >5 7186>>>>>>>>>>>0 ubyte <48 7187>>>>>>>>>>>>0 use dbase3-memo-print 7188# dBASE IV DBT with positive block size 7189>>>>>>>20 uleshort >0 7190# dBASE IV DBT with valid block length like 512, 1024 7191# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero 7192>>>>>>>>20 uleshort&0x800f 0 7193>>>>>>>>>0 use dbase4-memo-print 7194 7195# Print the information of dBase III DBT memo file 71960 name dbase3-memo-print 7197>0 ubyte x dBase III DBT 7198# instead 3 as version number 0 for unusual examples like biblio.dbt 7199>16 ubyte !3 \b, version number %u 7200# Number of next available block for appending data 7201#>0 lelong =0 \b, next free block index %u 7202>0 lelong !0 \b, next free block index %u 7203# no positiv block length 7204#>20 uleshort =0 \b, block length %u 7205>20 uleshort !0 \b, block length %u 7206# dBase III memo field terminated by \032\032 7207>512 string >\0 \b, 1st item "%s" 7208# Print the information of dBase IV DBT memo file 72090 name dbase4-memo-print 7210>0 lelong x dBase IV DBT 7211!:mime application/x-dbt 7212!:ext dbt 7213# 8 character shorted main name of coresponding dBASE IV DBF file 7214>8 ubelong >0x20000000 7215# skip unusual like for angest.dbt 7216>>20 uleshort >0 7217>>>8 string >\0 \b of %-.8s.DBF 7218# value 0 implies 512 as size 7219#>4 ulelong =0 \b, blocks size %u 7220# size of blocks not reliable like 0x2020204C in angest.dbt 7221>4 ulelong !0 7222>>4 ulelong&0x0000003f 0 \b, blocks size %u 7223# dBase IV DBT with positive block length (found 512 , 1024) 7224>20 uleshort >0 \b, block length %u 7225# next available block 7226#>0 lelong =0 \b, next free block index %u 7227>0 lelong !0 \b, next free block index %u 7228>20 uleshort >0 7229>>(20.s) ubelong x 7230>>>&-4 use dbase4-memofield-print 7231# unusual dBase IV DBT without block length (implies 512 as length) 7232>20 uleshort =0 7233>>512 ubelong x 7234>>>&-4 use dbase4-memofield-print 7235# Print the information of dBase IV memo field 72360 name dbase4-memofield-print 7237# free dBase IV memo field 7238>0 ubelong !0xFFFF0800 7239>>0 lelong x \b, next free block %u 7240>>4 lelong x \b, next used block %u 7241# used dBase IV memo field 7242>0 ubelong =0xFFFF0800 7243# length of memo field 7244>>4 lelong x \b, field length %d 7245>>>8 string >\0 \b, 1st used item "%s" 7246# Print the information of FoxPro FPT memo file 72470 name foxpro-memo-print 7248>0 belong x FoxPro FPT 7249# Size of blocks for FoxPro ( 64,256 ) 7250>6 ubeshort x \b, blocks size %u 7251# next available block 7252#>0 belong =0 \b, next free block index %u 7253>0 belong !0 \b, next free block index %u 7254# field type ( 0~picture, 1~memo, 2~object ) 7255>512 ubelong <3 \b, field type %u 7256# length of memo field 7257>512 ubelong 1 7258>>516 belong >0 \b, field length %d 7259>>>520 string >\0 \b, 1st item "%s" 7260 7261# TODO: 7262# DBASE index file *.NDX 7263# DBASE Compound Index file *.CDX 7264# dBASE IV Printer Driver *.PRF 7265## End of XBase database stuff 7266 7267# MS Access database 72684 string Standard\ Jet\ DB Microsoft Access Database 7269!:mime application/x-msaccess 72704 string Standard\ ACE\ DB Microsoft Access Database 7271!:mime application/x-msaccess 7272 7273# From: Joerg Jenderek 7274# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine 7275# Reference: https://github.com/libyal/libesedb/archive/master.zip 7276# libesedb-master/documentation/ 7277# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc 7278# Note: also known as "JET Blue". Used by numerous Windows components such as 7279# Windows Search, Mail, Exchange and Active Directory. 72804 ubelong 0xefcdab89 7281# unknown1 7282>132 ubelong 0 Extensible storage engine 7283!:mime application/x-ms-ese 7284# file_type 0~database 1~stream 7285>>12 ulelong 0 DataBase 7286# Security DataBase (sdb) 7287!:ext edb/sdb 7288>>12 ulelong 1 STreaMing 7289!:ext stm 7290# format_version 620h 7291>>8 uleshort x \b, version 0x%x 7292>>10 uleshort >0 revision 0x%4.4x 7293>>0 ubelong x \b, checksum 0x%8.8x 7294# Page size 4096 8192 32768 7295>>236 ulequad x \b, page size %lld 7296# database_state 7297>>52 ulelong 1 \b, JustCreated 7298>>52 ulelong 2 \b, DirtyShutdown 7299#>>52 ulelong 3 \b, CleanShutdown 7300>>52 ulelong 4 \b, BeingConverted 7301>>52 ulelong 5 \b, ForceDetach 7302# Windows�NT major version when the databases indexes were updated. 7303>>216 ulelong x \b, Windows version %d 7304# Windows�NT minor version 7305>>220 ulelong x \b.%d 7306 7307# From: Joerg Jenderek 7308# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility 7309# Note: files contain application compatibility fixes, application compatibility modes and application help messages. 73108 string sdbf 7311>7 ubyte 0 7312# TAG_TYPE_LIST+TAG_INDEXES 7313>>12 uleshort 0x7802 Windows application compatibility Shim DataBase 7314# version? 2 3 7315#>>>0 ulelong x \b, version %d 7316!:mime application/x-ms-sdb 7317!:ext sdb 7318 7319# TDB database from Samba et al - Martin Pool <mbp@samba.org> 73200 string TDB\ file TDB database 7321>32 lelong 0x2601196D version 6, little-endian 7322>>36 lelong x hash size %d bytes 7323 7324# SE Linux policy database 73250 lelong 0xf97cff8c SE Linux policy 7326>16 lelong x v%d 7327>20 lelong 1 MLS 7328>24 lelong x %d symbols 7329>28 lelong x %d ocons 7330 7331# ICE authority file data (Wolfram Kleff) 73322 string ICE ICE authority data 7333 7334# X11 Xauthority file (Wolfram Kleff) 733510 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 733611 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 733712 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 733813 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 733914 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 734015 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 734116 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 734217 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 734318 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 7344 7345# From: Maxime Henrion <mux@FreeBSD.org> 7346# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 73470 string PGDMP PostgreSQL custom database dump 7348>5 byte x - v%d 7349>6 byte x \b.%d 7350>5 beshort <0x101 \b-0 7351>5 beshort >0x100 7352>>7 byte x \b-%d 7353 7354# Type: Advanced Data Format (ADF) database 7355# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 7356# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 73570 string @(#)ADF\ Database CGNS Advanced Data Format 7358 7359# Tokyo Cabinet magic data 7360# http://tokyocabinet.sourceforge.net/index.html 73610 string ToKyO\ CaBiNeT\n Tokyo Cabinet 7362>14 string x \b (%s) 7363>32 byte 0 \b, Hash 7364!:mime application/x-tokyocabinet-hash 7365>32 byte 1 \b, B+ tree 7366!:mime application/x-tokyocabinet-btree 7367>32 byte 2 \b, Fixed-length 7368!:mime application/x-tokyocabinet-fixed 7369>32 byte 3 \b, Table 7370!:mime application/x-tokyocabinet-table 7371>33 byte &1 \b, [open] 7372>33 byte &2 \b, [fatal] 7373>34 byte x \b, apow=%d 7374>35 byte x \b, fpow=%d 7375>36 byte &0x01 \b, [large] 7376>36 byte &0x02 \b, [deflate] 7377>36 byte &0x04 \b, [bzip] 7378>36 byte &0x08 \b, [tcbs] 7379>36 byte &0x10 \b, [excodec] 7380>40 lequad x \b, bnum=%lld 7381>48 lequad x \b, rnum=%lld 7382>56 lequad x \b, fsiz=%lld 7383 7384# Type: QDBM Quick Database Manager 7385# From: Benoit Sibaud <bsibaud@april.org> 73860 string \\[depot\\]\n\f Quick Database Manager, little endian 73870 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 7388 7389# Type: TokyoCabinet database 7390# URL: http://tokyocabinet.sourceforge.net/ 7391# From: Benoit Sibaud <bsibaud@april.org> 73920 string ToKyO\ CaBiNeT\n TokyoCabinet database 7393>14 string x (version %s) 7394 7395# From: Stephane Blondon http://www.yaal.fr 7396# Database file for Zope (done by FileStorage) 73970 string FS21 Zope Object Database File Storage v3 (data) 73980 string FS30 Zope Object Database File Storage v4 (data) 7399 7400# Cache file for the database of Zope (done by ClientStorage) 74010 string ZEC3 Zope Object Database Client Cache File (data) 7402 7403# IDA (Interactive Disassembler) database 74040 string IDA1 IDA (Interactive Disassembler) database 7405 7406# Hopper (reverse engineering tool) http://www.hopperapp.com/ 74070 string hopperdb Hopper database 7408 7409# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) 7410# Reference: http://www.provue.com/Panorama/ 7411# From: Joerg Jenderek 7412# NOTE: test only versions 4 and 6.0 with Windows 7413# length of Panorama database name 74145 ubyte >0 7415# look after database name for "some" null bits 7416>(5.B+7) ubelong&0xF3ffF000 0 7417# look for first keyword 7418>>&1 search/2 DESIGN Panorama database 7419#!:mime application/x-panorama-database 7420!:apple KASXZEPD 7421!:ext pan 7422# database name 7423>>>5 pstring x \b, "%s" 7424 7425# 7426# 7427# askSam Database by Stefan A. Haubenthal <polluks@web.de> 74280 string askw40\0 askSam DB 7429 7430# 7431# 7432# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de> 74330 string MBSTV\040 MUIbase DB 7434>6 string x version %s 7435 7436# 7437# CDB database 74380 string NBCDB\012 NetBSD Constant Database 7439>7 byte x \b, version %d 7440>8 string x \b, for '%s' 7441>24 lelong x \b, datasize %d 7442>28 lelong x \b, entries %d 7443>32 lelong x \b, index %d 7444>36 lelong x \b, seed %#x 7445#------------------------------------------------------------------------------ 7446# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $ 7447# der: file(1) magic for DER encoded files 7448# 7449 7450# Certificate information piece 74510 name certinfo 7452>0 der seq 7453>>&0 der set 7454>>>&0 der seq 7455>>>>&0 der obj_id3=550406 7456>>>>&0 der prt_str=x \b, countryName=%s 7457>>&0 der set 7458>>>&0 der seq 7459>>>>&0 der obj_id3=550408 7460>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s 7461>>&0 der set 7462>>>&0 der seq 7463>>>>&0 der obj_id3=55040a 7464>>>>&0 der utf8_str=x \b, organizationName=%s 7465>>&0 der set 7466>>>&0 der seq 7467>>>>&0 der obj_id3=550403 7468>>>>&0 der utf8_str=x \b, commonName=%s 7469>>&0 der seq 7470 7471# Certificate requests 74720 der seq 7473>&0 der seq 7474>>&0 der int1=00 DER Encoded Certificate request 7475>>&0 use certinfo 7476 7477# Key Pairs 74780 der seq 7479>&0 der int1=00 7480>&0 der int65=x 7481>&0 der int3=010001 DER Encoded Key Pair, 512 bits 7482 74830 der seq 7484>&0 der int1=00 7485>&0 der int129=x 7486>&0 der int3=010001 DER Encoded Key Pair, 1024 bits 7487 74880 der seq 7489>&0 der int1=00 7490>&0 der int257=x 7491>&0 der int3=010001 DER Encoded Key Pair, 2048 bits 7492 74930 der seq 7494>&0 der int1=00 7495>&0 der int513=x 7496>&0 der int3=010001 DER Encoded Key Pair, 4096 bits 7497 74980 der seq 7499>&0 der int1=00 7500>&0 der int1025=x 7501>&0 der int3=010001 DER Encoded Key Pair, 8192 bits 7502 75030 der seq 7504>&0 der int1=00 7505>&0 der int2049=x 7506>&0 der int3=010001 DER Encoded Key Pair, 16k bits 7507 75080 der seq 7509>&0 der int1=00 7510>&0 der int4097=x 7511>&0 der int3=010001 DER Encoded Key Pair, 32k bits 7512 7513# Certificates 75140 der seq 7515>&0 der seq 7516>>&0 der int2=0dfa DER Encoded Certificate, 512 bits 7517>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits 7518>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits 7519>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits 7520>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits 7521>>&0 der int2=0dff DER Encoded Certificate, 16k bits 7522>>&0 der int2=0e04 DER Encoded Certificate, 32k bits 7523>>&0 der int2=x DER Encoded Certificate, ? bits (%s) 7524>>&0 der seq 7525>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption 7526>>>&0 der obj_id9=x \b, ? Encryption (%s) 7527>>>&0 der null 7528>>&0 der seq 7529>>>&0 der set 7530>>>>&0 der seq 7531>>>>>&0 der obj_id3=550406 7532>>>>>&0 der prt_str=x \b, countryName=%s 7533>>>&0 der set 7534>>>>&0 der seq 7535>>>>>&0 der obj_id3=550408 7536>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s 7537>>>&0 der set 7538>>>>&0 der seq 7539>>>>>&0 der obj_id3=550407 7540>>>>>&0 der prt_str=x \b, localityName=%s 7541>>>&0 der set 7542>>>>&0 der seq 7543>>>>>&0 der obj_id3=55040a 7544>>>>>&0 der prt_str=x \b, organizationName=%s 7545>>>&0 der set 7546>>>>&0 der seq 7547>>>>>&0 der obj_id3=55040b 7548>>>>>&0 der prt_str=x \b, organizationUnitName=%s 7549>>>&0 der set 7550>>>>&0 der seq 7551>>>>>&0 der obj_id3=550403 7552>>>>>&0 der prt_str=x \b, commonName=%s 7553>>>&0 der set 7554>>>>&0 der seq 7555>>>>>&0 der obj_id9=2a864886f70d010901 7556>>>>>&0 der ia5_str=x \b, emailAddress=%s 7557>>&0 der seq 7558>>>&0 der utc_time=x \b, utcTime=%s 7559>>>&0 der utc_time=x \b, utcTime=%s 7560>>&0 use certinfo 7561 7562#------------------------------------------------------------------------------ 7563# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 7564# diamond: file(1) magic for Diamond system 7565# 7566# ... diamond is a multi-media mail and electronic conferencing system.... 7567# 7568# XXX - I think it was either renamed Slate, or replaced by Slate.... 7569# 7570# The full deal is too long... 7571#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 75720 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 7573 7574#------------------------------------------------------------------------------ 7575# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $ 7576# diff: file(1) magic for diff(1) output 7577# 75780 search/1 diff\040 diff output text 7579!:mime text/x-diff 75800 search/1 ***\040 diff output text 7581!:mime text/x-diff 75820 search/1 Only\040in\040 diff output text 7583!:mime text/x-diff 75840 search/1 Common\040subdirectories:\040 diff output text 7585!:mime text/x-diff 7586 75870 search/1 Index: RCS/CVS diff output text 7588!:mime text/x-diff 7589 7590# bsdiff: file(1) magic for bsdiff(1) output 75910 string/b BSDIFF40 bsdiff(1) patch file 7592 7593 7594# unified diff 75950 search/4096 ---\040 7596>&0 search/1024 \n 7597>>&0 search/1 +++\040 7598>>>&0 search/1024 \n 7599>>>>&0 search/1 @@ unified diff output text 7600!:mime text/x-diff 7601!:strength + 90 7602 7603# librsync -- the library for network deltas 7604# 7605# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 7606# this file. 7607# 76080 belong 0x72730236 rdiff network-delta data 7609 76100 belong 0x72730136 rdiff network-delta signature data 7611>4 belong x (block length=%d, 7612>8 belong x signature strength=%d) 7613 7614#------------------------------------------------------------------------------ 7615# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ 7616# Digital UNIX - Info 7617# 76180 string =!<arch>\n________64E Alpha archive 7619>22 string X -- out of date 7620# 7621 76220 leshort 0603 7623>24 leshort 0410 COFF format alpha pure 7624>24 leshort 0413 COFF format alpha demand paged 7625>>22 leshort&030000 !020000 executable 7626>>22 leshort&020000 !0 dynamically linked 7627>>16 lelong !0 not stripped 7628>>16 lelong 0 stripped 7629>>27 byte x - version %d 7630>>26 byte x \b.%d 7631>>28 byte x \b-%d 7632>24 leshort 0407 COFF format alpha object 7633>>22 leshort&030000 020000 shared library 7634>>27 byte x - version %d 7635>>26 byte x \b.%d 7636>>28 byte x \b-%d 7637 7638# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 7639# 7640# The actual magic number is just "Core", followed by a 2-byte version 7641# number; however, treating any file that begins with "Core" as a Digital 7642# UNIX core dump file may produce too many false hits, so we include one 7643# byte of the version number as well; DU 5.0 appears only to be up to 7644# version 2. 7645# 76460 string Core\001 Alpha COFF format core dump (Digital UNIX) 7647>24 string >\0 \b, from '%s' 76480 string Core\002 Alpha COFF format core dump (Digital UNIX) 7649>24 string >\0 \b, from '%s' 7650# 7651# The next is incomplete, we could tell more about this format, 7652# but its not worth it. 76530 leshort 0x188 Alpha compressed COFF 76540 leshort 0x18f Alpha u-code object 7655# 7656# 7657# Some other interesting Digital formats, 76580 string \377\377\177 ddis/ddif 76590 string \377\377\174 ddis/dots archive 76600 string \377\377\176 ddis/dtif table data 76610 string \033c\033 LN03 output 76620 long 04553207 X image 7663# 76640 string =!<PDF>!\n profiling data file 7665# 7666# Locale data tables (MIPS and Alpha). 7667# 76680 short 0x0501 locale data table 7669>6 short 0x24 for MIPS 7670>6 short 0x40 for Alpha 7671 7672#------------------------------------------------------------------------------ 7673# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $ 7674# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 7675# from http://www.atsc.org/standards/a_52a.pdf 7676# corrections, additions, etc. are always welcome! 7677# 7678# syncword 76790 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 7680# Proposed audio/ac3 RFC/4184 7681!:mime audio/vnd.dolby.dd-raw 7682# fscod 7683>4 byte&0xc0 = 0x00 48 kHz, 7684>4 byte&0xc0 = 0x40 44.1 kHz, 7685>4 byte&0xc0 = 0x80 32 kHz, 7686# is this one used for 96 kHz? 7687>4 byte&0xc0 = 0xc0 reserved frequency, 7688# 7689>5 byte&0x07 = 0x00 \b, complete main (CM) 7690>5 byte&0x07 = 0x01 \b, music and effects (ME) 7691>5 byte&0x07 = 0x02 \b, visually impaired (VI) 7692>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 7693>5 byte&0x07 = 0x04 \b, dialogue (D) 7694>5 byte&0x07 = 0x05 \b, commentary (C) 7695>5 byte&0x07 = 0x06 \b, emergency (E) 7696>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 7697>5 beshort&0x07e0 >0x0720 \b, karaoke 7698# acmod 7699>6 byte&0xe0 = 0x00 1+1 front, 7700>>6 byte&0x10 = 0x10 LFE on, 7701>6 byte&0xe0 = 0x20 1 front/0 rear, 7702>>6 byte&0x10 = 0x10 LFE on, 7703>6 byte&0xe0 = 0x40 2 front/0 rear, 7704# dsurmod (for stereo only) 7705>>6 byte&0x18 = 0x00 Dolby Surround not indicated 7706>>6 byte&0x18 = 0x08 not Dolby Surround encoded 7707>>6 byte&0x18 = 0x10 Dolby Surround encoded 7708>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 7709>>6 byte&0x04 = 0x04 LFE on, 7710>6 byte&0xe0 = 0x60 3 front/0 rear, 7711>>6 byte&0x04 = 0x04 LFE on, 7712>6 byte&0xe0 = 0x80 2 front/1 rear, 7713>>6 byte&0x04 = 0x04 LFE on, 7714>6 byte&0xe0 = 0xa0 3 front/1 rear, 7715>>6 byte&0x01 = 0x01 LFE on, 7716>6 byte&0xe0 = 0xc0 2 front/2 rear, 7717>>6 byte&0x04 = 0x04 LFE on, 7718>6 byte&0xe0 = 0xe0 3 front/2 rear, 7719>>6 byte&0x01 = 0x01 LFE on, 7720# 7721>4 byte&0x3e = 0x00 \b, 32 kbit/s 7722>4 byte&0x3e = 0x02 \b, 40 kbit/s 7723>4 byte&0x3e = 0x04 \b, 48 kbit/s 7724>4 byte&0x3e = 0x06 \b, 56 kbit/s 7725>4 byte&0x3e = 0x08 \b, 64 kbit/s 7726>4 byte&0x3e = 0x0a \b, 80 kbit/s 7727>4 byte&0x3e = 0x0c \b, 96 kbit/s 7728>4 byte&0x3e = 0x0e \b, 112 kbit/s 7729>4 byte&0x3e = 0x10 \b, 128 kbit/s 7730>4 byte&0x3e = 0x12 \b, 160 kbit/s 7731>4 byte&0x3e = 0x14 \b, 192 kbit/s 7732>4 byte&0x3e = 0x16 \b, 224 kbit/s 7733>4 byte&0x3e = 0x18 \b, 256 kbit/s 7734>4 byte&0x3e = 0x1a \b, 320 kbit/s 7735>4 byte&0x3e = 0x1c \b, 384 kbit/s 7736>4 byte&0x3e = 0x1e \b, 448 kbit/s 7737>4 byte&0x3e = 0x20 \b, 512 kbit/s 7738>4 byte&0x3e = 0x22 \b, 576 kbit/s 7739>4 byte&0x3e = 0x24 \b, 640 kbit/s 7740 7741#------------------------------------------------------------------------------ 7742# $File: dump,v 1.14 2017/03/17 21:35:28 christos Exp $ 7743# dump: file(1) magic for dump file format--for new and old dump filesystems 7744# 7745# We specify both byte orders in order to recognize byte-swapped dumps. 7746# 77470 name new-dump-be 7748>4 bedate x Previous dump %s, 7749>8 bedate x This dump %s, 7750>12 belong >0 Volume %d, 7751>692 belong 0 Level zero, type: 7752>692 belong >0 Level %d, type: 7753>0 belong 1 tape header, 7754>0 belong 2 beginning of file record, 7755>0 belong 3 map of inodes on tape, 7756>0 belong 4 continuation of file record, 7757>0 belong 5 end of volume, 7758>0 belong 6 map of inodes deleted, 7759>0 belong 7 end of medium (for floppy), 7760>676 string >\0 Label %s, 7761>696 string >\0 Filesystem %s, 7762>760 string >\0 Device %s, 7763>824 string >\0 Host %s, 7764>888 belong >0 Flags %x 7765 77660 name old-dump-be 7767#>4 bedate x Previous dump %s, 7768#>8 bedate x This dump %s, 7769>12 belong >0 Volume %d, 7770>692 belong 0 Level zero, type: 7771>692 belong >0 Level %d, type: 7772>0 belong 1 tape header, 7773>0 belong 2 beginning of file record, 7774>0 belong 3 map of inodes on tape, 7775>0 belong 4 continuation of file record, 7776>0 belong 5 end of volume, 7777>0 belong 6 map of inodes deleted, 7778>0 belong 7 end of medium (for floppy), 7779>676 string >\0 Label %s, 7780>696 string >\0 Filesystem %s, 7781>760 string >\0 Device %s, 7782>824 string >\0 Host %s, 7783>888 belong >0 Flags %x 7784 77850 name ufs2-dump-be 7786>896 beqdate x Previous dump %s, 7787>904 beqdate x This dump %s, 7788>12 belong >0 Volume %d, 7789>692 belong 0 Level zero, type: 7790>692 belong >0 Level %d, type: 7791>0 belong 1 tape header, 7792>0 belong 2 beginning of file record, 7793>0 belong 3 map of inodes on tape, 7794>0 belong 4 continuation of file record, 7795>0 belong 5 end of volume, 7796>0 belong 6 map of inodes deleted, 7797>0 belong 7 end of medium (for floppy), 7798>676 string >\0 Label %s, 7799>696 string >\0 Filesystem %s, 7800>760 string >\0 Device %s, 7801>824 string >\0 Host %s, 7802>888 belong >0 Flags %x 7803 780424 belong 60012 new-fs dump file (big endian), 7805>0 use new-dump-be 7806 780724 belong 60011 old-fs dump file (big endian), 7808>0 use old-dump-be 7809 781024 lelong 60012 new-fs dump file (little endian), 7811# to correctly recognize '*.mo' GNU message catalog (little endian) 7812!:strength - 15 7813>0 use \^new-dump-be 7814 781524 lelong 60011 old-fs dump file (little endian), 7816>0 use \^old-dump-be 7817 7818 781924 belong 0x19540119 new-fs dump file (ufs2, big endian), 7820>0 use ufs2-dump-be 7821 782224 lelong 0x19540119 new-fs dump file (ufs2, little endian), 7823>0 use \^ufs2-dump-be 7824 782518 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 7826>2 medate x Previous dump %s, 7827>6 medate x This dump %s, 7828>10 leshort >0 Volume %d, 7829>0 leshort 1 tape header. 7830>0 leshort 2 beginning of file record. 7831>0 leshort 3 map of inodes on tape. 7832>0 leshort 4 continuation of file record. 7833>0 leshort 5 end of volume. 7834>0 leshort 6 map of inodes deleted. 7835>0 leshort 7 end of medium (for floppy). 7836 7837#------------------------------------------------------------------------------ 7838# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $ 7839# Dyadic: file(1) magic for Dyalog APL. 7840# 7841# updated by Joerg Jenderek at Oct 2013 7842# http://en.wikipedia.org/wiki/Dyalog_APL 7843# http://www.dyalog.com/ 7844# .DXV Dyalog APL External Variable 7845# .DIN Dyalog APL Input Table 7846# .DOT Dyalog APL Output Table 7847# .DFT Dyalog APL Format File 78480 ubeshort&0xFF60 0xaa00 7849# skip biblio.dbt 7850>1 byte !4 7851# real Dyalog APL have non zero version numbers like 7.3 or 13.4 7852>>2 ubeshort >0x0000 Dyalog APL 7853>>>1 byte 0x00 aplcore 7854#>>>1 byte 0x00 incomplete workspace 7855# *.DCF Dyalog APL Component File 7856>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed 7857#>>>1 byte 0x01 component file 7858>>>1 byte 0x02 external variable exclusive 7859#>>>1 byte 0x02 external variable 7860# *.DWS Dyalog APL Workspace 7861>>>1 byte 0x03 workspace 7862>>>>7 byte&0x28 0x00 32-bit 7863>>>>7 byte&0x28 0x20 64-bit 7864>>>>7 byte&0x0c 0x00 classic 7865>>>>7 byte&0x0c 0x04 unicode 7866>>>>7 byte&0x88 0x00 big-endian 7867>>>>7 byte&0x88 0x80 little-endian 7868>>>1 byte 0x06 external variable shared 7869# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File 7870>>>1 byte 0x07 session 7871>>>1 byte 0x08 mapped file 32-bit 7872>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed 7873>>>1 byte 0x0a mapped file 64-bit 7874>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 7875>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 7876>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed 7877>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed 7878>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed 7879>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed 7880>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed 7881>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed 7882>>>1 byte 0x13 component file 32-bit non-journaled checksummed 7883>>>1 byte 0x14 component file 64-bit non-journaled checksummed 7884>>>1 byte 0x15 component file under construction 7885>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed 7886>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed 7887>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed 7888>>>1 byte 0x19 external workspace 7889>>>1 byte 0x80 DDB 7890>>>2 byte x version %d 7891>>>3 byte x \b.%d 7892#>>>2 byte x type %d 7893#>>>3 byte x subtype %d 7894 7895# *.DXF Dyalog APL Transfer File 78960 short 0x6060 Dyalog APL transfer 7897 7898#------------------------------------------------------------------------------ 7899# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $ 7900# ebml: file(1) magic for various Extensible Binary Meta Language 7901# http://www.matroska.org/technical/specs/index.html#track 79020 belong 0x1a45dfa3 EBML file 7903>4 search/b/100 \102\202 7904>>&1 string x \b, creator %.8s 7905 7906#------------------------------------------------------------------------------ 7907# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $ 7908# T602 editor documents 7909# by David Necas <yeti@physics.muni.cz> 79100 string @CT\ T602 document data, 7911>4 string 0 Kamenicky 7912>4 string 1 CP 852 7913>4 string 2 KOI8-CS 7914>4 string >2 unknown encoding 7915 7916# Vi IMproved Encrypted file 7917# by David Necas <yeti@physics.muni.cz> 79180 string VimCrypt~ Vim encrypted file data 7919 79200 name vimnanoswap 7921>67 byte 0 7922>>107 byte 0 7923#>>>2 string x %s swap file 7924>>>24 ulelong x \b, pid %d 7925>>>28 string >\0 \b, user %s 7926>>>68 string >\0 \b, host %s 7927>>>108 string >\0 \b, file %s 7928>>>1007 byte 0x55 \b, modified 7929 7930# Vi IMproved Swap file 7931# by Sven Wegener <swegener@gentoo.org> 79320 string b0VIM\ Vim swap file 7933>&0 string >\0 \b, version %s 7934>0 use vimnanoswap 7935 7936 7937# Lock/swap file for several editors, at least 7938# Vi IMproved and nano 79390 string b0nano Nano swap file 7940>0 use vimnanoswap 7941 7942# kate (K Advanced Text Editor) 79430 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file 7944 7945#------------------------------------------------------------------------------ 7946# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $ 7947# efi: file(1) magic for Universal EFI binaries 7948 79490 lelong 0x0ef1fab9 7950>4 lelong 1 Universal EFI binary with 1 architecture 7951>>&0 lelong 7 \b, i386 7952>>&0 lelong 0x01000007 \b, x86_64 7953>4 lelong 2 Universal EFI binary with 2 architectures 7954>>&0 lelong 7 \b, i386 7955>>&0 lelong 0x01000007 \b, x86_64 7956>>&20 lelong 7 \b, i386 7957>>&20 lelong 0x01000007 \b, x86_64 7958>4 lelong >2 Universal EFI binary with %d architectures 7959 7960#------------------------------------------------------------------------------ 7961# $File: elf,v 1.70 2016/06/02 12:36:30 christos Exp $ 7962# elf: file(1) magic for ELF executables 7963# 7964# We have to check the byte order flag to see what byte order all the 7965# other stuff in the header is in. 7966# 7967# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 7968# 7969# Created by: unknown 7970# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 7971# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 7972# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 7973# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 7974# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 7975 79760 name elf-mips 7977>0 lelong&0xf0000000 0x00000000 MIPS-I 7978>0 lelong&0xf0000000 0x10000000 MIPS-II 7979>0 lelong&0xf0000000 0x20000000 MIPS-III 7980>0 lelong&0xf0000000 0x30000000 MIPS-IV 7981>0 lelong&0xf0000000 0x40000000 MIPS-V 7982>0 lelong&0xf0000000 0x50000000 MIPS32 7983>0 lelong&0xf0000000 0x60000000 MIPS64 7984>0 lelong&0xf0000000 0x70000000 MIPS32 rel2 7985>0 lelong&0xf0000000 0x80000000 MIPS64 rel2 7986>0 lelong&0xf0000000 0x90000000 MIPS32 rel6 7987>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6 7988 79890 name elf-sparc 7990>0 lelong&0x00ffff00 0x00000100 V8+ Required, 7991>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required, 7992>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required, 7993>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required, 7994>0 lelong&0x3 0 total store ordering, 7995>0 lelong&0x3 1 partial store ordering, 7996>0 lelong&0x3 2 relaxed memory ordering, 7997 79980 name elf-pa-risc 7999>2 leshort 0x0214 2.0 8000>0 leshort &0x0008 (LP64) 8001 80020 name elf-le 8003>16 leshort 0 no file type, 8004!:mime application/octet-stream 8005>16 leshort 1 relocatable, 8006!:mime application/x-object 8007>16 leshort 2 executable, 8008!:mime application/x-executable 8009>16 leshort 3 shared object, 8010!:mime application/x-sharedlib 8011>16 leshort 4 core file 8012!:mime application/x-coredump 8013# Core file detection is not reliable. 8014#>>>(0x38+0xcc) string >\0 of '%s' 8015#>>>(0x38+0x10) lelong >0 (signal %d), 8016>16 leshort &0xff00 processor-specific, 8017>18 clear x 8018>18 leshort 0 no machine, 8019>18 leshort 1 AT&T WE32100, 8020>18 leshort 2 SPARC, 8021>18 leshort 3 Intel 80386, 8022>18 leshort 4 Motorola m68k, 8023>>4 byte 1 8024>>>36 lelong &0x01000000 68000, 8025>>>36 lelong &0x00810000 CPU32, 8026>>>36 lelong 0 68020, 8027>18 leshort 5 Motorola m88k, 8028>18 leshort 6 Intel 80486, 8029>18 leshort 7 Intel 80860, 8030# The official e_machine number for MIPS is now #8, regardless of endianness. 8031# The second number (#10) will be deprecated later. For now, we still 8032# say something if #10 is encountered, but only gory details for #8. 8033>18 leshort 8 MIPS, 8034>>4 byte 1 8035>>>36 lelong &0x20 N32 8036>18 leshort 10 MIPS, 8037>>4 byte 1 8038>>>36 lelong &0x20 N32 8039>18 leshort 8 8040# only for 32-bit 8041>>4 byte 1 8042>>>36 use elf-mips 8043# only for 64-bit 8044>>4 byte 2 8045>>>48 use elf-mips 8046>18 leshort 9 Amdahl, 8047>18 leshort 10 MIPS (deprecated), 8048>18 leshort 11 RS6000, 8049>18 leshort 15 PA-RISC, 8050# only for 32-bit 8051>>4 byte 1 8052>>>36 use elf-pa-risc 8053# only for 64-bit 8054>>4 byte 2 8055>>>48 use elf-pa-risc 8056>18 leshort 16 nCUBE, 8057>18 leshort 17 Fujitsu VPP500, 8058>18 leshort 18 SPARC32PLUS, 8059# only for 32-bit 8060>>4 byte 1 8061>>>36 use elf-sparc 8062>18 leshort 19 Intel 80960, 8063>18 leshort 20 PowerPC or cisco 4500, 8064>18 leshort 21 64-bit PowerPC or cisco 7500, 8065>18 leshort 22 IBM S/390, 8066>18 leshort 23 Cell SPU, 8067>18 leshort 24 cisco SVIP, 8068>18 leshort 25 cisco 7200, 8069>18 leshort 36 NEC V800 or cisco 12000, 8070>18 leshort 37 Fujitsu FR20, 8071>18 leshort 38 TRW RH-32, 8072>18 leshort 39 Motorola RCE, 8073>18 leshort 40 ARM, 8074>>4 byte 1 8075>>>36 lelong&0xff000000 0x04000000 EABI4 8076>>>36 lelong&0xff000000 0x05000000 EABI5 8077>>>36 lelong &0x00800000 BE8 8078>>>36 lelong &0x00400000 LE8 8079>18 leshort 41 Alpha, 8080>18 leshort 42 Renesas SH, 8081>18 leshort 43 SPARC V9, 8082>>4 byte 2 8083>>>48 use elf-sparc 8084>18 leshort 44 Siemens Tricore Embedded Processor, 8085>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 8086>18 leshort 46 Renesas H8/300, 8087>18 leshort 47 Renesas H8/300H, 8088>18 leshort 48 Renesas H8S, 8089>18 leshort 49 Renesas H8/500, 8090>18 leshort 50 IA-64, 8091>18 leshort 51 Stanford MIPS-X, 8092>18 leshort 52 Motorola Coldfire, 8093>18 leshort 53 Motorola M68HC12, 8094>18 leshort 54 Fujitsu MMA, 8095>18 leshort 55 Siemens PCP, 8096>18 leshort 56 Sony nCPU, 8097>18 leshort 57 Denso NDR1, 8098>18 leshort 58 Start*Core, 8099>18 leshort 59 Toyota ME16, 8100>18 leshort 60 ST100, 8101>18 leshort 61 Tinyj emb., 8102>18 leshort 62 x86-64, 8103>18 leshort 63 Sony DSP, 8104>18 leshort 64 DEC PDP-10, 8105>18 leshort 65 DEC PDP-11, 8106>18 leshort 66 FX66, 8107>18 leshort 67 ST9+ 8/16 bit, 8108>18 leshort 68 ST7 8 bit, 8109>18 leshort 69 MC68HC16, 8110>18 leshort 70 MC68HC11, 8111>18 leshort 71 MC68HC08, 8112>18 leshort 72 MC68HC05, 8113>18 leshort 73 SGI SVx or Cray NV1, 8114>18 leshort 74 ST19 8 bit, 8115>18 leshort 75 Digital VAX, 8116>18 leshort 76 Axis cris, 8117>18 leshort 77 Infineon 32-bit embedded, 8118>18 leshort 78 Element 14 64-bit DSP, 8119>18 leshort 79 LSI Logic 16-bit DSP, 8120>18 leshort 80 MMIX, 8121>18 leshort 81 Harvard machine-independent, 8122>18 leshort 82 SiTera Prism, 8123>18 leshort 83 Atmel AVR 8-bit, 8124>18 leshort 84 Fujitsu FR30, 8125>18 leshort 85 Mitsubishi D10V, 8126>18 leshort 86 Mitsubishi D30V, 8127>18 leshort 87 NEC v850, 8128>18 leshort 88 Renesas M32R, 8129>18 leshort 89 Matsushita MN10300, 8130>18 leshort 90 Matsushita MN10200, 8131>18 leshort 91 picoJava, 8132>18 leshort 92 OpenRISC, 8133>18 leshort 93 ARC Cores Tangent-A5, 8134>18 leshort 94 Tensilica Xtensa, 8135>18 leshort 95 Alphamosaic VideoCore, 8136>18 leshort 96 Thompson Multimedia, 8137>18 leshort 97 NatSemi 32k, 8138>18 leshort 98 Tenor Network TPC, 8139>18 leshort 99 Trebia SNP 1000, 8140>18 leshort 100 STMicroelectronics ST200, 8141>18 leshort 101 Ubicom IP2022, 8142>18 leshort 102 MAX Processor, 8143>18 leshort 103 NatSemi CompactRISC, 8144>18 leshort 104 Fujitsu F2MC16, 8145>18 leshort 105 TI msp430, 8146>18 leshort 106 Analog Devices Blackfin, 8147>18 leshort 107 S1C33 Family of Seiko Epson, 8148>18 leshort 108 Sharp embedded, 8149>18 leshort 109 Arca RISC, 8150>18 leshort 110 PKU-Unity Ltd., 8151>18 leshort 111 eXcess: 16/32/64-bit, 8152>18 leshort 112 Icera Deep Execution Processor, 8153>18 leshort 113 Altera Nios II, 8154>18 leshort 114 NatSemi CRX, 8155>18 leshort 115 Motorola XGATE, 8156>18 leshort 116 Infineon C16x/XC16x, 8157>18 leshort 117 Renesas M16C series, 8158>18 leshort 118 Microchip dsPIC30F, 8159>18 leshort 119 Freescale RISC core, 8160>18 leshort 120 Renesas M32C series, 8161>18 leshort 131 Altium TSK3000 core, 8162>18 leshort 132 Freescale RS08, 8163>18 leshort 134 Cyan Technology eCOG2, 8164>18 leshort 135 Sunplus S+core7 RISC, 8165>18 leshort 136 New Japan Radio (NJR) 24-bit DSP, 8166>18 leshort 137 Broadcom VideoCore III, 8167>18 leshort 138 LatticeMico32, 8168>18 leshort 139 Seiko Epson C17 family, 8169>18 leshort 140 TI TMS320C6000 DSP family, 8170>18 leshort 141 TI TMS320C2000 DSP family, 8171>18 leshort 142 TI TMS320C55x DSP family, 8172>18 leshort 160 STMicroelectronics 64bit VLIW DSP, 8173>18 leshort 161 Cypress M8C, 8174>18 leshort 162 Renesas R32C series, 8175>18 leshort 163 NXP TriMedia family, 8176>18 leshort 164 QUALCOMM DSP6, 8177>18 leshort 165 Intel 8051 and variants, 8178>18 leshort 166 STMicroelectronics STxP7x family, 8179>18 leshort 167 Andes embedded RISC, 8180>18 leshort 168 Cyan eCOG1X family, 8181>18 leshort 169 Dallas MAXQ30, 8182>18 leshort 170 New Japan Radio (NJR) 16-bit DSP, 8183>18 leshort 171 M2000 Reconfigurable RISC, 8184>18 leshort 172 Cray NV2 vector architecture, 8185>18 leshort 173 Renesas RX family, 8186>18 leshort 174 META, 8187>18 leshort 175 MCST Elbrus, 8188>18 leshort 176 Cyan Technology eCOG16 family, 8189>18 leshort 177 NatSemi CompactRISC, 8190>18 leshort 178 Freescale Extended Time Processing Unit, 8191>18 leshort 179 Infineon SLE9X, 8192>18 leshort 180 Intel L1OM, 8193>18 leshort 181 Intel K1OM, 8194>18 leshort 183 ARM aarch64, 8195>18 leshort 185 Atmel 32-bit family, 8196>18 leshort 186 STMicroeletronics STM8 8-bit, 8197>18 leshort 187 Tilera TILE64, 8198>18 leshort 188 Tilera TILEPro, 8199>18 leshort 189 Xilinx MicroBlaze 32-bit RISC, 8200>18 leshort 190 NVIDIA CUDA architecture, 8201>18 leshort 191 Tilera TILE-Gx, 8202>18 leshort 197 Renesas RL78 family, 8203>18 leshort 199 Renesas 78K0R, 8204>18 leshort 200 Freescale 56800EX, 8205>18 leshort 201 Beyond BA1, 8206>18 leshort 202 Beyond BA2, 8207>18 leshort 203 XMOS xCORE, 8208>18 leshort 204 Microchip 8-bit PIC(r), 8209>18 leshort 210 KM211 KM32, 8210>18 leshort 211 KM211 KMX32, 8211>18 leshort 212 KM211 KMX16, 8212>18 leshort 213 KM211 KMX8, 8213>18 leshort 214 KM211 KVARC, 8214>18 leshort 215 Paneve CDP, 8215>18 leshort 216 Cognitive Smart Memory, 8216>18 leshort 217 iCelero CoolEngine, 8217>18 leshort 218 Nanoradio Optimized RISC, 8218>18 leshort 243 UCB RISC-V, 8219>18 leshort 0x1057 AVR (unofficial), 8220>18 leshort 0x1059 MSP430 (unofficial), 8221>18 leshort 0x1223 Adapteva Epiphany (unofficial), 8222>18 leshort 0x2530 Morpho MT (unofficial), 8223>18 leshort 0x3330 FR30 (unofficial), 8224>18 leshort 0x3426 OpenRISC (obsolete), 8225>18 leshort 0x4688 Infineon C166 (unofficial), 8226>18 leshort 0x5441 Cygnus FRV (unofficial), 8227>18 leshort 0x5aa5 DLX (unofficial), 8228>18 leshort 0x7650 Cygnus D10V (unofficial), 8229>18 leshort 0x7676 Cygnus D30V (unofficial), 8230>18 leshort 0x8217 Ubicom IP2xxx (unofficial), 8231>18 leshort 0x8472 OpenRISC (obsolete), 8232>18 leshort 0x9025 Cygnus PowerPC (unofficial), 8233>18 leshort 0x9026 Alpha (unofficial), 8234>18 leshort 0x9041 Cygnus M32R (unofficial), 8235>18 leshort 0x9080 Cygnus V850 (unofficial), 8236>18 leshort 0xa390 IBM S/390 (obsolete), 8237>18 leshort 0xabc7 Old Xtensa (unofficial), 8238>18 leshort 0xad45 xstormy16 (unofficial), 8239>18 leshort 0xbaab Old MicroBlaze (unofficial),, 8240>18 leshort 0xbeef Cygnus MN10300 (unofficial), 8241>18 leshort 0xdead Cygnus MN10200 (unofficial), 8242>18 leshort 0xf00d Toshiba MeP (unofficial), 8243>18 leshort 0xfeb0 Renesas M32C (unofficial), 8244>18 leshort 0xfeba Vitesse IQ2000 (unofficial), 8245>18 leshort 0xfebb NIOS (unofficial), 8246>18 leshort 0xfeed Moxie (unofficial), 8247>18 default x 8248>>18 leshort x *unknown arch 0x%x* 8249>20 lelong 0 invalid version 8250>20 lelong 1 version 1 8251 82520 string \177ELF ELF 8253!:strength *2 8254>4 byte 0 invalid class 8255>4 byte 1 32-bit 8256>4 byte 2 64-bit 8257>5 byte 0 invalid byte order 8258>5 byte 1 LSB 8259>>0 use elf-le 8260>5 byte 2 MSB 8261>>0 use \^elf-le 8262>7 byte 0 (SYSV) 8263>7 byte 1 (HP-UX) 8264>7 byte 2 (NetBSD) 8265>7 byte 3 (GNU/Linux) 8266>7 byte 4 (GNU/Hurd) 8267>7 byte 5 (86Open) 8268>7 byte 6 (Solaris) 8269>7 byte 7 (Monterey) 8270>7 byte 8 (IRIX) 8271>7 byte 9 (FreeBSD) 8272>7 byte 10 (Tru64) 8273>7 byte 11 (Novell Modesto) 8274>7 byte 12 (OpenBSD) 8275>7 byte 13 (OpenVMS) 8276>7 byte 14 (HP NonStop Kernel) 8277>7 byte 15 (AROS Research Operating System) 8278>7 byte 16 (FenixOS) 8279>7 byte 17 (Nuxi CloudABI) 8280>7 byte 97 (ARM) 8281>7 byte 255 (embedded) 8282 8283#------------------------------------------------------------------------------ 8284# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $ 8285# encore: file(1) magic for Encore machines 8286# 8287# XXX - needs to have the byte order specified (NS32K was little-endian, 8288# dunno whether they run the 88K in little-endian mode or not). 8289# 82900 short 0x154 Encore 8291>20 short 0x107 executable 8292>20 short 0x108 pure executable 8293>20 short 0x10b demand-paged executable 8294>20 short 0x10f unsupported executable 8295>12 long >0 not stripped 8296>22 short >0 - version %d 8297>22 short 0 - 8298#>4 date x stamp %s 82990 short 0x155 Encore unsupported executable 8300>12 long >0 not stripped 8301>22 short >0 - version %d 8302>22 short 0 - 8303#>4 date x stamp %s 8304 8305#------------------------------------------------------------------------------ 8306# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $ 8307# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 8308# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 8309# Useful information for improving this file can be found at: 8310# http://software.frodo.looijaard.name/psiconv/formats/Index.html 8311#------------------------------------------------------------------------------ 83120 lelong 0x10000037 Psion Series 5 8313>4 lelong 0x10000039 font file 8314>4 lelong 0x1000003A printer driver 8315>4 lelong 0x1000003B clipboard 8316>4 lelong 0x10000042 multi-bitmap image 8317!:mime image/x-epoc-mbm 8318>4 lelong 0x1000006A application information file 8319>4 lelong 0x1000006D 8320>>8 lelong 0x1000007D Sketch image 8321!:mime image/x-epoc-sketch 8322>>8 lelong 0x1000007E voice note 8323>>8 lelong 0x1000007F Word file 8324!:mime application/x-epoc-word 8325>>8 lelong 0x10000085 OPL program (TextEd) 8326!:mime application/x-epoc-opl 8327>>8 lelong 0x10000087 Comms settings 8328>>8 lelong 0x10000088 Sheet file 8329!:mime application/x-epoc-sheet 8330>>8 lelong 0x100001C4 EasyFax initialisation file 8331>4 lelong 0x10000073 OPO module 8332!:mime application/x-epoc-opo 8333>4 lelong 0x10000074 OPL application 8334!:mime application/x-epoc-app 8335>4 lelong 0x1000008A exported multi-bitmap image 8336>4 lelong 0x1000016D 8337>>8 lelong 0x10000087 Comms names 8338 83390 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 8340 83410 lelong 0x10000050 Psion Series 5 8342>4 lelong 0x1000006D database 8343>>8 lelong 0x10000084 Agenda file 8344!:mime application/x-epoc-agenda 8345>>8 lelong 0x10000086 Data file 8346!:mime application/x-epoc-data 8347>>8 lelong 0x10000CEA Jotter file 8348!:mime application/x-epoc-jotter 8349>4 lelong 0x100000E4 ini file 8350 83510 lelong 0x10000079 Psion Series 5 binary: 8352>4 lelong 0x00000000 DLL 8353>4 lelong 0x10000049 comms hardware library 8354>4 lelong 0x1000004A comms protocol library 8355>4 lelong 0x1000005D OPX 8356>4 lelong 0x1000006C application 8357>4 lelong 0x1000008D DLL 8358>4 lelong 0x100000AC logical device driver 8359>4 lelong 0x100000AD physical device driver 8360>4 lelong 0x100000E5 file transfer protocol 8361>4 lelong 0x100000E5 file transfer protocol 8362>4 lelong 0x10000140 printer definition 8363>4 lelong 0x10000141 printer definition 8364 83650 lelong 0x1000007A Psion Series 5 executable 8366 8367#------------------------------------------------------------------------------ 8368# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $ 8369# erlang: file(1) magic for Erlang JAM and BEAM files 8370# URL: http://www.erlang.org/faq/x779.html#AEN812 8371 8372# OTP R3-R4 83730 string \0177BEAM! Old Erlang BEAM file 8374>6 short >0 - version %d 8375 8376# OTP R5 and onwards 83770 string FOR1 8378>8 string BEAM Erlang BEAM file 8379 8380# 4.2 version may have a copyright notice! 83814 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 838279 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 8383 83844 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 8385 83860 bequad 0x0000000000ABCDEF Erlang DETS file 8387 8388#------------------------------------------------------------------------------ 8389# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $ 8390# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 8391# Based on info from 8392# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 83930 belong 9994 ESRI Shapefile 8394>4 belong =0 8395>8 belong =0 8396>12 belong =0 8397>16 belong =0 8398>20 belong =0 8399>28 lelong x version %d 8400>24 belong x length %d 8401>32 lelong =0 type Null Shape 8402>32 lelong =1 type Point 8403>32 lelong =3 type PolyLine 8404>32 lelong =5 type Polygon 8405>32 lelong =8 type MultiPoint 8406>32 lelong =11 type PointZ 8407>32 lelong =13 type PolyLineZ 8408>32 lelong =15 type PolygonZ 8409>32 lelong =18 type MultiPointZ 8410>32 lelong =21 type PointM 8411>32 lelong =23 type PolyLineM 8412>32 lelong =25 type PolygonM 8413>32 lelong =28 type MultiPointM 8414>32 lelong =31 type MultiPatch 8415 8416#------------------------------------------------------------------------------ 8417# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 8418# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 8419# From Roger Leigh <roger@whinlatter.uklinux.net> 84200 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 84210 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 84220 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 8423 8424#------------------------------------------------------------------------------ 8425# $File: filesystems,v 1.120 2017/03/24 19:29:26 christos Exp $ 8426# filesystems: file(1) magic for different filesystems 8427# 84280 name partid 8429>0 ubyte 0x00 Unused 8430>0 ubyte 0x01 12-bit FAT 8431>0 ubyte 0x02 XENIX / 8432>0 ubyte 0x03 XENIX /usr 8433>0 ubyte 0x04 16-bit FAT, less than 32M 8434>0 ubyte 0x05 extended partition 8435>0 ubyte 0x06 16-bit FAT, more than 32M 8436>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 8437>0 ubyte 0x08 AIX or os, or etc. 8438>0 ubyte 0x09 AIX boot partition or Coherent 8439>0 ubyte 0x0a O/2 boot manager or Coherent swap 8440>0 ubyte 0x0b 32-bit FAT 8441>0 ubyte 0x0c 32-bit FAT, LBA-mapped 8442>0 ubyte 0x0d 7XXX, LBA-mapped 8443>0 ubyte 0x0e 16-bit FAT, LBA-mapped 8444>0 ubyte 0x0f extended partition, LBA-mapped 8445>0 ubyte 0x10 OPUS 8446>0 ubyte 0x11 OS/2 DOS 12-bit FAT 8447>0 ubyte 0x12 Compaq diagnostics 8448>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 8449>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 8450>0 ubyte 0x17 OS/2 hidden IFS 8451>0 ubyte 0x18 AST Windows swapfile 8452>0 ubyte 0x19 Willowtech Photon coS 8453>0 ubyte 0x1b hidden win95 fat 32 8454>0 ubyte 0x1c hidden win95 fat 32 lba 8455>0 ubyte 0x1d hidden win95 fat 16 lba 8456>0 ubyte 0x20 Willowsoft OFS1 8457>0 ubyte 0x21 reserved 8458>0 ubyte 0x23 reserved 8459>0 ubyte 0x24 NEC DOS 8460>0 ubyte 0x26 reserved 8461>0 ubyte 0x31 reserved 8462>0 ubyte 0x32 Alien Internet Services NOS 8463>0 ubyte 0x33 reserved 8464>0 ubyte 0x34 reserved 8465>0 ubyte 0x35 JFS on OS2 8466>0 ubyte 0x36 reserved 8467>0 ubyte 0x38 Theos 8468>0 ubyte 0x39 Plan 9, or Theos spanned 8469>0 ubyte 0x3a Theos ver 4 4gb partition 8470>0 ubyte 0x3b Theos ve 4 extended partition 8471>0 ubyte 0x3c PartitionMagic recovery 8472>0 ubyte 0x3d Hidden Netware 8473>0 ubyte 0x40 VENIX 286 or LynxOS 8474>0 ubyte 0x41 PReP 8475>0 ubyte 0x42 linux swap sharing DRDOS disk 8476>0 ubyte 0x43 linux sharing DRDOS disk 8477>0 ubyte 0x44 GoBack change utility 8478>0 ubyte 0x45 Boot US Boot manager 8479>0 ubyte 0x46 EUMEL/Elan or Ergos 3 8480>0 ubyte 0x47 EUMEL/Elan or Ergos 3 8481>0 ubyte 0x48 EUMEL/Elan or Ergos 3 8482>0 ubyte 0x4a ALFX/THIN filesystem for DOS 8483>0 ubyte 0x4c Oberon partition 8484>0 ubyte 0x4d QNX4.x 8485>0 ubyte 0x4e QNX4.x 2nd part 8486>0 ubyte 0x4f QNX4.x 3rd part 8487>0 ubyte 0x50 DM (disk manager) 8488>0 ubyte 0x51 DM6 Aux1 (or Novell) 8489>0 ubyte 0x52 CP/M or Microport SysV/AT 8490>0 ubyte 0x53 DM6 Aux3 8491>0 ubyte 0x54 DM6 DDO 8492>0 ubyte 0x55 EZ-Drive (disk manager) 8493>0 ubyte 0x56 Golden Bow (disk manager) 8494>0 ubyte 0x57 Drive PRO 8495>0 ubyte 0x5c Priam Edisk (disk manager) 8496>0 ubyte 0x61 SpeedStor 8497>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 8498>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 8499>0 ubyte 0x65 Novell Netware 3.xx 8500>0 ubyte 0x66 Novell 386 Netware 8501>0 ubyte 0x67 Novell 8502>0 ubyte 0x68 Novell 8503>0 ubyte 0x69 Novell 8504>0 ubyte 0x70 DiskSecure Multi-Boot 8505>0 ubyte 0x71 reserved 8506>0 ubyte 0x73 reserved 8507>0 ubyte 0x74 reserved 8508>0 ubyte 0x75 PC/IX 8509>0 ubyte 0x76 reserved 8510>0 ubyte 0x77 M2FS/M2CS partition 8511>0 ubyte 0x78 XOSL boot loader filesystem 8512>0 ubyte 0x80 MINIX until 1.4a 8513>0 ubyte 0x81 MINIX since 1.4b 8514>0 ubyte 0x82 Linux swap or Solaris 8515>0 ubyte 0x83 Linux native 8516>0 ubyte 0x84 OS/2 hidden C: drive 8517>0 ubyte 0x85 Linux extended partition 8518>0 ubyte 0x86 NT FAT volume set 8519>0 ubyte 0x87 NTFS volume set or HPFS mirrored 8520>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 8521>0 ubyte 0x8b Legacy Fault tolerant FAT32 8522>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 8523>0 ubyte 0x8d Hidden free FDISK FAT12 8524>0 ubyte 0x8e Linux Logical Volume Manager 8525>0 ubyte 0x90 Hidden free FDISK FAT16 8526>0 ubyte 0x91 Hidden free FDISK DOS EXT 8527>0 ubyte 0x92 Hidden free FDISK FAT16 Big 8528>0 ubyte 0x93 Amoeba filesystem 8529>0 ubyte 0x94 Amoeba bad block table 8530>0 ubyte 0x95 MIT EXOPC native partitions 8531>0 ubyte 0x97 Hidden free FDISK FAT32 8532>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 8533>0 ubyte 0x99 Mylex EISA SCSI 8534>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 8535>0 ubyte 0x9b Hidden free FDISK EXT LBA 8536>0 ubyte 0x9f BSDI? 8537>0 ubyte 0xa0 IBM Thinkpad hibernation 8538>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 8539>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 8540>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 8541>0 ubyte 0xa5 386BSD partition type 8542>0 ubyte 0xa6 OpenBSD partition type 8543>0 ubyte 0xa7 NeXTSTEP 486 8544>0 ubyte 0xa8 Apple UFS 8545>0 ubyte 0xa9 NetBSD partition type 8546>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 8547>0 ubyte 0xab Apple Boot 8548>0 ubyte 0xae SHAG OS filesystem 8549>0 ubyte 0xaf Apple HFS 8550>0 ubyte 0xb0 BootStar Dummy 8551>0 ubyte 0xb1 reserved 8552>0 ubyte 0xb3 reserved 8553>0 ubyte 0xb4 reserved 8554>0 ubyte 0xb6 reserved 8555>0 ubyte 0xb7 BSDI BSD/386 filesystem 8556>0 ubyte 0xb8 BSDI BSD/386 swap 8557>0 ubyte 0xbb Boot Wizard Hidden 8558>0 ubyte 0xbe Solaris 8 partition type 8559>0 ubyte 0xbf Solaris partition type 8560>0 ubyte 0xc0 CTOS 8561>0 ubyte 0xc1 DRDOS/sec (FAT-12) 8562>0 ubyte 0xc2 Hidden Linux 8563>0 ubyte 0xc3 Hidden Linux swap 8564>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 8565>0 ubyte 0xc5 DRDOS/sec (EXT) 8566>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 8567>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 8568>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 8569>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 8570>0 ubyte 0xca Reserved for DR-DOS 8.0+ 8571>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 8572>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 8573>0 ubyte 0xcd CTOS Memdump 8574>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 8575>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 8576>0 ubyte 0xd0 REAL/32 secure big partition 8577>0 ubyte 0xd1 Old Multiuser DOS FAT12 8578>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 8579>0 ubyte 0xd5 Old Multiuser DOS Extended 8580>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 8581>0 ubyte 0xd8 CP/M 86 8582>0 ubyte 0xdb CP/M or Concurrent CP/M 8583>0 ubyte 0xdd Hidden CTOS Memdump 8584>0 ubyte 0xde Dell PowerEdge Server utilities 8585>0 ubyte 0xdf DG/UX virtual disk manager 8586>0 ubyte 0xe0 STMicroelectronics ST AVFS 8587>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 8588>0 ubyte 0xe3 DOS R/O or Storage Dimensions 8589>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 8590>0 ubyte 0xe5 reserved 8591>0 ubyte 0xe6 reserved 8592>0 ubyte 0xeb BeOS 8593>0 ubyte 0xee GPT Protective MBR 8594>0 ubyte 0xef EFI system partition 8595>0 ubyte 0xf0 Linux PA-RISC boot loader 8596>0 ubyte 0xf1 SpeedStor or Storage Dimensions 8597>0 ubyte 0xf2 DOS 3.3+ Secondary 8598>0 ubyte 0xf3 reserved 8599>0 ubyte 0xf4 SpeedStor large partition 8600>0 ubyte 0xf5 Prologue multi-volumen partition 8601>0 ubyte 0xf6 reserved 8602>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 8603>0 ubyte 0xfa Bochs x86 emulator 8604>0 ubyte 0xfb VMware File System 8605>0 ubyte 0xfc VMware Swap 8606>0 ubyte 0xfd Linux RAID partition persistent sb 8607>0 ubyte 0xfe LANstep or IBM PS/2 IML 8608>0 ubyte 0xff Xenix Bad Block Table 8609 86100 string \366\366\366\366 PC formatted floppy with no filesystem 8611# Sun disk labels 8612# From /usr/include/sun/dklabel.h: 86130774 beshort 0xdabe 8614# modified by Joerg Jenderek, because original test 8615# succeeds for Cabinet archive dao360.dl_ with negative blocks 8616>0770 long >0 Sun disk label 8617>>0 string x '%s 8618>>>31 string >\0 \b%s 8619>>>>63 string >\0 \b%s 8620>>>>>95 string >\0 \b%s 8621>>0 string x \b' 8622>>0734 short >0 %d rpm, 8623>>0736 short >0 %d phys cys, 8624>>0740 short >0 %d alts/cyl, 8625>>0746 short >0 %d interleave, 8626>>0750 short >0 %d data cyls, 8627>>0752 short >0 %d alt cyls, 8628>>0754 short >0 %d heads/partition, 8629>>0756 short >0 %d sectors/track, 8630>>0764 long >0 start cyl %d, 8631>>0770 long x %d blocks 8632# Is there a boot block written 1 sector in? 8633>512 belong&077777777 0600407 \b, boot block present 8634 8635# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 8636# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 86370 string SBMBAKUP_ Smart Boot Manager backup file 8638>9 string x \b, version %-5.5s 8639>>14 string =_ 8640>>>15 string x %-.1s 8641>>>>16 string =_ \b. 8642>>>>>17 string x \b%-.1s 8643>>>>>>18 string =_ \b. 8644>>>>>>>19 string x \b%-.1s 8645>>>22 ubyte 0 8646>>>>21 ubyte x \b, from drive 0x%x 8647>>>22 ubyte >0 8648>>>>21 string x \b, from drive %s 8649>>>535 search/17 \x55\xAA 8650>>>>&-512 indirect x \b; contains 8651 8652# updated by Joerg Jenderek at Nov 2012 8653# DOS Emulator image is 128 byte, null right padded header + harddisc image 86540 string DOSEMU\0 8655>0x27E leshort 0xAA55 8656#offset is 128 8657>>19 ubyte 128 8658>>>(19.b-1) ubyte 0x0 DOS Emulator image 8659>>>>7 ulelong >0 \b, %u heads 8660>>>>11 ulelong >0 \b, %d sectors/track 8661>>>>15 ulelong >0 \b, %d cylinders 8662>>>>128 indirect x \b; contains 8663 8664# added by Joerg Jenderek at Nov 2012 8665# http://www.thenakedpc.com/articles/v04/08/0408-05.html 8666# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 86670 string PNCIHISK\0 Norton Utilities disc image data 8668# real x86 boot sector with jump instruction 8669>509 search/1026 \x55\xAA\xeb 8670>>&-1 indirect x \b; contains 8671# http://file-extension.net/seeker/file_extension_dat 86720 string PNCIUNDO Norton Disk Doctor UnDo file 8673# 8674 8675# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 8676# for any allowed sector sizes 867730 search/481 \x55\xAA 8678# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 8679# DOS BPB information (70) and after DOS floppy (120) like in previous file version 8680!:strength +65 8681# for sector sizes < 512 Bytes 8682>11 uleshort <512 8683>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 8684# for sector sizes with 512 or more Bytes 8685>0x1FE leshort 0xAA55 DOS/MBR boot sector 8686 8687# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 8688# only for sector sizes with 512 or more Bytes 86890x1FE leshort 0xAA55 DOS/MBR boot sector 8690# 8691# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 8692!:strength +65 8693>2 string OSBS OS/BS MBR 8694# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/ 8695# and http://en.wikipedia.org/wiki/Master_Boot_Record 8696# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 8697# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 8698>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 8699# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 8700# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 8701>>8 ubequad 0x8bf45007501ffbfc 8702# http://thestarman.pcministry.com/asm/mbr/200MBR.htm 8703>>>0x16 ubyte 0xF3 \b,DOS 2 8704>>>>219 regex Author\ -\ Author: 8705# found "David Litton" , "A Pehrsson " 8706>>>>>&0 string x "%s" 8707>>>0x16 ubyte 0xF2 8708# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 8709# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 8710>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 8711# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 8712>>>>0x22 default x \b,D0S version 3.3-7.0 8713# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 8714# where nn is string offset varying for different languages 8715# "Invalid partition table" nn=0x8b for english version 8716>>>>>(0x49.b) string Invalid\ partition\ table english 8717>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 8718>>>>>(0x49.b) string Table\ de\ partition\ invalide french 8719>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 8720>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 8721>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 8722>>>>>0x49 ubyte >0 at offset 0x%x 8723>>>>>>(0x49.b) string >\0 "%s" 8724# "Error loading operating system" nn=0xa3 for english version 8725# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 8726# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 8727# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 8728# "Error al cargar sistema operativo" nn=0xa8 for spanish version 8729# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 8730>>>>>0x74 ubyte >0 at offset 0x%x 8731>>>>>>(0x74.b) string >\0 "%s" 8732# "Missing operating system" nn=0xc2 for english version 8733# "Betriebssystem fehlt" nn=0xcd for german version 8734# "Syst\212me d'exploitation absent" nn=0xd2 for french version 8735# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 8736# "Falta sistema operativo" nn=0xca for spanish version 8737# "Sistema operativo mancante" nn=0xe2 for italian version 8738>>>>>0x79 ubyte >0 at offset 0x%x 8739>>>>>>(0x79.b) string >\0 "%s" 8740# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 8741# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 8742>>8 ubequad 0x5007501ffcbe1b7c 8743# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 8744>>>24 ubequad 0xf3a4cbbebe07b104 9M 8745# "Invalid partition table" nn=0x10F for english version 8746# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 8747# "Table de partition erron\202e" nn=0x10F for french version 8748# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 8749>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 8750>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 8751>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 8752>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 8753>>>>0x3C ubyte x at offset 0x%x+0xFF 8754>>>>(0x3C.b+0x0FF) string >\0 "%s" 8755# "Error loading operating system" nn=0x127 for english version 8756# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 8757# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 8758# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 8759>>>>0xBD ubyte x at offset 0x1%x 8760>>>>(0xBD.b+0x100) string >\0 "%s" 8761# "Missing operating system" nn=0x146 for english version 8762# "Betriebssystem fehlt" nn=0x151 for german version 8763# "Syst\212me d'exploitation manquant" nn=0x15e for french version 8764# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 8765>>>>0xA9 ubyte x at offset 0x1%x 8766>>>>(0xA9.b+0x100) string >\0 "%s" 8767# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 8768# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 8769>>>24 ubequad 0xf3a4cbbdbe07b104 XP 8770# where xxyyzz are lower bits from offsets of error messages varying for different languages 8771>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 8772>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 8773# "Invalid partition table" xx=0x12C for english version 8774# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 8775>>>>0x1b5 ubyte >0 at offset 0x1%x 8776>>>>(0x1b5.b+0x100) string >\0 "%s" 8777# "Error loading operating system" yy=0x144 for english version 8778# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 8779>>>>0x1b6 ubyte >0 at offset 0x1%x 8780>>>>(0x1b6.b+0x100) string >\0 "%s" 8781# "Missing operating system" zz=0x163 for english version 8782# "Betriebssystem nicht vorhanden" zz=0x16e for german version 8783>>>>0x1b7 ubyte >0 at offset 0x1%x 8784>>>>(0x1b7.b+0x100) string >\0 "%s" 8785# Microsoft Windows Vista or 7 8786# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 8787>>8 ubequad 0xc08ed8be007cbf00 8788# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 8789# assembler instructions: jnz 0729;cmp ebx,"TCPA" 8790>>>0xEC ubequad 0x753b6681fb544350 Vista 8791# where xxyyzz are lower bits from offsets of error messages varying for different languages 8792>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 8793#>>>>0x1B4 ubelong&0x00FFFFFF ? german 8794# "Invalid partition table" xx=0x162 for english version 8795# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 8796>>>>0x1b5 ubyte >0 at offset 0x1%x 8797>>>>(0x1b5.b+0x100) string >\0 "%s" 8798# "Error loading operating system" yy=0x17a for english version 8799# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 8800>>>>0x1b6 ubyte >0 at offset 0x1%x 8801>>>>(0x1b6.b+0x100) string >\0 "%s" 8802# "Missing operating system" zz=0x199 for english version 8803# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 8804>>>>0x1b7 ubyte >0 at offset 0x1%x 8805>>>>(0x1b7.b+0x100) string >\0 "%s" 8806# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 8807# assembler instructions: cmp ebx,"TCPA";cmp 8808>>>0xEC ubequad 0x6681fb5443504175 Windows 7 8809# where xxyyzz are lower bits from offsets of error messages varying for different languages 8810>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 8811#>>>>0x1B4 ubelong&0x00FFFFFF ? german 8812# "Invalid partition table" xx=0x163 for english version 8813# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 8814>>>>0x1b5 ubyte >0 at offset 0x1%x 8815>>>>(0x1b5.b+0x100) string >\0 "%s" 8816# "Error loading operating system" yy=0x17b for english version 8817# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 8818>>>>0x1b6 ubyte >0 at offset 0x1%x 8819>>>>(0x1b6.b+0x100) string >\0 "%s" 8820# "Missing operating system" zz=0x19a for english version 8821# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 8822>>>>0x1b7 ubyte >0 at offset 0x1%x 8823>>>>(0x1b7.b+0x100) string >\0 "%s" 8824# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 8825# http://en.wikipedia.org/wiki/MBR_disk_signature#ID 8826>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 8827# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm 8828>>0xDA uleshort 0 8829>>>0xDC ulelong >0 \b, created 8830# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 8831>>>>0xDC ubyte x with driveID 0x%x 8832# hours, minutes and seconds 8833>>>>0xDf ubyte x at %x 8834>>>>0xDe ubyte x \b:%x 8835>>>>0xDd ubyte x \b:%x 8836# special case for Microsoft MS-DOS 3.21 spanish 8837# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 8838>0 ubequad 0xfab830008ed0bc00 8839# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 8840>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 8841# Microsoft MBR IPL end 8842 8843# dr-dos with some upper-, lowercase variants 8844>0x9D string Invalid\ partition\ table$ 8845>>181 string No\ Operating\ System$ 8846>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 8847>0x9D string Invalid\ partition\ table$ 8848>>181 string No\ operating\ system$ 8849>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 8850>342 string Invalid\ partition\ table$ 8851>>366 string No\ operating\ system$ 8852>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 8853>295 string NEWLDR\0 8854>>302 string Bad\ PT\ $ 8855>>>310 string No\ OS\ $ 8856>>>>317 string OS\ load\ err$ 8857>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 8858>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 8859>>>>>>>387 string Copyright\ (c)\ 1984,1998 8860>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 8861# 8862# tests for different MS-DOS Master Boot Records (MBR) moved and merged 8863# 8864#>0x145 string Default:\ F \b, FREE-DOS MBR 8865#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 8866>0x145 search/7 Default:\ F \b, FREE-DOS MBR 8867#>>313 string F0\ .\ .\ . 8868#>>>322 string disk\ 1 8869#>>>>382 string FAT3 8870>64 string no\ active\ partition\ found 8871>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 8872# Ranish Partition Manager http://www.ranish.com/part/ 8873>387 search/4 \0\ Error!\r 8874>>378 search/7 Virus! 8875>>>397 search/4 Booting\040 8876>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 8877>>>>>416 string Writing\ changes... \b2.37 8878>>>>>>438 ubyte x \b,0x%x dots 8879>>>>>>440 ubyte >0 \b,virus check 8880>>>>>>441 ubyte >0 \b,partition %c 8881#2.38,2.42,2.44 8882>>>>>416 string !Writing\ changes... \b 8883>>>>>>418 ubyte 1 \bvirus check, 8884>>>>>>419 ubyte x \b0x%x seconds 8885>>>>>>420 ubyte&0x0F >0 \b,partition 8886>>>>>>>420 ubyte&0x0F <5 \b %x 8887>>>>>>>420 ubyte&0x0F 0Xf \b ask 8888>>>>>420 ubyte x \b) 8889# 8890# SYSLINUX MBR moved 8891# http://www.acronis.de/ 8892>362 string MBR\ Error\ \0\r 8893>>376 string ress\ any\ key\ to\040 8894>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 8895# added by Joerg Jenderek 8896# http://www.visopsys.org/ 8897# http://partitionlogic.org.uk/ 8898>309 string No\ bootable\ partition\ found\r 8899>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 8900>349 string No\ bootable\ partition\ found\r 8901>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 8902# bootloader, bootmanager 8903>0x40 string SBML 8904# label with 11 characters of FAT 12 bit filesystem 8905>>43 string SMART\ BTMGR 8906>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 8907# OEM-ID not always "SBM" 8908#>>>>3 strings SBM 8909>>>>6 string >\0 \b, version %s 8910>382 string XOSLLOADXCF \b, eXtended Operating System Loader 8911>6 string LILO \b, LInux i386 boot LOader 8912>>120 string LILO \b, version 22.3.4 SuSe 8913>>172 string LILO \b, version 22.5.8 Debian 8914# updated by Joerg Jenderek at Oct 2008 8915# variables according to grub-0.97/stage1/stage1.S or 8916# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 8917# usual values are marked with comments to get only informations of strange GRUB loaders 8918>342 search/60 \0Geom\0 8919#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 8920>>0x41 ubyte <2 8921>>>0x3E ubyte >2 \b; GRand Unified Bootloader 8922# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 8923>>>>0x3E ubyte x \b, stage1 version 0x%x 8924#If it is 0xFF, use a drive passed by BIOS 8925>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 8926# in most case 0,1,0x2e for GRUB 0.5.95 8927>>>>0x41 ubyte >0 \b, LBA flag 0x%x 8928>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 8929#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 8930>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 8931#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 8932>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 8933>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 8934#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 8935>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 8936>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 8937>>>>>394 string stage1 \b, GRUB version 0.5.95 8938>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 8939>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 8940>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 8941>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 8942>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 8943>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 8944>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 8945>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 8946# unknown version 8947>>>343 string Geom\0Read\0\ Error\0 8948>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 8949>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 8950>>>>374 string GRUB\ \0 \b, GRUB version n.m 8951# SYSLINUX bootloader moved 8952>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 8953# http://www.bcdwb.de/bcdw/index_e.htm 8954>3 string BCDL 8955>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 8956# mbr partition table entries updated by Joerg Jenderek at Sep 2013 8957# skip Norton Utilities disc image data 8958>3 string !IHISK 8959# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; 8960>>0 belong !0xb8c0078e 8961# not Linux kernel 8962>>>514 string !HdrS 8963# not BeOS 8964>>>>422 string !Be\ Boot\ Loader 8965# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 8966>>>>>0 ubelong&0xFD000000 =0xE9000000 8967# AdvanceMAME mbr 8968>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 8969>>>>>>>446 use partition-table 8970# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 8971>>>>>0 ubelong&0xFD000000 !0xE9000000 8972# skip FSInfosector 8973>>>>>>0 string !RRaA 8974# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 8975# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 8976>>>>>>>0 ubequad !0xfa660fb64610668b 8977# skip 13rd sector of MS x86 bootloader 8978>>>>>>>>0 ubequad !0x660fb64610668b4e 8979# skip sector starting with DOS new line 8980>>>>>>>>>0 string !\r\n 8981# allowed active flag 0,80h-FFh 8982>>>>>>>>>>446 ubyte 0 8983>>>>>>>>>>>446 use partition-table 8984>>>>>>>>>>446 ubyte >0x7F 8985>>>>>>>>>>>446 use partition-table 8986# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 8987# mbr partition table entries end 8988# http://www.acronis.de/ 8989#FAT label=ACRONIS\ SZ 8990#OEM-ID=BOOTWIZ0 8991>442 string Non-system\ disk,\040 8992>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 8993# updated by Joerg Jenderek at Nov 2012, Sep 2013 8994# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 8995# display 1 space 8996>>>447 ubyte x \b 8997>>>477 use DOS-filename 8998# 8999>185 string FDBOOT\ Version\040 9000>>204 string \rNo\ Systemdisk.\040 9001>>>220 string Booting\ from\ harddisk.\n\r 9002>>>245 string Cannot\ load\ from\ harddisk.\n\r 9003>>>>273 string Insert\ Systemdisk\040 9004>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 9005>>>>>>200 string >\0 \b, version %-3s 9006>242 string Bootsector\ from\ C.H.\ Hochst\204 9007# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 9008# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 9009# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 9010>242 search/127 Bootsector\ from\ C.H.\ Hochst 9011>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 9012# followed by variants with point,CR-NL or NL-CR 9013>>>208 search/261 Cannot\ load\ from\ harddisk. 9014# followed by variants CR-NL or NL-CR 9015>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 9016# followed by variants with point,CR-NL or NL-CR 9017>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 9018# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 9019>>>>>>&0 string x \b, version %-4.4s 9020>(1.b+2) ubyte 0xe 9021>>(1.b+3) ubyte 0x1f 9022>>>(1.b+4) ubyte 0xbe 9023# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 9024>>>>(1.b+5) ubyte&0xd3 0x53 9025>>>>>(1.b+6) ubyte 0x7c 9026# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 9027>>>>>>(1.b+7) ubyte 0xac 9028>>>>>>>(1.b+8) ubyte 0x22 9029>>>>>>>>(1.b+9) ubyte 0xc0 9030>>>>>>>>>(1.b+10) ubyte 0x74 9031>>>>>>>>>>(1.b+11) ubyte 0x0b 9032>>>>>>>>>>>(1.b+12) ubyte 0x56 9033>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 9034# FAT1X version 9035>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 9036>>>>>>>>>>>>>>0x5b string >\0 "%-s" 9037# FAT32 version 9038>>>>>>>>>>>>>(1.b+5) ubyte 0x77 9039>>>>>>>>>>>>>>0x77 string >\0 "%-s" 9040>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 9041#>>244 string from\ dosemu-freedos-*-bin.tgz\r 9042#>>>170 string Sorry,\ could\ not\ load\ an\040 9043#>>>>195 string operating\ system.\r\n 9044# 9045>103 string This\ is\ not\ a\ bootable\ disk.\040 9046>>132 string Please\ insert\ a\ bootable\040 9047>>>157 string floppy\ and\r\n 9048>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 9049# 9050>66 string Solaris\ Boot\ Sector 9051>>99 string Incomplete\ MDBoot\ load. 9052>>>89 string Version \b, Sun Solaris Bootloader 9053>>>>97 byte x version %c 9054# 9055>408 string OS/2\ !!\ SYS01475\r\0 9056>>429 string OS/2\ !!\ SYS02025\r\0 9057>>>450 string OS/2\ !!\ SYS02027\r\0 9058>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 9059# 9060>409 string OS/2\ !!\ SYS01475\r\0 9061>>430 string OS/2\ !!\ SYS02025\r\0 9062>>>451 string OS/2\ !!\ SYS02027\r\0 9063>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 9064>112 string This\ disk\ is\ not\ bootable\r 9065>>142 string If\ you\ wish\ to\ make\ it\ bootable 9066>>>176 string run\ the\ DOS\ program\ SYS\040 9067>>>200 string after\ the\r 9068>>>>216 string system\ has\ been\ loaded\r\n 9069>>>>>242 string Please\ insert\ a\ DOS\ diskette\040 9070>>>>>271 string into\r\n\ the\ drive\ and\040 9071>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 9072# XP 9073>430 string NTLDR\ is\ missing\xFF\r\n 9074>>449 string Disk\ error\xFF\r\n 9075>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 9076# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 9077>>>>417 ubyte&0xDF >0 9078>>>>>417 string x %-.5s 9079>>>>>>422 ubyte&0xDF >0 9080>>>>>>>422 string x \b%-.3s 9081>>>>>425 ubyte&0xDF >0 9082>>>>>>425 string >\ \b.%-.3s 9083# 9084>>>>371 ubyte >0x20 9085>>>>>368 ubyte&0xDF >0 9086>>>>>>368 string x %-.5s 9087>>>>>>>373 ubyte&0xDF >0 9088>>>>>>>>373 string x \b%-.3s 9089>>>>>>376 ubyte&0xDF >0 9090>>>>>>>376 string x \b.%-.3s 9091# 9092>430 string NTLDR\ nicht\ gefunden\xFF\r\n 9093>>453 string Datentr\204gerfehler\xFF\r\n 9094>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 9095>>>>417 ubyte&0xDF >0 9096>>>>>417 string x %-.5s 9097>>>>>>422 ubyte&0xDF >0 9098>>>>>>>422 string x \b%-.3s 9099>>>>>425 ubyte&0xDF >0 9100>>>>>>425 string >\ \b.%-.3s 9101# offset variant 9102>>>>379 string \0 9103>>>>>368 ubyte&0xDF >0 9104>>>>>>368 string x %-.5s 9105>>>>>>>373 ubyte&0xDF >0 9106>>>>>>>>373 string x \b%-.3s 9107# 9108>430 string NTLDR\ fehlt\xFF\r\n 9109>>444 string Datentr\204gerfehler\xFF\r\n 9110>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 9111>>>>417 ubyte&0xDF >0 9112>>>>>417 string x %-.5s 9113>>>>>>422 ubyte&0xDF >0 9114>>>>>>>422 string x \b%-.3s 9115>>>>>425 ubyte&0xDF >0 9116>>>>>>425 string >\ \b.%-.3s 9117# variant 9118>>>>371 ubyte >0x20 9119>>>>>368 ubyte&0xDF >0 9120>>>>>>368 string x %-.5s 9121>>>>>>>373 ubyte&0xDF >0 9122>>>>>>>>373 string x \b%-.3s 9123>>>>>>376 ubyte&0xDF >0 9124>>>>>>>376 string x \b.%-.3s 9125# 9126>430 string NTLDR\ fehlt\xFF\r\n 9127>>444 string Medienfehler\xFF\r\n 9128>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 9129>>>>371 ubyte >0x20 9130>>>>>368 ubyte&0xDF >0 9131>>>>>>368 string x %-.5s 9132>>>>>>>373 ubyte&0xDF >0 9133>>>>>>>>373 string x \b%-.3s 9134>>>>>>376 ubyte&0xDF >0 9135>>>>>>>376 string x \b.%-.3s 9136# variant 9137>>>>417 ubyte&0xDF >0 9138>>>>>417 string x %-.5s 9139>>>>>>422 ubyte&0xDF >0 9140>>>>>>>422 string x \b%-.3s 9141>>>>>425 ubyte&0xDF >0 9142>>>>>>425 string >\ \b.%-.3s 9143# 9144>430 string Datentr\204ger\ entfernen\xFF\r\n 9145>>454 string Medienfehler\xFF\r\n 9146>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 9147>>>>379 string \0 9148>>>>>368 ubyte&0xDF >0 9149>>>>>>368 string x %-.5s 9150>>>>>>>373 ubyte&0xDF >0 9151>>>>>>>>373 string x \b%-.3s 9152>>>>>>376 ubyte&0xDF >0 9153>>>>>>>376 string x \b.%-.3s 9154# variant 9155>>>>417 ubyte&0xDF >0 9156>>>>>417 string x %-.5s 9157>>>>>>422 ubyte&0xDF >0 9158>>>>>>>422 string x \b%-.3s 9159>>>>>425 ubyte&0xDF >0 9160>>>>>>425 string >\ \b.%-.3s 9161# 9162 9163#>3 string NTFS\ \ \ \040 9164>389 string Fehler\ beim\ Lesen\040 9165>>407 string des\ Datentr\204gers 9166>>>426 string NTLDR\ fehlt 9167>>>>440 string NTLDR\ ist\ komprimiert 9168>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 9169#>3 string NTFS\ \ \ \040 9170>313 string A\ disk\ read\ error\ occurred.\r 9171>>345 string A\ kernel\ file\ is\ missing\040 9172>>>370 string from\ the\ disk.\r 9173>>>>484 string NTLDR\ is\ compressed 9174>>>>>429 string Insert\ a\ system\ diskette\040 9175>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 9176# DOS loader variants different languages,offsets 9177>472 ubyte&0xDF >0 9178>>389 string Invalid\ system\ disk\xFF\r\n 9179>>>411 string Disk\ I/O\ error 9180>>>>428 string Replace\ the\ disk,\ and\040 9181>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 9182#IO.SYS 9183>>>>>>472 ubyte&0xDF >0 9184>>>>>>>472 string x \b %-.2s 9185>>>>>>>>474 ubyte&0xDF >0 9186>>>>>>>>>474 string x \b%-.5s 9187>>>>>>>>>>479 ubyte&0xDF >0 9188>>>>>>>>>>>479 string x \b%-.1s 9189>>>>>>>480 ubyte&0xDF >0 9190>>>>>>>>480 string x \b.%-.3s 9191#MSDOS.SYS 9192>>>>>>>483 ubyte&0xDF >0 \b+ 9193>>>>>>>>483 string x \b%-.5s 9194>>>>>>>>>488 ubyte&0xDF >0 9195>>>>>>>>>>488 string x \b%-.3s 9196>>>>>>>>491 ubyte&0xDF >0 9197>>>>>>>>>491 string x \b.%-.3s 9198# 9199>>390 string Invalid\ system\ disk\xFF\r\n 9200>>>412 string Disk\ I/O\ error\xFF\r\n 9201>>>>429 string Replace\ the\ disk,\ and\040 9202>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 9203>>388 string Ungueltiges\ System\ \xFF\r\n 9204>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 9205>>>>427 string Datentraeger\ wechseln\ und\040 9206>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 9207#WINBOOT.SYS only not spaces (0xDF) 9208>>>>>>497 ubyte&0xDF >0 9209>>>>>>>497 string x %-.5s 9210>>>>>>>>502 ubyte&0xDF >0 9211>>>>>>>>>502 string x \b%-.1s 9212>>>>>>>>>>503 ubyte&0xDF >0 9213>>>>>>>>>>>503 string x \b%-.1s 9214>>>>>>>>>>>>504 ubyte&0xDF >0 9215>>>>>>>>>>>>>504 string x \b%-.1s 9216>>>>>>505 ubyte&0xDF >0 9217>>>>>>>505 string x \b.%-.3s 9218#IO.SYS 9219>>>>>>472 ubyte&0xDF >0 or 9220>>>>>>>472 string x \b %-.2s 9221>>>>>>>>474 ubyte&0xDF >0 9222>>>>>>>>>474 string x \b%-.5s 9223>>>>>>>>>>479 ubyte&0xDF >0 9224>>>>>>>>>>>479 string x \b%-.1s 9225>>>>>>>480 ubyte&0xDF >0 9226>>>>>>>>480 string x \b.%-.3s 9227#MSDOS.SYS 9228>>>>>>>483 ubyte&0xDF >0 \b+ 9229>>>>>>>>483 string x \b%-.5s 9230>>>>>>>>>488 ubyte&0xDF >0 9231>>>>>>>>>>488 string x \b%-.3s 9232>>>>>>>>491 ubyte&0xDF >0 9233>>>>>>>>>491 string x \b.%-.3s 9234# 9235>>390 string Ungueltiges\ System\ \xFF\r\n 9236>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 9237>>>>429 string Datentraeger\ wechseln\ und\040 9238>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 9239#WINBOOT.SYS only not spaces (0xDF) 9240>>>>>>497 ubyte&0xDF >0 9241>>>>>>>497 string x %-.7s 9242>>>>>>>>504 ubyte&0xDF >0 9243>>>>>>>>>504 string x \b%-.1s 9244>>>>>>505 ubyte&0xDF >0 9245>>>>>>>505 string x \b.%-.3s 9246#IO.SYS 9247>>>>>>472 ubyte&0xDF >0 or 9248>>>>>>>472 string x \b %-.2s 9249>>>>>>>>474 ubyte&0xDF >0 9250>>>>>>>>>474 string x \b%-.6s 9251>>>>>>>480 ubyte&0xDF >0 9252>>>>>>>>480 string x \b.%-.3s 9253#MSDOS.SYS 9254>>>>>>>483 ubyte&0xDF >0 \b+ 9255>>>>>>>>483 string x \b%-.5s 9256>>>>>>>>>488 ubyte&0xDF >0 9257>>>>>>>>>>488 string x \b%-.3s 9258>>>>>>>>491 ubyte&0xDF >0 9259>>>>>>>>>491 string x \b.%-.3s 9260# 9261>>389 string Ungueltiges\ System\ \xFF\r\n 9262>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 9263>>>>428 string Datentraeger\ wechseln\ und\040 9264>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 9265# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 9266>>>>>>472 string x %-.2s 9267>>>>>>>474 ubyte&0xDF >0 9268>>>>>>>>474 string x \b%-.5s 9269>>>>>>>>479 ubyte&0xDF >0 9270>>>>>>>>>479 string x \b%-.1s 9271>>>>>>480 ubyte&0xDF >0 9272>>>>>>>480 string x \b.%-.3s 9273>>>>>>483 ubyte&0xDF >0 \b+ 9274>>>>>>>483 string x \b%-.5s 9275>>>>>>>488 ubyte&0xDF >0 9276>>>>>>>>488 string x \b%-.2s 9277>>>>>>>>490 ubyte&0xDF >0 9278>>>>>>>>>490 string x \b%-.1s 9279>>>>>>>491 ubyte&0xDF >0 9280>>>>>>>>491 string x \b.%-.3s 9281>479 ubyte&0xDF >0 9282>>416 string Kein\ System\ oder\040 9283>>>433 string Laufwerksfehler 9284>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 9285#IO.SYS 9286>>>>>479 string x \b %-.2s 9287>>>>>>481 ubyte&0xDF >0 9288>>>>>>>481 string x \b%-.6s 9289>>>>>487 ubyte&0xDF >0 9290>>>>>>487 string x \b.%-.3s 9291#MSDOS.SYS 9292>>>>>>490 ubyte&0xDF >0 \b+ 9293>>>>>>>490 string x \b%-.5s 9294>>>>>>>>495 ubyte&0xDF >0 9295>>>>>>>>>495 string x \b%-.3s 9296>>>>>>>498 ubyte&0xDF >0 9297>>>>>>>>498 string x \b.%-.3s 9298# 9299>376 search/41 Non-System\ disk\ or\040 9300>>395 search/41 disk\ error\r 9301>>>407 search/41 Replace\ and\040 9302>>>>419 search/41 press\ \b, 9303>>>>419 search/41 strike\ \b, old 9304>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 9305#449 Disk\ Boot\ failure\r MS 3.21 9306#466 Boot\ Failure\r MS 3.30 9307>>>>>468 search/18 \0 9308#IO.SYS,IBMBIO.COM 9309>>>>>>&0 string x \b %-.2s 9310>>>>>>>&-20 ubyte&0xDF >0 9311>>>>>>>>&-1 string x \b%-.4s 9312>>>>>>>>>&-16 ubyte&0xDF >0 9313>>>>>>>>>>&-1 string x \b%-.2s 9314>>>>>>&8 ubyte&0xDF >0 \b. 9315>>>>>>>&-1 string x \b%-.3s 9316#MSDOS.SYS,IBMDOS.COM 9317>>>>>>&11 ubyte&0xDF >0 \b+ 9318>>>>>>>&-1 string x \b%-.5s 9319>>>>>>>>&-6 ubyte&0xDF >0 9320>>>>>>>>>&-1 string x \b%-.1s 9321>>>>>>>>>>&-5 ubyte&0xDF >0 9322>>>>>>>>>>>&-1 string x \b%-.2s 9323>>>>>>>&7 ubyte&0xDF >0 \b. 9324>>>>>>>>&-1 string x \b%-.3s 9325>441 string Cannot\ load\ from\ harddisk.\n\r 9326>>469 string Insert\ Systemdisk\040 9327>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 9328#>43 string \224R-LOADER\ \ SYS =label 9329>54 string SYS 9330>>324 string VASKK 9331>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 9332# 9333>98 string Press\ a\ key\ to\ retry\0\r 9334>>120 string Cannot\ find\ file\ \0\r 9335>>>139 string Disk\ read\ error\0\r 9336>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 9337#DRBIOS.SYS 9338>>>>>44 ubyte&0xDF >0 9339>>>>>>44 string x \b %-.6s 9340>>>>>>>50 ubyte&0xDF >0 9341>>>>>>>>50 string x \b%-.2s 9342>>>>>>52 ubyte&0xDF >0 9343>>>>>>>52 string x \b.%-.3s 9344# 9345>70 string IBMBIO\ \ COM 9346>>472 string Cannot\ load\ DOS!\040 9347>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 9348>>471 string Cannot\ load\ DOS\040 9349>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 9350#?? 9351>444 string KERNEL\ \ SYS 9352>>314 string BOOT\ error! \b, FREE-DOS Bootloader 9353>499 string KERNEL\ \ SYS 9354>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 9355>449 string KERNEL\ \ SYS 9356>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 9357# 9358>449 string Loading\ FreeDOS 9359>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 9360>>>497 ubyte&0xDF >0 9361>>>>497 string x \b %-.6s 9362>>>>>503 ubyte&0xDF >0 9363>>>>>>503 string x \b%-.1s 9364>>>>>>>504 ubyte&0xDF >0 9365>>>>>>>>504 string x \b%-.1s 9366>>>>505 ubyte&0xDF >0 9367>>>>>505 string x \b.%-.3s 9368# 9369>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 9370# 9371>125 string Loading\ FreeDOS...\r 9372>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 9373>>>441 ubyte&0xDF >0 9374>>>>441 string x \b %-.6s 9375>>>>>447 ubyte&0xDF >0 9376>>>>>>447 string x \b%-.1s 9377>>>>>>>448 ubyte&0xDF >0 9378>>>>>>>>448 string x \b%-.1s 9379>>>>449 ubyte&0xDF >0 9380>>>>>449 string x \b.%-.3s 9381>124 string FreeDOS\0 9382>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 9383# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 9384>>>497 ubyte&0xDF >0 9385>>>>497 string x \b %-.6s 9386>>>>>503 ubyte&0xDF >0 9387>>>>>>503 string x \b%-.1s 9388>>>>>>>504 ubyte&0xDF >0 9389>>>>>>>>504 string x \b%-.1s 9390>>>>505 ubyte&0xDF >0 9391>>>>>505 string x \b.%-.3s 9392>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 9393>>>497 ubyte&0xDF >0 9394>>>>497 string x \b %-.6s 9395>>>>>503 ubyte&0xDF >0 9396>>>>>>503 string x \b%-.1s 9397>>>>>>>504 ubyte&0xDF >0 9398>>>>>>>>504 string x \b%-.1s 9399>>>>505 ubyte&0xDF >0 9400>>>>>505 string x \b.%-.3s 9401>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 9402>>>497 ubyte&0xDF >0 9403>>>>497 string x \b %-.6s 9404>>>>>503 ubyte&0xDF >0 9405>>>>>>503 string x \b%-.1s 9406>>>>>>>504 ubyte&0xDF >0 9407>>>>>>>>504 string x \b%-.1s 9408>>>>505 ubyte&0xDF >0 9409>>>>>505 string x \b.%-.3s 9410>336 string Error!\040 9411>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 9412>>>497 ubyte&0xDF >0 9413>>>>497 string x \b %-.6s 9414>>>>>503 ubyte&0xDF >0 9415>>>>>>503 string x \b%-.1s 9416>>>>>>>504 ubyte&0xDF >0 9417>>>>>>>>504 string x \b%-.1s 9418>>>>505 ubyte&0xDF >0 9419>>>>>505 string x \b.%-.3s 9420# added by Joerg Jenderek 9421# http://www.visopsys.org/ 9422# http://partitionlogic.org.uk/ 9423# OEM-ID=Visopsys 9424>478 ulelong 0 9425>>(1.b+326) string I/O\ Error\ reading\040 9426>>>(1.b+344) string Visopsys\ loader\r 9427>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 9428# http://alexfru.chat.ru/epm.html#bootprog 9429>494 ubyte >0x4D 9430>>495 string >E 9431>>>495 string <S 9432#OEM-ID is not reliable 9433>>>>3 string BootProg 9434# It just looks for a program file name at the root directory 9435# and loads corresponding file with following execution. 9436# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 9437>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 9438>>>>>499 use DOS-filename 9439#If the boot sector fails to read any other sector, 9440#it prints a very short message ("RE") to the screen and hangs the computer. 9441#If the boot sector fails to find needed program in the root directory, 9442#it also hangs with another message ("NF"). 9443>>>>>492 string RENF \b, FAT (12 bit) 9444>>>>>495 string RENF \b, FAT (16 bit) 9445#If the boot sector fails to read any other sector, 9446#it prints a very short message ("RE") to the screen and hangs the computer. 9447# x86 bootloader end 9448 9449# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 9450# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 9451>0 string RRaA 9452>>0x1E4 string rrAa \b, FSInfosector 9453#>>0x1FC uleshort =0 SHOULD BE ZERO 9454>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 9455>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 9456 9457# updated by Joerg Jenderek at Sep 2007 9458>3 ubyte 0 9459#no active flag 9460>>446 ubyte 0 9461# partition 1 not empty 9462>>>450 ubyte >0 9463# partitions 3,4 empty 9464>>>>482 ubyte 0 9465>>>>>498 ubyte 0 9466# partition 2 ID=0,5,15 9467>>>>>>466 ubyte <0x10 9468>>>>>>>466 ubyte 0x05 \b, extended partition table 9469>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 9470>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 9471 9472# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 9473 9474>0x200 lelong 0x82564557 \b, BSD disklabel 9475 9476# by Joerg Jenderek at Apr 2013 9477# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 9478# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 94790 name DOS-filename 9480# space=0x20 (00100000b) means empty 9481>0 ubyte&0xDF >0 9482>>0 ubyte x \b%c 9483>>>1 ubyte&0xDF >0 9484>>>>1 ubyte x \b%c 9485>>>>>2 ubyte&0xDF >0 9486>>>>>>2 ubyte x \b%c 9487>>>>>>>3 ubyte&0xDF >0 9488>>>>>>>>3 ubyte x \b%c 9489>>>>>>>>>4 ubyte&0xDF >0 9490>>>>>>>>>>4 ubyte x \b%c 9491>>>>>>>>>>>5 ubyte&0xDF >0 9492>>>>>>>>>>>>5 ubyte x \b%c 9493>>>>>>>>>>>>>6 ubyte&0xDF >0 9494>>>>>>>>>>>>>>6 ubyte x \b%c 9495>>>>>>>>>>>>>>>7 ubyte&0xDF >0 9496>>>>>>>>>>>>>>>>7 ubyte x \b%c 9497# DOS filename extension 9498>>8 ubyte&0xDF >0 \b. 9499>>>8 ubyte x \b%c 9500>>>>9 ubyte&0xDF >0 9501>>>>>9 ubyte x \b%c 9502>>>>>>10 ubyte&0xDF >0 9503>>>>>>>10 ubyte x \b%c 9504# Print 2 following DOS filenames from directory entry form 9505# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 95060 name 2xDOS-filename 9507# display 1 space 9508>0 ubyte x \b 9509>0 use DOS-filename 9510>11 ubyte x \b+ 9511>11 use DOS-filename 9512 9513# http://en.wikipedia.org/wiki/Master_boot_record#PTE 9514# display standard partition table 95150 name partition-table 9516#>0 ubyte x PARTITION-TABLE 9517# test and display 1st til 4th partition table entry 9518>0 use partition-entry-test 9519>16 use partition-entry-test 9520>32 use partition-entry-test 9521>48 use partition-entry-test 9522# test for entry of partition table 95230 name partition-entry-test 9524# partition type ID > 0 9525>4 ubyte >0 9526# active flag 0 9527>>0 ubyte 0 9528>>>0 use partition-entry 9529# active flag 0x80, 0x81, ... 9530>>0 ubyte >0x7F 9531>>>0 use partition-entry 9532# Print entry of partition table 95330 name partition-entry 9534# partition type ID > 0 9535>4 ubyte >0 \b; partition 9536>>64 leshort 0xAA55 1 9537>>48 leshort 0xAA55 2 9538>>32 leshort 0xAA55 3 9539>>16 leshort 0xAA55 4 9540>>4 ubyte x : ID=0x%x 9541>>0 ubyte&0x80 0x80 \b, active 9542>>0 ubyte >0x80 0x%x 9543>>1 ubyte x \b, start-CHS ( 9544>>1 use partition-chs 9545>>5 ubyte x \b), end-CHS ( 9546>>5 use partition-chs 9547>>8 ulelong x \b), startsector %u 9548>>12 ulelong x \b, %u sectors 9549# Print cylinder,head,sector (CHS) of partition entry 95500 name partition-chs 9551# cylinder 9552>1 ubyte x \b0x 9553>1 ubyte&0xC0 0x40 \b1 9554>1 ubyte&0xC0 0x80 \b2 9555>1 ubyte&0xC0 0xC0 \b3 9556>2 ubyte x \b%x 9557# head 9558>0 ubyte x \b,%u 9559# sector 9560>1 ubyte&0x3F x \b,%u 9561 9562# FATX 95630 string FATX FATX filesystem data 9564 9565# romfs filesystems - Juan Cespedes <cespedes@debian.org> 95660 string -rom1fs- romfs filesystem, version 1 9567>8 belong x %d bytes, 9568>16 string x named %s. 9569 9570# netboot image - Juan Cespedes <cespedes@debian.org> 95710 lelong 0x1b031336L Netboot image, 9572>4 lelong&0xFFFFFF00 0 9573>>4 lelong&0x100 0x000 mode 2 9574>>4 lelong&0x100 0x100 mode 3 9575>4 lelong&0xFFFFFF00 !0 unknown mode 9576 95770x18b string OS/2 OS/2 Boot Manager 9578 9579# updated by Joerg Jenderek at Oct 2008 and Sep 2012 9580# http://syslinux.zytor.com/iso.php 9581# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 9582# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 95830 ulequad&0x909000007cc0eafa 0x909000007c40eafa 9584>631 search/689 ISOLINUX\ isolinux Loader 9585>>&0 string x (version %-4.4s) 9586# http://syslinux.zytor.com/pxe.php 9587# assembler instructions: jmp 7C05 95880 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 9589# assembler instructions: pushfd;pushad 95900 ulelong 0x60669c66 pxelinux loader 9591# assembler instructions: jmp 05 95920 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 9593# http://syslinux.zytor.com/wiki/index.php/SYSLINUX 95940 string LDLINUX\ SYS\ SYSLINUX loader 9595>12 string x (older version %-4.4s) 95960 string \r\nSYSLINUX\ SYSLINUX loader 9597>11 string x (version %-4.4s) 9598# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 9599# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 96000 ulelong&0x80909bEB 0x009018EB 9601# OEM-ID not always "SYSLINUX" 9602>434 search/47 Boot\ failed 9603# followed by \r\n\0 or :\ 9604>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 9605>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 9606>459 search/30 Boot\ error\r\n\0 9607>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 9608# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 9609# assembler instructions: mov di,0600h;mov cx,0100h 961016 search/4 \xbf\x00\x06\xb9\x00\x01 9611# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 9612!:strength +36 9613>94 search/249 Missing\ operating\ system 9614# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 9615# skip Ranish MBR 9616>>408 search/4 HD1/\0 9617>>408 default x 9618>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 9619# followed by "ing " or space 9620>>>>292 search/98 error 9621>>>>>&0 string \r (version 3.35 or older) 9622>>>>>&0 string .\r (version 3.52 or newer) 9623>>>>>&0 default x (version 3.36-3.51 ) 9624>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 9625>>156 search/10 \0Boot\ partition\ not\ found\r\n 9626>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 9627>>174 search/10 \0Missing\ OS\r\n 9628>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 9629# SYSLINUX END 9630 9631# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 9632# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 96330 ubequad 0x31c08ed0bc007c8e 9634# mbr_bootsel magic before partition table not reliable with small ipl fragments 9635#>444 uleshort 0xb5e1 9636>0004 uleshort x 9637# ERRorTeXT 9638>>181 search/166 Error\ \0\r\n NetBSD mbr 9639# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 9640>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 9641# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 9642>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 9643# BOOT_EXTENDED definitions contains assembler instructions: 9644# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 9645>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 9646# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 9647>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 9648# not TERSE_ERROR 9649>>>196 search/106 No\ active\ partition\0 9650>>>>&0 string Disk\ read\ error\0 9651>>>>>&0 string No\ operating\ system\0 \b,verbose 9652# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 9653>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 9654# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 9655>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 9656# assembler instructions: movw nametab,bx 9657>>>0x26 search/21 \xBB\x94\x07 9658# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 9659>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 9660>>>>>181 search/166 Error\ \0 9661# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 9662>>>>>>&3 string x \b,"%s" 9663>>>446 use partition-table 9664# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 9665# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 9666# assembler instructions: jmp short 0x58;nop;ASCII 96670 ubequad&0xeb58908000000000 0xeb58900000000000 9668# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 9669>(1.b+2) ubequad 0xfa31c08ed88ec08e 9670# Error messages at end of code 9671>>376 string No\ operating\ system\r\n\0 9672>>>398 string Disk\ error\r\n\0FDD\0HDD\0 9673>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 9674 9675# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/ 9676# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 9677# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 9678# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 96790 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 9680# pointer to the data starting with Neil Turton signature string 9681>(0x1BC.s) string NDTmbr 9682>>&-14 string 1234F\0 Turton mbr ( 9683# parameters also viewed by install-mbr --list 9684>>>(0x1BC.s+7) ubyte x \b%u<= 9685>>>(0x1BC.s+9) ubyte x \bVersion<=%u 9686#>>>(0x1BC.s+8) ubyte x asm_flag_%x 9687>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 9688# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode 9689>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 9690#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 9691#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 9692#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 9693#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 9694# for older versions 9695>>>(0x1BC.s+9) ubyte <2 9696#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 9697>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 9698# floppy A: or B: 9699>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 9700>>>>(0x1BC.s+13) ubyte >1 9701# 1st hard disc 9702#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 9703# not 1st hard disc 9704>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 9705# for version >= 2 maximal timeout can be 65534 9706>>>(0x1BC.s+9) ubyte >1 9707#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 9708>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 9709# floppy A: or B: 9710>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 9711>>>>(0x1BC.s+14) ubyte >1 9712# 1st hard disc 9713#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 9714# not 1st hard disc 9715>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 9716>>>0 ubyte x \b) 9717 9718# added by Joerg Jenderek 9719# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 9720# grub-1.94/kern/i386/pc/startup.S 9721# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data 9722# usual values are marked with comments to get only informations of strange GRUB loaders 97230x200 uleshort 0x70EA 9724# found only version 3.{1,2} 9725>0x206 ubeshort >0x0300 9726# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 9727>>0x212 ubyte >0x29 9728>>>0x213 ubyte >0x29 9729# not iso9660_stage1_5 9730#>>>0 ulelong&0x00BE5652 0x00BE5652 9731>>>>0x213 ubyte >0x29 GRand Unified Bootloader 9732# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 9733>>>>0x217 ubyte 0xFF stage1_5 9734>>>>0x217 ubyte <0xFF stage2 9735>>>>0x206 ubyte x \b version %u 9736>>>>0x207 ubyte x \b.%u 9737# module_size for 1.94 9738>>>>0x208 ulelong <0xffffff \b, installed partition %u 9739#>>>>0x208 ulelong =0xffffff \b, %lu (default) 9740>>>>0x208 ulelong >0xffffff \b, installed partition %u 9741# GRUB 0.5.95 unofficial 9742>>>>0x20C ulelong&0x2E300000 0x2E300000 9743# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 9744>>>>>0x20C ubyte x \b, identifier 0x%x 9745#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 9746>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 9747# GRUB version as string 9748>>>>>0x20E string >\0 \b, GRUB version %-s 9749# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 9750>>>>>>0x215 ulong 0xffffffff 9751>>>>>>>0x219 string >\0 \b, configuration file %-s 9752>>>>>>0x215 ulong !0xffffffff 9753>>>>>>>0x215 string >\0 \b, configuration file %-s 9754# newer GRUB versions 9755>>>>0x20C ulelong&0x2E300000 !0x2E300000 9756##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 9757>>>>>0x20C ulelong >0 \b, saved entry %d 9758# for 1.94 contains kernel image size 9759# for 0.93,0.94,0.96,0.97 9760# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 9761>>>>>0x210 ubyte x \b, identifier 0x%x 9762# The flag for LBA forcing is in most cases 0 9763#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 9764>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 9765# GRUB version as string 9766>>>>>0x212 string >\0 \b, GRUB version %-s 9767# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 9768>>>>>0x217 ulong 0xffffffff 9769>>>>>>0x21b string >\0 \b, configuration file %-s 9770>>>>>0x217 ulong !0xffffffff 9771>>>>>>0x217 string >\0 \b, configuration file %-s 9772 9773# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 9774# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 9775# over BIOS parameter block (BPB) 9776# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 9777# older drives may use Near JuMP instruction E9 xx xx 9778# minimal short forward jump found 0x29 for bootloaders or 0x0 9779# maximal short forward jump is 0x7f 9780# OEM-ID is empty or contain readable bytes 97810 ulelong&0x804000E9 0x000000E9 9782!:strength +60 9783# mtools-3.9.8/msdos.h 9784# usual values are marked with comments to get only informations of strange FAT systems 9785# valid sectorsize must be a power of 2 from 32 to 32768 9786>11 uleshort&0x001f 0 9787>>11 uleshort <32769 9788>>>11 uleshort >31 9789>>>>21 ubyte&0xf0 0xF0 9790>>>>>0 ubyte 0xEB DOS/MBR boot sector 9791>>>>>>1 ubyte x \b, code offset 0x%x+2 9792>>>>>0 ubyte 0xE9 9793>>>>>>1 uleshort x \b, code offset 0x%x+3 9794>>>>>3 string >\0 \b, OEM-ID "%-.8s" 9795#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 9796>>>>>>8 string IHC \b cached by Windows 9M 9797>>>>>11 uleshort >512 \b, Bytes/sector %u 9798#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 9799>>>>>11 uleshort <512 \b, Bytes/sector %u 9800>>>>>13 ubyte >1 \b, sectors/cluster %u 9801#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 9802# for lazy FAT32 implementation like Transcend digital photo frame PF830 9803>>>>>82 string/c fat32 9804>>>>>>14 uleshort !32 \b, reserved sectors %u 9805#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 9806>>>>>82 string/c !fat32 9807>>>>>>14 uleshort >1 \b, reserved sectors %u 9808#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 9809#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 9810>>>>>16 ubyte >2 \b, FATs %u 9811#>>>>>16 ubyte =2 \b, FATs %u (usual) 9812>>>>>16 ubyte =1 \b, FAT %u 9813>>>>>16 ubyte >0 9814>>>>>17 uleshort >0 \b, root entries %u 9815#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 9816>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 9817#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 9818>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 9819#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 9820>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 9821>>>>>22 uleshort >0 \b, sectors/FAT %u 9822#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 9823>>>>>24 uleshort x \b, sectors/track %u 9824>>>>>26 ubyte >2 \b, heads %u 9825#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 9826>>>>>26 ubyte =1 \b, heads %u 9827# valid only for sector sizes with more then 32 Bytes 9828>>>>>11 uleshort >32 9829# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 9830# skip for values 2,2Ah,70h,73h,DFh 9831# and continue for extended boot signature values 0,28h,29h,80h 9832>>>>>>38 ubyte&0x56 =0 9833>>>>>>>28 ulelong >0 \b, hidden sectors %u 9834#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 9835>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 9836#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 9837# FAT<32 bit specific 9838>>>>>>>82 string/c !fat32 9839#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 9840#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 9841>>>>>>>>36 ubyte !0x80 9842>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 9843# VGA-copy CRC or 9844# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 9845>>>>>>>>37 ubyte >0 \b, reserved 0x%x 9846#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 9847# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others 9848>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 9849>>>>>>>>38 ubyte&0xFE =0x28 9850>>>>>>>>>39 ulelong x \b, serial number 0x%x 9851>>>>>>>>38 ubyte =0x29 9852>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 9853>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 9854>>>>>>>>>43 string =NO\ NAME \b, unlabeled 9855# there exist some old floppies without word FAT at offset 54 9856# a word like "FATnm " is only a hint for a FAT size on nm-bits 9857# Normally the number of clusters is calculated by the values of BPP. 9858# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 9859# otherwise FAT is 16 bit. 9860# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 9861>>>>>82 string/c !fat32 9862>>>>>>54 string FAT12 \b, FAT (12 bit) 9863>>>>>>54 string FAT16 \b, FAT (16 bit) 9864>>>>>>54 default x 9865# determinate FAT bit size by media descriptor 9866# small floppies implies FAT12 9867>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 9868# with media descriptor F0h floppy or maybe superfloppy with FAT16 9869>>>>>>>21 ubyte =0xF0 9870# superfloppy (many sectors) implies FAT16 9871>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 9872# no superfloppy with media descriptor F0h implies FAT12 9873>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 9874# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 9875>>>>>>>21 ubyte =0xF8 9876# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 9877>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 9878# hard disc with FAT12 or FAT16 9879>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 9880# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 9881>>>>>>>21 ubyte =0xFA 9882# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 9883>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 9884# RAM disc with FAT12 or FAT16 or Tandy hard disc 9885>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 9886# others are floppy 9887>>>>>>>21 default x \b, FAT (12 bit by descriptor) 9888# FAT32 bit specific 9889>>>>>82 string/c fat32 \b, FAT (32 bit) 9890>>>>>>36 ulelong x \b, sectors/FAT %u 9891# http://technet.microsoft.com/en-us/library/cc977221.aspx 9892>>>>>>40 uleshort >0 \b, extension flags 0x%x 9893#>>>>>>40 uleshort =0 \b, extension flags %hu 9894>>>>>>42 uleshort >0 \b, fsVersion %u 9895#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 9896>>>>>>44 ulelong >2 \b, rootdir cluster %u 9897#>>>>>>44 ulelong =2 \b, rootdir cluster %u 9898#>>>>>>44 ulelong =1 \b, rootdir cluster %u 9899>>>>>>48 uleshort >1 \b, infoSector %u 9900#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 9901>>>>>>48 uleshort <1 \b, infoSector %u 9902# 0 or 0xFFFF instead of usual 6 means no backup sector 9903>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 9904>>>>>>50 uleshort =0 \b, no Backup boot sector 9905#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 9906>>>>>>50 default x 9907>>>>>>>50 uleshort x \b, Backup boot sector %u 9908# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 9909>>>>>>52 ulelong >0 \b, reserved1 0x%x 9910>>>>>>56 ulelong >0 \b, reserved2 0x%x 9911>>>>>>60 ulelong >0 \b, reserved3 0x%x 9912# same structure as FAT1X 9913#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 9914#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 9915>>>>>>64 ubyte !0x80 9916>>>>>>>64 ubyte >0 \b, physical drive 0x%x 9917# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 9918>>>>>>65 ubyte >0 \b, reserved 0x%x 9919>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 9920>>>>>>66 ubyte =0x29 9921>>>>>>>67 ulelong x \b, serial number 0x%x 9922>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 9923>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 9924>>>>>>>71 string =NO\ NAME \b, unlabeled 9925# additional tests for floppy image added by Joerg Jenderek 9926# no fixed disk 9927>>>>>21 ubyte !0xF8 9928# floppy media with 12 bit FAT 9929>>>>>>54 string !FAT16 9930# test for FAT after bootsector 9931>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 9932# floppy image 9933!:mime application/x-ima 9934# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 9935# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 9936# 0 FATs 9937>>>>>16 ubyte =0 9938# 0 root entries 9939>>>>>>17 uleshort =0 9940# 0 DOS sectors 9941>>>>>>>19 uleshort =0 9942# 0 sectors/FAT 9943# dos < 4.0 BootSector value found is 0x80 9944#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 9945>>>>>>>>22 uleshort =0 \b; NTFS 9946>>>>>>>>>24 uleshort >0 \b, sectors/track %u 9947>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 9948>>>>>>>>>40 ulequad >0 \b, sectors %lld 9949>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 9950>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 9951# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 9952# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 9953>>>>>>>>>64 lelong <256 9954>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 9955>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 9956# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 9957# Values 128 to 255 represent index block sizes of 2^(256-N) byte 9958>>>>>>>>>68 ulelong <256 9959>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 9960#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 9961>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 9962>>>>>>>>>72 ulequad x \b, serial number 0%llx 9963>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 9964#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 9965>>>>>>>>>0x258 ulelong&0x00009090 =0x00009090 9966>>>>>>>>>>&-92 indirect x \b; contains 9967# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013 9968# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 9969# unused assembler instructions JMP y2;NOP;NOP 99700x056 ulelong&0xFFFF0FFF 0x909002EB 9971# unicode loadername terminated by CTRL-D 9972>(0.s*2) ulelong&0xFFFFFF00 0x00040000 9973# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 9974>>0x002 lestring16 x Microsoft Windows XP/VISTA bootloader %-5.5s 9975>>0x12 string $ 9976>>>0x0c lestring16 x \b%-2.2s 9977### DOS,NTFS boot sectors end 9978 9979# ntfsclone-image is a special save format for NTFS volumes, 9980# created and restored by the ntfsclone program 99810 string \0ntfsclone-image ntfsclone image, 9982>0x10 byte x version %d. 9983>0x11 byte x \b%d, 9984>0x12 lelong x cluster size %d, 9985>0x16 lequad x device size %lld, 9986>0x1e lequad x %lld total clusters, 9987>0x26 lequad x %lld clusters in use 9988 99899564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 9990>8404 string x last mounted on %s, 9991#>9504 ledate x last checked at %s, 9992>8224 ledate x last written at %s, 9993>8401 byte x clean flag %d, 9994>8228 lelong x number of blocks %d, 9995>8232 lelong x number of data blocks %d, 9996>8236 lelong x number of cylinder groups %d, 9997>8240 lelong x block size %d, 9998>8244 lelong x fragment size %d, 9999>8252 lelong x minimum percentage of free blocks %d, 10000>8256 lelong x rotational delay %dms, 10001>8260 lelong x disk rotational speed %drps, 10002>8320 lelong 0 TIME optimization 10003>8320 lelong 1 SPACE optimization 10004 1000542332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 10006>&-1164 string x last mounted on %s, 10007>&-696 string >\0 volume name %s, 10008>&-304 leqldate x last written at %s, 10009>&-1167 byte x clean flag %d, 10010>&-1168 byte x readonly flag %d, 10011>&-296 lequad x number of blocks %lld, 10012>&-288 lequad x number of data blocks %lld, 10013>&-1332 lelong x number of cylinder groups %d, 10014>&-1328 lelong x block size %d, 10015>&-1324 lelong x fragment size %d, 10016>&-180 lelong x average file size %d, 10017>&-176 lelong x average number of files in dir %d, 10018>&-272 lequad x pending blocks to free %lld, 10019>&-264 lelong x pending inodes to free %d, 10020>&-664 lequad x system-wide uuid %0llx, 10021>&-1316 lelong x minimum percentage of free blocks %d, 10022>&-1248 lelong 0 TIME optimization 10023>&-1248 lelong 1 SPACE optimization 10024 1002566908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 10026>&-1164 string x last mounted on %s, 10027>&-696 string >\0 volume name %s, 10028>&-304 leqldate x last written at %s, 10029>&-1167 byte x clean flag %d, 10030>&-1168 byte x readonly flag %d, 10031>&-296 lequad x number of blocks %lld, 10032>&-288 lequad x number of data blocks %lld, 10033>&-1332 lelong x number of cylinder groups %d, 10034>&-1328 lelong x block size %d, 10035>&-1324 lelong x fragment size %d, 10036>&-180 lelong x average file size %d, 10037>&-176 lelong x average number of files in dir %d, 10038>&-272 lequad x pending blocks to free %lld, 10039>&-264 lelong x pending inodes to free %d, 10040>&-664 lequad x system-wide uuid %0llx, 10041>&-1316 lelong x minimum percentage of free blocks %d, 10042>&-1248 lelong 0 TIME optimization 10043>&-1248 lelong 1 SPACE optimization 10044 100459564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 10046>7168 belong 0x4c41424c Apple UFS Volume 10047>>7186 string x named %s, 10048>>7176 belong x volume label version %d, 10049>>7180 bedate x created on %s, 10050>8404 string x last mounted on %s, 10051#>9504 bedate x last checked at %s, 10052>8224 bedate x last written at %s, 10053>8401 byte x clean flag %d, 10054>8228 belong x number of blocks %d, 10055>8232 belong x number of data blocks %d, 10056>8236 belong x number of cylinder groups %d, 10057>8240 belong x block size %d, 10058>8244 belong x fragment size %d, 10059>8252 belong x minimum percentage of free blocks %d, 10060>8256 belong x rotational delay %dms, 10061>8260 belong x disk rotational speed %drps, 10062>8320 belong 0 TIME optimization 10063>8320 belong 1 SPACE optimization 10064 1006542332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 10066>&-1164 string x last mounted on %s, 10067>&-696 string >\0 volume name %s, 10068>&-304 beqldate x last written at %s, 10069>&-1167 byte x clean flag %d, 10070>&-1168 byte x readonly flag %d, 10071>&-296 bequad x number of blocks %lld, 10072>&-288 bequad x number of data blocks %lld, 10073>&-1332 belong x number of cylinder groups %d, 10074>&-1328 belong x block size %d, 10075>&-1324 belong x fragment size %d, 10076>&-180 belong x average file size %d, 10077>&-176 belong x average number of files in dir %d, 10078>&-272 bequad x pending blocks to free %lld, 10079>&-264 belong x pending inodes to free %d, 10080>&-664 bequad x system-wide uuid %0llx, 10081>&-1316 belong x minimum percentage of free blocks %d, 10082>&-1248 belong 0 TIME optimization 10083>&-1248 belong 1 SPACE optimization 10084 1008566908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 10086>&-1164 string x last mounted on %s, 10087>&-696 string >\0 volume name %s, 10088>&-304 beqldate x last written at %s, 10089>&-1167 byte x clean flag %d, 10090>&-1168 byte x readonly flag %d, 10091>&-296 bequad x number of blocks %lld, 10092>&-288 bequad x number of data blocks %lld, 10093>&-1332 belong x number of cylinder groups %d, 10094>&-1328 belong x block size %d, 10095>&-1324 belong x fragment size %d, 10096>&-180 belong x average file size %d, 10097>&-176 belong x average number of files in dir %d, 10098>&-272 bequad x pending blocks to free %lld, 10099>&-264 belong x pending inodes to free %d, 10100>&-664 bequad x system-wide uuid %0llx, 10101>&-1316 belong x minimum percentage of free blocks %d, 10102>&-1248 belong 0 TIME optimization 10103>&-1248 belong 1 SPACE optimization 10104 101050 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), 10106>0x90 lelong+1 x volume %d 10107>0x94 lelong x (of %d), 10108>0x50 string x name %s, 10109>0x98 ulelong x version %u, 10110>0xa0 ulelong x flags 0x%x 10111 10112# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 10113# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 10114# volume label and UUID Russell Coker 10115# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 101160x438 leshort 0xEF53 Linux 10117>0x44c lelong x rev %d 10118>0x43e leshort x \b.%d 10119# No journal? ext2 10120>0x45c lelong ^0x0000004 ext2 filesystem data 10121>>0x43a leshort ^0x0000001 (mounted or unclean) 10122# Has a journal? ext3 or ext4 10123>0x45c lelong &0x0000004 10124# and small INCOMPAT? 10125>>0x460 lelong <0x0000040 10126# and small RO_COMPAT? 10127>>>0x464 lelong <0x0000008 ext3 filesystem data 10128# else large RO_COMPAT? 10129>>>0x464 lelong >0x0000007 ext4 filesystem data 10130# else large INCOMPAT? 10131>>0x460 lelong >0x000003f ext4 filesystem data 10132>0x468 belong x \b, UUID=%08x 10133>0x46c beshort x \b-%04x 10134>0x46e beshort x \b-%04x 10135>0x470 beshort x \b-%04x 10136>0x472 belong x \b-%08x 10137>0x476 beshort x \b%04x 10138>0x478 string >0 \b, volume name "%s" 10139# General flags for any ext* fs 10140>0x460 lelong &0x0000004 (needs journal recovery) 10141>0x43a leshort &0x0000002 (errors) 10142# INCOMPAT flags 10143>0x460 lelong &0x0000001 (compressed) 10144#>0x460 lelong &0x0000002 (filetype) 10145#>0x460 lelong &0x0000010 (meta bg) 10146>0x460 lelong &0x0000040 (extents) 10147>0x460 lelong &0x0000080 (64bit) 10148#>0x460 lelong &0x0000100 (mmp) 10149#>0x460 lelong &0x0000200 (flex bg) 10150# RO_INCOMPAT flags 10151#>0x464 lelong &0x0000001 (sparse super) 10152>0x464 lelong &0x0000002 (large files) 10153>0x464 lelong &0x0000008 (huge files) 10154#>0x464 lelong &0x0000010 (gdt checksum) 10155#>0x464 lelong &0x0000020 (many subdirs) 10156#>0x463 lelong &0x0000040 (extra isize) 10157 10158# Minix filesystems - Juan Cespedes <cespedes@debian.org> 101590x410 leshort 0x137f 10160!:strength / 2 10161>0x402 beshort < 100 10162>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones 10163>0x1e string minix \b, bootable 101640x410 beshort 0x137f 10165!:strength / 2 10166>0x402 beshort < 100 10167>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 10168>0x1e string minix \b, bootable 101690x410 leshort 0x138f 10170!:strength / 2 10171>0x402 beshort < 100 10172>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 10173>0x1e string minix \b, bootable 101740x410 beshort 0x138f 10175!:strength / 2 10176>0x402 beshort < 100 10177>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 10178>0x1e string minix \b, bootable 10179# Weak Magic: this is $x 10180#0x410 leshort 0x2468 10181#>0x402 beshort < 100 10182#>>0x402 beshort > -1 Minix filesystem, V2, 14 char names 10183#>0x1e string minix \b, bootable 10184#0x410 beshort 0x2468 10185#>0x402 beshort < 100 10186#>0x402 beshort > -1 Minix filesystem, V2 (big endian) 10187#>0x1e string minix \b, bootable 10188#0x410 leshort 0x2478 10189#>0x402 beshort < 100 10190#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 10191#>0x1e string minix \b, bootable 10192#0x410 leshort 0x2478 10193#>0x402 beshort < 100 10194#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 10195#>0x1e string minix \b, bootable 10196#0x410 beshort 0x2478 10197#>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) 10198#>0x1e string minix \b, bootable 10199# Weak Magic! this is MD 10200#0x418 leshort 0x4d5a 10201#>0x402 beshort <100 10202#>>0x402 beshort > -1 Minix filesystem, V3, 60 char names 10203 10204# SGI disk labels - Nathan Scott <nathans@debian.org> 102050 belong 0x0BE5A941 SGI disk label (volume header) 10206 10207# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 102080 belong 0x58465342 SGI XFS filesystem data 10209>0x4 belong x (blksz %d, 10210>0x68 beshort x inosz %d, 10211>0x64 beshort ^0x2004 v1 dirs) 10212>0x64 beshort &0x2004 v2 dirs) 10213 10214############################################################################ 10215# Minix-ST kernel floppy 102160x800 belong 0x46fc2700 Atari-ST Minix kernel image 10217# http://en.wikipedia.org/wiki/BIOS_parameter_block 10218# floppies with valid BPB and any instruction at beginning 10219>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 10220>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 10221 10222############################################################################ 10223# Hmmm, is this a better way of detecting _standard_ floppy images ? 1022419 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 10225>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1022619 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 10227>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1022819 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 10229>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 10230 1023119 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 10232>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1023319 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 10234>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 10235 1023619 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 1023719 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 10238# | | | | | 10239# | | | | heads 10240# | | | sectors/track 10241# | | sectors/FAT 10242# | media descriptor 10243# BPB: sectors 10244 10245# Valid media descriptor bytes for MS-DOS: 10246# 10247# Byte Capacity Media Size and Type 10248# ------------------------------------------------- 10249# 10250# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 10251# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 10252# F9 720K 3.5-inch, 2-sided, 9-sector 10253# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 10254# FD 360K 5.25-inch, 2-sided, 9-sector 10255# FF 320K 5.25-inch, 2-sided, 8-sector 10256# FC 180K 5.25-inch, 1-sided, 9-sector 10257# FE 160K 5.25-inch, 1-sided, 8-sector 10258# FE 250K 8-inch, 1-sided, single-density 10259# FD 500K 8-inch, 2-sided, single-density 10260# FE 1.2 MB 8-inch, 2-sided, double-density 10261# F8 ----- Fixed disk 10262# 10263# FC xxxK Apricot 70x1x9 boot disk. 10264# 10265# Originally a bitmap: 10266# xxxxxxx0 Not two sided 10267# xxxxxxx1 Double sided 10268# xxxxxx0x Not 8 SPT 10269# xxxxxx1x 8 SPT 10270# xxxxx0xx Not Removable drive 10271# xxxxx1xx Removable drive 10272# 11111xxx Must be one. 10273# 10274# But now it's rather random: 10275# 111111xx Low density disk 10276# 00 SS, Not 8 SPT 10277# 01 DS, Not 8 SPT 10278# 10 SS, 8 SPT 10279# 11 DS, 8 SPT 10280# 10281# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 10282# 11110000 High density 3 1/2 floppy disk 10283# 11111000 Hard disk any format 10284# 10285 10286# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 10287# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 10288# Too Weak. 10289#512 ubelong&0xE0ffff00 0xE0ffff00 10290# without valid Media descriptor in place of BPB, cases with are done at other places 10291#>21 ubyte <0xE5 floppy with old FAT filesystem 10292# but valid Media descriptor at begin of FAT 10293#>>512 ubyte =0xed 720k 10294#>>512 ubyte =0xf0 1440k 10295#>>512 ubyte =0xf8 720k 10296#>>512 ubyte =0xf9 1220k 10297#>>512 ubyte =0xfa 320k 10298#>>512 ubyte =0xfb 640k 10299#>>512 ubyte =0xfc 180k 10300# look like an an old DOS directory entry 10301#>>>0xA0E ubequad 0 10302#>>>>0xA00 ubequad !0 10303#!:mime application/x-ima 10304#>>512 ubyte =0xfd 10305# look for 2nd FAT at different location to distinguish between 360k and 500k 10306#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 10307#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 10308#>>>0xA0E ubequad 0 10309#!:mime application/x-ima 10310#>>512 ubyte =0xfe 10311#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 10312#>>>>0x60E ubequad 0 10313#>>>>>0x600 ubequad !0 10314#!:mime application/x-ima 10315#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 10316#>>512 ubyte =0xff 320k 10317#>>>0x60E ubequad 0 10318#>>>>0x600 ubequad !0 10319#!:mime application/x-ima 10320#>>512 ubyte x \b, Media descriptor 0x%x 10321# without x86 jump instruction 10322#>>0 ulelong&0x804000E9 !0x000000E9 10323# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 10324#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 10325# IOSYS.COM+MSDOS.COM 10326#>>>>0xc4 use 2xDOS-filename 10327#>>0 ulelong&0x804000E9 =0x000000E9 10328# only x86 short jump instruction found 10329#>>>0 ubyte =0xEB 10330#>>>>1 ubyte x \b, code offset 0x%x+2 10331# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm 10332# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 10333#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 10334# ibmbio.com+ibmdos.com 10335#>>>>>0x176 use DOS-filename 10336#>>>>>0x181 ubyte x \b+ 10337#>>>>>0x182 use DOS-filename 10338# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm 10339# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 10340#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 10341# ibmbio.com+ibmdos.com 10342#>>>>>0x18b use DOS-filename 10343#>>>>>0x196 ubyte x \b+ 10344#>>>>>0x197 use DOS-filename 10345# http://en.wikipedia.org/wiki/Zenith_Data_Systems 10346# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 10347#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 10348# IO.SYS+MSDOS.SYS 10349#>>>>>0x20 use 2xDOS-filename 10350# http://en.wikipedia.org/wiki/Corona_Data_Systems 10351# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 10352#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 10353# IO.SYS+MSDOS.SYS 10354#>>>>>0x69 use 2xDOS-filename 10355# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 10356#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 10357# defect IO.SYS+MSDOS.SYS ? 10358#>>>>>0x162 use 2xDOS-filename 10359 103600 name cdrom 10361>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 10362!:mime application/x-iso9660-image 10363>38913 string NSR0 UDF filesystem data 10364!:mime application/x-iso9660-image 10365>>38917 string 1 (version 1.0) 10366>>38917 string 2 (version 1.5) 10367>>38917 string 3 (version 2.0) 10368>>38917 byte >0x33 (unknown version, ID 0x%X) 10369>>38917 byte <0x31 (unknown version, ID 0x%X) 10370# The next line is not necessary because the MBR staff is done looking for boot signature 10371>0x1FE leshort 0xAA55 (DOS/MBR boot sector) 10372# "application id" which appears to be used as a volume label 10373>32808 string/T >\0 '%s' 10374>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 1037537633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 10376!:mime application/x-iso9660-image 1037732777 string CDROM High Sierra CD-ROM filesystem data 10378 10379# CDROM Filesystems 10380# https://en.wikipedia.org/wiki/ISO_9660 10381# Modified for UDF by gerardo.cacciari@gmail.com 1038232769 string CD001 10383# mime line at that position does not work 10384# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 10385!:strength -11 10386# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 10387# does not work 10388#!:strength +33 10389>0 use cdrom 10390 10391# .cso files 10392# Reference: http://pismotec.com/ciso/ciso.h 10393# NOTE: There are two other formats with the same magic but 10394# completely incompatible specifications: 10395# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h 10396# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 103970 string CISO 10398# Other fields are used to determine what type of CISO this is: 10399# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 10400# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 10401# - None of the above: Compact ISO. 10402>4 lelong !0 10403>>4 lelong !0x200000 10404>>>0x10 lelong !0x800 Compressed ISO CD image 10405 10406# cramfs filesystem - russell@coker.com.au 104070 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 10408>4 lelong x size %u 10409>8 lelong &1 version #2 10410>8 lelong &2 sorted_dirs 10411>8 lelong &4 hole_support 10412>32 lelong x CRC 0x%x, 10413>36 lelong x edition %u, 10414>40 lelong x %u blocks, 10415>44 lelong x %u files 10416 104170 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 10418>4 belong x size %u 10419>8 belong &1 version #2 10420>8 belong &2 sorted_dirs 10421>8 belong &4 hole_support 10422>32 belong x CRC 0x%x, 10423>36 belong x edition %u, 10424>40 belong x %u blocks, 10425>44 belong x %u files 10426 10427# reiserfs - russell@coker.com.au 104280x10034 string ReIsErFs ReiserFS V3.5 104290x10034 string ReIsEr2Fs ReiserFS V3.6 104300x10034 string ReIsEr3Fs ReiserFS V3.6.19 10431>0x1002c leshort x block size %d 10432>0x10032 leshort &2 (mounted or unclean) 10433>0x10000 lelong x num blocks %d 10434>0x10040 lelong 1 tea hash 10435>0x10040 lelong 2 yura hash 10436>0x10040 lelong 3 r5 hash 10437 10438# JFFS - russell@coker.com.au 104390 lelong 0x34383931 Linux Journalled Flash File system, little endian 104400 belong 0x34383931 Linux Journalled Flash File system, big endian 10441 10442# EST flat binary format (which isn't, but anyway) 10443# From: Mark Brown <broonie@sirena.org.uk> 104440 string ESTFBINR EST flat binary 10445 10446# Aculab VoIP firmware 10447# From: Mark Brown <broonie@sirena.org.uk> 104480 string VoIP\ Startup\ and Aculab VoIP firmware 10449>35 string x format %s 10450 10451# From: Mark Brown <broonie@sirena.org.uk> [old] 10452# From: Behan Webster <behanw@websterwood.com> 104530 belong 0x27051956 u-boot legacy uImage, 10454>32 string x %s, 10455>28 byte 0 Invalid os/ 10456>28 byte 1 OpenBSD/ 10457>28 byte 2 NetBSD/ 10458>28 byte 3 FreeBSD/ 10459>28 byte 4 4.4BSD/ 10460>28 byte 5 Linux/ 10461>28 byte 6 SVR4/ 10462>28 byte 7 Esix/ 10463>28 byte 8 Solaris/ 10464>28 byte 9 Irix/ 10465>28 byte 10 SCO/ 10466>28 byte 11 Dell/ 10467>28 byte 12 NCR/ 10468>28 byte 13 LynxOS/ 10469>28 byte 14 VxWorks/ 10470>28 byte 15 pSOS/ 10471>28 byte 16 QNX/ 10472>28 byte 17 Firmware/ 10473>28 byte 18 RTEMS/ 10474>28 byte 19 ARTOS/ 10475>28 byte 20 Unity OS/ 10476>28 byte 21 INTEGRITY/ 10477>29 byte 0 \bInvalid CPU, 10478>29 byte 1 \bAlpha, 10479>29 byte 2 \bARM, 10480>29 byte 3 \bIntel x86, 10481>29 byte 4 \bIA64, 10482>29 byte 5 \bMIPS, 10483>29 byte 6 \bMIPS 64-bit, 10484>29 byte 7 \bPowerPC, 10485>29 byte 8 \bIBM S390, 10486>29 byte 9 \bSuperH, 10487>29 byte 10 \bSparc, 10488>29 byte 11 \bSparc 64-bit, 10489>29 byte 12 \bM68K, 10490>29 byte 13 \bNios-32, 10491>29 byte 14 \bMicroBlaze, 10492>29 byte 15 \bNios-II, 10493>29 byte 16 \bBlackfin, 10494>29 byte 17 \bAVR32, 10495>29 byte 18 \bSTMicroelectronics ST200, 10496>29 byte 19 \bSandbox architecture, 10497>29 byte 20 \bANDES Technology NDS32, 10498>29 byte 21 \bOpenRISC 1000, 10499>29 byte 22 \bARM 64-bit, 10500>29 byte 23 \bDesignWare ARC, 10501>29 byte 24 \bx86_64, 10502>29 byte 25 \bXtensa, 10503>30 byte 0 Invalid Image 10504>30 byte 1 Standalone Program 10505>30 byte 2 OS Kernel Image 10506>30 byte 3 RAMDisk Image 10507>30 byte 4 Multi-File Image 10508>30 byte 5 Firmware Image 10509>30 byte 6 Script File 10510>30 byte 7 Filesystem Image (any type) 10511>30 byte 8 Binary Flat Device Tree BLOB 10512>31 byte 0 (Not compressed), 10513>31 byte 1 (gzip), 10514>31 byte 2 (bzip2), 10515>31 byte 3 (lzma), 10516>12 belong x %d bytes, 10517>8 bedate x %s, 10518>16 belong x Load Address: 0x%08X, 10519>20 belong x Entry Point: 0x%08X, 10520>4 belong x Header CRC: 0x%08X, 10521>24 belong x Data CRC: 0x%08X 10522 10523# JFFS2 file system 105240 leshort 0x1984 Linux old jffs2 filesystem data little endian 105250 leshort 0x1985 Linux jffs2 filesystem data little endian 10526 10527# Squashfs 105280 string sqsh Squashfs filesystem, big endian, 10529>28 beshort x version %d. 10530>30 beshort x \b%d, 10531>28 beshort <3 10532>>8 belong x %d bytes, 10533>28 beshort >2 10534>>28 beshort <4 10535>>>63 bequad x %lld bytes, 10536>>28 beshort >3 10537>>>40 bequad x %lld bytes, 10538#>>67 belong x %d bytes, 10539>4 belong x %d inodes, 10540>28 beshort <2 10541>>32 beshort x blocksize: %d bytes, 10542>28 beshort >1 10543>>28 beshort <4 10544>>>51 belong x blocksize: %d bytes, 10545>>28 beshort >3 10546>>>12 belong x blocksize: %d bytes, 10547>28 beshort <4 10548>>39 bedate x created: %s 10549>28 beshort >3 10550>>8 bedate x created: %s 105510 string hsqs Squashfs filesystem, little endian, 10552>28 leshort x version %d. 10553>30 leshort x \b%d, 10554>28 leshort <3 10555>>8 lelong x %d bytes, 10556>28 leshort >2 10557>>28 leshort <4 10558>>>63 lequad x %lld bytes, 10559>>28 leshort >3 10560>>>40 lequad x %lld bytes, 10561#>>63 lelong x %d bytes, 10562>4 lelong x %d inodes, 10563>28 leshort <2 10564>>32 leshort x blocksize: %d bytes, 10565>28 leshort >1 10566>>28 leshort <4 10567>>>51 lelong x blocksize: %d bytes, 10568>>28 leshort >3 10569>>>12 lelong x blocksize: %d bytes, 10570>28 leshort <4 10571>>39 ledate x created: %s 10572>28 leshort >3 10573>>8 ledate x created: %s 10574 10575# AFS Dump Magic 10576# From: Ty Sarna <tsarna@sarna.org> 105770 string \x01\xb3\xa1\x13\x22 AFS Dump 10578>&0 belong x (v%d) 10579>>&0 byte 0x76 10580>>>&0 belong x Vol %d, 10581>>>>&0 byte 0x6e 10582>>>>>&0 string x %s 10583>>>>>>&1 byte 0x74 10584>>>>>>>&0 beshort 2 10585>>>>>>>>&4 bedate x on: %s 10586>>>>>>>>&0 bedate =0 full dump 10587>>>>>>>>&0 bedate !0 incremental since: %s 10588 10589#---------------------------------------------------------- 10590#delta ISO Daniel Novotny (dnovotny@redhat.com) 105910 string DISO Delta ISO data 10592!:strength +50 10593>4 belong x version %d 10594 10595# VMS backup savesets - gerardo.cacciari@gmail.com 10596# 105974 string \x01\x00\x01\x00\x01\x00 10598>(0.s+16) string \x01\x01 10599>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 10600>>>40 lelong x (block size %d, 10601>>>49 string >\0 original name '%s', 10602>>>2 short 1024 VAX generated) 10603>>>2 short 2048 AXP generated) 10604>>>2 short 4096 I64 generated) 10605 10606# Summary: Oracle Clustered Filesystem 10607# Created by: Aaron Botsis <redhat@digitalmafia.org> 106088 string OracleCFS Oracle Clustered Filesystem, 10609>4 long x rev %d 10610>0 long x \b.%d, 10611>560 string x label: %.64s, 10612>136 string x mountpoint: %.128s 10613 10614# Summary: Oracle ASM tagged volume 10615# Created by: Aaron Botsis <redhat@digitalmafia.org> 1061632 string ORCLDISK Oracle ASM Volume, 10617>40 string x Disk Name: %0.12s 1061832 string ORCLCLRD Oracle ASM Volume (cleared), 10619>40 string x Disk Name: %0.12s 10620 10621# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 106228 string OracleCFS Oracle Clustered Filesystem, 10623>4 long x rev %d 10624>0 long x \b.%d, 10625>560 string x label: %.64s, 10626>136 string x mountpoint: %.128s 10627 10628# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 1062932 string ORCLDISK Oracle ASM Volume, 10630>40 string x Disk Name: %0.12s 1063132 string ORCLCLRD Oracle ASM Volume (cleared), 10632>40 string x Disk Name: %0.12s 10633 10634# Compaq/HP RILOE floppy image 10635# From: Dirk Jagdmann <doj@cubic.org> 106360 string CPQRFBLO Compaq/HP RILOE floppy image 10637 10638#------------------------------------------------------------------------------ 10639# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 10640# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 10641# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 10642# 106431008 string DECFILE11 Files-11 On-Disk Structure 10644>525 byte x (ODS-%d); 10645>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 10646>1017 string B 10647>>525 byte 2 VAX/VMS or OpenVMS file system; 10648>>525 byte 5 OpenVMS Alpha or Itanium file system; 10649>984 string x volume label is '%-12.12s' 10650 10651# From: Thomas Klausner <wiz@NetBSD.org> 10652# http://filext.com/file-extension/DAA 10653# describes the daa file format. The magic would be: 106540 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 10655 10656# From Albert Cahalan <acahalan@gmail.com> 10657# really le32 operation,destination,payloadsize (but quite predictable) 10658# 01 00 00 00 00 00 00 c0 00 02 00 00 106590 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 10660 10661# From Eric Sandeen 10662# GFS2 106630x10000 belong 0x01161970 10664>0x10018 belong 0x0000051d GFS1 Filesystem 10665>>0x10024 belong x (blocksize %d, 10666>>0x10060 string >\0 lockproto %s) 10667>0x10018 belong 0x00000709 GFS2 Filesystem 10668>>0x10024 belong x (blocksize %d, 10669>>0x10060 string >\0 lockproto %s) 10670 10671# Russell Coker <russell@coker.com.au> 106720x10040 string _BHRfS_M BTRFS Filesystem 10673>0x1012b string >\0 label "%s", 10674>0x10090 lelong x sectorsize %d, 10675>0x10094 lelong x nodesize %d, 10676>0x10098 lelong x leafsize %d, 10677>0x10020 belong x UUID=%08x- 10678>0x10024 beshort x \b%04x- 10679>0x10026 beshort x \b%04x- 10680>0x10028 beshort x \b%04x- 10681>0x1002a beshort x \b%04x 10682>0x1002c belong x \b%08x, 10683>0x10078 lequad x %lld/ 10684>0x10070 lequad x \b%lld bytes used, 10685>0x10088 lequad x %lld devices 10686 10687# dvdisaster's .ecc 10688# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 106890 string *dvdisaster* dvdisaster error correction file 10690 10691# xfs metadump image 10692# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 10693# but can we do the << ? For now it's always 512 (0x200) anyway. 106940 string XFSM 10695>0x200 string XFSB XFS filesystem metadump image 10696 10697# Type: CROM filesystem 10698# From: Werner Fink <werner@suse.de> 106990 string CROMFS CROMFS 10700>6 string >\0 \b version %2.2s, 10701>8 ulequad >0 \b block data at %lld, 10702>16 ulequad >0 \b fblock table at %lld, 10703>24 ulequad >0 \b inode table at %lld, 10704>32 ulequad >0 \b root at %lld, 10705>40 ulelong >0 \b fblock size = %d, 10706>44 ulelong >0 \b block size = %d, 10707>48 ulequad >0 \b bytes = %lld 10708 10709# Type: xfs metadump image 10710# From: Daniel Novotny <dnovotny@redhat.com> 10711# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 10712# but can we do the << ? For now it's always 512 (0x200) anyway. 107130 string XFSM 10714>0x200 string XFSB XFS filesystem metadump image 10715 10716# Type: delta ISO 10717# From: Daniel Novotny <dnovotny@redhat.com> 107180 string DISO Delta ISO data, 10719>4 belong x version %d 10720 10721# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 10722# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 10723# From: Adam Buchbinder <adam.buchbinder@gmail.com> 107240x8000 string JFS1 10725# Because it's text-only magic, check a binary value (version) to be sure. 10726# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 10727# mountable. 10728>&0 lelong <3 JFS2 filesystem image 10729# Label is followed by a UUID; we have to limit string length to avoid 10730# appending the UUID in the case of a 16-byte label. 10731>>&144 regex [\x20-\x7E]{1,16} (label "%s") 10732>>&0 lequad x \b, %lld blocks 10733>>&8 lelong x \b, blocksize %d 10734>>&32 lelong&0x00000006 >0 (dirty) 10735>>&36 lelong >0 (compressed) 10736 10737# LFS 107380 lelong 0x070162 LFS filesystem image 10739>4 lelong 1 version 1, 10740>>8 lelong x \b blocks %u, 10741>>12 lelong x \b blocks per segment %u, 10742>4 lelong 2 version 2, 10743>>8 lelong x \b fragments %u, 10744>>12 lelong x \b bytes per segment %u, 10745>16 lelong x \b disk blocks %u, 10746>20 lelong x \b block size %u, 10747>24 lelong x \b fragment size %u, 10748>28 lelong x \b fragments per block %u, 10749>32 lelong x \b start for free list %u, 10750>36 lelong x \b number of free blocks %d, 10751>40 lelong x \b number of files %u, 10752>44 lelong x \b blocks available for writing %d, 10753>48 lelong x \b inodes in cache %d, 10754>52 lelong x \b inode file disk address 0x%x, 10755>56 lelong x \b inode file inode number %u, 10756>60 lelong x \b address of last segment written 0x%x, 10757>64 lelong x \b address of next segment to write 0x%x, 10758>68 lelong x \b address of current segment written 0x%x 10759 107600 string td\000 floppy image data (TeleDisk, compressed) 107610 string TD\000 floppy image data (TeleDisk) 10762 107630 string CQ\024 floppy image data (CopyQM, 10764>16 leshort x %d sectors, 10765>18 leshort x %d heads.) 10766 107670 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 10768 107690 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 107700 beshort 0xAA59 floppy image data (IBM SaveDskF) 107710 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 10772 107730 string \074CPM_Disk\076 disk image data (YAZE) 10774 10775# ReFS 10776# Richard W.M. Jones <rjones@redhat.com> 107770 string \0\0\0ReFS\0 ReFS filesystem image 10778 10779# EFW encase image file format: 10780# Gregoire Passault 10781# http://www.forensicswiki.org/wiki/Encase_image_file_format 107820 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 10783 10784# UBIfs 10785# Linux kernel sources: fs/ubifs/ubifs-media.h 107860 lelong 0x06101831 10787>0x16 leshort 0 UBIfs image 10788>0x08 lequad x \b, sequence number %llu 10789>0x10 leshort x \b, length %u 10790>0x04 lelong x \b, CRC 0x%08x 10791 107920 lelong 0x23494255 10793>0x04 leshort <2 10794>0x05 string \0\0\0 10795>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 10796>0x04 leshort x UBI image, version %u 10797 10798# NEC PC-88 2D disk image 10799# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 108000x20 ulelong&0xFFFFFEFF 0x2A0 10801>0x10 string \0\0\0\0\0\0\0\0\0\0 10802>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 10803>>>0x1A ubyte&0xEF 0 10804>>>>0x1B ubyte&0x8F 0 10805>>>>>0x1B ubyte&70 <0x40 10806>>>>>>0x1C ulelong >0x21 10807>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 10808>>>>>>>>0x1B ubyte 0 \b, media=2D 10809>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 10810>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 10811>>>>>>>>0x1B ubyte 0x30 \b, media=1D 10812>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 10813>>>>>>>>0x1A ubyte 0x10 \b, write-protected 10814 10815#------------------------------------------------------------------------------ 10816# $File: finger,v 1.2 2015/10/07 02:37:57 christos Exp $ 10817# fingerprint: file(1) magic for fingerprint data 10818# XPM bitmaps) 10819# 10820 10821# http://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c 10822 108230 string FP1 libfprint fingerprint data V1 10824>3 beshort x \b, driver_id %x 10825>5 belong x \b, devtype %x 10826 108270 string FP2 libfprint fingerprint data V2 10828>3 beshort x \b, driver_id %x 10829>5 belong x \b, devtype %x 10830 10831#------------------------------------------------------------------------------ 10832# $File: flash,v 1.12 2017/02/07 23:25:26 christos Exp $ 10833# flash: file(1) magic for Macromedia Flash file format 10834# 10835# See 10836# 10837# http://www.macromedia.com/software/flash/open/ 10838# http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ 10839# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 10840# 10841 108420 name swf-details 10843 10844>0 string F 10845>>8 byte&0xfd 0x08 Macromedia Flash data 10846!:mime application/x-shockwave-flash 10847>>>3 byte x \b, version %d 10848>>8 byte&0xfe 0x10 Macromedia Flash data 10849!:mime application/x-shockwave-flash 10850>>>3 byte x \b, version %d 10851>>8 byte 0x18 Macromedia Flash data 10852!:mime application/x-shockwave-flash 10853>>>3 byte x \b, version %d 10854>>8 beshort&ff87 0x2000 Macromedia Flash data 10855!:mime application/x-shockwave-flash 10856>>>3 byte x \b, version %d 10857>>8 beshort&ffe0 0x3000 Macromedia Flash data 10858!:mime application/x-shockwave-flash 10859>>>3 byte x \b, version %d 10860>>8 byte&0x7 0 10861>>>8 ubyte >0x2f 10862>>>>9 ubyte <0x20 Macromedia Flash data 10863!:mime application/x-shockwave-flash 10864>>>>>3 byte x \b, version %d 10865 10866>0 string C 10867>>8 byte 0x78 Macromedia Flash data (compressed) 10868!:mime application/x-shockwave-flash 10869>>>3 byte x \b, version %d 10870 10871>0 string Z 10872>>8 byte 0x5d Macromedia Flash data (lzma compressed) 10873!:mime application/x-shockwave-flash 10874>>>3 byte x \b, version %d 10875 10876 108771 string WS 10878>4 ulelong >14 10879>>3 ubyte !0 10880>>>0 use swf-details 10881 10882# From: Cal Peake <cp@absolutedigital.net> 108830 string FLV\x01 Macromedia Flash Video 10884!:mime video/x-flv 10885 10886# 10887# Yosu Gomez 108880 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 108890 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 10890# From Dave Wilson 108910 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 10892 10893#------------------------------------------------------------------------------ 10894# $File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $ 10895# flif: Magic data for file(1) command. 10896# FLIF (Free Lossless Image Format) 10897 108980 string FLIF FLIF 10899>4 string <H image data 10900>>6 beshort x \b, %u 10901>>8 beshort x \bx%u 10902>>5 string 1 \b, 8-bit/color, 10903>>5 string 2 \b, 16-bit/color, 10904>>4 string 1 \b, grayscale, non-interlaced 10905>>4 string 3 \b, RGB, non-interlaced 10906>>4 string 4 \b, RGBA, non-interlaced 10907>>4 string A \b, grayscale 10908>>4 string C \b, RGB, interlaced 10909>>4 string D \b, RGBA, interlaced 10910>4 string >H \b, animation data 10911>>5 ubyte <255 \b, %i frames 10912>>>7 beshort x \b, %u 10913>>>9 beshort x \bx%u 10914>>>6 string =1 \b, 8-bit/color 10915>>>6 string =2 \b, 16-bit/color 10916>>5 ubyte 0xFF 10917>>>6 beshort x \b, %i frames, 10918>>>9 beshort x \b, %u 10919>>>11 beshort x \bx%u 10920>>>8 string =1 \b, 8-bit/color 10921>>>8 string =2 \b, 16-bit/color 10922>>4 string =Q \b, grayscale, non-interlaced 10923>>4 string =S \b, RGB, non-interlaced 10924>>4 string =T \b, RGBA, non-interlaced 10925>>4 string =a \b, grayscale 10926>>4 string =c \b, RGB, interlaced 10927>>4 string =d \b, RGBA, interlaced 10928 10929#------------------------------------------------------------------------------ 10930# $File: fonts,v 1.35 2017/03/17 21:35:28 christos Exp $ 10931# fonts: file(1) magic for font data 10932# 109330 search/1 FONT ASCII vfont text 109340 short 0436 Berkeley vfont data 109350 short 017001 byte-swapped Berkeley vfont data 10936 10937# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 109380 string %!PS-AdobeFont-1. PostScript Type 1 font text 10939>20 string >\0 (%s) 109406 string %!PS-AdobeFont-1. PostScript Type 1 font program data 109410 string %!FontType1 PostScript Type 1 font program data 109426 string %!FontType1 PostScript Type 1 font program data 109430 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 10944 10945# Summary: PostScript Type 1 Printer Font Metrics 10946# URL: https://en.wikipedia.org/wiki/PostScript_fonts 10947# Reference: http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf 10948# Modified by: Joerg Jenderek 10949# Note: moved from ./msdos magic 10950# dfVersion 256=0100h 109510 uleshort 0x0100 10952# GRR: line above is too general as it catches also TrueType font, 10953# raw G3 data FAX, WhatsApp encrypted and Panorama database 10954# dfType 129=0081h 10955>66 uleshort 0x0081 10956# dfVertRes 300=012Ch not needed as additional test 10957#>>70 uleshort 0x012c 10958# dfHorizRes 300=012Ch 10959#>>>72 uleshort 0x012c 10960# dfDriverInfo points to postscript information section 10961>>(101.l) string/c Postscript Printer Font Metrics 10962# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID 10963!:mime application/x-font-pfm 10964# AppleShare Print Server 10965#!:apple ASPS???? 10966!:ext pfm 10967# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking 10968#>>>6 string >\060 - %-.60s 10969# dfDriverInfo 10970>>>139 ulelong >0 10971# often abbreviated and same as filename 10972>>>>(139.l) string x %s 10973# dfSize 10974>>>2 ulelong x \b, %d bytes 10975# dfFace 210=D2h 9Eh 10976>>>105 ulelong >0 10977# Windows font name 10978>>>>(105.l) string x \b, %s 10979# dfItalic 10980>>>80 ubyte 1 italic 10981# dfUnderline 10982>>>81 ubyte 1 underline 10983# dfStrikeOut 10984>>>82 ubyte 1 strikeout 10985# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc 10986>>>83 uleshort >699 bold 10987# dfPitchAndFamily 16 17 48 49 64 65 10988>>>90 ubyte 16 serif 10989>>>90 ubyte 17 serif proportional 10990#>>>90 ubyte 48 other 10991>>>90 ubyte 49 proportional 10992>>>90 ubyte 64 script 10993>>>90 ubyte 65 script proportional 10994 10995# X11 font files in SNF (Server Natural Format) format 10996# updated by Joerg Jenderek at Feb 2013 10997# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 109980 belong 00000004 X11 SNF font data, MSB first 10999#>104 belong 00000004 X11 SNF font data, MSB first 11000!:mime application/x-font-sfn 11001# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 110020 lelong 00000004 11003>104 lelong 00000004 X11 SNF font data, LSB first 11004!:mime application/x-font-sfn 11005 11006# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 110070 search/1 STARTFONT\ X11 BDF font text 11008 11009# From: Joerg Jenderek 11010# URL: http://grub.gibibit.com/New_font_format 11011# Reference: util/grub-mkfont.c 11012# include/grub/fontformat.h 11013# FONT_FORMAT_SECTION_NAMES_FILE 110140 string FILE 11015# FONT_FORMAT_PFF2_MAGIC 11016>8 string PFF2 11017# leng 4 only at the moment 11018>>4 ubelong 4 11019# FONT_FORMAT_SECTION_NAMES_FONT_NAME 11020>>>12 string NAME GRUB2 font 11021!:mime application/x-font-pf2 11022!:ext pf2 11023# length of font_name 11024>>>>16 ubelong >0 11025# font_name 11026>>>>>20 string >\0 "%-s" 11027 11028# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 11029# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 110300 string \001fcp X11 Portable Compiled Font data, 11031>12 lelong ^0x08 bit: LSB, 11032>12 lelong &0x08 bit: MSB, 11033>12 lelong ^0x04 byte: LSB first 11034>12 lelong &0x04 byte: MSB first 110350 string D1.0\015 X11 Speedo font data 11036 11037#------------------------------------------------------------------------------ 11038# FIGlet fonts and controlfiles 11039# From figmagic supplied with Figlet version 2.2 11040# "David E. O'Brien" <obrien@FreeBSD.ORG> 110410 string flf FIGlet font 11042>3 string >2a version %-2.2s 110430 string flc FIGlet controlfile 11044>3 string >2a version %-2.2s 11045 11046# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 11047# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 110480 belong 0x14025919 libGrx font data, 11049>8 leshort x %dx 11050>10 leshort x \b%d 11051>40 string x %s 11052# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 110530 belong 0xff464f4e DOS code page font data collection 110547 belong 0x00454741 DOS code page font data 110557 belong 0x00564944 DOS code page font data (from Linux?) 110564098 string DOSFONT DOSFONT2 encrypted font data 11057 11058# downloadable fonts for browser (prints type) anthon@mnt.org 11059# https://tools.ietf.org/html/rfc3073 110600 string PFR1 Portable Font Resource font data (new) 11061>102 string >0 \b: %s 110620 string PFR0 Portable Font Resource font data (old) 11063>4 beshort >0 version %d 11064 11065# True Type fonts 110660 string \000\001\000\000\000 TrueType font data 11067!:mime application/x-font-ttf 11068 110690 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 110700 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 11071 11072# TrueType/OpenType font collections (.ttc) 11073# http://www.microsoft.com/typography/otspec/otff.htm 110740 string ttcf TrueType font collection data 11075>4 belong 0x00010000 \b, 1.0 11076>>8 belong >0 \b, %d fonts 11077>4 belong 0x00020000 \b, 2.0 11078>>8 belong >0 \b, %d fonts 11079# 0x44454947 = 'DSIG' 11080>>>16 belong 0x44534947 \b, digitally signed 11081 11082# Opentype font data from Avi Bercovich 110830 string OTTO OpenType font data 11084!:mime application/vnd.ms-opentype 11085 11086# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 110870 string SplineFontDB: Spline Font Database 11088!:mime application/vnd.font-fontforge-sfd 11089>14 string x version %s 11090 11091# EOT 110920x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 11093>0x22 string LP Embedded OpenType (EOT) 11094# workaround until there's lepstring16 11095# >>0x52 lepstring16/h >\0 \b, %s family 11096>>0x52 short !0 11097>>>0x54 lestring16 x \b, %s family 11098!:mime application/vnd.ms-fontobject 11099 11100# Web Open Font Format (.woff) 111010 name woff 11102>4 belong 0x00010000 \b, TrueType 11103>4 belong 0x4F54544F \b, CFF 11104>4 belong 0x74727565 \b, TrueType 11105>4 default x 11106>>4 belong x \b, flavor %d 11107>8 belong x \b, length %d 11108#>12 beshort x \b, numTables %d 11109#>14 beshort x \b, reserved %d 11110#>16 belong x \b, totalSfntSize %d 11111 11112# http://www.w3.org/TR/WOFF/ 111130 string wOFF Web Open Font Format 11114>0 use woff 11115>20 beshort x \b, version %d 11116>22 beshort x \b.%d 11117# http://www.w3.org/TR/WOFF2/ 111180 string wOF2 Web Open Font Format (Version 2) 11119>0 use woff 11120#>20 belong x \b, totalCompressedSize %d 11121>24 beshort x \b, version %d 11122>26 beshort x \b.%d 11123 11124#------------------------------------------------------------------------------ 11125# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $ 11126# FORTRAN source 11127# Check that the first 100 lines start with C or whitespace first. 111280 regex/100l !\^[^Cc\ \t].*$ 11129>0 regex/100l \^[Cc][\ \t] FORTRAN program text 11130!:mime text/x-fortran 11131!:strength - 5 11132 11133#------------------------------------------------------------------------------ 11134# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $ 11135# frame: file(1) magic for FrameMaker files 11136# 11137# This stuff came on a FrameMaker demo tape, most of which is 11138# copyright, but this file is "published" as witness the following: 11139# 11140# Note that this is the Framemaker Maker Interchange Format, not the 11141# Normal format which would be application/vnd.framemaker. 11142# 111430 string \<MakerFile FrameMaker document 11144!:mime application/x-mif 11145>11 string 5.5 (5.5 11146>11 string 5.0 (5.0 11147>11 string 4.0 (4.0 11148>11 string 3.0 (3.0 11149>11 string 2.0 (2.0 11150>11 string 1.0 (1.0 11151>14 byte x %c) 111520 string \<MIFFile FrameMaker MIF (ASCII) file 11153!:mime application/x-mif 11154>9 string 4.0 (4.0) 11155>9 string 3.0 (3.0) 11156>9 string 2.0 (2.0) 11157>9 string 1.0 (1.x) 111580 search/1 \<MakerDictionary FrameMaker Dictionary text 11159!:mime application/x-mif 11160>17 string 3.0 (3.0) 11161>17 string 2.0 (2.0) 11162>17 string 1.0 (1.x) 111630 string \<MakerScreenFont FrameMaker Font file 11164!:mime application/x-mif 11165>17 string 1.01 (%s) 111660 string \<MML FrameMaker MML file 11167!:mime application/x-mif 111680 string \<BookFile FrameMaker Book file 11169!:mime application/x-mif 11170>10 string 3.0 (3.0 11171>10 string 2.0 (2.0 11172>10 string 1.0 (1.0 11173>13 byte x %c) 11174# XXX - this book entry should be verified, if you find one, uncomment this 11175#0 string \<Book\040 FrameMaker Book (ASCII) file 11176#!:mime application/x-mif 11177#>6 string 3.0 (3.0) 11178#>6 string 2.0 (2.0) 11179#>6 string 1.0 (1.0) 111800 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file 11181!:mime application/x-mif 11182 11183#------------------------------------------------------------------------------ 11184# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 11185# freebsd: file(1) magic for FreeBSD objects 11186# 11187# All new-style FreeBSD magic numbers are in host byte order (i.e., 11188# little-endian on x86). 11189# 11190# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 11191# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 11192# schemes for distinguishing between executable images, shared libraries, 11193# and object files. 11194# 11195# FreeBSD says: 11196# 11197# Regardless of whether it's pure, demand-paged, or none of the 11198# above: 11199# 11200# if the entry point is < 4096, then it's a shared library if 11201# the "has run-time loader information" bit is set, and is 11202# position-independent if the "is position-independent" bit 11203# is set; 11204# 11205# if the entry point is >= 4096 (or >4095, same thing), then it's 11206# an executable, and is dynamically-linked if the "has run-time 11207# loader information" bit is set. 11208# 11209# On x86, NetBSD says: 11210# 11211# If it's neither pure nor demand-paged: 11212# 11213# if it has the "has run-time loader information" bit set, it's 11214# a dynamically-linked executable; 11215# 11216# if it doesn't have that bit set, then: 11217# 11218# if it has the "is position-independent" bit set, it's 11219# position-independent; 11220# 11221# if the entry point is non-zero, it's an executable, otherwise 11222# it's an object file. 11223# 11224# If it's pure: 11225# 11226# if it has the "has run-time loader information" bit set, it's 11227# a dynamically-linked executable, otherwise it's just an 11228# executable. 11229# 11230# If it's demand-paged: 11231# 11232# if it has the "has run-time loader information" bit set, 11233# then: 11234# 11235# if the entry point is < 4096, it's a shared library; 11236# 11237# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 11238# it's a dynamically-linked executable); 11239# 11240# if it doesn't have the "has run-time loader information" bit 11241# set, then it's just an executable. 11242# 11243# (On non-x86, NetBSD does much the same thing, except that it uses 11244# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 11245# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 11246# had 8K pages; dunno about MIPS.) 11247# 11248# I suspect the two will differ only in perverse and uninteresting cases 11249# ("shared" libraries that aren't demand-paged and whose pages probably 11250# won't actually be shared, executables with entry points <4096). 11251# 11252# I leave it to those more familiar with FreeBSD and NetBSD to figure out 11253# what the right answer is (although using ">4095", FreeBSD-style, is 11254# probably better than separately checking for "=4096" and ">4096", 11255# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 11256# executables using the NetBSD technique.) 11257# 112580 lelong&0377777777 041400407 FreeBSD/i386 11259>20 lelong <4096 11260>>3 byte&0xC0 &0x80 shared library 11261>>3 byte&0xC0 0x40 PIC object 11262>>3 byte&0xC0 0x00 object 11263>20 lelong >4095 11264>>3 byte&0x80 0x80 dynamically linked executable 11265>>3 byte&0x80 0x00 executable 11266>16 lelong >0 not stripped 11267 112680 lelong&0377777777 041400410 FreeBSD/i386 pure 11269>20 lelong <4096 11270>>3 byte&0xC0 &0x80 shared library 11271>>3 byte&0xC0 0x40 PIC object 11272>>3 byte&0xC0 0x00 object 11273>20 lelong >4095 11274>>3 byte&0x80 0x80 dynamically linked executable 11275>>3 byte&0x80 0x00 executable 11276>16 lelong >0 not stripped 11277 112780 lelong&0377777777 041400413 FreeBSD/i386 demand paged 11279>20 lelong <4096 11280>>3 byte&0xC0 &0x80 shared library 11281>>3 byte&0xC0 0x40 PIC object 11282>>3 byte&0xC0 0x00 object 11283>20 lelong >4095 11284>>3 byte&0x80 0x80 dynamically linked executable 11285>>3 byte&0x80 0x00 executable 11286>16 lelong >0 not stripped 11287 112880 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 11289>20 lelong <4096 11290>>3 byte&0xC0 &0x80 shared library 11291>>3 byte&0xC0 0x40 PIC object 11292>>3 byte&0xC0 0x00 object 11293>20 lelong >4095 11294>>3 byte&0x80 0x80 dynamically linked executable 11295>>3 byte&0x80 0x00 executable 11296>16 lelong >0 not stripped 11297 11298# XXX gross hack to identify core files 11299# cores start with a struct tss; we take advantage of the following: 11300# byte 7: highest byte of the kernel stack pointer, always 0xfe 11301# 8/9: kernel (ring 0) ss value, always 0x0010 11302# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 11303# 28: low order byte of the current PTD entry, always 0 since the 11304# PTD is page-aligned 11305# 113067 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 11307>1039 string >\0 from '%s' 11308 11309# /var/run/ld.so.hints 11310# What are you laughing about? 113110 lelong 011421044151 ld.so hints file (Little Endian 11312>4 lelong >0 \b, version %d) 11313>4 belong <1 \b) 113140 belong 011421044151 ld.so hints file (Big Endian 11315>4 belong >0 \b, version %d) 11316>4 belong <1 \b) 11317 11318# 11319# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 11320# 113210 string SCRSHOT_ scrshot(1) screenshot, 11322>8 byte x version %d, 11323>9 byte 2 %d bytes in header, 11324>>10 byte x %d chars wide by 11325>>11 byte x %d chars high 11326 11327#------------------------------------------------------------------------------ 11328# $File: fsav,v 1.14 2017/03/17 21:35:28 christos Exp $ 11329# fsav: file(1) magic for datafellows fsav virus definition files 11330# Anthon van der Neut (anthon@mnt.org) 11331 11332# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 113330 beshort 0x1575 fsav macro virus signatures 11334>8 leshort >0 (%d- 11335>11 byte >0 \b%02d- 11336>10 byte >0 \b%02d) 11337# ftp://ftp.f-prot.com/pub/sign.zip 11338#10 ubyte <12 11339#>9 ubyte <32 11340#>>8 ubyte 0x0a 11341#>>>12 ubyte 0x07 11342#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 11343#>>>>10 byte 0 \b01- 11344#>>>>10 byte 1 \b02- 11345#>>>>10 byte 2 \b03- 11346#>>>>10 byte 3 \b04- 11347#>>>>10 byte 4 \b05- 11348#>>>>10 byte 5 \b06- 11349#>>>>10 byte 6 \b07- 11350#>>>>10 byte 7 \b08- 11351#>>>>10 byte 8 \b09- 11352#>>>>10 byte 9 \b10- 11353#>>>>10 byte 10 \b11- 11354#>>>>10 byte 11 \b12- 11355#>>>>9 ubyte >0 \b%02d) 11356# ftp://ftp.f-prot.com/pub/sign2.zip 11357#0 ubyte 0x62 11358#>1 ubyte 0xF5 11359#>>2 ubyte 0x1 11360#>>>3 ubyte 0x1 11361#>>>>4 ubyte 0x0e 11362#>>>>>13 ubyte >0 fsav virus signatures 11363#>>>>>>11 ubyte x size 0x%02x 11364#>>>>>>12 ubyte x \b%02x 11365#>>>>>>13 ubyte x \b%02x bytes 11366 11367# Joerg Jenderek: joerg dot jenderek at web dot de 11368# http://www.clamav.net/doc/latest/html/node45.html 11369# .cvd files start with a 512 bytes colon separated header 11370# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 11371# + gzipped tarball files 113720 string ClamAV-VDB: 11373>11 string >\0 Clam AntiVirus database %-.23s 11374>>34 string : 11375>>>35 string !: \b, version 11376>>>>35 string x \b%-.1s 11377>>>>>36 string !: 11378>>>>>>36 string x \b%-.1s 11379>>>>>>>37 string !: 11380>>>>>>>>37 string x \b%-.1s 11381>>>>>>>>>38 string !: 11382>>>>>>>>>>38 string x \b%-.1s 11383>512 string \037\213 \b, gzipped 11384>769 string ustar\0 \b, tarred 11385 11386# Type: Grisoft AVG AntiVirus 11387# From: David Newgas <david@newgas.net> 113880 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 11389 113900 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 11391>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 11392 11393#------------------------------------------------------------------------------ 11394# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 11395# fusecompress: file(1) magic for fusecompress 113960 string \037\135\211 FuseCompress(ed) data 11397>3 byte 0x00 (none format) 11398>3 byte 0x01 (bz2 format) 11399>3 byte 0x02 (gz format) 11400>3 byte 0x03 (lzo format) 11401>3 byte 0x04 (xor format) 11402>3 byte >0x04 (unknown format) 11403>4 long x uncompressed size: %d 11404 11405#------------------------------------------------------------------------------ 11406# $File: games,v 1.15 2017/03/17 21:35:28 christos Exp $ 11407# games: file(1) for games 11408 11409# Fabio Bonelli <fabiobonelli@libero.it> 11410# Quake II - III data files 114110 string IDP2 Quake II 3D Model file, 11412>20 long x %u skin(s), 11413>8 long x (%u x 11414>12 long x %u), 11415>40 long x %u frame(s), 11416>16 long x Frame size %u bytes, 11417>24 long x %u vertices/frame, 11418>28 long x %u texture coordinates, 11419>32 long x %u triangles/frame 11420 114210 string IBSP Quake 11422>4 long 0x26 II Map file (BSP) 11423>4 long 0x2E III Map file (BSP) 11424 114250 string IDS2 Quake II SP2 sprite file 11426 11427#--------------------------------------------------------------------------- 11428# Doom and Quake 11429# submitted by Nicolas Patrois 11430 114310 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 11432# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 11433 1143424 string LxD\ 203 Linuxdoom save 11435>0 string x , name=%s 11436>44 string x , world=%s 11437 11438# Quake 11439 114400 string PACK Quake I or II world or extension 11441>8 lelong >0 \b, %d entries 11442 11443#0 string -1\x0a Quake I demo 11444#>30 string x version %.4s 11445#>61 string x level %s 11446 11447#0 string 5\x0a Quake I save 11448 11449# The levels 11450 11451# Quake 1 11452 114530 string 5\x0aIntroduction Quake I save: start Introduction 114540 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 114550 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 114560 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 114570 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 114580 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 114590 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 114600 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 114610 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 114620 string 5\x0athe_Installation Quake I save: e2m1 The installation 114630 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 114640 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 114650 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 114660 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 114670 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 114680 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 114690 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 114700 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 114710 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 114720 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 114730 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 114740 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 114750 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 114760 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 114770 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 114780 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 114790 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 114800 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 114810 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 114820 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 114830 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 114840 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 11485 11486# Quake DeathMatch levels 11487 114880 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 114890 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 114900 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 114910 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 114920 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 114930 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 11494 11495# Scourge of Armagon 11496 114970 string 5\x0aCommand_HQ Quake I save: start Command HQ 114980 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 114990 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 115000 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 115010 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 115020 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 115030 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 115040 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 115050 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 115060 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 115070 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 115080 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 115090 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 115100 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 115110 string 5\x0aLimbo Quake I save: hip3m3 Limbo 115120 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 115130 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 115140 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 11515 11516# Malice 11517 115180 string 5\x0aThe_Academy Quake I save: start The academy 115190 string 5\x0aThe_Lab Quake I save: d1 The lab 115200 string 5\x0aArea_33 Quake I save: d1b Area 33 115210 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 115220 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 115230 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 115240 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 115250 string 5\x0aArea44 Quake I save: d1c Area 44 115260 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 115270 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 115280 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 115290 string 5\x0aThe_Flood Quake I save: d5 The flood 115300 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 115310 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 115320 string 5\x0aThe_Foundry Quake I save: d7b The foundry 115330 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 115340 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 115350 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 115360 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 115370 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 115380 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 11539 11540# Malice DeathMatch levels 11541 115420 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 115430 string 5\x0aSub_Station Quake I save: ddm2 Sub station 115440 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 115450 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 115460 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 115470 string 5\x0aDOMINO Quake I save: ddm6 Domino 115480 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 11549 11550 115510 string MComprHD MAME CHD compressed hard disk image, 11552>12 belong x version %u 11553 11554# doom - submitted by Jon Dowland 11555 115560 string =IWAD doom main IWAD data 11557>4 lelong x containing %d lumps 115580 string =PWAD doom patch PWAD data 11559>4 lelong x containing %d lumps 11560 11561# Build engine group files (Duke Nukem, Shadow Warrior, ...) 11562# Extension: .grp 11563# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 115640 string KenSilverman Build engine group file 11565>12 lelong x containing %d files 11566 11567# Summary: Warcraft 3 save 11568# Extension: .w3g 11569# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 115700 string Warcraft\ III\ recorded\ game %s 11571 11572 11573# Summary: Warcraft 3 map 11574# Extension: .w3m 11575# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 115760 string HM3W Warcraft III map file 11577 11578 11579# Summary: SGF Smart Game Format 11580# Extension: .sgf 11581# Reference: http://www.red-bean.com/sgf/ 11582# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 11583# Modified by (1): Abel Cheung (regex, more game format) 11584# FIXME: Some games don't have GM (game type) 115850 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 11586>2 search/0x200/b GM[ 11587>>&0 string 1] (Go) 11588>>&0 string 2] (Othello) 11589>>&0 string 3] (chess) 11590>>&0 string 4] (Gomoku+Renju) 11591>>&0 string 5] (Nine Men's Morris) 11592>>&0 string 6] (Backgammon) 11593>>&0 string 7] (Chinese chess) 11594>>&0 string 8] (Shogi) 11595>>&0 string 9] (Lines of Action) 11596>>&0 string 10] (Ataxx) 11597>>&0 string 11] (Hex) 11598>>&0 string 12] (Jungle) 11599>>&0 string 13] (Neutron) 11600>>&0 string 14] (Philosopher's Football) 11601>>&0 string 15] (Quadrature) 11602>>&0 string 16] (Trax) 11603>>&0 string 17] (Tantrix) 11604>>&0 string 18] (Amazons) 11605>>&0 string 19] (Octi) 11606>>&0 string 20] (Gess) 11607>>&0 string 21] (Twixt) 11608>>&0 string 22] (Zertz) 11609>>&0 string 23] (Plateau) 11610>>&0 string 24] (Yinsh) 11611>>&0 string 25] (Punct) 11612>>&0 string 26] (Gobblet) 11613>>&0 string 27] (hive) 11614>>&0 string 28] (Exxit) 11615>>&0 string 29] (Hnefatal) 11616>>&0 string 30] (Kuba) 11617>>&0 string 31] (Tripples) 11618>>&0 string 32] (Chase) 11619>>&0 string 33] (Tumbling Down) 11620>>&0 string 34] (Sahara) 11621>>&0 string 35] (Byte) 11622>>&0 string 36] (Focus) 11623>>&0 string 37] (Dvonn) 11624>>&0 string 38] (Tamsk) 11625>>&0 string 39] (Gipf) 11626>>&0 string 40] (Kropki) 11627 11628############################################## 11629# NetImmerse/Gamebryo game engine entries 11630 11631# Summary: Gamebryo game engine file 11632# Extension: .nif, .kf 11633# Created by: Abel Cheung <abelcheung@gmail.com> 116340 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 11635>&0 regex [0-9a-z.]+ \b, version %s 11636 11637# Summary: Gamebryo game engine file 11638# Extension: .kfm 11639# Created by: Abel Cheung <abelcheung@gmail.com> 116400 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 11641>&0 regex [0-9a-z.]+ \b, version %s 11642 11643# Summary: NetImmerse game engine file 11644# Extension .nif 11645# Created by: Abel Cheung <abelcheung@gmail.com> 116460 string NetImmerse\ File\ Format,\ Versio 11647>&0 string n\ NetImmerse game engine file 11648>>&0 regex [0-9a-z.]+ \b, version %s 11649 11650# Type: SGF Smart Game Format 11651# URL: http://www.red-bean.com/sgf/ 11652# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 116532 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 11654>2 regex/c GM\\[1\\] - Go Game 11655>2 regex/c GM\\[6\\] - BackGammon Game 11656>2 regex/c GM\\[11\\] - Hex Game 11657>2 regex/c GM\\[18\\] - Amazons Game 11658>2 regex/c GM\\[19\\] - Octi Game 11659>2 regex/c GM\\[20\\] - Gess Game 11660>2 regex/c GM\\[21\\] - twix Game 11661 11662# Epic Games/Unreal Engine Package 11663# 116640 lelong 0x9E2A83C1 Unreal Engine Package, 11665>4 leshort x version: %i 11666>12 lelong !0 \b, names: %i 11667>28 lelong !0 \b, imports: %i 11668>20 lelong !0 \b, exports: %i 11669 11670#------------------------------------------------------------------------------ 11671# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $ 11672# gcc: file(1) magic for GCC special files 11673# 116740 string gpch GCC precompiled header 11675 11676# The version field is annoying. It's 3 characters, not zero-terminated. 11677>5 byte x (version %c 11678>6 byte x \b%c 11679>7 byte x \b%c) 11680 11681# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 11682>4 byte 67 for C 11683>4 byte 111 for Objective-C 11684>4 byte 43 for C++ 11685>4 byte 79 for Objective-C++ 11686 11687#------------------------------------------------------------------------------ 11688# $File: geo,v 1.4 2017/03/17 21:35:28 christos Exp $ 11689# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 11690 11691###################################################################### 11692# 11693# Acoustic Doppler Current Profilers (ADCP) 11694# 11695###################################################################### 11696 116970 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 11698 11699###################################################################### 11700# 11701# Metadata 11702# 11703###################################################################### 11704 117050 string Identification_Information FGDC ASCII metadata 11706 11707###################################################################### 11708# 11709# Seimsic / Subbottom 11710# 11711###################################################################### 11712 11713# Knudsen subbottom chirp profiler - Binary File Format: B9 11714# KEB D409-03167 V1.75 Huffman 117150 string KEB\ Knudsen seismic KEL binary (KEB) - 11716>4 regex [-A-Z0-9]* Software: %s 11717>>&1 regex V[0-9]*\.[0-9]* version %s 11718 11719###################################################################### 11720# 11721# LIDAR - Laser altimetry or bathy 11722# 11723###################################################################### 11724 11725 11726# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 117270 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 11728>4 regex [0-9]*\.[0-9]* version %s 11729 117300 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 11731>3 byte x version %d . 11732>4 byte x %d 11733 11734 11735###################################################################### 11736# 11737# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 11738# 11739###################################################################### 11740 11741# GeoAcoustics - GeoSwath Plus 117424 beshort 0x2002 GeoSwath RDF 117430 string Start:- GeoSwatch auf text file 11744 11745# Seabeam 2100 11746# mbsystem code mb41 117470 string SB2100 SeaBeam 2100 multibeam sonar 117480 string SB2100DR SeaBeam 2100 DR multibeam sonar 117490 string SB2100PR SeaBeam 2100 PR multibeam sonar 11750 11751# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 11752# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 117530 string $HSF XSE multibeam 11754 11755# mb121 http://www.saic.com/maritime/gsf/ 117568 string GSF-v SAIC generic sensor format (GSF) sonar data, 11757>&0 regex [0-9]*\.[0-9]* version %s 11758 11759# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 11760# mb161 117619 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 11762 11763# MBSystem processing caches the mbinfo output 117641 string Swath\ Data\ File: mbsystem info cache 11765 11766# Caris John Hughes Clark format 117670 string HDCS Caris multibeam sonar related data 117681 string Start/Stop\ parameter\ header: Caris ASCII project summary 11769 11770###################################################################### 11771# 11772# Visualization and 3D modeling 11773# 11774###################################################################### 11775 11776# IVS - IVS3d.com Tagged Data Represetation 117770 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 11778 11779# http://www.ecma-international.org/publications/standards/Ecma-363.htm 11780# 3D in PDFs 117810 string U3D ECMA-363, Universal 3D 11782 11783###################################################################### 11784# 11785# Support files 11786# 11787###################################################################### 11788 11789# https://midas.psi.ch/elog/ 117900 string $@MID@$ elog journal entry 11791 11792# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm 117930 string DSBB Surfer 6 binary grid file 11794>4 leshort x \b, %d 11795>6 leshort x \bx%d 11796>8 ledouble x \b, minx=%g 11797>16 ledouble x \b, maxx=%g 11798>24 ledouble x \b, miny=%g 11799>32 ledouble x \b, maxy=%g 11800>40 ledouble x \b, minz=%g 11801>48 ledouble x \b, maxz=%g 11802 11803 11804#------------------------------------------------------------------------------ 11805# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 11806# GEOS files (Vidar Madsen, vidar@gimp.org) 11807# semi-commonly used in embedded and handheld systems. 118080 belong 0xc745c153 GEOS 11809>40 byte 1 executable 11810>40 byte 2 VMFile 11811>40 byte 3 binary 11812>40 byte 4 directory label 11813>40 byte <1 unknown 11814>40 byte >4 unknown 11815>4 string >\0 \b, name "%s" 11816#>44 short x \b, version %d 11817#>46 short x \b.%d 11818#>48 short x \b, rev %d 11819#>50 short x \b.%d 11820#>52 short x \b, proto %d 11821#>54 short x \br%d 11822#>168 string >\0 \b, copyright "%s" 11823 11824#------------------------------------------------------------------------------ 11825# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $ 11826# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 11827# by Federico Mena <federico@nuclecu.unam.mx> 11828 118290 string/t GIMP\ Gradient GIMP gradient data 11830 11831# GIMP palette (.gpl) 11832# From: Markus Heidelberg <markus.heidelberg@web.de> 118330 string/t GIMP\ Palette GIMP palette data 11834 11835#------------------------------------------------------------------------------ 11836# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 11837# by Spencer Kimball and Peter Mattis 11838# ('Bucky' LaDieu, nega@vt.edu) 11839 118400 string gimp\ xcf GIMP XCF image data, 11841!:mime image/x-xcf 11842>9 string file version 0, 11843>9 string v version 11844>>10 string >\0 %s, 11845>14 belong x %u x 11846>18 belong x %u, 11847>22 belong 0 RGB Color 11848>22 belong 1 Greyscale 11849>22 belong 2 Indexed Color 11850>22 belong >2 Unknown Image Type. 11851 11852#------------------------------------------------------------------------------ 11853# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 11854# by Spencer Kimball and Peter Mattis 11855# ('Bucky' LaDieu, nega@vt.edu) 11856 1185720 string GPAT GIMP pattern data, 11858>24 string x %s 11859 11860#------------------------------------------------------------------------------ 11861# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 11862# by Spencer Kimball and Peter Mattis 11863# ('Bucky' LaDieu, nega@vt.edu) 11864 1186520 string GIMP GIMP brush data 11866 11867# GIMP Curves File 11868# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 118690 string #\040GIMP\040Curves\040File GIMP curve file 11870 11871#------------------------------------------------------------------------------ 11872# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $ 11873# GNOME related files 11874 11875# Contributed by Josh Triplett 11876# FIXME: Could be simplified if pstring supported two-byte counts 118770 string GnomeKeyring\n\r\0\n GNOME keyring 11878>&0 ubyte 0 \b, major version 0 11879>>&0 ubyte 0 \b, minor version 0 11880>>>&0 ubyte 0 \b, crypto type 0 (AES) 11881>>>&0 ubyte >0 \b, crypto type %u (unknown) 11882>>>&1 ubyte 0 \b, hash type 0 (MD5) 11883>>>&1 ubyte >0 \b, hash type %u (unknown) 11884>>>&2 ubelong 0xFFFFFFFF \b, name NULL 11885>>>&2 ubelong !0xFFFFFFFF 11886>>>>&-4 ubelong >255 \b, name too long for file's pstring type 11887>>>>&-4 ubelong <256 11888>>>>>&-1 pstring x \b, name "%s" 11889>>>>>>&0 ubeqdate x \b, last modified %s 11890>>>>>>&8 ubeqdate x \b, created %s 11891>>>>>>&16 ubelong &1 11892>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 11893>>>>>>&16 ubelong ^1 \b, not locked if idle 11894>>>>>>&24 ubelong x \b, hash iterations %u 11895>>>>>>&28 ubequad x \b, salt %llu 11896>>>>>>&52 ubelong x \b, %u item(s) 11897 11898# From: Alex Beregszaszi <alex@fsn.hu> 118994 string gtktalog GNOME Catalogue (gtktalog) 11900>13 string >\0 version %s 11901 11902# Summary: GStreamer binary registry 11903# Extension: .bin 11904# Submitted by: Josh Triplett <josh@joshtriplett.org> 119050 belong 0xc0def00d GStreamer binary registry 11906>4 string x \b, version %s 11907 11908# GVariant Database file 11909# By Elan Ruusamae <glen@delfi.ee> 11910# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 11911# It's always "GVariant", it's byte swapped on incompatible archs 11912# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 11913# file_builder_serialise() 11914# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 119150 string GVariant GVariant Database file, 11916# version is never filled. probably future extension 11917>8 lelong x version %d 11918# not sure are these usable, so commented out 11919#>>16 lelong x start %d, 11920#>>>20 lelong x end %d 11921 11922# G-IR database made by gobject-introspect toolset, 11923# http://live.gnome.org/GObjectIntrospection 119240 string GOBJ\nMETADATA\r\n\032 G-IR binary database 11925>16 byte x \b, v%d 11926>17 byte x \b.%d 11927>20 leshort x \b, %d entries 11928>22 leshort x \b/%d local 11929 11930#------------------------------------------------------------------------------ 11931# $File: gnu,v 1.18 2017/03/17 21:35:28 christos Exp $ 11932# gnu: file(1) magic for various GNU tools 11933# 11934# GNU nlsutils message catalog file format 11935# 11936# GNU message catalog (.mo and .gmo files) 11937 119380 string \336\22\4\225 GNU message catalog (little endian), 11939>6 leshort x revision %d. 11940>4 leshort >0 \b%d, 11941>>8 lelong x %d messages, 11942>>36 lelong x %d sysdep messages 11943>4 leshort =0 \b%d, 11944>>8 lelong x %d messages 11945 119460 string \225\4\22\336 GNU message catalog (big endian), 11947>4 beshort x revision %d. 11948>6 beshort >0 \b%d, 11949>>8 belong x %d messages, 11950>>36 belong x %d sysdep messages 11951>6 beshort =0 \b%d, 11952>>8 belong x %d messages 11953 11954 11955# GnuPG 11956# The format is very similar to pgp 119570 string \001gpg GPG key trust database 11958>4 byte x version %d 11959# Note: magic.mime had 0x8501 for the next line instead of 0x8502 119600 beshort 0x8502 GPG encrypted data 11961!:mime text/PGP # encoding: data 11962 11963# This magic is not particularly good, as the keyrings don't have true 11964# magic. Nevertheless, it covers many keyrings. 119650 ubeshort-0x9901 <2 11966>3 byte 4 11967>>4 bedate x GPG key public ring, created %s 11968!:mime application/x-gnupg-keyring 11969 11970 11971# Symmetric encryption 119720 leshort 0x0d8c 11973>4 leshort 0x0203 11974>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 11975>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 11976>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 11977>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 11978>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 11979>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 11980>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 11981>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 11982>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 11983>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 11984 11985 11986# GnuPG Keybox file 11987# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 11988# From: Philipp Hahn <hahn@univention.de> 119890 belong 32 11990>4 byte 1 11991>>8 string KBXf GPG keybox database 11992>>>5 byte 1 version %d 11993>>>16 bedate x \b, created-at %s 11994>>>20 bedate x \b, last-maintained %s 11995 11996 11997# Gnumeric spreadsheet 11998# This entry is only semi-helpful, as Gnumeric compresses its files, so 11999# they will ordinarily reported as "compressed", but at least -z helps 1200039 string =<gmr:Workbook Gnumeric spreadsheet 12001 12002# From: James Youngman <jay@gnu.org> 12003# gnu find magic 120040 string \0LOCATE GNU findutils locate database data 12005>7 string >\0 \b, format %s 12006>7 string 02 \b (frcode) 12007 12008# Files produced by GNU gettext 120090 long 0xDE120495 GNU-format message catalog data 120100 long 0x950412DE GNU-format message catalog data 12011 12012# gettext message catalogue 120130 search/1024 \nmsgid 12014>&0 search/1024 \nmsgstr GNU gettext message catalogue text 12015!:strength +100 12016!:mime text/x-po 12017 12018#------------------------------------------------------------------------------ 12019# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 12020# gnumeric: file(1) magic for Gnumeric spreadsheet 12021# This entry is only semi-helpful, as Gnumeric compresses its files, so 12022# they will ordinarily reported as "compressed", but at least -z helps 1202339 string =<gmr:Workbook Gnumeric spreadsheet 12024!:mime application/x-gnumeric 12025 12026#------------------------------------------------------------------------------ 12027# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $ 12028# 12029# GPT Partition table patterns. 12030# Author: Rogier Goossens (goossens.rogier@gmail.com) 12031# Note that a GPT-formatted disk must contain an MBR as well. 12032# 12033 12034# The initial segment (up to >>>>>>>>422) was copied from the X86 12035# partition table code (aka MBR). 12036# This is kept separate, so that MBR partitions are not reported as well. 12037# (use -k if you do want them as well) 12038 12039# First, detect the MBR partiton table 12040# If more than one GPT protective MBR partition exists, don't print anything 12041# (the other MBR detection code will then just print the MBR partition table) 120420x1FE leshort 0xAA55 12043>3 string !MS 12044>>3 string !SYSLINUX 12045>>>3 string !MTOOL 12046>>>>3 string !NEWLDR 12047>>>>>5 string !DOS 12048# not FAT (32 bit) 12049>>>>>>82 string !FAT32 12050#not Linux kernel 12051>>>>>>>514 string !HdrS 12052#not BeOS 12053>>>>>>>>422 string !Be\ Boot\ Loader 12054# GPT with protective MBR entry in partition 1 (only) 12055>>>>>>>>>450 ubyte 0xee 12056>>>>>>>>>>466 ubyte !0xee 12057>>>>>>>>>>>482 ubyte !0xee 12058>>>>>>>>>>>>498 ubyte !0xee 12059#>>>>>>>>>>>>>446 use gpt-mbr-partition 12060>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 12061>>>>>>>>>>>>>>0 use gpt-mbr-type 12062>>>>>>>>>>>>>>&-8 use gpt-table 12063>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 12064>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 12065>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 12066>>>>>>>>>>>>>>>0 use gpt-mbr-type 12067>>>>>>>>>>>>>>>&-8 use gpt-table 12068>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 12069>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 12070>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 12071>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12072>>>>>>>>>>>>>>>>&-8 use gpt-table 12073>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 12074>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 12075>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 12076>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12077>>>>>>>>>>>>>>>>>&-8 use gpt-table 12078>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 12079>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 12080>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 12081>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12082>>>>>>>>>>>>>>>>>>&-8 use gpt-table 12083>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 12084# GPT with protective MBR entry in partition 2 (only) 12085>>>>>>>>>450 ubyte !0xee 12086>>>>>>>>>>466 ubyte 0xee 12087>>>>>>>>>>>482 ubyte !0xee 12088>>>>>>>>>>>>498 ubyte !0xee 12089#>>>>>>>>>>>>>462 use gpt-mbr-partition 12090>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 12091>>>>>>>>>>>>>>0 use gpt-mbr-type 12092>>>>>>>>>>>>>>&-8 use gpt-table 12093>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 12094>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 12095>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 12096>>>>>>>>>>>>>>>0 use gpt-mbr-type 12097>>>>>>>>>>>>>>>&-8 use gpt-table 12098>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 12099>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 12100>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 12101>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12102>>>>>>>>>>>>>>>>&-8 use gpt-table 12103>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 12104>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 12105>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 12106>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12107>>>>>>>>>>>>>>>>>&-8 use gpt-table 12108>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 12109>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 12110>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 12111>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12112>>>>>>>>>>>>>>>>>>&-8 use gpt-table 12113>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 12114# GPT with protective MBR entry in partition 3 (only) 12115>>>>>>>>>450 ubyte !0xee 12116>>>>>>>>>>466 ubyte !0xee 12117>>>>>>>>>>>482 ubyte 0xee 12118>>>>>>>>>>>>498 ubyte !0xee 12119#>>>>>>>>>>>>>478 use gpt-mbr-partition 12120>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 12121>>>>>>>>>>>>>>0 use gpt-mbr-type 12122>>>>>>>>>>>>>>&-8 use gpt-table 12123>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 12124>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 12125>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 12126>>>>>>>>>>>>>>>0 use gpt-mbr-type 12127>>>>>>>>>>>>>>>&-8 use gpt-table 12128>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 12129>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 12130>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 12131>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12132>>>>>>>>>>>>>>>>&-8 use gpt-table 12133>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 12134>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 12135>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 12136>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12137>>>>>>>>>>>>>>>>>&-8 use gpt-table 12138>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 12139>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 12140>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 12141>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12142>>>>>>>>>>>>>>>>>>&-8 use gpt-table 12143>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 12144# GPT with protective MBR entry in partition 4 (only) 12145>>>>>>>>>450 ubyte !0xee 12146>>>>>>>>>>466 ubyte !0xee 12147>>>>>>>>>>>482 ubyte !0xee 12148>>>>>>>>>>>>498 ubyte 0xee 12149#>>>>>>>>>>>>>494 use gpt-mbr-partition 12150>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 12151>>>>>>>>>>>>>>0 use gpt-mbr-type 12152>>>>>>>>>>>>>>&-8 use gpt-table 12153>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 12154>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 12155>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 12156>>>>>>>>>>>>>>>0 use gpt-mbr-type 12157>>>>>>>>>>>>>>>&-8 use gpt-table 12158>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 12159>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 12160>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 12161>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12162>>>>>>>>>>>>>>>>&-8 use gpt-table 12163>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 12164>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 12165>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 12166>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12167>>>>>>>>>>>>>>>>>&-8 use gpt-table 12168>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 12169>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 12170>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 12171>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 12172>>>>>>>>>>>>>>>>>>&-8 use gpt-table 12173>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 12174 12175# The following code does GPT detection and processing, including 12176# sector size detection. 12177# It has to be duplicated above because the top-level pattern 12178# (i.e. not called using 'use') must print *something* for file 12179# to count it as a match. Text only printed in named patterns is 12180# not counted, and causes file to continue, and try and match 12181# other patterns. 12182# 12183# Unfortunately, when assuming sector sizes >=16k, if the sector size 12184# happens to be 512 instead, we may find confusing data after the GPT 12185# table... If the GPT table has less than 128 entries, this may even 12186# happen for assumed sector sizes as small as 4k 12187# This could be solved by checking for the presence of the backup GPT 12188# header as well, but that makes the logic extremely complex 12189##0 name gpt-mbr-partition 12190##>(8.l*8192) string EFI\ PART 12191##>>(8.l*8192) use gpt-mbr-type 12192##>>&-8 use gpt-table 12193##>>0 ubyte x of 8192 bytes 12194##>(8.l*8192) string !EFI\ PART 12195##>>(8.l*4096) string EFI\ PART GPT partition table 12196##>>>0 use gpt-mbr-type 12197##>>>&-8 use gpt-table 12198##>>>0 ubyte x of 4096 bytes 12199##>>(8.l*4096) string !EFI\ PART 12200##>>>(8.l*2048) string EFI\ PART GPT partition table 12201##>>>>0 use gpt-mbr-type 12202##>>>>&-8 use gpt-table 12203##>>>>0 ubyte x of 2048 bytes 12204##>>>(8.l*2048) string !EFI\ PART 12205##>>>>(8.l*1024) string EFI\ PART GPT partition table 12206##>>>>>0 use gpt-mbr-type 12207##>>>>>&-8 use gpt-table 12208##>>>>>0 ubyte x of 1024 bytes 12209##>>>>(8.l*1024) string !EFI\ PART 12210##>>>>>(8.l*512) string EFI\ PART GPT partition table 12211##>>>>>>0 use gpt-mbr-type 12212##>>>>>>&-8 use gpt-table 12213##>>>>>>0 ubyte x of 512 bytes 12214 12215# Print details of MBR type for a GPT-disk 12216# Calling code ensures that there is only one 0xee partition. 122170 name gpt-mbr-type 12218# GPT with protective MBR entry in partition 1 12219>450 ubyte 0xee 12220>>454 ulelong 1 12221>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 12222>>454 ulelong !1 \b (nonstandard: not at LBA 1) 12223# GPT with protective MBR entry in partition 2 12224>466 ubyte 0xee 12225>>470 ulelong 1 12226>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 12227>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 12228>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 12229>>470 ulelong !1 \b (nonstandard: not at LBA 1) 12230# GPT with protective MBR entry in partition 3 12231>482 ubyte 0xee 12232>>486 ulelong 1 12233>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 12234>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 12235>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 12236>>486 ulelong !1 \b (nonstandard: not at LBA 1) 12237# GPT with protective MBR entry in partition 4 12238>498 ubyte 0xee 12239>>502 ulelong 1 12240>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 12241>>502 ulelong !1 \b (nonstandard: not at LBA 1) 12242 12243# Print the information from a GPT partition table structure 122440 name gpt-table 12245>10 uleshort x \b, version %u 12246>8 uleshort x \b.%u 12247>56 ulelong x \b, GUID: %08x 12248>60 uleshort x \b-%04x 12249>62 uleshort x \b-%04x 12250>64 ubeshort x \b-%04x 12251>66 ubeshort x \b-%04x 12252>68 ubelong x \b%08x 12253#>80 uleshort x \b, %d partition entries 12254>32 ulequad+1 x \b, disk size: %lld sectors 12255 12256# In case a GPT data-structure is at LBA 0, report it as well 12257# This covers systems which are not GPT-aware, and which show 12258# and allow access to the protective partition. This code will 12259# detect the contents of such a partition. 122600 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 12261>0 use gpt-table 12262>0 ubyte x (sector size unknown) 12263 12264 12265 12266#------------------------------------------------------------------------------ 12267# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $ 12268# gpu: file(1) magic for GPU input files 12269 12270# Standard Portable Intermediate Representation (SPIR) 12271# Documentation: https://www.khronos.org/spir 12272# Typical file extension: .spv 12273 122740 belong 0x07230203 Khronos SPIR-V binary, big-endian 12275>4 belong x \b, version 0x%08x 12276>8 belong x \b, generator 0x%08x 12277 122780 lelong 0x07230203 Khronos SPIR-V binary, little-endian 12279>4 lelong x \b, version 0x%08x 12280>8 lelong x \b, generator 0x%08x 12281 12282# Vulkan Trace file 12283# Documentation: 12284# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\ 12285# vktrace_trace_packet_identifiers.h 12286# Typical file extension: .vktrace 12287 122888 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian 12289>0 leshort x \b, version %d 12290 122918 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian 12292>0 beshort x \b, version %d 12293 12294#------------------------------------------------------------------------------ 12295# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 12296# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 12297# 12298# ACE/gr binary 122990 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 12300>39 byte >0 - version %c 12301# ACE/gr ascii 123020 string #\ xvgr\ parameter\ file ACE/gr ascii file 123030 string #\ xmgr\ parameter\ file ACE/gr ascii file 123040 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 12305# Grace projects 123060 string #\ Grace\ project\ file Grace project file 12307>23 string @version\ (version 12308>>32 byte >0 %c 12309>>33 string >\0 \b.%.2s 12310>>35 string >\0 \b.%.2s) 12311# ACE/gr fit description files 123120 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 12313# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 12314 12315#------------------------------------------------------------------------------ 12316# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $ 12317# graphviz: file(1) magic for http://www.graphviz.org/ 12318 12319# FIXME: These patterns match too generally. For example, the first 12320# line matches a LaTeX file containing the word "graph" (with a { 12321# following later) and the second line matches this file. 12322#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 12323#!:mime text/vnd.graphviz 12324#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 12325#!:mime text/vnd.graphviz 12326 12327#------------------------------------------------------------------------------ 12328# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $ 12329# gringotts: file(1) magic for Gringotts 12330# http://devel.pluto.linux.it/projects/Gringotts/ 12331# author: Germano Rizzo <mano@pluto.linux.it> 12332#GRG3????Y 123330 string GRG Gringotts data file 12334#file format 1 12335>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 12336#file format 2 12337>3 string 2 v.2, MCRYPT S2K, 12338>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 12339>>8 byte&0x70 0x10 SERPENT crypt, 12340>>8 byte&0x70 0x20 TWOFISH crypt, 12341>>8 byte&0x70 0x30 CAST-256 crypt, 12342>>8 byte&0x70 0x40 SAFER+ crypt, 12343>>8 byte&0x70 0x50 LOKI97 crypt, 12344>>8 byte&0x70 0x60 3DES crypt, 12345>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 12346>>8 byte&0x08 0x00 SHA1 hash, 12347>>8 byte&0x08 0x08 RIPEMD-160 hash, 12348>>8 byte&0x04 0x00 ZLib 12349>>8 byte&0x04 0x04 BZip2 12350>>8 byte&0x03 0x00 lvl.0 12351>>8 byte&0x03 0x01 lvl.3 12352>>8 byte&0x03 0x02 lvl.6 12353>>8 byte&0x03 0x03 lvl.9 12354#file format 3 12355>3 string 3 v.3, OpenPGP S2K, 12356>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 12357>>8 byte&0x70 0x10 SERPENT crypt, 12358>>8 byte&0x70 0x20 TWOFISH crypt, 12359>>8 byte&0x70 0x30 CAST-256 crypt, 12360>>8 byte&0x70 0x40 SAFER+ crypt, 12361>>8 byte&0x70 0x50 LOKI97 crypt, 12362>>8 byte&0x70 0x60 3DES crypt, 12363>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 12364>>8 byte&0x08 0x00 SHA1 hash, 12365>>8 byte&0x08 0x08 RIPEMD-160 hash, 12366>>8 byte&0x04 0x00 ZLib 12367>>8 byte&0x04 0x04 BZip2 12368>>8 byte&0x03 0x00 lvl.0 12369>>8 byte&0x03 0x01 lvl.3 12370>>8 byte&0x03 0x02 lvl.6 12371>>8 byte&0x03 0x03 lvl.9 12372#file format >3 12373>3 string >3 v.%.1s (unknown details) 12374 12375#------------------------------------------------------------------------------ 12376# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $ 12377# Guile file magic from <dalepsmith@gmail.com> 12378# http://www.gnu.org/s/guile/ 12379# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 12380 123810 string GOOF---- Guile Object 12382>8 string LE \b, little endian 12383>8 string BE \b, big endian 12384>11 string 4 \b, 32bit 12385>11 string 8 \b, 64bit 12386>13 regex .\.. \b, bytecode v%s 12387 12388#------------------------------------------------------------------------------ 12389# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $ 12390# hitach-sh: file(1) magic for Hitachi Super-H 12391# 12392# Super-H COFF 12393# 12394# updated by Joerg Jenderek at Oct 2015 12395# https://en.wikipedia.org/wiki/COFF 12396# https://de.wikipedia.org/wiki/Common_Object_File_Format 12397# http://www.delorie.com/djgpp/doc/coff/filhdr.html 12398# below test line conflicts with 2nd NTFS filesystem sector 12399# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 12400# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/) 124010 beshort 0x0500 12402# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 12403>18 ubeshort&0x8E80 0 12404# use big endian variant of subroutine to display name+variables+flags 12405# for common object formated files 12406>>0 use \^display-coff 12407 124080 leshort 0x0550 12409# test for unused flag bits in f_flags 12410>18 uleshort&0x8E80 0 12411# use little endian variant of subroutine to 12412# display name+variables+flags for common object formated files 12413>>0 use display-coff 12414 12415 12416#------------------------------------------------------------------------------ 12417# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $ 12418# hp: file(1) magic for Hewlett Packard machines (see also "printer") 12419# 12420# XXX - somebody should figure out whether any byte order needs to be 12421# applied to the "TML" stuff; I'm assuming the Apollo stuff is 12422# big-endian as it was mostly 68K-based. 12423# 12424# I think the 500 series was the old stack-based machines, running a 12425# UNIX environment atop the "SUN kernel"; dunno whether it was 12426# big-endian or little-endian. 12427# 12428# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 12429# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 12430# HP magic is useful for reference, but using "long" magic is a better 12431# practice in order to avoid collisions. 12432# 12433# Guy Harris (guy@netapp.com): some additions to this list came from 12434# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 12435# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 12436# "/etc/magic", though, except for the "archive file relocatable library" 12437# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 12438# used in executables, or have they just not yet updated "/etc/magic" 12439# completely? 12440# 12441# 0 beshort 200 hp200 (68010) BSD binary 12442# 0 beshort 300 hp300 (68020+68881) BSD binary 12443# 0 beshort 0x20c hp200/300 HP-UX binary 12444# 0 beshort 0x20d hp400 (68030) HP-UX binary 12445# 0 beshort 0x20e hp400 (68040?) HP-UX binary 12446# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 12447# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 12448# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 12449# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 12450 12451# 12452# The "misc" stuff needs a byte order; the archives look suspiciously 12453# like the old 177545 archives (0xff65 = 0177545). 12454# 12455#### Old Apollo stuff 124560 beshort 0627 Apollo m68k COFF executable 12457>18 beshort ^040000 not stripped 12458>22 beshort >0 - version %d 124590 beshort 0624 apollo a88k COFF executable 12460>18 beshort ^040000 not stripped 12461>22 beshort >0 - version %d 124620 long 01203604016 TML 0123 byte-order format 124630 long 01702407010 TML 1032 byte-order format 124640 long 01003405017 TML 2301 byte-order format 124650 long 01602007412 TML 3210 byte-order format 12466#### PA-RISC 1.1 124670 belong 0x02100106 PA-RISC1.1 relocatable object 124680 belong 0x02100107 PA-RISC1.1 executable 12469>168 belong &0x00000004 dynamically linked 12470>(144) belong 0x054ef630 dynamically linked 12471>96 belong >0 - not stripped 12472 124730 belong 0x02100108 PA-RISC1.1 shared executable 12474>168 belong&0x4 0x4 dynamically linked 12475>(144) belong 0x054ef630 dynamically linked 12476>96 belong >0 - not stripped 12477 124780 belong 0x0210010b PA-RISC1.1 demand-load executable 12479>168 belong&0x4 0x4 dynamically linked 12480>(144) belong 0x054ef630 dynamically linked 12481>96 belong >0 - not stripped 12482 124830 belong 0x0210010e PA-RISC1.1 shared library 12484>96 belong >0 - not stripped 12485 124860 belong 0x0210010d PA-RISC1.1 dynamic load library 12487>96 belong >0 - not stripped 12488 12489#### PA-RISC 2.0 124900 belong 0x02140106 PA-RISC2.0 relocatable object 12491 124920 belong 0x02140107 PA-RISC2.0 executable 12493>168 belong &0x00000004 dynamically linked 12494>(144) belong 0x054ef630 dynamically linked 12495>96 belong >0 - not stripped 12496 124970 belong 0x02140108 PA-RISC2.0 shared executable 12498>168 belong &0x00000004 dynamically linked 12499>(144) belong 0x054ef630 dynamically linked 12500>96 belong >0 - not stripped 12501 125020 belong 0x0214010b PA-RISC2.0 demand-load executable 12503>168 belong &0x00000004 dynamically linked 12504>(144) belong 0x054ef630 dynamically linked 12505>96 belong >0 - not stripped 12506 125070 belong 0x0214010e PA-RISC2.0 shared library 12508>96 belong >0 - not stripped 12509 125100 belong 0x0214010d PA-RISC2.0 dynamic load library 12511>96 belong >0 - not stripped 12512 12513#### 800 125140 belong 0x020b0106 PA-RISC1.0 relocatable object 12515 125160 belong 0x020b0107 PA-RISC1.0 executable 12517>168 belong&0x4 0x4 dynamically linked 12518>(144) belong 0x054ef630 dynamically linked 12519>96 belong >0 - not stripped 12520 125210 belong 0x020b0108 PA-RISC1.0 shared executable 12522>168 belong&0x4 0x4 dynamically linked 12523>(144) belong 0x054ef630 dynamically linked 12524>96 belong >0 - not stripped 12525 125260 belong 0x020b010b PA-RISC1.0 demand-load executable 12527>168 belong&0x4 0x4 dynamically linked 12528>(144) belong 0x054ef630 dynamically linked 12529>96 belong >0 - not stripped 12530 125310 belong 0x020b010e PA-RISC1.0 shared library 12532>96 belong >0 - not stripped 12533 125340 belong 0x020b010d PA-RISC1.0 dynamic load library 12535>96 belong >0 - not stripped 12536 125370 belong 0x213c6172 archive file 12538>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 12539>68 belong 0x02100619 - PA-RISC1.1 relocatable library 12540>68 belong 0x02110619 - PA-RISC1.2 relocatable library 12541>68 belong 0x02140619 - PA-RISC2.0 relocatable library 12542 12543#### 500 125440 long 0x02080106 HP s500 relocatable executable 12545>16 long >0 - version %d 12546 125470 long 0x02080107 HP s500 executable 12548>16 long >0 - version %d 12549 125500 long 0x02080108 HP s500 pure executable 12551>16 long >0 - version %d 12552 12553#### 200 125540 belong 0x020c0108 HP s200 pure executable 12555>4 beshort >0 - version %d 12556>8 belong &0x80000000 save fp regs 12557>8 belong &0x40000000 dynamically linked 12558>8 belong &0x20000000 debuggable 12559>36 belong >0 not stripped 12560 125610 belong 0x020c0107 HP s200 executable 12562>4 beshort >0 - version %d 12563>8 belong &0x80000000 save fp regs 12564>8 belong &0x40000000 dynamically linked 12565>8 belong &0x20000000 debuggable 12566>36 belong >0 not stripped 12567 125680 belong 0x020c010b HP s200 demand-load executable 12569>4 beshort >0 - version %d 12570>8 belong &0x80000000 save fp regs 12571>8 belong &0x40000000 dynamically linked 12572>8 belong &0x20000000 debuggable 12573>36 belong >0 not stripped 12574 125750 belong 0x020c0106 HP s200 relocatable executable 12576>4 beshort >0 - version %d 12577>6 beshort >0 - highwater %d 12578>8 belong &0x80000000 save fp regs 12579>8 belong &0x20000000 debuggable 12580>8 belong &0x10000000 PIC 12581 125820 belong 0x020a0108 HP s200 (2.x release) pure executable 12583>4 beshort >0 - version %d 12584>36 belong >0 not stripped 12585 125860 belong 0x020a0107 HP s200 (2.x release) executable 12587>4 beshort >0 - version %d 12588>36 belong >0 not stripped 12589 125900 belong 0x020c010e HP s200 shared library 12591>4 beshort >0 - version %d 12592>6 beshort >0 - highwater %d 12593>36 belong >0 not stripped 12594 125950 belong 0x020c010d HP s200 dynamic load library 12596>4 beshort >0 - version %d 12597>6 beshort >0 - highwater %d 12598>36 belong >0 not stripped 12599 12600#### MISC 126010 long 0x0000ff65 HP old archive 126020 long 0x020aff65 HP s200 old archive 126030 long 0x020cff65 HP s200 old archive 126040 long 0x0208ff65 HP s500 old archive 12605 126060 long 0x015821a6 HP core file 12607 126080 long 0x4da7eee8 HP-WINDOWS font 12609>8 byte >0 - version %d 126100 string Bitmapfile HP Bitmapfile 12611 126120 string IMGfile CIS compimg HP Bitmapfile 12613# XXX - see "lif" 12614#0 short 0x8000 lif file 126150 long 0x020c010c compiled Lisp 12616 126170 string msgcat01 HP NLS message catalog, 12618>8 long >0 %d messages 12619 12620# Summary: HP-48/49 calculator 12621# Created by: phk@data.fls.dk 12622# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 12623# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 126240 string HPHP HP 12625>4 string 48 48 binary 12626>4 string 49 49 binary 12627>7 byte >64 - Rev %c 12628>8 leshort 0x2911 (ADR) 12629>8 leshort 0x2933 (REAL) 12630>8 leshort 0x2955 (LREAL) 12631>8 leshort 0x2977 (COMPLX) 12632>8 leshort 0x299d (LCOMPLX) 12633>8 leshort 0x29bf (CHAR) 12634>8 leshort 0x29e8 (ARRAY) 12635>8 leshort 0x2a0a (LNKARRAY) 12636>8 leshort 0x2a2c (STRING) 12637>8 leshort 0x2a4e (HXS) 12638>8 leshort 0x2a74 (LIST) 12639>8 leshort 0x2a96 (DIR) 12640>8 leshort 0x2ab8 (ALG) 12641>8 leshort 0x2ada (UNIT) 12642>8 leshort 0x2afc (TAGGED) 12643>8 leshort 0x2b1e (GROB) 12644>8 leshort 0x2b40 (LIB) 12645>8 leshort 0x2b62 (BACKUP) 12646>8 leshort 0x2b88 (LIBDATA) 12647>8 leshort 0x2d9d (PROG) 12648>8 leshort 0x2dcc (CODE) 12649>8 leshort 0x2e48 (GNAME) 12650>8 leshort 0x2e6d (LNAME) 12651>8 leshort 0x2e92 (XLIB) 12652 126530 string %%HP: HP text 12654>6 string T(0) - T(0) 12655>6 string T(1) - T(1) 12656>6 string T(2) - T(2) 12657>6 string T(3) - T(3) 12658>10 string A(D) A(D) 12659>10 string A(R) A(R) 12660>10 string A(G) A(G) 12661>14 string F(.) F(.); 12662>14 string F(,) F(,); 12663 12664 12665# Summary: HP-38/39 calculator 12666# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 126670 string HP3 12668>3 string 8 HP 38 12669>3 string 9 HP 39 12670>4 string Bin binary 12671>4 string Asc ASCII 12672>7 string A (Directory List) 12673>7 string B (Zaplet) 12674>7 string C (Note) 12675>7 string D (Program) 12676>7 string E (Variable) 12677>7 string F (List) 12678>7 string G (Matrix) 12679>7 string H (Library) 12680>7 string I (Target List) 12681>7 string J (ASCII Vector specification) 12682>7 string K (wildcard) 12683 12684# Summary: HP-38/39 calculator 12685# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 126860 string HP3 12687>3 string 8 HP 38 12688>3 string 9 HP 39 12689>4 string Bin binary 12690>4 string Asc ASCII 12691>7 string A (Directory List) 12692>7 string B (Zaplet) 12693>7 string C (Note) 12694>7 string D (Program) 12695>7 string E (Variable) 12696>7 string F (List) 12697>7 string G (Matrix) 12698>7 string H (Library) 12699>7 string I (Target List) 12700>7 string J (ASCII Vector specification) 12701>7 string K (wildcard) 12702 12703# hpBSD magic numbers 127040 beshort 200 hp200 (68010) BSD 12705>2 beshort 0407 impure binary 12706>2 beshort 0410 read-only binary 12707>2 beshort 0413 demand paged binary 127080 beshort 300 hp300 (68020+68881) BSD 12709>2 beshort 0407 impure binary 12710>2 beshort 0410 read-only binary 12711>2 beshort 0413 demand paged binary 12712# 12713# From David Gero <dgero@nortelnetworks.com> 12714# HP-UX 10.20 core file format from /usr/include/sys/core.h 12715# Unfortunately, HP-UX uses corehead blocks without specifying the order 12716# There are four we care about: 12717# CORE_KERNEL, which starts with the string "HP-UX" 12718# CORE_EXEC, which contains the name of the command 12719# CORE_PROC, which contains the signal number that caused the core dump 12720# CORE_FORMAT, which contains the version of the core file format (== 1) 12721# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 12722# but we include all 6 variations of the order of the first 3, and 12723# assume that PROC will always be last 12724# Order 1: KERNEL, EXEC, FORMAT, PROC 127250x10 string HP-UX 12726>0 belong 2 12727>>0xC belong 0x3C 12728>>>0x4C belong 0x100 12729>>>>0x58 belong 0x44 12730>>>>>0xA0 belong 1 12731>>>>>>0xAC belong 4 12732>>>>>>>0xB0 belong 1 12733>>>>>>>>0xB4 belong 4 core file 12734>>>>>>>>>0x90 string >\0 from '%s' 12735>>>>>>>>>0xC4 belong 3 - received SIGQUIT 12736>>>>>>>>>0xC4 belong 4 - received SIGILL 12737>>>>>>>>>0xC4 belong 5 - received SIGTRAP 12738>>>>>>>>>0xC4 belong 6 - received SIGABRT 12739>>>>>>>>>0xC4 belong 7 - received SIGEMT 12740>>>>>>>>>0xC4 belong 8 - received SIGFPE 12741>>>>>>>>>0xC4 belong 10 - received SIGBUS 12742>>>>>>>>>0xC4 belong 11 - received SIGSEGV 12743>>>>>>>>>0xC4 belong 12 - received SIGSYS 12744>>>>>>>>>0xC4 belong 33 - received SIGXCPU 12745>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 12746# Order 2: KERNEL, FORMAT, EXEC, PROC 12747>>>0x4C belong 1 12748>>>>0x58 belong 4 12749>>>>>0x5C belong 1 12750>>>>>>0x60 belong 0x100 12751>>>>>>>0x6C belong 0x44 12752>>>>>>>>0xB4 belong 4 core file 12753>>>>>>>>>0xA4 string >\0 from '%s' 12754>>>>>>>>>0xC4 belong 3 - received SIGQUIT 12755>>>>>>>>>0xC4 belong 4 - received SIGILL 12756>>>>>>>>>0xC4 belong 5 - received SIGTRAP 12757>>>>>>>>>0xC4 belong 6 - received SIGABRT 12758>>>>>>>>>0xC4 belong 7 - received SIGEMT 12759>>>>>>>>>0xC4 belong 8 - received SIGFPE 12760>>>>>>>>>0xC4 belong 10 - received SIGBUS 12761>>>>>>>>>0xC4 belong 11 - received SIGSEGV 12762>>>>>>>>>0xC4 belong 12 - received SIGSYS 12763>>>>>>>>>0xC4 belong 33 - received SIGXCPU 12764>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 12765# Order 3: FORMAT, KERNEL, EXEC, PROC 127660x24 string HP-UX 12767>0 belong 1 12768>>0xC belong 4 12769>>>0x10 belong 1 12770>>>>0x14 belong 2 12771>>>>>0x20 belong 0x3C 12772>>>>>>0x60 belong 0x100 12773>>>>>>>0x6C belong 0x44 12774>>>>>>>>0xB4 belong 4 core file 12775>>>>>>>>>0xA4 string >\0 from '%s' 12776>>>>>>>>>0xC4 belong 3 - received SIGQUIT 12777>>>>>>>>>0xC4 belong 4 - received SIGILL 12778>>>>>>>>>0xC4 belong 5 - received SIGTRAP 12779>>>>>>>>>0xC4 belong 6 - received SIGABRT 12780>>>>>>>>>0xC4 belong 7 - received SIGEMT 12781>>>>>>>>>0xC4 belong 8 - received SIGFPE 12782>>>>>>>>>0xC4 belong 10 - received SIGBUS 12783>>>>>>>>>0xC4 belong 11 - received SIGSEGV 12784>>>>>>>>>0xC4 belong 12 - received SIGSYS 12785>>>>>>>>>0xC4 belong 33 - received SIGXCPU 12786>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 12787# Order 4: EXEC, KERNEL, FORMAT, PROC 127880x64 string HP-UX 12789>0 belong 0x100 12790>>0xC belong 0x44 12791>>>0x54 belong 2 12792>>>>0x60 belong 0x3C 12793>>>>>0xA0 belong 1 12794>>>>>>0xAC belong 4 12795>>>>>>>0xB0 belong 1 12796>>>>>>>>0xB4 belong 4 core file 12797>>>>>>>>>0x44 string >\0 from '%s' 12798>>>>>>>>>0xC4 belong 3 - received SIGQUIT 12799>>>>>>>>>0xC4 belong 4 - received SIGILL 12800>>>>>>>>>0xC4 belong 5 - received SIGTRAP 12801>>>>>>>>>0xC4 belong 6 - received SIGABRT 12802>>>>>>>>>0xC4 belong 7 - received SIGEMT 12803>>>>>>>>>0xC4 belong 8 - received SIGFPE 12804>>>>>>>>>0xC4 belong 10 - received SIGBUS 12805>>>>>>>>>0xC4 belong 11 - received SIGSEGV 12806>>>>>>>>>0xC4 belong 12 - received SIGSYS 12807>>>>>>>>>0xC4 belong 33 - received SIGXCPU 12808>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 12809# Order 5: FORMAT, EXEC, KERNEL, PROC 128100x78 string HP-UX 12811>0 belong 1 12812>>0xC belong 4 12813>>>0x10 belong 1 12814>>>>0x14 belong 0x100 12815>>>>>0x20 belong 0x44 12816>>>>>>0x68 belong 2 12817>>>>>>>0x74 belong 0x3C 12818>>>>>>>>0xB4 belong 4 core file 12819>>>>>>>>>0x58 string >\0 from '%s' 12820>>>>>>>>>0xC4 belong 3 - received SIGQUIT 12821>>>>>>>>>0xC4 belong 4 - received SIGILL 12822>>>>>>>>>0xC4 belong 5 - received SIGTRAP 12823>>>>>>>>>0xC4 belong 6 - received SIGABRT 12824>>>>>>>>>0xC4 belong 7 - received SIGEMT 12825>>>>>>>>>0xC4 belong 8 - received SIGFPE 12826>>>>>>>>>0xC4 belong 10 - received SIGBUS 12827>>>>>>>>>0xC4 belong 11 - received SIGSEGV 12828>>>>>>>>>0xC4 belong 12 - received SIGSYS 12829>>>>>>>>>0xC4 belong 33 - received SIGXCPU 12830>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 12831# Order 6: EXEC, FORMAT, KERNEL, PROC 12832>0 belong 0x100 12833>>0xC belong 0x44 12834>>>0x54 belong 1 12835>>>>0x60 belong 4 12836>>>>>0x64 belong 1 12837>>>>>>0x68 belong 2 12838>>>>>>>0x74 belong 0x2C 12839>>>>>>>>0xB4 belong 4 core file 12840>>>>>>>>>0x44 string >\0 from '%s' 12841>>>>>>>>>0xC4 belong 3 - received SIGQUIT 12842>>>>>>>>>0xC4 belong 4 - received SIGILL 12843>>>>>>>>>0xC4 belong 5 - received SIGTRAP 12844>>>>>>>>>0xC4 belong 6 - received SIGABRT 12845>>>>>>>>>0xC4 belong 7 - received SIGEMT 12846>>>>>>>>>0xC4 belong 8 - received SIGFPE 12847>>>>>>>>>0xC4 belong 10 - received SIGBUS 12848>>>>>>>>>0xC4 belong 11 - received SIGSEGV 12849>>>>>>>>>0xC4 belong 12 - received SIGSYS 12850>>>>>>>>>0xC4 belong 33 - received SIGXCPU 12851>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 12852 12853 12854 12855#------------------------------------------------------------------------------ 12856# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 12857# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 12858# Magic too short! 12859#0 string HU Human68k 12860#>68 string LZX LZX compressed 12861#>>72 string >\0 (version %s) 12862#>(8.L+74) string LZX LZX compressed 12863#>>(8.L+78) string >\0 (version %s) 12864#>60 belong >0 binded 12865#>(8.L+66) string #HUPAIR hupair 12866#>0 string HU X executable 12867#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 12868#>4 belong >0 - base address 0x%x 12869#>28 belong >0 not stripped 12870#>32 belong >0 with debug information 12871#0 beshort 0x601a Human68k Z executable 12872#0 beshort 0x6000 Human68k object file 12873#0 belong 0xd1000000 Human68k ar binary archive 12874#0 belong 0xd1010000 Human68k ar ascii archive 12875#0 beshort 0x0068 Human68k lib archive 12876#4 string LZX Human68k LZX compressed 12877#>8 string >\0 (version %s) 12878#>4 string LZX R executable 12879#2 string #HUPAIR Human68k hupair R executable 12880 12881#------------------------------------------------------------------------------ 12882# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $ 12883# ibm370: file(1) magic for IBM 370 and compatibles. 12884# 12885# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 12886# What the heck *is* "USS/370"? 12887# AIX 4.1's "/etc/magic" has 12888# 12889# 0 short 0535 370 sysV executable 12890# >12 long >0 not stripped 12891# >22 short >0 - version %d 12892# >30 long >0 - 5.2 format 12893# 0 short 0530 370 sysV pure executable 12894# >12 long >0 not stripped 12895# >22 short >0 - version %d 12896# >30 long >0 - 5.2 format 12897# 12898# instead of the "USS/370" versions of the same magic numbers. 12899# 129000 beshort 0537 370 XA sysV executable 12901>12 belong >0 not stripped 12902>22 beshort >0 - version %d 12903>30 belong >0 - 5.2 format 129040 beshort 0532 370 XA sysV pure executable 12905>12 belong >0 not stripped 12906>22 beshort >0 - version %d 12907>30 belong >0 - 5.2 format 129080 beshort 054001 370 sysV pure executable 12909>12 belong >0 not stripped 129100 beshort 055001 370 XA sysV pure executable 12911>12 belong >0 not stripped 129120 beshort 056401 370 sysV executable 12913>12 belong >0 not stripped 129140 beshort 057401 370 XA sysV executable 12915>12 belong >0 not stripped 129160 beshort 0531 SVR2 executable (Amdahl-UTS) 12917>12 belong >0 not stripped 12918>24 belong >0 - version %d 129190 beshort 0534 SVR2 pure executable (Amdahl-UTS) 12920>12 belong >0 not stripped 12921>24 belong >0 - version %d 129220 beshort 0530 SVR2 pure executable (USS/370) 12923>12 belong >0 not stripped 12924>24 belong >0 - version %d 129250 beshort 0535 SVR2 executable (USS/370) 12926>12 belong >0 not stripped 12927>24 belong >0 - version %d 12928 12929#------------------------------------------------------------------------------ 12930# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $ 12931# ibm6000: file(1) magic for RS/6000 and the RT PC. 12932# 129330 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 12934>12 belong >0 not stripped 12935# Breaks sun4 statically linked execs. 12936#0 beshort 0x0103 executable (RT Version 2) or obj module 12937#>2 byte 0x50 pure 12938#>28 belong >0 not stripped 12939#>6 beshort >0 - version %ld 129400 beshort 0x0104 shared library 129410 beshort 0x0105 ctab data 129420 beshort 0xfe04 structured file 129430 string 0xabcdef AIX message catalog 129440 belong 0x000001f9 AIX compiled message catalog 129450 string \<aiaff> archive 129460 string \<bigaf> archive (big format) 12947 129480 beshort 0x01f7 64-bit XCOFF executable or object module 12949>20 belong 0 not stripped 12950# GRR: this test is still too general as it catches also many FATs of DOS filesystems 129514 belong &0x0feeddb0 12952# real core dump could not be 32-bit and 64-bit together 12953>7 byte&0x03 !3 AIX core file 12954>>1 byte &0x01 fulldump 12955>>7 byte &0x01 32-bit 12956>>>0x6e0 string >\0 \b, %s 12957>>7 byte &0x02 64-bit 12958>>>0x524 string >\0 \b, %s 12959 12960#------------------------------------------------------------------------------ 12961# $File: icc,v 1.4 2017/03/17 22:20:22 christos Exp $ 12962# icc: file(1) magic for International Color Consortium file formats 12963 12964# 12965# Color profiles as per the ICC's "Image technology colour management - 12966# Architecture, profile format, and data structure" specification. 12967# See 12968# 12969# http://www.color.org/specification/ICC1v43_2010-12.pdf 12970# 12971# for Specification ICC.1:2010 (Profile version 4.3.0.0). 12972# URL: http://fileformats.archiveteam.org/wiki/ICC_profile 12973# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf 12974# Update: Joerg Jenderek 12975# 12976# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 12977# bytes 40 to 43 "may be used to identify the primary platform/operating 12978# system framework for which the profile was created". 12979# 12980# check and display ICC/ICM color profile 129810 name color-profile 12982>36 string acsp 12983# skip ASCII like Cognacspirit.txt by month <= 12 12984>>26 ubeshort <13 12985# platform/operating system. Only 5 mentioned 12986 12987# 12988# This appears to be what's used for Apple ColorSync profiles. 12989# Instead of adding that, Apple just changed the generic "acsp" entry 12990# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 12991# Management System, ICC Profile". 12992# Yes, it's "APPL", not "AAPL"; see the spec. 12993>>>40 string APPL ColorSync 12994 12995# Microsoft ICM color profile 12996>>>40 string MSFT Microsoft 12997 12998# Yes, that's a blank after "SGI". 12999>>>40 string SGI\ SGI 13000 13001# XXX - is this what's used for the Sun KCMS or not? The standard file 13002# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 13003# and there *is* an identified "primary platform" value of SUNW. 13004>>>40 string SUNW Sun KCMS 13005 13006# 5th platform 13007>>>40 string TGNT Taligent 13008 13009# remaing "l" "e" of "color profile" printed later to avoid error 13010>>>40 string x color profi 13011#>>>40 string x (%.4s) 13012!:mime application/vnd.iccprofile 13013# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found 13014>>>8 ubyte =2 13015# do not use empty message text to a avoid error like 13016# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type 13017# file.exe: could not find any valid magic files! 13018>>>>9 ubyte !0 \ble 13019!:ext icc/icm 13020# minor version 13021>>>>9 ubyte =0 \bl 13022# Kodak colour management system 13023>>>>>4 string =KCMS \be 13024!:ext icc/icm/cc 13025>>>>>4 string !KCMS \be 13026!:ext icc/icm 13027>>>8 ubyte !2 \ble 13028!:ext icc 13029# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h) 13030>>>8 ubyte x %u 13031>>>9 ubyte/16 x \b.%u 13032# reserved and shall be null but 205.205 in umx1220u.icm 13033>>>10 ubyte >0 \b.%u 13034>>>>11 ubyte >0 \b.%u 13035# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF " 13036# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm 13037>>>4 string >\ \b, type %.2s 13038>>>>6 string >\ \b%.1s 13039>>>>>7 string >\ \b%.1s 13040# colour space "XYZ " "Lab " "RGB " CMYK GRAY ... 13041>>>16 string x \b, %.3s 13042>>>19 string >\ \b%.1s 13043# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes 13044# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc 13045>>>20 string >\0 \b/%.3s 13046>>>>23 string >\ \b%.1s 13047# eleven device classes 13048>>>12 string x \b-%.4s device 13049# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm 13050>>>52 string >\040 13051# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm" 13052>>>>52 ubelong !0x6e6f6e65 13053# device manufacturer field like "HP " "IBM " EPSO 13054>>>>>48 string x \b, %.2s 13055>>>>>50 string >\ \b%.1s 13056>>>>>51 string >\ \b%.1s 13057# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC 13058>>>>>52 string >\ \ \b/%.3s 13059>>>>>>55 string >\ \b%.1s 13060>>>>>52 string x model 13061# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm 13062>>>80 string >\0 by %.2s 13063>>>>82 string >\ \b%.1s 13064>>>>>83 string >\ \b%.1s 13065# profile size 13066>>>0 ubelong x \b, %u bytes 13067# skip invalid date 0 like in linearSRGB.icc 13068>>>24 ubequad !0 13069# datetime dd-mm-yyyy hh:mm:ss 13070>>>>28 ubeshort x \b, %u 13071# month <= 12 13072>>>>26 ubeshort x \b-%u 13073# year 13074>>>>24 ubeshort x \b-%u 13075# do not display midnight time like in CNHP8308.ICC 13076>>>>30 ubequad&0xFFffFFffFFff0000 !0 13077# hour <= 24 13078>>>>>30 ubeshort x %u 13079# minutes <= 59 13080>>>>>32 ubeshort x \b:%.2u 13081# seconds <= 59 13082>>>>>34 ubeshort x \b:%.2u 13083# vendor specific flags like 2 in HPCLJ5.ICM 13084>>>44 ubeshort >0 \b, 0x%x vendor flags 13085# profile flags bits 0-2 of least 16 used by ICC 13086#>>>44 ubelong >0 \b, 0x%x flags 13087# icEmbeddedProfileTrue 13088>>>44 ubelong &1 \b, embedded 13089# icEmbeddedProfileFalse 13090#>>>44 ubelong ^1 \b, not embedded 13091# icUseWithEmbeddedDataOnly 13092>>>44 ubelong &2 \b, dependently 13093# icUseAnywhere 13094#>>>44 ubelong ^2 \b, independently 13095>>>44 ubelong &4 \b, MCS 13096#>>>44 ubelong ^4 \b, no MCS 13097# vendor specific device attributes 1~srgb.icc 13098# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM 13099>>>56 ubelong >0 \b, 0x%x vendor attribute 13100# ICC device attributes bits 0-7 used 13101#>>>60 ubelong x \b, 0x%x attribute 13102# http://www.color.org/icc34.h 13103>>>60 ubelong &0x01 \b, transparent 13104#>>>60 ubelong ^0x01 \b, reflective 13105>>>60 ubelong &0x02 \b, matte 13106#>>>60 ubelong ^0x02 \b, glossy 13107>>>60 ubelong &0x04 \b, negative 13108#>>>60 ubelong ^0x04 \b, positive 13109>>>60 ubelong &0x08 \b, black&white 13110#>>>60 ubelong ^0x08 \b, colour 13111>>>60 ubelong &0x10 \b, non-paper 13112#>>>60 ubelong ^0x10 \b, paper 13113>>>60 ubelong &0x20 \b, non-textured 13114#>>>60 ubelong ^0x20 \b, textured 13115>>>60 ubelong &0x40 \b, non-isotropic 13116#>>>60 ubelong ^0x40 \b, isotropic 13117>>>60 ubelong &0x80 \b, self-luminous 13118#>>>60 ubelong ^0x80 \b, non-self-luminous 13119# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM 13120>>>64 ubelong >3 \b, 0x%x rendering intent 13121#>>>64 ubelong =0 \b, perceptual 13122>>>64 ubelong =1 \b, relative colorimetric 13123>>>64 ubelong =2 \b, saturation 13124>>>64 ubelong =3 \b, absolute colorimetric 13125# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d 13126>>>71 ubequad !0xd6000100000000d3 \b, PCS 13127# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found 13128# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm 13129>>>>68 ubelong !0x0000f6d5 X=0x%x 13130# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm 13131>>>>72 ubelong !0x00010000 Y=0x%x 13132# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found 13133# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm 13134>>>>76 ubelong !0x0000d32d Z=0x%x 13135# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321. 13136>>>84 ubequad >0 \b, 0x%llx MD5 13137# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD 13138#>>100 ubequad x \b 0x%llx reserved 13139# tag table 13140# 6 <= tags count <= 43 13141#>>>128 ubelong >43 \b, %u tags 13142>>>128 ubelong x 13143# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt" 13144# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508 13145>>>>132 search/508 cprt 13146# but no copyright tag in linearSRGB.icc 13147# beneath /System/Library/Frameworks/WebKit.framework/ 13148# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources 13149>>>>132 default x \b, no copyright tag 13150# 1st tag 13151#>>>132 string x \b, 1st tag %.4s 13152#>>>136 ubelong x 0x%x offset 13153#>>>140 ubelong x 0x%x len 13154# 2nd tag,... 13155# look also for profileDescriptionTag "desc" 13156>>>132 search/508 desc 13157# look further for TextDescriptionType "desc" signature 13158>>>>(&0.L) string =desc 13159>>>>>&4 pstring/l x "%s" 13160# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc 13161>>>>(&0.L) string =mluc 13162>>>>>&(&8.L) ubequad x 13163>>>>>>&4 bestring16 x '%s' 13164 13165# Any other profile. 13166# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 13167# and use "acsp" for everything else and dump the "primary platform" 13168# string in those cases? 1316936 string acsp 13170>0 use color-profile 13171 13172 13173 13174#------------------------------------------------------------------------------ 13175# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $ 13176# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 13177# 13178# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 13179# Arts for file interchange. It has also been used by Apple, SGI, and 13180# especially Commodore-Amiga. 13181# 13182# IFF files begin with an 8 byte FORM header, followed by a 4 character 13183# FORM type, which is followed by the first chunk in the FORM. 13184 131850 string FORM IFF data 13186#>4 belong x \b, FORM is %d bytes long 13187# audio formats 13188>8 string AIFF \b, AIFF audio 13189!:mime audio/x-aiff 13190>8 string AIFC \b, AIFF-C compressed audio 13191!:mime audio/x-aiff 13192>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 13193!:mime audio/x-aiff 13194>8 string 16SV \b, 16SV 16-bit sampled sound voice 13195>8 string SAMP \b, SAMP sampled audio 13196>8 string MAUD \b, MAUD MacroSystem audio 13197>8 string SMUS \b, SMUS simple music 13198>8 string CMUS \b, CMUS complex music 13199# image formats 13200>8 string ILBMBMHD \b, ILBM interleaved image 13201>>20 beshort x \b, %d x 13202>>22 beshort x %d 13203>8 string RGBN \b, RGBN 12-bit RGB image 13204>8 string RGB8 \b, RGB8 24-bit RGB image 13205>8 string DEEP \b, DEEP TVPaint/XiPaint image 13206>8 string DR2D \b, DR2D 2-D object 13207>8 string TDDD \b, TDDD 3-D rendering 13208>8 string LWOB \b, LWOB 3-D object 13209>8 string LWO2 \b, LWO2 3-D object, v2 13210>8 string LWLO \b, LWLO 3-D layered object 13211>8 string REAL \b, REAL Real3D rendering 13212>8 string MC4D \b, MC4D MaxonCinema4D rendering 13213>8 string ANIM \b, ANIM animation 13214>8 string YAFA \b, YAFA animation 13215>8 string SSA\ \b, SSA super smooth animation 13216>8 string ACBM \b, ACBM continuous image 13217>8 string FAXX \b, FAXX fax image 13218# other formats 13219>8 string FTXT \b, FTXT formatted text 13220>8 string CTLG \b, CTLG message catalog 13221>8 string PREF \b, PREF preferences 13222>8 string DTYP \b, DTYP datatype description 13223>8 string PTCH \b, PTCH binary patch 13224>8 string AMFF \b, AMFF AmigaMetaFile format 13225>8 string WZRD \b, WZRD StormWIZARD resource 13226>8 string DOC\ \b, DOC desktop publishing document 13227>8 string WVQA \b, Westwood Studios VQA Multimedia, 13228>>24 leshort x %d video frames, 13229>>26 leshort x %d x 13230>>28 leshort x %d 13231>8 string MOVE \b, Wing Commander III Video 13232>>12 string _PC_ \b, PC version 13233>>12 string 3DO_ \b, 3DO version 13234 13235# These go at the end of the iff rules 13236# 13237# David Griffith <dave@661.org> 13238# I don't see why these might collide with anything else. 13239# 13240# Interactive Fiction related formats 13241# 13242>8 string IFRS \b, Blorb Interactive Fiction 13243>>24 string Exec with executable chunk 13244>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 13245!:mime application/x-blorb 13246 13247#------------------------------------------------------------------------------ 13248# $File: images,v 1.123 2017/04/04 20:34:24 christos Exp $ 13249# images: file(1) magic for image formats (see also "iff", and "c-lang" for 13250# XPM bitmaps) 13251# 13252# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 13253# additions by janl@ifi.uio.no as well as others. Jan also suggested 13254# merging several one- and two-line files into here. 13255# 13256# little magic: PCX (first byte is 0x0a) 13257 13258# Targa - matches `povray', `ppmtotga' and `xv' outputs 13259# by Philippe De Muyter <phdm@macqel.be> 13260# URL: http://justsolve.archiveteam.org/wiki/TGA 13261# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf 13262# Update: Joerg Jenderek 13263# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 13264# ,32 or 33 (both not observed) 13265# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 13266# or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications 13267# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 13268# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 13269# `tgatoppm' recognizes a superset (Index may be anything) 13270# 13271# test of Color Map Type 0~no 1~color map 13272# and Image Type 1 2 3 9 10 11 32 33 13273# and Color Map Entry Size 0 15 16 24 32 132740 ubequad&0x00FeC400000000C0 0 13275# skip more garbage by looking for positive image type 13276>2 ubyte >0 13277# skip some compiled terminfo by looking for image type less equal 33 13278>>2 ubyte <34 13279# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel sizes 15 16 24 32 13280>>>16 ubyte <33 13281# skip more by looking for pixel size 0Fh 10h 18h 20h 13282>>>>16 ubyte&0xC0 0x00 13283# Color Map 13284>>>>>1 belong&0xfff7ffff 0x01010000 13285>>>>>>0 use tga-image 13286>>>>>1 belong&0xfff7ffff 0x00020000 13287>>>>>>0 use tga-image 13288>>>>>1 belong&0xfff7ffff 0x00030000 13289>>>>>>0 use tga-image 13290>>>>>1 default x 13291# skip 260-16.ico by looking for no color map 13292>>>>>>1 ubyte 0 13293# implies no first map entry 13294>>>>>>>3 uleshort 0 13295>>>>>>>>0 use tga-image 13296# display tga bitmap image information 132970 name tga-image 13298>2 ubyte <34 Targa image data 13299!:mime image/x-tga 13300!:apple ????TPIC 13301# normal extension .tga but some Truevision products used others: 13302# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that) 13303!:ext tga/tpic/icb/vda/vst 13304# image type 1 2 3 9 10 11 32 33 13305>2 ubyte&0xF7 1 - Map 13306>2 ubyte&0xF7 2 - RGB 13307# alpha channel 13308>>17 ubyte&0x0F >0 \bA 13309>2 ubyte&0xF7 3 - Mono 13310# type not found, but by http://www.fileformat.info/format/tga/corion.htm 13311# Compressed color-mapped data, using Huffman, Delta, and runlength encoding 13312>2 ubyte 32 - Color 13313# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process 13314>2 ubyte 33 - Color 13315# Color Map Type 0~no 1~color map 13316>1 ubyte 1 ( 13317# first color map entry, 0 normal 13318>>3 uleshort >0 \b%d- 13319# color map length 0 2 1dh 3bh d9h 100h 13320>>5 uleshort x \b%d) 13321# 8~run length encoding bit 13322>2 ubyte&0x08 8 - RLE 13323# gimp can create big pictures! 13324>12 uleshort >0 %d x 13325>12 uleshort =0 65536 x 13326# image height. 0 interpreted as 65536 13327>14 uleshort >0 %d 13328>14 uleshort =0 65536 13329# Image Pixel Size 15 16 24 32 13330>16 ubyte x x %d 13331# X origin of image. 0 normal 13332>8 uleshort >0 +%d 13333# Y origin of image. 0 normal; positive for top 13334>10 uleshort >0 +%d 13335# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction 13336>17 ubyte&0x0F >0 - %d-bit alpha 13337# bits 5-4 give direction. normal bottom left 13338>17 ubyte &0x20 - top 13339#>17 ubyte ^0x20 - bottom 13340>17 ubyte &0x10 - right 13341#>17 ubyte ^0x10 - left 13342# some info say other bits 6-7 should be zero 13343# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm 13344# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved 13345#>17 ubyte&0xC0 0x00 - no interleave 13346>17 ubyte&0xC0 0x40 - interleave 13347>17 ubyte&0xC0 0x80 - four way interleave 13348>17 ubyte&0xC0 0xC0 - reserved 13349# positive length implies identification field 13350>0 ubyte >0 13351>>18 string x "%s" 13352# last 18 bytes of newer tga file footer signature 13353>18 search/4261301/s TRUEVISION-XFILE.\0 13354# extension area offset if not 0 13355>>&-8 ulelong >0 13356# length of the extension area. normal 495 for version 2.0 13357>>>(&-4.l) uleshort 0x01EF 13358# AuthorName[41] 13359>>>>&0 string >\0 - author "%-.40s" 13360# Comment[324]=4 * 80 null terminated 13361>>>>&41 string >\0 - comment "%-.80s" 13362# date 13363>>>>&365 ubequad&0xffffFFFFffff0000 !0 13364# Day 13365>>>>>&-6 uleshort x %d 13366# Month 13367>>>>>&-8 uleshort x \b-%d 13368# Year 13369>>>>>&-4 uleshort x \b-%d 13370# time 13371>>>>&371 ubequad&0xffffFFFFffff0000 !0 13372# hour 13373>>>>>&-8 uleshort x %d 13374# minutes 13375>>>>>&-6 uleshort x \b:%.2d 13376# second 13377>>>>>&-4 uleshort x \b:%.2d 13378# JobName[41] 13379>>>>&377 string >\0 - job "%-.40s" 13380# JobHour Jobminute Jobsecond 13381>>>>&418 ubequad&0xffffFFFFffff0000 !0 13382>>>>>&-8 uleshort x %d 13383>>>>>&-6 uleshort x \b:%.2d 13384>>>>>&-4 uleshort x \b:%.2d 13385# SoftwareId[41] 13386>>>>&424 string >\0 - %-.40s 13387# SoftwareVersionNumber 13388>>>>&424 ubyte >0 13389>>>>>&40 uleshort/100 x %d 13390>>>>>&40 uleshort%100 x \b.%d 13391# VersionLetter 13392>>>>>&42 ubyte >0x20 \b%c 13393# KeyColor 13394>>>>&468 ulelong >0 - keycolor 0x%8.8x 13395# Denominator of Pixel ratio. 0~no pixel aspect 13396>>>>&474 uleshort >0 13397# Numerator 13398>>>>>&-4 uleshort >0 - aspect %d 13399>>>>>&-2 uleshort x \b/%d 13400# Denominator of Gamma ratio. 0~no Gamma value 13401>>>>&478 uleshort >0 13402# Numerator 13403>>>>>&-4 uleshort >0 - gamma %d 13404>>>>>&-2 uleshort x \b/%d 13405# ColorOffset 13406#>>>>&480 ulelong x - col offset 0x%8.8x 13407# StampOffset 13408#>>>>&484 ulelong x - stamp offset 0x%8.8x 13409# ScanOffset 13410#>>>>&488 ulelong x - scan offset 0x%8.8x 13411# AttributesType 13412#>>>>&492 ubyte x - Attributes 0x%x 13413## EndOfTGA 13414 13415# PBMPLUS images 13416# The next byte following the magic is always whitespace. 13417# strength is changed to try these patterns before "x86 boot sector" 134180 name netpbm 13419>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data 13420>>&0 regex =[0-9]{1,50} \b, size = %s x 13421>>>&0 regex =[0-9]{1,50} \b %s 13422 134230 search/1 P1 13424>0 regex/4 P1[\040\t\f\r\n] 13425>>0 use netpbm 13426>>>0 string x \b, bitmap 13427!:strength + 45 13428!:mime image/x-portable-bitmap 13429 134300 search/1 P2 13431>0 regex/4 P2[\040\t\f\r\n] 13432>>0 use netpbm 13433>>>0 string x \b, greymap 13434!:strength + 45 13435!:mime image/x-portable-greymap 13436 134370 search/1 P3 13438>0 regex/4 P3[\040\t\f\r\n] 13439>>0 use netpbm 13440>>>0 string x \b, pixmap 13441!:strength + 45 13442!:mime image/x-portable-pixmap 13443 134440 string P4 13445>0 regex/4 P4[\040\t\f\r\n] 13446>>0 use netpbm 13447>>>0 string x \b, rawbits, bitmap 13448!:strength + 45 13449!:mime image/x-portable-bitmap 13450 134510 string P5 13452>0 regex/4 P5[\040\t\f\r\n] 13453>>0 use netpbm 13454>>>0 string x \b, rawbits, greymap 13455!:strength + 45 13456!:mime image/x-portable-greymap 13457 134580 string P6 13459>0 regex/4 P6[\040\t\f\r\n] 13460>>0 use netpbm 13461>>>0 string x \b, rawbits, pixmap 13462!:strength + 45 13463!:mime image/x-portable-pixmap 13464 134650 string P7 Netpbm PAM image file 13466!:mime image/x-portable-pixmap 13467 13468# From: bryanh@giraffe-data.com (Bryan Henderson) 134690 string \117\072 Solitaire Image Recorder format 13470>4 string \013 MGI Type 11 13471>4 string \021 MGI Type 17 134720 string .MDA MicroDesign data 13473>21 byte 48 version 2 13474>21 byte 51 version 3 134750 string .MDP MicroDesign page data 13476>21 byte 48 version 2 13477>21 byte 51 version 3 13478 13479# NIFF (Navy Interchange File Format, a modification of TIFF) images 13480# [GRR: this *must* go before TIFF] 134810 string IIN1 NIFF image data 13482!:mime image/x-niff 13483 13484# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 13485# (CIFF) file. These are apparently all little-endian. 13486# From: Adam Buchbinder <adam.buchbinder@gmail.com> 13487# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 134880 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 13489!:mime image/x-canon-crw 13490>16 leshort x \b, version %d. 13491>14 leshort x \b%d 13492 13493# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 13494# number. Put this above the TIFF test to make sure we detect them. 13495# These are apparently all little-endian. 13496# From: Adam Buchbinder <adam.buchbinder@gmail.com> 13497# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2 134980 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 13499!:mime image/x-canon-cr2 13500>10 byte x \b, version %d. 13501>11 byte x \b%d 13502 13503# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 13504# The second word of TIFF files is the TIFF version number, 42, which has 13505# never changed. The TIFF specification recommends testing for it. 135060 string MM\x00\x2a TIFF image data, big-endian 13507!:mime image/tiff 13508>(4.L) use \^tiff_ifd 135090 string II\x2a\x00 TIFF image data, little-endian 13510!:mime image/tiff 13511>(4.l) use tiff_ifd 13512 135130 name tiff_ifd 13514>0 leshort x \b, direntries=%d 13515>2 use tiff_entry 13516 135170 name tiff_entry 13518# NewSubFileType 13519>0 leshort 0xfe 13520>>12 use tiff_entry 13521>0 leshort 0x100 13522>>4 lelong 1 13523>>>12 use tiff_entry 13524>>>8 leshort x \b, width=%d 13525>0 leshort 0x101 13526>>4 lelong 1 13527>>>8 leshort x \b, height=%d 13528>>>12 use tiff_entry 13529>0 leshort 0x102 13530>>8 leshort x \b, bps=%d 13531>>12 use tiff_entry 13532>0 leshort 0x103 13533>>4 lelong 1 \b, compression= 13534>>>8 leshort 1 \bnone 13535>>>8 leshort 2 \bhuffman 13536>>>8 leshort 3 \bbi-level group 3 13537>>>8 leshort 4 \bbi-level group 4 13538>>>8 leshort 5 \bLZW 13539>>>8 leshort 6 \bJPEG (old) 13540>>>8 leshort 7 \bJPEG 13541>>>8 leshort 8 \bdeflate 13542>>>8 leshort 9 \bJBIG, ITU-T T.85 13543>>>8 leshort 0xa \bJBIG, ITU-T T.43 13544>>>8 leshort 0x7ffe \bNeXT RLE 2-bit 13545>>>8 leshort 0x8005 \bPackBits (Macintosh RLE) 13546>>>8 leshort 0x8029 \bThunderscan RLE 13547>>>8 leshort 0x807f \bRasterPadding (CT or MP) 13548>>>8 leshort 0x8080 \bRLE (Line Work) 13549>>>8 leshort 0x8081 \bRLE (High-Res Cont-Tone) 13550>>>8 leshort 0x8082 \bRLE (Binary Line Work) 13551>>>8 leshort 0x80b2 \bDeflate (PKZIP) 13552>>>8 leshort 0x80b3 \bKodak DCS 13553>>>8 leshort 0x8765 \bJBIG 13554>>>8 leshort 0x8798 \bJPEG2000 13555>>>8 leshort 0x8799 \bNikon NEF Compressed 13556>>>8 default x 13557>>>>8 leshort x \b(unknown 0x%x) 13558>>>12 use tiff_entry 13559>0 leshort 0x106 \b, PhotometricIntepretation= 13560>>8 clear x 13561>>8 leshort 0 \bWhiteIsZero 13562>>8 leshort 1 \bBlackIsZero 13563>>8 leshort 2 \bRGB 13564>>8 leshort 3 \bRGB Palette 13565>>8 leshort 4 \bTransparency Mask 13566>>8 leshort 5 \bCMYK 13567>>8 leshort 6 \bYCbCr 13568>>8 leshort 8 \bCIELab 13569>>8 default x 13570>>>8 leshort x \b(unknown=0x%x) 13571>>12 use tiff_entry 13572# FillOrder 13573>0 leshort 0x10a 13574>>4 lelong 1 13575>>>12 use tiff_entry 13576# DocumentName 13577>0 leshort 0x10d 13578>>(8.l) string x \b, name=%s 13579>>>12 use tiff_entry 13580# ImageDescription 13581>0 leshort 0x10e 13582>>(8.l) string x \b, description=%s 13583>>>12 use tiff_entry 13584# Make 13585>0 leshort 0x10f 13586>>(8.l) string x \b, manufacturer=%s 13587>>>12 use tiff_entry 13588# Model 13589>0 leshort 0x110 13590>>(8.l) string x \b, model=%s 13591>>>12 use tiff_entry 13592# StripOffsets 13593>0 leshort 0x111 13594>>12 use tiff_entry 13595# Orientation 13596>0 leshort 0x112 \b, orientation= 13597>>8 leshort 1 \bupper-left 13598>>8 leshort 3 \blower-right 13599>>8 leshort 6 \bupper-right 13600>>8 leshort 8 \blower-left 13601>>8 leshort 9 \bundefined 13602>>8 default x 13603>>>8 leshort x \b[*%d*] 13604>>12 use tiff_entry 13605# XResolution 13606>0 leshort 0x11a 13607>>8 lelong x \b, xresolution=%d 13608>>12 use tiff_entry 13609# YResolution 13610>0 leshort 0x11b 13611>>8 lelong x \b, yresolution=%d 13612>>12 use tiff_entry 13613# ResolutionUnit 13614>0 leshort 0x128 13615>>8 leshort x \b, resolutionunit=%d 13616>>12 use tiff_entry 13617# Software 13618>0 leshort 0x131 13619>>(8.l) string x \b, software=%s 13620>>12 use tiff_entry 13621# Datetime 13622>0 leshort 0x132 13623>>(8.l) string x \b, datetime=%s 13624>>12 use tiff_entry 13625# HostComputer 13626>0 leshort 0x13c 13627>>(8.l) string x \b, hostcomputer=%s 13628>>12 use tiff_entry 13629# WhitePoint 13630>0 leshort 0x13e 13631>>12 use tiff_entry 13632# PrimaryChromaticities 13633>0 leshort 0x13f 13634>>12 use tiff_entry 13635# YCbCrCoefficients 13636>0 leshort 0x211 13637>>12 use tiff_entry 13638# YCbCrPositioning 13639>0 leshort 0x213 13640>>12 use tiff_entry 13641# ReferenceBlackWhite 13642>0 leshort 0x214 13643>>12 use tiff_entry 13644# Copyright 13645>0 leshort 0x8298 13646>>(8.l) string x \b, copyright=%s 13647>>12 use tiff_entry 13648# ExifOffset 13649>0 leshort 0x8769 13650>>12 use tiff_entry 13651# GPS IFD 13652>0 leshort 0x8825 \b, GPS-Data 13653>>12 use tiff_entry 13654 13655#>0 leshort x \b, unknown=0x%x 13656#>>12 use tiff_entry 13657 136580 string MM\x00\x2b Big TIFF image data, big-endian 13659!:mime image/tiff 136600 string II\x2b\x00 Big TIFF image data, little-endian 13661!:mime image/tiff 13662 13663# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 13664# (Greg Roelofs, newt@uchicago.edu) 13665# (Albert Cahalan, acahalan@cs.uml.edu) 13666# 13667# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ... 13668# 136690 string \x89PNG\x0d\x0a\x1a\x0a PNG image data 13670!:mime image/png 13671!:strength +10 13672>16 belong x \b, %d x 13673>20 belong x %d, 13674>24 byte x %d-bit 13675>25 byte 0 grayscale, 13676>25 byte 2 \b/color RGB, 13677>25 byte 3 colormap, 13678>25 byte 4 gray+alpha, 13679>25 byte 6 \b/color RGBA, 13680#>26 byte 0 deflate/32K, 13681>28 byte 0 non-interlaced 13682>28 byte 1 interlaced 13683 13684# possible GIF replacements; none yet released! 13685# (Greg Roelofs, newt@uchicago.edu) 13686# 13687# GRR 950115: this was mine ("Zip GIF"): 136880 string GIF94z ZIF image (GIF+deflate alpha) 13689!:mime image/x-unknown 13690# 13691# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 13692# 136930 string FGF95a FGF image (GIF+deflate beta) 13694!:mime image/x-unknown 13695# 13696# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 13697# (best; not yet implemented): 13698# 136990 string PBF PBF image (deflate compression) 13700!:mime image/x-unknown 13701 13702# GIF 13703# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65) 137040 string GIF8 GIF image data 13705!:strength +80 13706!:mime image/gif 13707!:apple 8BIMGIFf 13708>4 string 7a \b, version 8%s, 13709>4 string 9a \b, version 8%s, 13710>6 leshort >0 %d x 13711>8 leshort >0 %d 13712#>10 byte &0x80 color mapped, 13713#>10 byte&0x07 =0x00 2 colors 13714#>10 byte&0x07 =0x01 4 colors 13715#>10 byte&0x07 =0x02 8 colors 13716#>10 byte&0x07 =0x03 16 colors 13717#>10 byte&0x07 =0x04 32 colors 13718#>10 byte&0x07 =0x05 64 colors 13719#>10 byte&0x07 =0x06 128 colors 13720#>10 byte&0x07 =0x07 256 colors 13721 13722# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 13723# 1 plane, no encoding. 137240 string \361\0\100\273 CMU window manager raster image data 13725>4 lelong >0 %d x 13726>8 lelong >0 %d, 13727>12 lelong >0 %d-bit 13728 13729# Magick Image File Format 137300 string id=ImageMagick MIFF image data 13731 13732# Artisan 137330 long 1123028772 Artisan image data 13734>4 long 1 \b, rectangular 24-bit 13735>4 long 2 \b, rectangular 8-bit with colormap 13736>4 long 3 \b, rectangular 32-bit (24-bit with matte) 13737 13738# FIG (Facility for Interactive Generation of figures), an object-based format 137390 search/1 #FIG FIG image text 13740>5 string x \b, version %.3s 13741 13742# PHIGS 137430 string ARF_BEGARF PHIGS clear text archive 137440 string @(#)SunPHIGS SunPHIGS 13745# version number follows, in the form m.n 13746>40 string SunBin binary 13747>32 string archive archive 13748 13749# GKS (Graphics Kernel System) 137500 string GKSM GKS Metafile 13751>24 string SunGKS \b, SunGKS 13752 13753# CGM image files 137540 string BEGMF clear text Computer Graphics Metafile 13755 13756# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 137570 string yz MGR bitmap, modern format, 8-bit aligned 137580 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 137590 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 137600 string yx MGR bitmap, modern format, squeezed 13761 13762# Fuzzy Bitmap (FBM) images 137630 string %bitmap\0 FBM image data 13764>30 long 0x31 \b, mono 13765>30 long 0x33 \b, color 13766 13767# facsimile data 137681 string PC\ Research,\ Inc group 3 fax data 13769>29 byte 0 \b, normal resolution (204x98 DPI) 13770>29 byte 1 \b, fine resolution (204x196 DPI) 13771# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 137720 string Sfff structured fax file 13773 13774# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 13775# most files with the extension .EPA and some with .BMP 137760 string \x11\x06 Award BIOS Logo, 136 x 84 13777!:mime image/x-award-bioslogo 137780 string \x11\x09 Award BIOS Logo, 136 x 126 13779!:mime image/x-award-bioslogo 13780#0 string \x07\x1f BIOS Logo corrupted? 13781# http://www.blackfiveservices.co.uk/awbmtools.shtml 13782# http://biosgfx.narod.ru/v3/ 13783# http://biosgfx.narod.ru/abr-2/ 137840 string AWBM 13785>4 leshort <1981 Award BIOS bitmap 13786!:mime image/x-award-bmp 13787# image width is a multiple of 4 13788>>4 leshort&0x0003 0 13789>>>4 leshort x \b, %d 13790>>>6 leshort x x %d 13791>>4 leshort&0x0003 >0 \b, 13792>>>4 leshort&0x0003 =1 13793>>>>4 leshort x %d+3 13794>>>4 leshort&0x0003 =2 13795>>>>4 leshort x %d+2 13796>>>4 leshort&0x0003 =3 13797>>>>4 leshort x %d+1 13798>>>6 leshort x x %d 13799# at offset 8 starts imagedata followed by "RGB " marker 13800 13801# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 13802# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 13803# 28bitmap_information_header.29 138040 string BM 13805>14 leshort 12 PC bitmap, OS/2 1.x format 13806!:mime image/x-ms-bmp 13807>>18 leshort x \b, %d x 13808>>20 leshort x %d 13809>14 leshort 64 PC bitmap, OS/2 2.x format 13810!:mime image/x-ms-bmp 13811>>18 leshort x \b, %d x 13812>>20 leshort x %d 13813>14 leshort 40 PC bitmap, Windows 3.x format 13814!:mime image/x-ms-bmp 13815>>18 lelong x \b, %d x 13816>>22 lelong x %d x 13817>>28 leshort x %d 13818>14 leshort 124 PC bitmap, Windows 98/2000 and newer format 13819!:mime image/x-ms-bmp 13820>>18 lelong x \b, %d x 13821>>22 lelong x %d x 13822>>28 leshort x %d 13823>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format 13824!:mime image/x-ms-bmp 13825>>18 lelong x \b, %d x 13826>>22 lelong x %d x 13827>>28 leshort x %d 13828>14 leshort 128 PC bitmap, Windows NT/2000 format 13829!:mime image/x-ms-bmp 13830>>18 lelong x \b, %d x 13831>>22 lelong x %d x 13832>>28 leshort x %d 13833# Too simple - MPi 13834#0 string IC PC icon data 13835#0 string PI PC pointer image data 13836#0 string CI PC color icon data 13837#0 string CP PC color pointer image data 13838# Conflicts with other entries [BABYL] 13839#0 string BA PC bitmap array data 13840 13841# XPM icons (Greg Roelofs, newt@uchicago.edu) 138420 search/1 /*\ XPM\ */ X pixmap image text 13843!:mime image/x-xpmi 13844 13845# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 138460 leshort 0xcc52 RLE image data, 13847>6 leshort x %d x 13848>8 leshort x %d 13849>2 leshort >0 \b, lower left corner: %d 13850>4 leshort >0 \b, lower right corner: %d 13851>10 byte&0x1 =0x1 \b, clear first 13852>10 byte&0x2 =0x2 \b, no background 13853>10 byte&0x4 =0x4 \b, alpha channel 13854>10 byte&0x8 =0x8 \b, comment 13855>11 byte >0 \b, %d color channels 13856>12 byte >0 \b, %d bits per pixel 13857>13 byte >0 \b, %d color map channels 13858 13859# image file format (Robert Potter, potter@cs.rochester.edu) 138600 string Imagefile\ version- iff image data 13861# this adds the whole header (inc. version number), informative but longish 13862>10 string >\0 %s 13863 13864# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 138650 belong 0x59a66a95 Sun raster image data 13866>4 belong >0 \b, %d x 13867>8 belong >0 %d, 13868>12 belong >0 %d-bit, 13869#>16 belong >0 %d bytes long, 13870>20 belong 0 old format, 13871#>20 belong 1 standard, 13872>20 belong 2 compressed, 13873>20 belong 3 RGB, 13874>20 belong 4 TIFF, 13875>20 belong 5 IFF, 13876>20 belong 0xffff reserved for testing, 13877>24 belong 0 no colormap 13878>24 belong 1 RGB colormap 13879>24 belong 2 raw colormap 13880#>28 belong >0 colormap is %d bytes long 13881 13882# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 13883# 13884# See 13885# http://reality.sgi.com/grafica/sgiimage.html 13886# 138870 beshort 474 SGI image data 13888#>2 byte 0 \b, verbatim 13889>2 byte 1 \b, RLE 13890#>3 byte 1 \b, normal precision 13891>3 byte 2 \b, high precision 13892>4 beshort x \b, %d-D 13893>6 beshort x \b, %d x 13894>8 beshort x %d 13895>10 beshort x \b, %d channel 13896>10 beshort !1 \bs 13897>80 string >0 \b, "%s" 13898 138990 string IT01 FIT image data 13900>4 belong x \b, %d x 13901>8 belong x %d x 13902>12 belong x %d 13903# 139040 string IT02 FIT image data 13905>4 belong x \b, %d x 13906>8 belong x %d x 13907>12 belong x %d 13908# 139092048 string PCD_IPI Kodak Photo CD image pack file 13910>0xe02 byte&0x03 0x00 , landscape mode 13911>0xe02 byte&0x03 0x01 , portrait mode 13912>0xe02 byte&0x03 0x02 , landscape mode 13913>0xe02 byte&0x03 0x03 , portrait mode 139140 string PCD_OPA Kodak Photo CD overview pack file 13915 13916# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 13917# FITS is the Flexible Image Transport System, the de facto standard for 13918# data and image transfer, storage, etc., for the astronomical community. 13919# (FITS floating point formats are big-endian.) 139200 string SIMPLE\ \ = FITS image data 13921>109 string 8 \b, 8-bit, character or unsigned binary integer 13922>108 string 16 \b, 16-bit, two's complement binary integer 13923>107 string \ 32 \b, 32-bit, two's complement binary integer 13924>107 string -32 \b, 32-bit, floating point, single precision 13925>107 string -64 \b, 64-bit, floating point, double precision 13926 13927# other images 139280 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 13929 13930# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 13931# stuff. 13932# 139330 beshort 0x1010 PEX Binary Archive 13934 13935# DICOM medical imaging data 13936# URL: https://en.wikipedia.org/wiki/DICOM#Data_format 13937# Note: "dcm" is the official file name extension 13938# XnView mention also "dc3" and "acr" as file name extension 13939128 string DICM DICOM medical imaging data 13940!:mime application/dicom 13941!:ext dcm/dicom/dic 13942 13943# XWD - X Window Dump file. 13944# As described in /usr/X11R6/include/X11/XWDFile.h 13945# used by the xwd program. 13946# Bradford Castalia, idaeim, 1/01 13947# updated by Adam Buchbinder, 2/09 13948# The following assumes version 7 of the format; the first long is the length 13949# of the header, which is at least 25 4-byte longs, and the one at offset 8 13950# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 13951# which is a maximum of 32. 139520 belong >100 13953>8 belong <3 13954>>12 belong <33 13955>>>4 belong 7 XWD X Window Dump image data 13956!:mime image/x-xwindowdump 13957>>>>100 string >\0 \b, "%s" 13958>>>>16 belong x \b, %dx 13959>>>>20 belong x \b%dx 13960>>>>12 belong x \b%d 13961 13962# PDS - Planetary Data System 13963# These files use Parameter Value Language in the header section. 13964# Unfortunately, there is no certain magic, but the following 13965# strings have been found to be most likely. 139660 string NJPL1I00 PDS (JPL) image data 139672 string NJPL1I PDS (JPL) image data 139680 string CCSD3ZF PDS (CCSD) image data 139692 string CCSD3Z PDS (CCSD) image data 139700 string PDS_ PDS image data 139710 string LBLSIZE= PDS (VICAR) image data 13972 13973# pM8x: ATARI STAD compressed bitmap format 13974# 13975# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 13976# p M 8 5/6 xx yy zz data... 13977# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 13978# bytes either run horizontally (pM85) or vertically (pM86). yy is the 13979# most frequent byte, xx and zz are runlength escape codes, where xx is 13980# used for runs of yy. 13981# 139820 string pM85 Atari ST STAD bitmap image data (hor) 13983>5 byte 0x00 (white background) 13984>5 byte 0xFF (black background) 139850 string pM86 Atari ST STAD bitmap image data (vert) 13986>5 byte 0x00 (white background) 13987>5 byte 0xFF (black background) 13988 13989# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 13990# http://www.atarimax.com/jindroush.atari.org/afmtatr.html 139910 leshort 0x0296 Atari ATR image 13992 13993# XXX: 13994# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 13995# magic. 13996# SGI RICE image file <mpruett@sgi.com> 13997#0 beshort 0x5249 RICE image 13998#>2 beshort x v%d 13999#>4 beshort x (%d x 14000#>6 beshort x %d) 14001#>8 beshort 0 8 bit 14002#>8 beshort 1 10 bit 14003#>8 beshort 2 12 bit 14004#>8 beshort 3 13 bit 14005#>10 beshort 0 4:2:2 14006#>10 beshort 1 4:2:2:4 14007#>10 beshort 2 4:4:4 14008#>10 beshort 3 4:4:4:4 14009#>12 beshort 1 RGB 14010#>12 beshort 2 CCIR601 14011#>12 beshort 3 RP175 14012#>12 beshort 4 YUV 14013 14014# PCX image files 14015# From: Dan Fandrich <dan@coneharvesters.com> 14016# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX 14017# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 14018# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 14019# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 140200 ubelong&0xffF8fe00 0x0a000000 14021# for PCX bit depth > 0 14022>3 ubyte >0 14023# test for valid versions 14024>>1 ubyte <6 14025>>>1 ubyte !1 PCX 14026!:mime image/x-pcx 14027#!:mime image/pcx 14028>>>>1 ubyte 0 ver. 2.5 image data 14029>>>>1 ubyte 2 ver. 2.8 image data, with palette 14030>>>>1 ubyte 3 ver. 2.8 image data, without palette 14031>>>>1 ubyte 4 for Windows image data 14032>>>>1 ubyte 5 ver. 3.0 image data 14033>>>>4 uleshort x bounding box [%d, 14034>>>>6 uleshort x %d] - 14035>>>>8 uleshort x [%d, 14036>>>>10 uleshort x %d], 14037>>>>65 ubyte >1 %d planes each of 14038>>>>3 ubyte x %d-bit 14039>>>>68 byte 1 colour, 14040>>>>68 byte 2 grayscale, 14041# this should not happen 14042>>>>68 default x image, 14043>>>>12 leshort >0 %d x 14044>>>>>14 uleshort x %d dpi, 14045>>>>2 byte 0 uncompressed 14046>>>>2 byte 1 RLE compressed 14047 14048# Adobe Photoshop 14049# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 140500 string 8BPS Adobe Photoshop Image 14051!:mime image/vnd.adobe.photoshop 14052>4 beshort 2 (PSB) 14053>18 belong x \b, %d x 14054>14 belong x %d, 14055>24 beshort 0 bitmap 14056>24 beshort 1 grayscale 14057>>12 beshort 2 with alpha 14058>24 beshort 2 indexed 14059>24 beshort 3 RGB 14060>>12 beshort 4 \bA 14061>24 beshort 4 CMYK 14062>>12 beshort 5 \bA 14063>24 beshort 7 multichannel 14064>24 beshort 8 duotone 14065>24 beshort 9 lab 14066>12 beshort > 1 14067>>12 beshort x \b, %dx 14068>12 beshort 1 \b, 14069>22 beshort x %d-bit channel 14070>12 beshort > 1 \bs 14071 14072# XV thumbnail indicator (ThMO) 140730 string P7\ 332 XV thumbnail image data 14074 14075# NITF is defined by United States MIL-STD-2500A 140760 string NITF National Imagery Transmission Format 14077>25 string >\0 dated %.14s 14078 14079# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 14080# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de> 14081# Update: Joerg Jenderek 14082# See http://fileformats.archiveteam.org/wiki/GEM_Raster 14083# For variations, also see: 14084# http://www.seasip.info/Gem/ff_img.html (Ventura) 14085# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) 14086# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) 14087# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) 140880 beshort 0x0001 14089# header_size 14090>2 beshort 0x0008 14091>>0 use gem_info 14092>2 beshort 0x0009 14093>>0 use gem_info 14094# no example for NOSIG 14095>2 beshort 24 14096>>0 use gem_info 14097# no example for HYPERPAINT 14098>2 beshort 25 14099>>0 use gem_info 1410016 string XIMG\0 14101>0 use gem_info 14102# no example 1410316 string STTT\0\x10 14104>0 use gem_info 14105# no example or description 1410616 string TIMG\0 14107>0 use gem_info 14108 141090 name gem_info 14110# version is 2 for some XIMG and 1 for all others 14111>0 beshort <0x0003 GEM 14112# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt 14113!:mime image/x-gem 14114# header_size 24 25 27 59 779 words for colored bitmaps 14115>>2 beshort >9 14116>>>16 string STTT\0\x10 STTT 14117>>>16 string TIMG\0 TIMG 14118# HYPERPAINT or NOSIG variant 14119>>>16 string \0\x80 14120>>>>2 beshort =24 NOSIG 14121>>>>2 beshort !24 HYPERPAINT 14122# NOSIG or XIMG variant 14123>>>16 default x 14124>>>>16 string !XIMG\0 NOSIG 14125>>16 string =XIMG\0 XIMG Image data 14126!:ext img/ximg 14127# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type 14128>>16 string !XIMG\0 Image data 14129!:ext img 14130# header_size is 9 for Ventura files and 8 for other GEM Paint files 14131>>2 beshort 9 (Ventura) 14132#>>2 beshort 8 (Paint) 14133>>12 beshort x %d x 14134>>14 beshort x %d, 14135# 1 4 8 14136>>4 beshort x %d planes, 14137# in tenths of a millimetre 14138>>8 beshort x %d x 14139>>10 beshort x %d pixelsize 14140# pattern_size 1-8. 2 for GEM Paint 14141>>6 beshort !2 \b, pattern size %d 14142 14143# GEM Metafile (Wolfram Kleff) 141440 lelong 0x0018FFFF GEM Metafile data 14145>4 leshort x version %d 14146 14147# 14148# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 14149# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 14150# 141510 string \0\nSMJPEG SMJPEG 14152>8 belong x %d.x data 14153# According to the specification you could find any number of _TXT 14154# headers here, but I can't think of any way of handling that. None of 14155# the SMJPEG files I tried it on used this feature. Even if such a 14156# file is encountered the output should still be reasonable. 14157>16 string _SND \b, 14158>>24 beshort >0 %d Hz 14159>>26 byte 8 8-bit 14160>>26 byte 16 16-bit 14161>>28 string NONE uncompressed 14162# >>28 string APCM ADPCM compressed 14163>>27 byte 1 mono 14164>>28 byte 2 stereo 14165# Help! Isn't there any way to avoid writing this part twice? 14166>>32 string _VID \b, 14167# >>>48 string JFIF JPEG 14168>>>40 belong >0 %d frames 14169>>>44 beshort >0 (%d x 14170>>>46 beshort >0 %d) 14171>16 string _VID \b, 14172# >>32 string JFIF JPEG 14173>>24 belong >0 %d frames 14174>>28 beshort >0 (%d x 14175>>30 beshort >0 %d) 14176 141770 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 14178 14179# "thumbnail file" (icon) 14180# descended from "xv", but in use by other applications as well (Wolfram Kleff) 141810 string P7\ 332 XV "thumbnail file" (icon) data 14182 14183# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 141840 string KiSS KISS/GS 14185>4 byte 16 color 14186>>5 byte x %d bit 14187>>8 leshort x %d colors 14188>>10 leshort x %d groups 14189>4 byte 32 cell 14190>>5 byte x %d bit 14191>>8 leshort x %d x 14192>>10 leshort x %d 14193>>12 leshort x +%d 14194>>14 leshort x +%d 14195 14196# Webshots (www.webshots.com), by John Harrison 141970 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 14198 14199# Hercules DASD image files 14200# From Jan Jaeger <jj@septa.nl> 142010 string CKD_P370 Hercules CKD DASD image file 14202>8 long x \b, %d heads per cylinder 14203>12 long x \b, track size %d bytes 14204>16 byte x \b, device type 33%2.2X 14205 142060 string CKD_C370 Hercules compressed CKD DASD image file 14207>8 long x \b, %d heads per cylinder 14208>12 long x \b, track size %d bytes 14209>16 byte x \b, device type 33%2.2X 14210 142110 string CKD_S370 Hercules CKD DASD shadow file 14212>8 long x \b, %d heads per cylinder 14213>12 long x \b, track size %d bytes 14214>16 byte x \b, device type 33%2.2X 14215 14216# Squeak images and programs - etoffi@softhome.net 142170 string \146\031\0\0 Squeak image data 142180 search/1 'From\040Squeak Squeak program text 14219 14220# partimage: file(1) magic for PartImage files (experimental, incomplete) 14221# Author: Hans-Joachim Baader <hjb@pro-linux.de> 142220 string PaRtImAgE-VoLuMe PartImage 14223>0x0020 string 0.6.1 file version %s 14224>>0x0060 lelong >-1 volume %d 14225#>>0x0064 8 byte identifier 14226#>>0x007c reserved 14227>>0x0200 string >\0 type %s 14228>>0x1400 string >\0 device %s, 14229>>0x1600 string >\0 original filename %s, 14230# Some fields omitted 14231>>0x2744 lelong 0 not compressed 14232>>0x2744 lelong 1 gzip compressed 14233>>0x2744 lelong 2 bzip2 compressed 14234>>0x2744 lelong >2 compressed with unknown algorithm 14235>0x0020 string >0.6.1 file version %s 14236>0x0020 string <0.6.1 file version %s 14237 14238# DCX is multi-page PCX, using a simple header of up to 1024 14239# offsets for the respective PCX components. 14240# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 142410 lelong 987654321 DCX multi-page PCX image data 14242 14243# Simon Walton <simonw@matteworld.com> 14244# Kodak Cineon format for scanned negatives 14245# http://www.kodak.com/US/en/motion/support/dlad/ 142460 lelong 0xd75f2a80 Cineon image data 14247>200 belong >0 \b, %d x 14248>204 belong >0 %d 14249 14250 14251# Bio-Rad .PIC is an image format used by microscope control systems 14252# and related image processing software used by biologists. 14253# From: Vebjorn Ljosa <vebjorn@ljosa.com> 14254# BOOL values are two-byte integers; use them to rule out false positives. 14255# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 14256# Samples: http://www.loci.wisc.edu/software/sample-data 1425714 leshort <2 14258>62 leshort <2 14259>>54 leshort 12345 Bio-Rad .PIC Image File 14260>>>0 leshort >0 %d x 14261>>>2 leshort >0 %d, 14262>>>4 leshort =1 1 image in file 14263>>>4 leshort >1 %d images in file 14264 14265# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 14266# The description of *.mrw format can be found at 14267# http://www.dalibor.cz/minolta/raw_file_format.htm 142680 string \000MRM Minolta Dimage camera raw image data 14269 14270# Summary: DjVu image / document 14271# Extension: .djvu 14272# Reference: http://djvu.org/docs/DjVu3Spec.djvu 14273# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 14274# Modified by (1): Abel Cheung <abelcheung@gmail.com> 142750 string AT&TFORM 14276>12 string DJVM DjVu multiple page document 14277!:mime image/vnd.djvu 14278>12 string DJVU DjVu image or single page document 14279!:mime image/vnd.djvu 14280>12 string DJVI DjVu shared document 14281!:mime image/vnd.djvu 14282>12 string THUM DjVu page thumbnails 14283!:mime image/vnd.djvu 14284 14285# Originally by Marc Espie 14286# Modified by Robert Minsk <robertminsk at yahoo.com> 14287# http://www.openexr.com/openexrfilelayout.pdf 142880 lelong 20000630 OpenEXR image data, 14289!:mime image/x-exr 14290>4 lelong&0x000000ff x version %d, 14291>4 lelong ^0x00000200 storage: scanline 14292>4 lelong &0x00000200 storage: tiled 14293>8 search/0x1000 compression\0 \b, compression: 14294>>&16 byte 0 none 14295>>&16 byte 1 rle 14296>>&16 byte 2 zips 14297>>&16 byte 3 zip 14298>>&16 byte 4 piz 14299>>&16 byte 5 pxr24 14300>>&16 byte 6 b44 14301>>&16 byte 7 b44a 14302>>&16 byte >7 unknown 14303>8 search/0x1000 dataWindow\0 \b, dataWindow: 14304>>&10 lelong x (%d 14305>>&14 lelong x %d)- 14306>>&18 lelong x \b(%d 14307>>&22 lelong x %d) 14308>8 search/0x1000 displayWindow\0 \b, displayWindow: 14309>>&10 lelong x (%d 14310>>&14 lelong x %d)- 14311>>&18 lelong x \b(%d 14312>>&22 lelong x %d) 14313>8 search/0x1000 lineOrder\0 \b, lineOrder: 14314>>&14 byte 0 increasing y 14315>>&14 byte 1 decreasing y 14316>>&14 byte 2 random y 14317>>&14 byte >2 unknown 14318 14319# SMPTE Digital Picture Exchange Format, SMPTE DPX 14320# 14321# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 14322# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 14323# Robert Minsk <robertminsk at yahoo.com> 143240 string SDPX DPX image data, big-endian, 14325!:mime image/x-dpx 14326>768 beshort <4 14327>>772 belong x %dx 14328>>776 belong x \b%d, 14329>768 beshort >3 14330>>776 belong x %dx 14331>>772 belong x \b%d, 14332>768 beshort 0 left to right/top to bottom 14333>768 beshort 1 right to left/top to bottom 14334>768 beshort 2 left to right/bottom to top 14335>768 beshort 3 right to left/bottom to top 14336>768 beshort 4 top to bottom/left to right 14337>768 beshort 5 top to bottom/right to left 14338>768 leshort 6 bottom to top/left to right 14339>768 leshort 7 bottom to top/right to left 14340 14341# From: Tom Hilinski <tom.hilinski@comcast.net> 14342# http://www.unidata.ucar.edu/packages/netcdf/ 143430 string CDF\001 NetCDF Data Format data 14344 14345#----------------------------------------------------------------------- 14346# Hierarchical Data Format, used to facilitate scientific data exchange 14347# specifications at http://hdf.ncsa.uiuc.edu/ 143480 belong 0x0e031301 Hierarchical Data Format (version 4) data 14349!:mime application/x-hdf 143500 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 14351!:mime application/x-hdf 14352512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block 14353!:mime application/x-hdf 143541024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 14355!:mime application/x-hdf 143562048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 14357!:mime application/x-hdf 143584096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 14359!:mime application/x-hdf 14360 14361 14362# From: Tobias Burnus <burnus@net-b.de> 14363# Xara (for a while: Corel Xara) is a graphic package, see 14364# http://www.xara.com/ for Windows and as GPL application for Linux 143650 string XARA\243\243 Xara graphics file 14366 14367# http://www.cartesianinc.com/Tech/ 143680 string CPC\262 Cartesian Perceptual Compression image 14369!:mime image/x-cpi 14370 14371# From Albert Cahalan <acahalan@gmail.com> 14372# puredigital used it for the CVS disposable camcorder 14373#8 lelong 4 ZBM bitmap image data 14374#>4 leshort x %u x 14375#>6 leshort x %u 14376 14377# From Albert Cahalan <acahalan@gmail.com> 14378# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 143790 string C565 OLPC firmware icon image data 14380>4 leshort x %u x 14381>6 leshort x %u 14382 14383# Applied Images - Image files from Cytovision 14384# Gustavo Junior Alves <gjalves@gjalves.com.br> 143850 string \xce\xda\xde\xfa Cytovision Metaphases file 143860 string \xed\xad\xef\xac Cytovision Karyotype file 143870 string \x0b\x00\x03\x00 Cytovision FISH Probe file 143880 string \xed\xfe\xda\xbe Cytovision FLEX file 143890 string \xed\xab\xed\xfe Cytovision FLEX file 143900 string \xad\xfd\xea\xad Cytovision RATS file 14391 14392# Wavelet Scalar Quantization format used in gray-scale fingerprint images 14393# From Tano M Fotang <mfotang@quanteq.com> 143940 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 14395 14396# Type: PCO B16 image files 14397# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 14398# From: Florian Philipp <florian.philipp@binarywings.net> 14399# Extension: .b16 14400# Description: Pixel image format produced by PCO Camware, typically used 14401# together with PCO cameras. 14402# Note: Different versions exist for e.g. 8 bit and 16 bit images. 14403# Documentation is incomplete. 144040 string/b PCO- PCO B16 image data 14405>12 lelong x \b, %dx 14406>16 lelong x \b%d 14407>20 lelong 0 \b, short header 14408>20 lelong -1 \b, extended header 14409>>24 lelong 0 \b, grayscale 14410>>>36 lelong 0 linear LUT 14411>>>36 lelong 1 logarithmic LUT 14412>>>28 lelong x [%d 14413>>>32 lelong x \b,%d] 14414>>24 lelong 1 \b, color 14415>>>64 lelong 0 linear LUT 14416>>>64 lelong 1 logarithmic LUT 14417>>>40 lelong x r[%d 14418>>>44 lelong x \b,%d] 14419>>>48 lelong x g[%d 14420>>>52 lelong x \b,%d] 14421>>>56 lelong x b[%d 14422>>>60 lelong x \b,%d] 14423 14424# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 14425# From: Markus Heidelberg <markus.heidelberg at web.de> 144260 string/t [BitmapInfo2] Polar Monitor Bitmap text 14427!:mime image/x-polar-monitor-bitmap 14428 14429# From: Rick Richardson <rickrich@gmail.com> 14430# updated by: Joerg Jenderek 14431# URL: http://techmods.net/nuvi/ 144320 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 14433# extension is also used for 14434# Sony SRF raw image (image/x-sony-srf) 14435# SRF map 14436# Terragen Surface Map (http://www.planetside.co.uk/terragen) 14437# FileLocator Pro search criteria file (http://www.mythicsoft.com/filelocatorpro) 14438!:ext srf 14439#!:mime image/x-garmin-srf 14440# version 1.00,2.00,2.10,2.40,2.50 14441>0x2f string >0 \b, version %4.4s 14442# width (2880,2881,3240) 14443>0x55 uleshort >0 \b, %dx 14444# height (80,90) 14445>>0x53 uleshort x \b%d 14446 14447# Type: Ulead Photo Explorer5 (.pe5) 14448# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 14449# From: Simon Horman <horms@debian.org> 144500 string IIO2H Ulead Photo Explorer5 14451 14452# Type: X11 cursor 14453# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 14454# From: Mathias Brodala <info@noctus.net> 144550 string Xcur X11 cursor 14456 14457# Type: Olympus ORF raw images. 14458# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF 14459# From: Adam Buchbinder <adam.buchbinder@gmail.com> 144600 string MMOR Olympus ORF raw image data, big-endian 14461!:mime image/x-olympus-orf 144620 string IIRO Olympus ORF raw image data, little-endian 14463!:mime image/x-olympus-orf 144640 string IIRS Olympus ORF raw image data, little-endian 14465!:mime image/x-olympus-orf 14466 14467# Type: files used in modern AVCHD camcoders to store clip information 14468# Extension: .cpi 14469# From: Alexander Danilov <alexander.a.danilov@gmail.com> 144700 string HDMV0100 AVCHD Clip Information 14471 14472# From: Adam Buchbinder <adam.buchbinder@gmail.com> 14473# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 14474# Radiance HDR; usually has .pic or .hdr extension. 144750 string #?RADIANCE\n Radiance HDR image data 14476#!mime image/vnd.radiance 14477 14478# From: Adam Buchbinder <adam.buchbinder@gmail.com> 14479# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 14480# Used by the pfstools packages. The regex matches for the image size could 14481# probably use some work. The MIME type is made up; if there's one in 14482# actual common use, it should replace the one below. 144830 string PFS1\x0a PFS HDR image data 14484#!mime image/x-pfs 14485>1 regex [0-9]*\ \b, %s 14486>>1 regex \ [0-9]{4} \bx%s 14487 14488# Type: Foveon X3F 14489# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf 14490# From: Adam Buchbinder <adam.buchbinder@gmail.com> 14491# Note that the MIME type isn't defined anywhere that I can find; if 14492# there's a canonical type for this format, it should replace this one. 144930 string FOVb Foveon X3F raw image data 14494!:mime image/x-x3f 14495>6 leshort x \b, version %d. 14496>4 leshort x \b%d 14497>28 lelong x \b, %dx 14498>32 lelong x \b%d 14499 14500# Paint.NET file 14501# From Adam Buchbinder <adam.buchbinder@gmail.com> 145020 string PDN3 Paint.NET image data 14503!:mime image/x-paintnet 14504 14505# Not really an image. 14506# From: "Tano M. Fotang" <mfotang@quanteq.com> 145070 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 14508 14509# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip 14510# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 1451190 bequad 0x574D50484F544F00 JPEG-XR Image 14512>98 byte&0x08 =0x08 \b, hard tiling 14513>99 byte&0x80 =0x80 \b, tiling present 14514>99 byte&0x40 =0x40 \b, codestream present 14515>99 byte&0x38 x \b, spatial xform= 14516>99 byte&0x38 0x00 \bTL 14517>99 byte&0x38 0x08 \bBL 14518>99 byte&0x38 0x10 \bTR 14519>99 byte&0x38 0x18 \bBR 14520>99 byte&0x38 0x20 \bBT 14521>99 byte&0x38 0x28 \bRB 14522>99 byte&0x38 0x30 \bLT 14523>99 byte&0x38 0x38 \bLB 14524>100 byte&0x80 =0x80 \b, short header 14525>>102 beshort+1 x \b, %d 14526>>104 beshort+1 x \bx%d 14527>100 byte&0x80 =0x00 \b, long header 14528>>102 belong+1 x \b, %x 14529>>106 belong+1 x \bx%x 14530>101 beshort&0xf x \b, bitdepth= 14531>>101 beshort&0xf 0x0 \b1-WHITE=1 14532>>101 beshort&0xf 0x1 \b8 14533>>101 beshort&0xf 0x2 \b16 14534>>101 beshort&0xf 0x3 \b16-SIGNED 14535>>101 beshort&0xf 0x4 \b16-FLOAT 14536>>101 beshort&0xf 0x5 \b(reserved 5) 14537>>101 beshort&0xf 0x6 \b32-SIGNED 14538>>101 beshort&0xf 0x7 \b32-FLOAT 14539>>101 beshort&0xf 0x8 \b5 14540>>101 beshort&0xf 0x9 \b10 14541>>101 beshort&0xf 0xa \b5-6-5 14542>>101 beshort&0xf 0xb \b(reserved %d) 14543>>101 beshort&0xf 0xc \b(reserved %d) 14544>>101 beshort&0xf 0xd \b(reserved %d) 14545>>101 beshort&0xf 0xe \b(reserved %d) 14546>>101 beshort&0xf 0xf \b1-BLACK=1 14547>101 beshort&0xf0 x \b, colorfmt= 14548>>101 beshort&0xf0 0x00 \bYONLY 14549>>101 beshort&0xf0 0x10 \bYUV240 14550>>101 beshort&0xf0 0x20 \bYWV422 14551>>101 beshort&0xf0 0x30 \bYWV444 14552>>101 beshort&0xf0 0x40 \bCMYK 14553>>101 beshort&0xf0 0x50 \bCMYKDIRECT 14554>>101 beshort&0xf0 0x60 \bNCOMPONENT 14555>>101 beshort&0xf0 0x70 \bRGB 14556>>101 beshort&0xf0 0x80 \bRGBE 14557>>101 beshort&0xf0 >0x80 \b(reserved 0x%x) 14558 14559# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 14560# 14561# BPG (Better Portable Graphics) format 14562# http://bellard.org/bpg/ 14563# http://fileformats.archiveteam.org/wiki/BPG 14564# 145650 string \x42\x50\x47\xFB BPG (Better Portable Graphics) 14566!:mime image/bpg 14567 14568# From: Joerg Jenderek 14569# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format 145700 string icns Mac OS X icon 14571!:mime image/x-icns 14572!:apple ????icns 14573!:ext icns 14574>4 ubelong >0 14575# file size 14576>>4 ubelong x \b, %d bytes 14577# icon type 14578>>8 string x \b, "%4.4s" type 14579 14580# TIM images 145810 lelong 0x00000010 TIM image, 14582>4 lelong 0x8 4-Bit, 14583>4 lelong 0x9 8-Bit, 14584>4 lelong 0x2 15-Bit, 14585>4 lelong 0x3 24-Bit, 14586>4 lelong &8 14587>>(8.l+12) leshort x Pixel at (%d, 14588>>(8.l+14) leshort x \b%d) 14589>>(8.l+16) leshort x Size=%dx 14590>>(8.l+18) leshort x \b%d, 14591>>4 lelong 0x8 16 CLUT Entries at 14592>>4 lelong 0x9 256 CLUT Entries at 14593>>12 leshort x (%d, 14594>>14 leshort x \b%d) 14595>4 lelong ^8 14596>>12 leshort x Pixel at (%d, 14597>>14 leshort x \b%d) 14598>>16 leshort x Size=%dx 14599>>18 leshort x \b%d 14600 14601# MDEC streams 146020 lelong 0x80010160 MDEC video stream, 14603>16 leshort x %dx 14604>18 leshort x \b%d 14605#>8 lelong x %d frames 14606#>4 leshort x secCount=%d; 14607#>6 leshort x nSectors=%d; 14608#>12 lelong x frameSize=%d; 14609 14610# BS encoded bitstreams 146112 leshort 0x3800 BS image, 14612>6 leshort x Version %d, 14613>4 leshort x Quantization %d, 14614>0 leshort x (Decompresses to %d words) 14615 14616# Type: farbfeld image. 14617# Url: http://tools.suckless.org/farbfeld/ 14618# From: Ian D. Scott <ian@iandouglasscott.com> 14619# 146200 string farbfeld farbfeld image data, 14621>8 ubelong x %dx 14622>12 ubelong x \b%d 14623 14624# Type: Sega PVR image. 14625# From: David Korth <gerbilsoft@gerbilsoft.com> 14626# References: 14627# - http://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt 14628# - https://github.com/yazgoo/pvrx2png 14629# - https://github.com/nickworonekin/puyotools 14630 14631# Sega PVR header. 146320 name sega-pvr-image-header 14633>0x0C leshort x %d x 14634>0x0E leshort x %d 14635# Image format. 14636>0x08 byte 0 \b, ARGB1555 14637>0x08 byte 1 \b, RGB565 14638>0x08 byte 2 \b, ARGB4444 14639>0x08 byte 3 \b, YUV442 14640>0x08 byte 4 \b, Bump 14641>0x08 byte 5 \b, 4bpp 14642>0x08 byte 6 \b, 8bpp 14643# Image data type. 14644>0x09 byte 0x01 \b, square twiddled 14645>0x09 byte 0x02 \b, square twiddled & mipmap 14646>0x09 byte 0x03 \b, VQ 14647>0x09 byte 0x04 \b, VQ & mipmap 14648>0x09 byte 0x05 \b, 8-bit CLUT twiddled 14649>0x09 byte 0x06 \b, 4-bit CLUT twiddled 14650>0x09 byte 0x07 \b, 8-bit direct twiddled 14651>0x09 byte 0x08 \b, 4-bit direct twiddled 14652>0x09 byte 0x09 \b, rectangle 14653>0x09 byte 0x0B \b, rectangular stride 14654>0x09 byte 0x0D \b, rectangular twiddled 14655>0x09 byte 0x10 \b, small VQ 14656>0x09 byte 0x11 \b, small VQ & mipmap 14657>0x09 byte 0x12 \b, square twiddled & mipmap 14658 14659# Sega PVR (Xbox) image header. 14660# Contains an embedded DirectDraw surface instead of PVR data. 146610 name sega-pvr-xbox-dds-header 14662>16 lelong x %d x 14663>12 lelong x %d, 14664>84 string x %.4s 14665 14666# Sega PVR image. 146670 string PVRT 14668>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 14669>>0x20 use sega-pvr-xbox-dds-header 14670>0x10 belong !0x44445320 Sega PVR image: 14671>>0 use sega-pvr-image-header 14672 14673# Sega PVR image with GBIX. 146740 string GBIX 14675>0x10 string PVRT 14676>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 14677>>>0x20 use sega-pvr-xbox-dds-header 14678>>0x10 belong !0x44445320 Sega PVR image: 14679>>>0x10 use sega-pvr-image-header 14680>>0x08 lelong x \b, global index = %u 14681 14682# Sega GVR header. 146830 name sega-gvr-image-header 14684>0x0C beshort x %d x 14685>0x0E beshort x %d 14686# Image data format. 14687>0x0B byte 0 \b, I4 14688>0x0B byte 1 \b, I8 14689>0x0B byte 2 \b, IA4 14690>0x0B byte 3 \b, IA8 14691>0x0B byte 4 \b, RGB565 14692>0x0B byte 5 \b, RGB5A3 14693>0x0B byte 6 \b, ARGB8888 14694>0x0B byte 8 \b, CI4 14695>0x0B byte 9 \b, CI8 14696>0x0B byte 14 \b, DXT1 14697 14698# Sega GVR image. 146990 string GVRT Sega GVR image: 14700>0x10 use sega-gvr-image-header 14701 14702# Sega GVR image with GBIX. 147030 string GBIX 14704>0x10 string GVRT Sega GVR image: 14705>>0x10 use sega-gvr-image-header 14706>>0x08 belong x \b, global index = %u 14707 14708# Light Field Picture 14709# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx 14710# Typical file extensions: .lfp .lfr .lfx 14711 147120 belong 0x894C4650 14713>4 belong 0x0D0A1A0A 14714>12 belong 0x00000000 Lytro Light Field Picture 14715>8 belong x \b, version %d 14716 14717#------------------------------------------------------------------------------ 14718# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 14719# inform: file(1) magic for Inform interactive fiction language 14720 14721# URL: http://www.inform-fiction.org/ 14722# From: Reuben Thomas <rrt@sc3d.org> 14723 147240 search/100/cW constant\ story Inform source text 14725 14726#------------------------------------------------------------------------------ 14727# $File: intel,v 1.15 2017/03/17 21:35:28 christos Exp $ 14728# intel: file(1) magic for x86 Unix 14729# 14730# Various flavors of x86 UNIX executable/object (other than Xenix, which 14731# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 14732# Windows as well. 14733# 14734# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 14735# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 14736# as well, if, as, and when IBM makes it portable. 14737# 14738# The `versions' should be un-commented if they work for you. 14739# (Was the problem just one of endianness?) 14740# 147410 leshort 0502 basic-16 executable 14742>12 lelong >0 not stripped 14743#>22 leshort >0 - version %d 147440 leshort 0503 basic-16 executable (TV) 14745>12 lelong >0 not stripped 14746#>22 leshort >0 - version %d 147470 leshort 0510 x86 executable 14748>12 lelong >0 not stripped 147490 leshort 0511 x86 executable (TV) 14750>12 lelong >0 not stripped 147510 leshort =0512 iAPX 286 executable small model (COFF) 14752>12 lelong >0 not stripped 14753#>22 leshort >0 - version %d 147540 leshort =0522 iAPX 286 executable large model (COFF) 14755>12 lelong >0 not stripped 14756#>22 leshort >0 - version %d 14757# updated by Joerg Jenderek at Oct 2015 14758# https://de.wikipedia.org/wiki/Common_Object_File_Format 14759# http://www.delorie.com/djgpp/doc/coff/filhdr.html 14760# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file" 14761# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable" 14762# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 147630 leshort =0514 14764# use subroutine to display name+flags+variables for common object formated files 14765>0 use display-coff 14766#>12 lelong >0 not stripped 14767# no hint found, that at offset 22 is version 14768#>22 leshort >0 - version %d 14769 14770# rom: file(1) magic for BIOS ROM Extensions found in intel machines 14771# mapped into memory between 0xC0000 and 0xFFFFF 14772# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu 14773# updated by Joerg Jenderek 14774# https://en.wikipedia.org/wiki/Option_ROM 147750 beshort 0x55AA BIOS (ia32) ROM Ext. 14776!:mime application/octet-stream 14777!:ext rom/bin 14778>5 string USB USB 14779>7 string LDR UNDI image 14780>30 string IBM IBM comp. Video 14781>26 string Adaptec Adaptec 14782>28 string Adaptec Adaptec 14783>42 string PROMISE Promise 14784>2 byte x (%d*512) 14785 14786# Flash descriptors for Intel SPI flash roms. 14787# From Dr. Jesus <j@hug.gs> 147880 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1478916 lelong 0x0ff0a55a Intel serial flash for PCH ROM 14790 14791#------------------------------------------------------------------------------ 14792# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 14793# interleaf: file(1) magic for InterLeaf TPS: 14794# 147950 string =\210OPS Interleaf saved data 147960 string =<!OPS Interleaf document text 14797>5 string ,\ Version\ = \b, version 14798>>17 string >\0 %.3s 14799 14800#------------------------------------------------------------------------------ 14801# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 14802# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 14803# "/etc/magic": 14804# From: guy@netapp.com (Guy Harris) 14805# 148064 string pgscriptver IslandWrite document 1480713 string DrawFile IslandDraw document 14808 14809 14810#------------------------------------------------------------------------------ 14811# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 14812# ispell: file(1) magic for ispell 14813# 14814# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 14815# will match 0x9600 through 0x9603 in *both* little endian and big endian. 14816# (No other current magic entries collide.) 14817# 14818# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 14819# 148200 leshort&0xFFFC 0x9600 little endian ispell 14821>0 byte 0 hash file (?), 14822>0 byte 1 3.0 hash file, 14823>0 byte 2 3.1 hash file, 14824>0 byte 3 hash file (?), 14825>2 leshort 0x00 8-bit, no capitalization, 26 flags 14826>2 leshort 0x01 7-bit, no capitalization, 26 flags 14827>2 leshort 0x02 8-bit, capitalization, 26 flags 14828>2 leshort 0x03 7-bit, capitalization, 26 flags 14829>2 leshort 0x04 8-bit, no capitalization, 52 flags 14830>2 leshort 0x05 7-bit, no capitalization, 52 flags 14831>2 leshort 0x06 8-bit, capitalization, 52 flags 14832>2 leshort 0x07 7-bit, capitalization, 52 flags 14833>2 leshort 0x08 8-bit, no capitalization, 128 flags 14834>2 leshort 0x09 7-bit, no capitalization, 128 flags 14835>2 leshort 0x0A 8-bit, capitalization, 128 flags 14836>2 leshort 0x0B 7-bit, capitalization, 128 flags 14837>2 leshort 0x0C 8-bit, no capitalization, 256 flags 14838>2 leshort 0x0D 7-bit, no capitalization, 256 flags 14839>2 leshort 0x0E 8-bit, capitalization, 256 flags 14840>2 leshort 0x0F 7-bit, capitalization, 256 flags 14841>4 leshort >0 and %d string characters 148420 beshort&0xFFFC 0x9600 big endian ispell 14843>1 byte 0 hash file (?), 14844>1 byte 1 3.0 hash file, 14845>1 byte 2 3.1 hash file, 14846>1 byte 3 hash file (?), 14847>2 beshort 0x00 8-bit, no capitalization, 26 flags 14848>2 beshort 0x01 7-bit, no capitalization, 26 flags 14849>2 beshort 0x02 8-bit, capitalization, 26 flags 14850>2 beshort 0x03 7-bit, capitalization, 26 flags 14851>2 beshort 0x04 8-bit, no capitalization, 52 flags 14852>2 beshort 0x05 7-bit, no capitalization, 52 flags 14853>2 beshort 0x06 8-bit, capitalization, 52 flags 14854>2 beshort 0x07 7-bit, capitalization, 52 flags 14855>2 beshort 0x08 8-bit, no capitalization, 128 flags 14856>2 beshort 0x09 7-bit, no capitalization, 128 flags 14857>2 beshort 0x0A 8-bit, capitalization, 128 flags 14858>2 beshort 0x0B 7-bit, capitalization, 128 flags 14859>2 beshort 0x0C 8-bit, no capitalization, 256 flags 14860>2 beshort 0x0D 7-bit, no capitalization, 256 flags 14861>2 beshort 0x0E 8-bit, capitalization, 256 flags 14862>2 beshort 0x0F 7-bit, capitalization, 256 flags 14863>4 beshort >0 and %d string characters 14864# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 14865# Ispell 4.0 148660 string ISPL ispell 14867>4 long x hash file version %d, 14868>8 long x lexletters %d, 14869>12 long x lexsize %d, 14870>16 long x hashsize %d, 14871>20 long x stblsize %d 14872 14873#------------------------------------------------------------------------------ 14874# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $ 14875# ISO Zipped file format 14876# http://www.ezbsystems.com/isz/iszspec.txt 148770 string IsZ! ISO Zipped file 14878>4 byte x \b, header size %u 14879>5 byte x \b, version %u 14880>8 lelong x \b, serial %u 14881#12 leshort x \b, sector size %u 14882#>16 lelong x \b, total sectors %u 14883>17 byte >0 \b, password protected 14884#>24 lequad x \b, segment size %llu 14885#>32 lelong x \b, blocks %u 14886#>36 lelong x \b, block size %u 14887 14888#------------------------------------------------------------ 14889# $File: java,v 1.18 2015/11/29 22:08:14 christos Exp $ 14890# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 14891# same magic number, 0xcafebabe, so they are both handled 14892# in the entry called "cafebabe". 14893#------------------------------------------------------------ 14894# Java serialization 14895# From Martin Pool (m.pool@pharos.com.au) 148960 beshort 0xaced Java serialization data 14897>2 beshort >0x0004 \b, version %d 14898 148990 belong 0xfeedfeed Java KeyStore 14900!:mime application/x-java-keystore 149010 belong 0xcececece Java JCE KeyStore 14902!:mime application/x-java-jce-keystore 14903 14904# Java source 149050 regex \^import.*;$ Java source 14906!:mime text/x-java 14907 14908# Java HPROF dumps 14909# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 149100 string JAVA\x20PROFILE\x201.0. 14911>0x12 short 0 14912>>0x11 ushort-0x31 <2 Java HPROF dump, 14913>>0x17 beqdate/1000 x created %s 14914 14915#------------------------------------------------------------------------------ 14916# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $ 14917# javascript: magic for javascript and node.js scripts. 14918# 149190 search/1/w #!/bin/node Node.js script text executable 14920!:mime application/javascript 149210 search/1/w #!/usr/bin/node Node.js script text executable 14922!:mime application/javascript 149230 search/1/w #!/bin/nodejs Node.js script text executable 14924!:mime application/javascript 149250 search/1/w #!/usr/bin/nodejs Node.js script text executable 14926!:mime application/javascript 149270 search/1 #!/usr/bin/env\ node Node.js script text executable 14928!:mime application/javascript 149290 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 14930!:mime application/javascript 14931 14932#------------------------------------------------------------------------------ 14933# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $ 14934# JPEG images 14935# SunOS 5.5.1 had 14936# 14937# 0 string \377\330\377\340 JPEG file 14938# 0 string \377\330\377\356 JPG file 14939# 14940# both of which turn into "JPEG image data" here. 14941# 149420 beshort 0xffd8 JPEG image data 14943!:mime image/jpeg 14944!:apple 8BIMJPEG 14945!:strength *3 14946!:ext jpeg/jpg/jpe/jfif 14947>6 string JFIF \b, JFIF standard 14948# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 14949# in a vain attempt to add image size reporting for JFIF. Note that these 14950# tests are not fool-proof since some perfectly valid JPEGs are currently 14951# impossible to specify in magic(4) format. 14952# First, a little JFIF version info: 14953>>11 byte x \b %d. 14954>>12 byte x \b%02d 14955# Next, the resolution or aspect ratio of the image: 14956>>13 byte 0 \b, aspect ratio 14957>>13 byte 1 \b, resolution (DPI) 14958>>13 byte 2 \b, resolution (DPCM) 14959>>14 beshort x \b, density %dx 14960>>16 beshort x \b%d 14961>>4 beshort x \b, segment length %d 14962# Next, show thumbnail info, if it exists: 14963>>18 byte !0 \b, thumbnail %dx 14964>>>19 byte x \b%d 14965>6 string Exif \b, Exif standard: [ 14966>>12 indirect/r x 14967>>12 string x \b] 14968 14969# Jump to the first segment 14970>(4.S+4) use jpeg_segment 14971 14972# This uses recursion... 149730 name jpeg_segment 14974>0 beshort 0xFFFE 14975# Recursion handled by FFE0 14976#>>(2.S+2) use jpeg_segment 14977>>2 pstring/HJ x \b, comment: "%s" 14978 14979>0 beshort 0xFFC0 14980>>(2.S+2) use jpeg_segment 14981>>4 byte x \b, baseline, precision %d 14982>>7 beshort x \b, %dx 14983>>5 beshort x \b%d 14984>>9 byte x \b, frames %d 14985 14986>0 beshort 0xFFC1 14987>>(2.S+2) use jpeg_segment 14988>>4 byte x \b, extended sequential, precision %d 14989>>7 beshort x \b, %dx 14990>>5 beshort x \b%d 14991>>9 byte x \b, frames %d 14992 14993>0 beshort 0xFFC2 14994>>(2.S+2) use jpeg_segment 14995>>4 byte x \b, progressive, precision %d 14996>>7 beshort x \b, %dx 14997>>5 beshort x \b%d 14998>>9 byte x \b, frames %d 14999 15000# Define Huffman Tables 15001>0 beshort 0xFFC4 15002>>(2.S+2) use jpeg_segment 15003 15004>0 beshort 0xFFE1 15005# Recursion handled by FFE0 15006#>>(2.S+2) use jpeg_segment 15007>>4 string Exif \b, Exif Standard: [ 15008>>>10 indirect/r x 15009>>>10 string x \b] 15010 15011# Application specific markers 15012>0 beshort&0xFFE0 =0xFFE0 15013>>(2.S+2) use jpeg_segment 15014 15015# DB: Define Quantization tables 15016# DD: Define Restart interval [XXX: wrong here, it is 4 bytes] 15017# D8: Start of image 15018# D9: End of image 15019# Dn: Restart 15020>0 beshort&0xFFD0 =0xFFD0 15021>>0 beshort&0xFFE0 !0xFFE0 15022>>>(2.S+2) use jpeg_segment 15023 15024#>0 beshort x unknown 0x%x 15025#>>(2.S+2) use jpeg_segment 15026 15027# HSI is Handmade Software's proprietary JPEG encoding scheme 150280 string hsi1 JPEG image data, HSI proprietary 15029 15030# From: David Santinoli <david@santinoli.com> 150310 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 15032# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 15033# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 15034# https://github.com/bitsgalore/jp2kMagic 15035# 15036# Now read value of 'Brand' field, which yields a few possibilities: 15037>20 string \x6a\x70\x32\x20 Part 1 (JP2) 15038!:mime image/jp2 15039>20 string \x6a\x70\x78\x20 Part 2 (JPX) 15040!:mime image/jpx 15041>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 15042!:mime image/jpm 15043>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 15044!:mime video/mj2 15045 15046# Type: JPEG 2000 codesream 15047# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 150480 belong 0xff4fff51 JPEG 2000 codestream 1504945 beshort 0xff52 15050 15051# JPEG extended range 150520 string \x49\x49\xbc 15053>3 byte 1 15054>>4 lelong%2 0 JPEG-XR 15055!:mime image/jxr 15056!:ext jxr 15057 15058#------------------------------------------------------------------------------ 15059# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $ 15060# karma: file(1) magic for Karma data files 15061# 15062# From <rgooch@atnf.csiro.au> 15063 150640 string KarmaRHD\040Version Karma Data Structure Version 15065>16 belong x %u 15066 15067#------------------------------------------------------------------------------ 15068# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 15069# kde: file(1) magic for KDE 15070 150710 string/t [KDE\ Desktop\ Entry] KDE desktop entry 15072!:mime application/x-kdelnk 150730 string/t #\ KDE\ Config\ File KDE config file 15074!:mime application/x-kdelnk 150750 string/t #\ xmcd xmcd database file for kscd 15076!:mime text/x-xmcd 15077 15078#------------------------------------------------------------------------------ 15079# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $ 15080# keepass: file(1) magic for KeePass file 15081# 15082# Keepass Password Safe: 15083# * original one: http://keepass.info/ 15084# * *nix port: http://www.keepassx.org/ 15085# * android port: http://code.google.com/p/keepassdroid/ 15086 150870 lelong 0x9AA2D903 Keepass password database 15088>4 lelong 0xB54BFB65 1.x KDB 15089>>48 lelong >0 \b, %d groups 15090>>52 lelong >0 \b, %d entries 15091>>8 lelong&0x0f 1 \b, SHA-256 15092>>8 lelong&0x0f 2 \b, AES 15093>>8 lelong&0x0f 4 \b, RC4 15094>>8 lelong&0x0f 8 \b, Twofish 15095>>120 lelong >0 \b, %d key transformation rounds 15096>4 lelong 0xB54BFB67 2.x KDBX 15097 15098#------------------------------------------------------------------------------ 15099# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $ 15100# kerberos: MIT kerberos file binary formats 15101# 15102 15103# This magic entry is for demonstration purposes and could be improved 15104# if the following features were implemented in file: 15105# 15106# Strings inside [[ .. ]] in the descriptions have special meanings and 15107# are not printed. 15108# 15109# - Provide some form of iteration in number of components 15110# [[${counter}=%d]] in the description 15111# then append 15112# [${counter}--] in the offset of the entries 15113# - Provide a way to round the next offset 15114# Add [R:4] after the offset? 15115# - Provide a way to have optional entries 15116# XXX: Syntax: 15117# - Provide a way to "save" entries to print them later. 15118# if the description is [[${name}=%s]], then nothing is 15119# printed and a subsequent entry in the same magic file 15120# can refer to ${name} 15121# - Provide a way to format strings as hex values 15122# 15123# http://www.gnu.org/software/shishi/manual/html_node/\ 15124# The-Keytab-Binary-File-Format.html 15125# 15126 151270 name keytab_entry 15128#>0 beshort x \b, size=%d 15129#>2 beshort x \b, components=%d 15130>4 pstring/H x \b, realm=%s 15131>>&0 pstring/H x \b, principal=%s/ 15132>>>&0 pstring/H x \b%s 15133>>>>&0 belong x \b, type=%d 15134>>>>>&0 bedate x \b, date=%s 15135>>>>>>&0 byte x \b, kvno=%u 15136#>>>>>>>&0 pstring/H x 15137#>>>>>>>>&0 belong x 15138#>>>>>>>>>>&0 use keytab_entry 15139 151400 belong 0x05020000 Kerberos Keytab file 15141>4 use keytab_entry 15142 15143#------------------------------------------------------------------------------ 15144# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $ 15145# Type: Google KML, formerly Keyhole Markup Language 15146# Future development of this format has been handed 15147# over to the Open Geospatial Consortium. 15148# http://www.opengeospatial.org/standards/kml/ 15149# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 151500 string/t \<?xml 15151>20 search/400 \ xmlns= 15152>>&0 regex ['"]http://earth.google.com/kml Google KML document 15153!:mime application/vnd.google-earth.kml+xml 15154>>>&1 string 2.0' \b, version 2.0 15155>>>&1 string 2.1' \b, version 2.1 15156>>>&1 string 2.2' \b, version 2.2 15157 15158#------------------------------------------------------------------------------ 15159# Type: OpenGIS KML, formerly Keyhole Markup Language 15160# This standard is maintained by the 15161# Open Geospatial Consortium. 15162# http://www.opengeospatial.org/standards/kml/ 15163# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 15164>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document 15165!:mime application/vnd.google-earth.kml+xml 15166>>>&1 string/t 2.2 \b, version 2.2 15167 15168#------------------------------------------------------------------------------ 15169# Type: Google KML Archive (ZIP based) 15170# http://code.google.com/apis/kml/documentation/kml_tut.html 15171# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 151720 string PK\003\004 15173>4 byte 0x14 15174>>30 string doc.kml Compressed Google KML Document, including resources. 15175!:mime application/vnd.google-earth.kmz 15176 15177#------------------------------------------------------------------------------ 15178# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 15179# DEC SRC Virtual Paper: Lectern files 15180# Karl M. Hegbloom <karlheg@inetarena.com> 151810 string lect DEC SRC Virtual Paper Lectern file 15182 15183#------------------------------------------------------------------------------ 15184# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 15185# lex: file(1) magic for lex 15186# 15187# derived empirically, your offsets may vary! 151880 search/100 yyprevious C program text (from lex) 15189>3 search/1 >\0 for %s 15190# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 151910 search/100 generated\ by\ flex C program text (from flex) 15192# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 151930 search/1 %{ lex description text 15194 15195#------------------------------------------------------------------------------ 15196# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ 15197# lif: file(1) magic for lif 15198# 15199# (Daniel Quinlan <quinlan@yggdrasil.com>) 15200# 152010 beshort 0x8000 lif file 15202 15203#------------------------------------------------------------------------------ 15204# $File: linux,v 1.64 2017/03/17 21:35:28 christos Exp $ 15205# linux: file(1) magic for Linux files 15206# 15207# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 15208# The following basic Linux magic is useful for reference, but using 15209# "long" magic is a better practice in order to avoid collisions. 15210# 15211# 2 leshort 100 Linux/i386 15212# >0 leshort 0407 impure executable (OMAGIC) 15213# >0 leshort 0410 pure executable (NMAGIC) 15214# >0 leshort 0413 demand-paged executable (ZMAGIC) 15215# >0 leshort 0314 demand-paged executable (QMAGIC) 15216# 152170 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 15218>16 lelong 0 \b, stripped 152190 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 15220>16 lelong 0 \b, stripped 152210 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 15222>16 lelong 0 \b, stripped 152230 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 15224>16 lelong 0 \b, stripped 15225# 152260 string \007\001\000 Linux/i386 object file 15227>20 lelong >0x1020 \b, DLL library 15228# Linux-8086 stuff: 152290 string \01\03\020\04 Linux-8086 impure executable 15230>28 long !0 not stripped 152310 string \01\03\040\04 Linux-8086 executable 15232>28 long !0 not stripped 15233# 152340 string \243\206\001\0 Linux-8086 object file 15235# 152360 string \01\03\020\20 Minix-386 impure executable 15237>28 long !0 not stripped 152380 string \01\03\040\20 Minix-386 executable 15239>28 long !0 not stripped 152400 string \01\03\04\20 Minix-386 NSYM/GNU executable 15241>28 long !0 not stripped 15242# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 15243216 lelong 0421 Linux/i386 core file 15244!:strength / 2 15245>220 string >\0 of '%s' 15246>200 lelong >0 (signal %d) 15247# 15248# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 15249# this can be overridden by the DOS executable (COM) entry 152502 string LILO Linux/i386 LILO boot/chain loader 15251# 15252# Linux make config build file, from Ole Aamot <oka@oka.no> 15253# Updated by Ken Sharp 1525428 string make\ config Linux make config build file (old) 1525549 search/70 Kernel\ Configuration Linux make config build file 15256 15257# 15258# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 15259# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 15260# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 152610 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 15262>2 byte&0x01 0 256 characters, 15263>2 byte&0x01 !0 512 characters, 15264>2 byte&0x02 0 no directory, 15265>2 byte&0x02 !0 Unicode directory, 15266>3 byte >0 8x%d 152670 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 15268>16 lelong x %d characters, 15269>12 lelong&0x01 0 no directory, 15270>12 lelong&0x01 !0 Unicode directory, 15271>24 lelong x %d 15272>28 lelong x \bx%d 15273 15274# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 152754086 string SWAP-SPACE Linux/i386 swap file 15276# From: Jeff Bailey <jbailey@ubuntu.com> 15277# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 152784076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 15279# From: James Hunt <james.hunt@ubuntu.com> 152804076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) 15281# according to man page of mkswap (8) March 1999 15282# volume label and UUID Russell Coker 15283# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 152844086 string SWAPSPACE2 Linux/i386 swap file (new style), 15285>0x400 long x version %d (4K pages), 15286>0x404 long x size %d pages, 15287>1052 string \0 no label, 15288>1052 string >\0 LABEL=%s, 15289>0x40c belong x UUID=%08x 15290>0x410 beshort x \b-%04x 15291>0x412 beshort x \b-%04x 15292>0x414 beshort x \b-%04x 15293>0x416 belong x \b-%08x 15294>0x41a beshort x \b%04x 15295# From Daniel Novotny <dnovotny@redhat.com> 15296# swap file for PowerPC 1529765526 string SWAPSPACE2 Linux/ppc swap file 1529816374 string SWAPSPACE2 Linux/ia64 swap file 15299# 15300# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 15301# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 15302# and Nicolas Lichtmaier <nick@debian.org> 15303# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 15304# Linux kernel boot images (i386 arch) (Wolfram Kleff) 15305514 string HdrS Linux kernel 15306!:strength + 55 15307>510 leshort 0xAA55 x86 boot executable 15308>>518 leshort >0x1ff 15309>>>529 byte 0 zImage, 15310>>>529 byte 1 bzImage, 15311>>>526 lelong >0 15312>>>>(526.s+0x200) string >\0 version %s, 15313>>498 leshort 1 RO-rootFS, 15314>>498 leshort 0 RW-rootFS, 15315>>508 leshort >0 root_dev 0x%X, 15316>>502 leshort >0 swap_dev 0x%X, 15317>>504 leshort >0 RAMdisksize %u KB, 15318>>506 leshort 0xFFFF Normal VGA 15319>>506 leshort 0xFFFE Extended VGA 15320>>506 leshort 0xFFFD Prompt for Videomode 15321>>506 leshort >0 Video mode %d 15322# This also matches new kernels, which were caught above by "HdrS". 153230 belong 0xb8c0078e Linux kernel 15324>0x1e3 string Loading version 1.3.79 or older 15325>0x1e9 string Loading from prehistoric times 15326 15327# System.map files - Nicolas Lichtmaier <nick@debian.org> 153288 search/1 \ A\ _text Linux kernel symbol map text 15329 15330# LSM entries - Nicolas Lichtmaier <nick@debian.org> 153310 search/1 Begin3 Linux Software Map entry text 153320 search/1 Begin4 Linux Software Map entry text (new format) 15333 15334# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 153350 belong 0x4f4f4f4d User-mode Linux COW file 15336>4 belong <3 \b, version %d 15337>>8 string >\0 \b, backing file %s 15338>4 belong >2 \b, version %d 15339>>32 string >\0 \b, backing file %s 15340 15341############################################################################ 15342# Linux kernel versions 15343 153440 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 15345>497 leshort 0 x86 boot sector 15346>>514 belong 0x8e of a kernel from the dawn of time! 15347>>514 belong 0x908ed8b4 version 0.99-1.1.42 15348>>514 belong 0x908ed8b8 for memtest86 15349 15350>497 leshort !0 x86 kernel 15351>>504 leshort >0 RAMdisksize=%u KB 15352>>502 leshort >0 swap=0x%X 15353>>508 leshort >0 root=0x%X 15354>>>498 leshort 1 \b-ro 15355>>>498 leshort 0 \b-rw 15356>>506 leshort 0xFFFF vga=normal 15357>>506 leshort 0xFFFE vga=extended 15358>>506 leshort 0xFFFD vga=ask 15359>>506 leshort >0 vga=%d 15360>>514 belong 0x908ed881 version 1.1.43-1.1.45 15361>>514 belong 0x15b281cd 15362>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 15363>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 15364>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 15365>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 15366>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 15367>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 15368>>514 string HdrS 15369>>>518 leshort >0x1FF 15370>>>>529 byte 0 \b, zImage 15371>>>>529 byte 1 \b, bzImage 15372>>>>(526.s+0x200) string >\0 \b, version %s 15373 15374# Linux boot sector thefts. 153750 belong 0xb8c0078e Linux 15376>0x1e6 belong 0x454c4b53 ELKS Kernel 15377>0x1e6 belong !0x454c4b53 style boot sector 15378 15379############################################################################ 15380# Linux S390 kernel image 15381# Created by: Jan Kaluza <jkaluza@redhat.com> 153828 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 15383>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 15384# 64bit 15385>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 15386>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 15387>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 15388>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 15389# 32bit 15390>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 15391>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 15392>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 15393>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 15394 15395# Linux ARM compressed kernel image 15396# From: Kevin Cernekee <cernekee@gmail.com> 1539736 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian) 1539836 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 15399 15400############################################################################ 15401# Linux 8086 executable 154020 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 15403>5 string . 15404>>4 string >\0 \b, libc version %s 15405 154060 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 15407>2 byte&0x01 !0 \b, unmapped zero page 15408>2 byte&0x20 0 \b, impure 15409>2 byte&0x20 !0 15410>>2 byte&0x10 !0 \b, A_EXEC 15411>2 byte&0x02 !0 \b, A_PAL 15412>2 byte&0x04 !0 \b, A_NSYM 15413>2 byte&0x08 !0 \b, A_STAND 15414>2 byte&0x40 !0 \b, A_PURE 15415>2 byte&0x80 !0 \b, A_TOVLY 15416>28 long !0 \b, not stripped 15417>37 string . 15418>>36 string >\0 \b, libc version %s 15419 15420# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 15421# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 15422# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 15423# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 15424 15425# SYSLINUX boot logo files (from 'ppmtolss16' sources) 15426# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 15427# file extension .lss .16 154280 lelong =0x1413f33d SYSLINUX' LSS16 image data 15429# syslinux-4.05/mime/image/x-lss16.xml 15430!:mime image/x-lss16 15431>4 leshort x \b, width %d 15432>6 leshort x \b, height %d 15433 154340 string OOOM User-Mode-Linux's Copy-On-Write disk image 15435>4 belong x version %d 15436 15437# SE Linux policy database 15438# From: Mike Frysinger <vapier@gentoo.org> 154390 lelong 0xf97cff8c SE Linux policy 15440>16 lelong x v%d 15441>20 lelong 1 MLS 15442>24 lelong x %d symbols 15443>28 lelong x %d ocons 15444 15445# Linux Logical Volume Manager (LVM) 15446# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 15447# 15448# System ID, UUID and volume group name are 128 bytes long 15449# but they should never be full and initialized with zeros... 15450# 15451# LVM1 15452# 154530x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 15454>0x12c string >\0 , System ID: %s 15455 154560x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 15457>0x12c string >\0 , System ID: %s 15458 15459# LVM2 15460# 15461# It seems that the label header can be in one the four first sector 15462# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 15463# 15464# 0x200 seems to be the common case 15465 154660x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 15467# read the offset to add to the start of the header, and the header 15468# start in 0x200 15469>&(&-12.l-0x21) byte x 15470# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 15471>>&0x0 string >\x2f \b, UUID: %.6s 15472>>&0x6 string >\x2f \b-%.4s 15473>>&0xa string >\x2f \b-%.4s 15474>>&0xe string >\x2f \b-%.4s 15475>>&0x12 string >\x2f \b-%.4s 15476>>&0x16 string >\x2f \b-%.4s 15477>>&0x1a string >\x2f \b-%.6s 15478>>&0x20 lequad x \b, size: %lld 15479 154800x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 15481>&(&-12.l-0x21) byte x 15482# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 15483>>&0x0 string >\x2f \b, UUID: %.6s 15484>>&0x6 string >\x2f \b-%.4s 15485>>&0xa string >\x2f \b-%.4s 15486>>&0xe string >\x2f \b-%.4s 15487>>&0x12 string >\x2f \b-%.4s 15488>>&0x16 string >\x2f \b-%.4s 15489>>&0x1a string >\x2f \b-%.6s 15490>>&0x20 lequad x \b, size: %lld 15491 154920x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 15493>&(&-12.l-0x21) byte x 15494# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 15495>>&0x0 string >\x2f \b, UUID: %.6s 15496>>&0x6 string >\x2f \b-%.4s 15497>>&0xa string >\x2f \b-%.4s 15498>>&0xe string >\x2f \b-%.4s 15499>>&0x12 string >\x2f \b-%.4s 15500>>&0x16 string >\x2f \b-%.4s 15501>>&0x1a string >\x2f \b-%.6s 15502>>&0x20 lequad x \b, size: %lld 15503 155040x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 15505>&(&-12.l-0x21) byte x 15506# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 15507>>&0x0 string >\x2f \b, UUID: %.6s 15508>>&0x6 string >\x2f \b-%.4s 15509>>&0xa string >\x2f \b-%.4s 15510>>&0xe string >\x2f \b-%.4s 15511>>&0x12 string >\x2f \b-%.4s 15512>>&0x16 string >\x2f \b-%.4s 15513>>&0x1a string >\x2f \b-%.6s 15514>>&0x20 lequad x \b, size: %lld 15515 15516# LVM snapshot 15517# from Jason Farrel 155180 string SnAp LVM Snapshot (CopyOnWrite store) 15519>4 lelong !0 - valid, 15520>4 lelong 0 - invalid, 15521>8 lelong x version %d, 15522>12 lelong x chunk_size %d 15523 15524# SE Linux policy database 155250 lelong 0xf97cff8c SE Linux policy 15526>16 lelong x v%d 15527>20 lelong 1 MLS 15528>24 lelong x %d symbols 15529>28 lelong x %d ocons 15530 15531# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 15532# Anthon van der Neut (anthon@mnt.org) 155330 string LUKS\xba\xbe LUKS encrypted file, 15534>6 beshort x ver %d 15535>8 string x [%s, 15536>40 string x %s, 15537>72 string x %s] 15538>168 string x UUID: %s 15539 15540 15541# Summary: Xen saved domain file 15542# Created by: Radek Vokal <rvokal@redhat.com> 155430 string LinuxGuestRecord Xen saved domain 15544>20 search/256 (name 15545>>&1 string x (name %s) 15546 15547# Type: Xen, the virtual machine monitor 15548# From: Radek Vokal <rvokal@redhat.com> 155490 string LinuxGuestRecord Xen saved domain 15550#>2 regex \(name\ [^)]*\) %s 15551>20 search/256 (name (name 15552>>&1 string x %s...) 15553 15554# Systemd journald files 15555# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/. 15556# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 15557 15558# check magic 155590 string LPKSHHRH 15560# check that state is one of known values 15561>16 ubyte&252 0 15562# check that each half of three unique id128s is non-zero 15563>>24 ubequad >0 15564>>>32 ubequad >0 15565>>>>40 ubequad >0 15566>>>>>48 ubequad >0 15567>>>>>>56 ubequad >0 15568>>>>>>>64 ubequad >0 Journal file 15569!:mime application/octet-stream 15570# provide more info 15571>>>>>>>>184 leqdate 0 empty 15572>>>>>>>>16 ubyte 0 \b, offline 15573>>>>>>>>16 ubyte 1 \b, online 15574>>>>>>>>16 ubyte 2 \b, archived 15575>>>>>>>>8 ulelong&1 1 \b, sealed 15576>>>>>>>>12 ulelong&1 1 \b, compressed 15577 15578# BCache backing and cache devices 15579# From: Gabriel de Perthuis <g2p.code@gmail.com> 155800x1008 lequad 8 15581>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 15582>>0x1010 ulequad 0 cache device 15583>>0x1010 ulequad 1 backing device 15584>>0x1010 ulequad 3 cache device 15585>>0x1010 ulequad 4 backing device 15586>>0x1048 string >0 \b, label "%.32s" 15587>>0x1028 ubelong x \b, uuid %08x 15588>>0x102c ubeshort x \b-%04x 15589>>0x102e ubeshort x \b-%04x 15590>>0x1030 ubeshort x \b-%04x 15591>>0x1032 ubelong x \b-%08x 15592>>0x1036 ubeshort x \b%04x 15593>>0x1038 ubelong x \b, set uuid %08x 15594>>0x103c ubeshort x \b-%04x 15595>>0x103e ubeshort x \b-%04x 15596>>0x1040 ubeshort x \b-%04x 15597>>0x1042 ubelong x \b-%08x 15598>>0x1046 ubeshort x \b%04x 15599 15600# Linux device tree: 15601# File format description can be found in the Linux kernel sources at 15602# Documentation/devicetree/booting-without-of.txt 15603# From Christoph Biedl 156040 belong 0xd00dfeed 15605# structure and strings must be within blob 15606>&(8.L) byte x 15607>>&(12.L) byte x 15608>>>20 belong >1 Device Tree Blob version %d 15609>>>>4 belong x \b, size=%d 15610>>>>20 belong >1 15611>>>>>28 belong x \b, boot CPU=%d 15612>>>>20 belong >2 15613>>>>>32 belong x \b, string block size=%d 15614>>>>20 belong >16 15615>>>>>36 belong x \b, DT structure block size=%d 15616 15617# glibc locale archive as defined in glibc locale/locarchive.h 156180 lelong 0xde020109 locale archive 15619>24 lelong x %d strings 15620 15621# Linux Software RAID (mdadm) 15622# Russell Coker <russell@coker.com.au> 156230 name linuxraid 15624>16 belong x UUID=%8x: 15625>20 belong x \b%8x: 15626>24 belong x \b%8x: 15627>28 belong x \b%8x 15628>32 string x name=%s 15629>72 lelong x level=%d 15630>92 lelong x disks=%d 15631 156324096 lelong 0xa92b4efc Linux Software RAID 15633>4100 lelong x version 1.2 (%d) 15634>4096 use linuxraid 15635 156360 lelong 0xa92b4efc Linux Software RAID 15637>4 lelong x version 1.1 (%d) 15638>0 use linuxraid 15639 15640# Summary: Database file for mlocate 15641# Description: A database file as used by mlocate, a fast implementation 15642# of locate/updatedb. It uses merging to reuse the existing 15643# database and avoid rereading most of the filesystem. It's 15644# the default version of locate on Arch Linux (and others). 15645# File path: /var/lib/mlocate/mlocate.db by default (but configurable) 15646# Site: https://fedorahosted.org/mlocate/ 15647# Format docs: http://linux.die.net/man/5/mlocate.db 15648# Type: mlocate database file 15649# URL: https://fedorahosted.org/mlocate/ 15650# From: Wander Nauta <info@wandernauta.nl> 156510 string \0mlocate mlocate database 15652>12 byte x \b, version %d 15653>13 byte 1 \b, require visibility 15654>16 string x \b, root %s 15655 15656# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL: 15657# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2 15658# From: Pavel Emelyanov <xemul@parallels.com> 156590 lelong 0x45311224 iproute2 routes dump 156600 lelong 0x47361222 iproute2 addresses dump 15661 15662# Image and service files for CRIU tool. 15663# URL: http://criu.org 15664# From: Pavel Emelyanov <xemul@parallels.com> 156650 lelong 0x54564319 CRIU image file v1.1 156660 lelong 0x55105940 CRIU service file 156670 lelong 0x58313116 CRIU inventory 15668 15669# Kdump compressed dump files 15670# http://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION 15671 156720 string KDUMP Kdump compressed dump 15673>8 long x v%d 15674>12 string >\0 \b, system %s 15675>77 string >\0 \b, node %s 15676>142 string >\0 \b, release %s 15677>207 string >\0 \b, version %s 15678>272 string >\0 \b, machine %s 15679>337 string >\0 \b, domain %s 15680 15681#------------------------------------------------------------------------------ 15682# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $ 15683# lisp: file(1) magic for lisp programs 15684# 15685# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 15686 15687# updated by Joerg Jenderek 15688# GRR: This lot is too weak 15689#0 string ;; 15690# windows INF files often begin with semicolon and use CRLF as line end 15691# lisp files are mainly created on unix system with LF as line end 15692#>2 search/4096 !\r Lisp/Scheme program text 15693#>2 search/4096 \r Windows INF file 15694 156950 search/4096 (setq\ Lisp/Scheme program text 15696!:mime text/x-lisp 156970 search/4096 (defvar\ Lisp/Scheme program text 15698!:mime text/x-lisp 156990 search/4096 (defparam\ Lisp/Scheme program text 15700!:mime text/x-lisp 157010 search/4096 (defun\ Lisp/Scheme program text 15702!:mime text/x-lisp 157030 search/4096 (autoload\ Lisp/Scheme program text 15704!:mime text/x-lisp 157050 search/4096 (custom-set-variables\ Lisp/Scheme program text 15706!:mime text/x-lisp 15707 15708# URL: https://en.wikipedia.org/wiki/Emacs_Lisp 15709# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz 15710# Update: Joerg Jenderek 15711# Emacs 18 - this is always correct, but not very magical. 157120 string \012( 15713# look for emacs lisp keywords 15714# GRR: split regex because it is too long or get error like 15715# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|' 15716>&0 regex \^(defun|defvar|defconst|defmacro|setq|fset) Emacs v18 byte-compiled Lisp data 15717!:mime application/x-elc 15718# https://searchcode.com/codesearch/view/2173420/ 15719# not really pure text 15720!:apple EMAxTEXT 15721!:ext elc 15722# remaining regex 15723>&0 regex \^(put|provide|require|random) Emacs v18 byte-compiled Lisp data 15724!:mime application/x-elc 15725!:apple EMAxTEXT 15726!:ext elc 15727# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;; 15728 15729# Emacs 19+ - ver. recognition added by Ian Springer 15730# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 15731# - Chris Chittleborough <cchittleborough@yahoo.com.au> 15732# Update: Joerg Jenderek 157330 string ;ELC 15734# version\0\0\0 15735>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data 15736# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015 15737#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 15738!:mime application/x-elc 15739!:apple EMAxTEXT 15740!:ext elc 15741 15742# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 157430 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 157440 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 15745 157460 long 0x70768BD2 CLISP memory image data 157470 long 0xD28B7670 CLISP memory image data, other endian 15748 15749#.com and .bin for MIT scheme 157500 string \372\372\372\372 MIT scheme (library?) 15751 15752# From: David Allouche <david@allouche.net> 157530 search/1 \<TeXmacs| TeXmacs document text 15754!:mime text/texmacs 15755 15756#------------------------------------------------------------------------------ 15757# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $ 15758# llvm: file(1) magic for LLVM byte-codes 15759# URL: http://llvm.org/docs/BitCodeFormat.html 15760# From: Al Stone <ahs3@fc.hp.com> 15761 157620 string llvm LLVM byte-codes, uncompressed 157630 string llvc0 LLVM byte-codes, null compression 157640 string llvc1 LLVM byte-codes, gzip compression 157650 string llvc2 LLVM byte-codes, bzip2 compression 15766 157670 lelong 0x0b17c0de LLVM bitcode, wrapper 15768# Are these Mach-O ABI values? They appear to be. 15769>16 lelong 0x01000007 x86_64 15770>16 lelong 0x00000007 i386 15771>16 lelong 0x00000012 ppc 15772>16 lelong 0x01000012 ppc64 15773>16 lelong 0x0000000c arm 15774 157750 string BC\xc0\xde LLVM IR bitcode 15776 15777#------------------------------------------------------------------------------ 15778# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $ 15779# lua: file(1) magic for Lua scripting language 15780# URL: http://www.lua.org/ 15781# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 15782 15783# Lua scripts 157840 search/1/w #!\ /usr/bin/lua Lua script text executable 15785!:mime text/x-lua 157860 search/1/w #!\ /usr/local/bin/lua Lua script text executable 15787!:mime text/x-lua 157880 search/1 #!/usr/bin/env\ lua Lua script text executable 15789!:mime text/x-lua 157900 search/1 #!\ /usr/bin/env\ lua Lua script text executable 15791!:mime text/x-lua 15792 15793# Lua bytecode 157940 string \033Lua Lua bytecode, 15795>4 byte 0x50 version 5.0 15796>4 byte 0x51 version 5.1 15797>4 byte 0x52 version 5.2 15798 15799#------------------------------------------------------------------------------ 15800# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 15801# luks: file(1) magic for Linux Unified Key Setup 15802# URL: http://luks.endorphin.org/spec 15803# From: Anthon van der Neut <anthon@mnt.org> 15804 158050 string LUKS\xba\xbe LUKS encrypted file, 15806>6 beshort x ver %d 15807>8 string x [%s, 15808>40 string x %s, 15809>72 string x %s] 15810>168 string x UUID: %s 15811#------------------------------------------------------------------------------ 15812# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $ 15813# make: file(1) magic for M4 scripts 15814# 158150 regex \^dnl\ M4 macro processor script text 15816!:mime text/x-m4 15817 15818#------------------------------------------------------------ 15819# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $ 15820# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 15821# Unfortunately the first, cafebabe, is shared with 15822# Java ByteCode, so they are both handled in the file "cafebabe". 15823# The "feedface" ones are handled herein. 15824#------------------------------------------------------------ 15825# if set, it's for the 64-bit version of the architecture 15826# yes, this is separate from the low-order magic number bit 15827# it's also separate from the "64-bit libraries" bit in the 15828# upper 8 bits of the CPU subtype 15829 158300 name mach-o-cpu 15831>0 belong&0x01000000 0 15832# 15833# 32-bit ABIs. 15834# 15835# 1 vax 15836>>0 belong&0x00ffffff 1 15837>>>4 belong&0x00ffffff 0 vax 15838>>>4 belong&0x00ffffff 1 vax11/780 15839>>>4 belong&0x00ffffff 2 vax11/785 15840>>>4 belong&0x00ffffff 3 vax11/750 15841>>>4 belong&0x00ffffff 4 vax11/730 15842>>>4 belong&0x00ffffff 5 uvaxI 15843>>>4 belong&0x00ffffff 6 uvaxII 15844>>>4 belong&0x00ffffff 7 vax8200 15845>>>4 belong&0x00ffffff 8 vax8500 15846>>>4 belong&0x00ffffff 9 vax8600 15847>>>4 belong&0x00ffffff 10 vax8650 15848>>>4 belong&0x00ffffff 11 vax8800 15849>>>4 belong&0x00ffffff 12 uvaxIII 15850>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 15851>>0 belong&0x00ffffff 2 romp 15852>>0 belong&0x00ffffff 3 architecture=3 15853>>0 belong&0x00ffffff 4 ns32032 15854>>0 belong&0x00ffffff 5 ns32332 15855>>0 belong&0x00ffffff 6 m68k 15856# 7 x86 15857>>0 belong&0x00ffffff 7 15858>>>4 belong&0x0000000f 3 i386 15859>>>4 belong&0x0000000f 4 i486 15860>>>>4 belong&0x00fffff0 0 15861>>>>4 belong&0x00fffff0 0x80 \bsx 15862>>>4 belong&0x0000000f 5 i586 15863>>>4 belong&0x0000000f 6 15864>>>>4 belong&0x00fffff0 0 p6 15865>>>>4 belong&0x00fffff0 0x10 pentium_pro 15866>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 15867>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 15868>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 15869>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 15870>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x 15871>>>4 belong&0x0000000f 7 celeron 15872>>>>4 belong&0x00fffff0 0x00 \b_m0x%x 15873>>>>4 belong&0x00fffff0 0x10 \b_m0x%x 15874>>>>4 belong&0x00fffff0 0x20 \b_m0x%x 15875>>>>4 belong&0x00fffff0 0x30 \b_m0x%x 15876>>>>4 belong&0x00fffff0 0x40 \b_m0x%x 15877>>>>4 belong&0x00fffff0 0x50 \b_m0x%x 15878>>>>4 belong&0x00fffff0 0x60 15879>>>>4 belong&0x00fffff0 0x70 \b_mobile 15880>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x 15881>>>4 belong&0x0000000f 8 pentium_3 15882>>>>4 belong&0x00fffff0 0x00 15883>>>>4 belong&0x00fffff0 0x10 \b_m 15884>>>>4 belong&0x00fffff0 0x20 \b_xeon 15885>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x 15886>>>4 belong&0x0000000f 9 pentiumM 15887>>>>4 belong&0x00fffff0 0x00 15888>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x 15889>>>4 belong&0x0000000f 10 pentium_4 15890>>>>4 belong&0x00fffff0 0x00 15891>>>>4 belong&0x00fffff0 0x10 \b_m 15892>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 15893>>>4 belong&0x0000000f 11 itanium 15894>>>>4 belong&0x00fffff0 0x00 15895>>>>4 belong&0x00fffff0 0x10 \b_2 15896>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 15897>>>4 belong&0x0000000f 12 xeon 15898>>>>4 belong&0x00fffff0 0x00 15899>>>>4 belong&0x00fffff0 0x10 \b_mp 15900>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 15901>>>4 belong&0x0000000f >12 ia32 family=%d 15902>>>>4 belong&0x00fffff0 0x00 15903>>>>4 belong&0x00fffff0 >0x00 model=%x 15904>>0 belong&0x00ffffff 8 mips 15905>>>4 belong&0x00ffffff 1 R2300 15906>>>4 belong&0x00ffffff 2 R2600 15907>>>4 belong&0x00ffffff 3 R2800 15908>>>4 belong&0x00ffffff 4 R2000a 15909>>>4 belong&0x00ffffff 5 R2000 15910>>>4 belong&0x00ffffff 6 R3000a 15911>>>4 belong&0x00ffffff 7 R3000 15912>>>4 belong&0x00ffffff >7 subarchitecture=%d 15913>>0 belong&0x00ffffff 9 ns32532 15914>>0 belong&0x00ffffff 10 mc98000 15915>>0 belong&0x00ffffff 11 hppa 15916>>>4 belong&0x00ffffff 0 7100 15917>>>4 belong&0x00ffffff 1 7100LC 15918>>>4 belong&0x00ffffff >1 subarchitecture=%d 15919>>0 belong&0x00ffffff 12 arm 15920>>>4 belong&0x00ffffff 0 15921>>>4 belong&0x00ffffff 1 subarchitecture=%d 15922>>>4 belong&0x00ffffff 2 subarchitecture=%d 15923>>>4 belong&0x00ffffff 3 subarchitecture=%d 15924>>>4 belong&0x00ffffff 4 subarchitecture=%d 15925>>>4 belong&0x00ffffff 5 \bv4t 15926>>>4 belong&0x00ffffff 6 \bv6 15927>>>4 belong&0x00ffffff 7 \bv5tej 15928>>>4 belong&0x00ffffff 8 \bxscale 15929>>>4 belong&0x00ffffff 9 \bv7 15930>>>4 belong&0x00ffffff 10 \bv7f 15931>>>4 belong&0x00ffffff 11 \bv7s 15932>>>4 belong&0x00ffffff 12 \bv7k 15933>>>4 belong&0x00ffffff 13 \bv8 15934>>>4 belong&0x00ffffff 14 \bv6m 15935>>>4 belong&0x00ffffff 15 \bv7m 15936>>>4 belong&0x00ffffff 16 \bv7em 15937>>>4 belong&0x00ffffff >16 subarchitecture=%d 15938# 13 m88k 15939>>0 belong&0x00ffffff 13 15940>>>4 belong&0x00ffffff 0 mc88000 15941>>>4 belong&0x00ffffff 1 mc88100 15942>>>4 belong&0x00ffffff 2 mc88110 15943>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 15944>>0 belong&0x00ffffff 14 SPARC 15945>>0 belong&0x00ffffff 15 i860g 15946>>0 belong&0x00ffffff 16 alpha 15947>>0 belong&0x00ffffff 17 rs6000 15948>>0 belong&0x00ffffff 18 ppc 15949>>>4 belong&0x00ffffff 0 15950>>>4 belong&0x00ffffff 1 \b_601 15951>>>4 belong&0x00ffffff 2 \b_602 15952>>>4 belong&0x00ffffff 3 \b_603 15953>>>4 belong&0x00ffffff 4 \b_603e 15954>>>4 belong&0x00ffffff 5 \b_603ev 15955>>>4 belong&0x00ffffff 6 \b_604 15956>>>4 belong&0x00ffffff 7 \b_604e 15957>>>4 belong&0x00ffffff 8 \b_620 15958>>>4 belong&0x00ffffff 9 \b_650 15959>>>4 belong&0x00ffffff 10 \b_7400 15960>>>4 belong&0x00ffffff 11 \b_7450 15961>>>4 belong&0x00ffffff 100 \b_970 15962>>>4 belong&0x00ffffff >100 subarchitecture=%d 15963>>0 belong&0x00ffffff >18 architecture=%d 15964>0 belong&0x01000000 0x01000000 15965# 15966# 64-bit ABIs. 15967# 15968>>0 belong&0x00ffffff 0 64-bit architecture=%d 15969>>0 belong&0x00ffffff 1 64-bit architecture=%d 15970>>0 belong&0x00ffffff 2 64-bit architecture=%d 15971>>0 belong&0x00ffffff 3 64-bit architecture=%d 15972>>0 belong&0x00ffffff 4 64-bit architecture=%d 15973>>0 belong&0x00ffffff 5 64-bit architecture=%d 15974>>0 belong&0x00ffffff 6 64-bit architecture=%d 15975>>0 belong&0x00ffffff 7 x86_64 15976>>>4 belong&0x00ffffff 0 subarchitecture=%d 15977>>>4 belong&0x00ffffff 1 subarchitecture=%d 15978>>>4 belong&0x00ffffff 2 subarchitecture=%d 15979>>>4 belong&0x00ffffff 3 15980>>>4 belong&0x00ffffff 4 \b_arch1 15981>>>4 belong&0x00ffffff 8 \b_haswell 15982>>>4 belong&0x00ffffff >4 subarchitecture=%d 15983>>0 belong&0x00ffffff 8 64-bit architecture=%d 15984>>0 belong&0x00ffffff 9 64-bit architecture=%d 15985>>0 belong&0x00ffffff 10 64-bit architecture=%d 15986>>0 belong&0x00ffffff 11 64-bit architecture=%d 15987>>0 belong&0x00ffffff 12 arm64 15988>>>4 belong&0x00ffffff 0 15989>>>4 belong&0x00ffffff 1 \bv8 15990>>0 belong&0x00ffffff 13 64-bit architecture=%d 15991>>0 belong&0x00ffffff 14 64-bit architecture=%d 15992>>0 belong&0x00ffffff 15 64-bit architecture=%d 15993>>0 belong&0x00ffffff 16 64-bit architecture=%d 15994>>0 belong&0x00ffffff 17 64-bit architecture=%d 15995>>0 belong&0x00ffffff 18 ppc64 15996>>>4 belong&0x00ffffff 0 15997>>>4 belong&0x00ffffff 1 \b_601 15998>>>4 belong&0x00ffffff 2 \b_602 15999>>>4 belong&0x00ffffff 3 \b_603 16000>>>4 belong&0x00ffffff 4 \b_603e 16001>>>4 belong&0x00ffffff 5 \b_603ev 16002>>>4 belong&0x00ffffff 6 \b_604 16003>>>4 belong&0x00ffffff 7 \b_604e 16004>>>4 belong&0x00ffffff 8 \b_620 16005>>>4 belong&0x00ffffff 9 \b_650 16006>>>4 belong&0x00ffffff 10 \b_7400 16007>>>4 belong&0x00ffffff 11 \b_7450 16008>>>4 belong&0x00ffffff 100 \b_970 16009>>>4 belong&0x00ffffff >100 subarchitecture=%d 16010>>0 belong&0x00ffffff >18 64-bit architecture=%d 16011 16012 160130 name mach-o-be 16014>0 byte 0xcf 64-bit 16015>4 use mach-o-cpu 16016>12 belong 1 object 16017>12 belong 2 executable 16018>12 belong 3 fixed virtual memory shared library 16019>12 belong 4 core 16020>12 belong 5 preload executable 16021>12 belong 6 dynamically linked shared library 16022>12 belong 7 dynamic linker 16023>12 belong 8 bundle 16024>12 belong 9 dynamically linked shared library stub 16025>12 belong 10 dSYM companion file 16026>12 belong 11 kext bundle 16027>12 belong >11 16028>>12 belong x filetype=%d 16029>24 belong >0 \b, flags:< 16030>>24 belong &0x0000001 \bNOUNDEFS 16031>>24 belong &0x0000002 \b|INCRLINK 16032>>24 belong &0x0000004 \b|DYLDLINK 16033>>24 belong &0x0000008 \b|BINDATLOAD 16034>>24 belong &0x0000010 \b|PREBOUND 16035>>24 belong &0x0000020 \b|SPLIT_SEGS 16036>>24 belong &0x0000040 \b|LAZY_INIT 16037>>24 belong &0x0000080 \b|TWOLEVEL 16038>>24 belong &0x0000100 \b|FORCE_FLAT 16039>>24 belong &0x0000200 \b|NOMULTIDEFS 16040>>24 belong &0x0000400 \b|NOFIXPREBINDING 16041>>24 belong &0x0000800 \b|PREBINDABLE 16042>>24 belong &0x0001000 \b|ALLMODSBOUND 16043>>24 belong &0x0002000 \b|SUBSECTIONS_VIA_SYMBOLS 16044>>24 belong &0x0004000 \b|CANONICAL 16045>>24 belong &0x0008000 \b|WEAK_DEFINES 16046>>24 belong &0x0010000 \b|BINDS_TO_WEAK 16047>>24 belong &0x0020000 \b|ALLOW_STACK_EXECUTION 16048>>24 belong &0x0040000 \b|ROOT_SAFE 16049>>24 belong &0x0080000 \b|SETUID_SAFE 16050>>24 belong &0x0100000 \b|NO_REEXPORTED_DYLIBS 16051>>24 belong &0x0200000 \b|PIE 16052>>24 belong &0x0400000 \b|DEAD_STRIPPABLE_DYLIB 16053>>24 belong &0x0800000 \b|HAS_TLV_DESCRIPTORS 16054>>24 belong &0x1000000 \b|NO_HEAP_EXECUTION 16055>>24 belong &0x2000000 \b|APP_EXTENSION_SAFE 16056>>24 belong x \b> 16057 16058# 160590 lelong&0xfffffffe 0xfeedface Mach-O 16060!:strength +1 16061!:mime application/x-mach-binary 16062>0 use \^mach-o-be 16063 160640 belong&0xfffffffe 0xfeedface Mach-O 16065!:strength +1 16066!:mime application/x-mach-binary 16067>0 use mach-o-be 16068 16069#------------------------------------------------------------------------------ 16070# $File: macintosh,v 1.27 2017/03/17 21:35:28 christos Exp $ 16071# macintosh description 16072# 16073# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 16074# Daniel Quinlan, quinlan@yggdrasil.com 1607511 string must\ be\ converted\ with\ BinHex BinHex binary text 16076!:mime application/mac-binhex40 16077>41 string x \b, version %.3s 16078 16079# Stuffit archives are the de facto standard of compression for Macintosh 16080# files obtained from most archives. (franklsm@tuns.ca) 160810 string SIT! StuffIt Archive (data) 16082!:mime application/x-stuffit 16083!:apple SIT!SIT! 16084>2 string x : %s 160850 string SITD StuffIt Deluxe (data) 16086>2 string x : %s 160870 string Seg StuffIt Deluxe Segment (data) 16088>2 string x : %s 16089 16090# Newer StuffIt archives (grant@netbsd.org) 160910 string StuffIt StuffIt Archive 16092!:mime application/x-stuffit 16093!:apple SIT!SIT! 16094#>162 string >0 : %s 16095 16096# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 16097# GRR: Too weak 16098#0 string APPL Macintosh Application (data) 16099#>2 string x \b: %s 16100 16101# Macintosh System files (franklsm@tuns.ca) 16102# GRR: Too weak 16103#0 string zsys Macintosh System File (data) 16104#0 string FNDR Macintosh Finder (data) 16105#0 string libr Macintosh Library (data) 16106#>2 string x : %s 16107#0 string shlb Macintosh Shared Library (data) 16108#>2 string x : %s 16109#0 string cdev Macintosh Control Panel (data) 16110#>2 string x : %s 16111#0 string INIT Macintosh Extension (data) 16112#>2 string x : %s 16113#0 string FFIL Macintosh Truetype Font (data) 16114#>2 string x : %s 16115#0 string LWFN Macintosh Postscript Font (data) 16116#>2 string x : %s 16117 16118# Additional Macintosh Files (franklsm@tuns.ca) 16119# GRR: Too weak 16120#0 string PACT Macintosh Compact Pro Archive (data) 16121#>2 string x : %s 16122#0 string ttro Macintosh TeachText File (data) 16123#>2 string x : %s 16124#0 string TEXT Macintosh TeachText File (data) 16125#>2 string x : %s 16126#0 string PDF Macintosh PDF File (data) 16127#>2 string x : %s 16128 16129# MacBinary format (Eric Fischer, enf@pobox.com) 16130# 16131# Unfortunately MacBinary doesn't really have a magic number prior 16132# to the MacBinary III format. The checksum is really the way to 16133# do it, but the magic file format isn't up to the challenge. 16134# 16135# 0 byte 0 16136# 1 byte # filename length 16137# 2 string # filename 16138# 65 string # file type 16139# 69 string # file creator 16140# 73 byte # Finder flags 16141# 74 byte 0 16142# 75 beshort # vertical posn in window 16143# 77 beshort # horiz posn in window 16144# 79 beshort # window or folder ID 16145# 81 byte # protected? 16146# 82 byte 0 16147# 83 belong # length of data segment 16148# 87 belong # length of resource segment 16149# 91 belong # file creation date 16150# 95 belong # file modification date 16151# 99 beshort # length of comment after resource 16152# 101 byte # new Finder flags 16153# 102 string mBIN # (only in MacBinary III) 16154# 106 byte # char. code of file name 16155# 107 byte # still more Finder flags 16156# 116 belong # total file length 16157# 120 beshort # length of add'l header 16158# 122 byte 129 # for MacBinary II 16159# 122 byte 130 # for MacBinary III 16160# 123 byte 129 # minimum version that can read fmt 16161# 124 beshort # checksum 16162# 16163# This attempts to use the version numbers as a magic number, requiring 16164# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second 16165# be 0x81. This works for the files I have, but maybe not for everyone's. 16166 16167# Unfortunately, this magic is quite weak - MPi 16168#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data 16169 16170# MacBinary I doesn't have the version number field at all, but MacBinary II 16171# has been in use since 1987 so I hope there aren't many really old files 16172# floating around that this will miss. The original spec calls for using 16173# the nulls in 0, 74, and 82 as the magic number. 16174# 16175# Another possibility, that would also work for MacBinary I, is to use 16176# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will 16177# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, 16178# and that 74 will be 0. So something like 16179# 16180# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data 16181# 16182# >73 byte&0x01 0x01 \b, inited 16183# >73 byte&0x02 0x02 \b, changed 16184# >73 byte&0x04 0x04 \b, busy 16185# >73 byte&0x08 0x08 \b, bozo 16186# >73 byte&0x10 0x10 \b, system 16187# >73 byte&0x10 0x20 \b, bundle 16188# >73 byte&0x10 0x40 \b, invisible 16189# >73 byte&0x10 0x80 \b, locked 16190 16191#>65 string x \b, type "%4.4s" 16192 16193#>65 string 8BIM (PhotoShop) 16194#>65 string ALB3 (PageMaker 3) 16195#>65 string ALB4 (PageMaker 4) 16196#>65 string ALT3 (PageMaker 3) 16197#>65 string APPL (application) 16198#>65 string AWWP (AppleWorks word processor) 16199#>65 string CIRC (simulated circuit) 16200#>65 string DRWG (MacDraw) 16201#>65 string EPSF (Encapsulated PostScript) 16202#>65 string FFIL (font suitcase) 16203#>65 string FKEY (function key) 16204#>65 string FNDR (Macintosh Finder) 16205#>65 string GIFf (GIF image) 16206#>65 string Gzip (GNU gzip) 16207#>65 string INIT (system extension) 16208#>65 string LIB\ (library) 16209#>65 string LWFN (PostScript font) 16210#>65 string MSBC (Microsoft BASIC) 16211#>65 string PACT (Compact Pro archive) 16212#>65 string PDF\ (Portable Document Format) 16213#>65 string PICT (picture) 16214#>65 string PNTG (MacPaint picture) 16215#>65 string PREF (preferences) 16216#>65 string PROJ (Think C project) 16217#>65 string QPRJ (Think Pascal project) 16218#>65 string SCFL (Defender scores) 16219#>65 string SCRN (startup screen) 16220#>65 string SITD (StuffIt Deluxe) 16221#>65 string SPn3 (SuperPaint) 16222#>65 string STAK (HyperCard stack) 16223#>65 string Seg\ (StuffIt segment) 16224#>65 string TARF (Unix tar archive) 16225#>65 string TEXT (ASCII) 16226#>65 string TIFF (TIFF image) 16227#>65 string TOVF (Eudora table of contents) 16228#>65 string WDBN (Microsoft Word word processor) 16229#>65 string WORD (MacWrite word processor) 16230#>65 string XLS\ (Microsoft Excel) 16231#>65 string ZIVM (compress (.Z)) 16232#>65 string ZSYS (Pre-System 7 system file) 16233#>65 string acf3 (Aldus FreeHand) 16234#>65 string cdev (control panel) 16235#>65 string dfil (Desk Accessory suitcase) 16236#>65 string libr (library) 16237#>65 string nX^d (WriteNow word processor) 16238#>65 string nX^w (WriteNow dictionary) 16239#>65 string rsrc (resource) 16240#>65 string scbk (Scrapbook) 16241#>65 string shlb (shared library) 16242#>65 string ttro (SimpleText read-only) 16243#>65 string zsys (system file) 16244 16245#>69 string x \b, creator "%4.4s" 16246 16247# Somewhere, Apple has a repository of registered Creator IDs. These are 16248# just the ones that I happened to have files from and was able to identify. 16249 16250#>69 string 8BIM (Adobe Photoshop) 16251#>69 string ALD3 (PageMaker 3) 16252#>69 string ALD4 (PageMaker 4) 16253#>69 string ALFA (Alpha editor) 16254#>69 string APLS (Apple Scanner) 16255#>69 string APSC (Apple Scanner) 16256#>69 string BRKL (Brickles) 16257#>69 string BTFT (BitFont) 16258#>69 string CCL2 (Common Lisp 2) 16259#>69 string CCL\ (Common Lisp) 16260#>69 string CDmo (The Talking Moose) 16261#>69 string CPCT (Compact Pro) 16262#>69 string CSOm (Eudora) 16263#>69 string DMOV (Font/DA Mover) 16264#>69 string DSIM (DigSim) 16265#>69 string EDIT (Macintosh Edit) 16266#>69 string ERIK (Macintosh Finder) 16267#>69 string EXTR (self-extracting archive) 16268#>69 string Gzip (GNU gzip) 16269#>69 string KAHL (Think C) 16270#>69 string LWFU (LaserWriter Utility) 16271#>69 string LZIV (compress) 16272#>69 string MACA (MacWrite) 16273#>69 string MACS (Macintosh operating system) 16274#>69 string MAcK (MacKnowledge terminal emulator) 16275#>69 string MLND (Defender) 16276#>69 string MPNT (MacPaint) 16277#>69 string MSBB (Microsoft BASIC (binary)) 16278#>69 string MSWD (Microsoft Word) 16279#>69 string NCSA (NCSA Telnet) 16280#>69 string PJMM (Think Pascal) 16281#>69 string PSAL (Hunt the Wumpus) 16282#>69 string PSI2 (Apple File Exchange) 16283#>69 string R*ch (BBEdit) 16284#>69 string RMKR (Resource Maker) 16285#>69 string RSED (Resource Editor) 16286#>69 string Rich (BBEdit) 16287#>69 string SIT! (StuffIt) 16288#>69 string SPNT (SuperPaint) 16289#>69 string Unix (NeXT Mac filesystem) 16290#>69 string VIM! (Vim editor) 16291#>69 string WILD (HyperCard) 16292#>69 string XCEL (Microsoft Excel) 16293#>69 string aCa2 (Fontographer) 16294#>69 string aca3 (Aldus FreeHand) 16295#>69 string dosa (Macintosh MS-DOS file system) 16296#>69 string movr (Font/DA Mover) 16297#>69 string nX^n (WriteNow) 16298#>69 string pdos (Apple ProDOS file system) 16299#>69 string scbk (Scrapbook) 16300#>69 string ttxt (SimpleText) 16301#>69 string ufox (Foreign File Access) 16302 16303# Just in case... 16304 16305102 string mBIN MacBinary III data with surprising version number 16306 16307# sas magic from Bruce Foster (bef@nwu.edu) 16308# 16309#0 string SAS SAS 16310#>8 string x %s 163110 string SAS SAS 16312>24 string DATA data file 16313>24 string CATALOG catalog 16314>24 string INDEX data file index 16315>24 string VIEW data view 16316# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 16317# 163180x54 string SAS SAS 7+ 16319>0x9C string DATA data file 16320>0x9C string CATALOG catalog 16321>0x9C string INDEX data file index 16322>0x9C string VIEW data view 16323 16324# spss magic for SPSS system and portable files, 16325# from Bruce Foster (bef@nwu.edu). 16326 163270 long 0xc1e2c3c9 SPSS Portable File 16328>40 string x %s 16329 163300 string $FL2 SPSS System File 16331>24 string x %s 16332 163330 string $FL3 SPSS System File 16334>24 string x %s 16335 16336# Macintosh filesystem data 16337# From "Tom N Harris" <telliamed@mac.com> 16338# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 16339# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 16340# entries depend on the data arithmetic added after v.35 16341# There's also some Pascal strings in here, ditto... 16342 16343# The boot block signature, according to IM:Files, is 16344# "for HFS volumes, this field always contains the value 0x4C4B." 16345# But if this is true for MFS or HFS+ volumes, I don't know. 16346# Alternatively, the boot block is supposed to be zeroed if it's 16347# unused, so a simply >0 should suffice. 16348 163490x400 beshort 0xD2D7 Macintosh MFS data 16350>0 beshort 0x4C4B (bootable) 16351>0x40a beshort &0x8000 (locked) 16352>0x402 beldate-0x7C25B080 x created: %s, 16353>0x406 beldate-0x7C25B080 >0 last backup: %s, 16354>0x414 belong x block size: %d, 16355>0x412 beshort x number of blocks: %d, 16356>0x424 pstring x volume name: %s 16357 16358# *.hfs updated by Joerg Jenderek 16359# http://en.wikipedia.org/wiki/Hierarchical_File_System 16360# "BD" gives many false positives 163610x400 beshort 0x4244 16362# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 16363# first block of volume bit map (always 3) 16364>0x40e ubeshort 0x0003 16365# maximal length of volume name is 27 16366>>0x424 ubyte <28 Macintosh HFS data 16367!:mime application/x-apple-diskimage 16368#!:apple hfsdINIT 16369#!:apple MACSdisk 16370# http://www.macdisk.com/macsigen.php 16371#!:apple ddskdevi 16372!:apple ????devi 16373# https://en.wikipedia.org/wiki/Apple_Disk_Image 16374!:ext hfs/dmg 16375>>>0 beshort 0x4C4B (bootable) 16376#>>>0 beshort 0x0000 (not bootable) 16377>>>0x40a beshort &0x8000 (locked) 16378>>>0x40a beshort ^0x0100 (mounted) 16379>>>0x40a beshort &0x0200 (spared blocks) 16380>>>0x40a beshort &0x0800 (unclean) 16381>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 16382# http://www.epochconverter.com/ 16383# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 16384# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 16385# construct not working 16386#>>>0x402 beldate-0x7C25B080 x created: %s, 16387#>>>0x406 beldate-0x7C25B080 x last modified: %s, 16388#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 16389# found block sizes 200h,1200h,2800h 16390>>>0x414 belong x block size: %d, 16391>>>0x412 beshort x number of blocks: %d, 16392>>>0x424 pstring x volume name: %s 16393 163940x400 beshort 0x482B Macintosh HFS Extended 16395>&0 beshort x version %d data 16396>0 beshort 0x4C4B (bootable) 16397>0x404 belong ^0x00000100 (mounted) 16398>&2 belong &0x00000200 (spared blocks) 16399>&2 belong &0x00000800 (unclean) 16400>&2 belong &0x00008000 (locked) 16401>&6 string x last mounted by: '%.4s', 16402# really, that should be treated as a belong and we print a string 16403# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 16404>&14 beldate-0x7C25B080 x created: %s, 16405# only the creation date is local time, all other timestamps in HFS+ are UTC. 16406>&18 bedate-0x7C25B080 x last modified: %s, 16407>&22 bedate-0x7C25B080 >0 last backup: %s, 16408>&26 bedate-0x7C25B080 >0 last checked: %s, 16409>&38 belong x block size: %d, 16410>&42 belong x number of blocks: %d, 16411>&46 belong x free blocks: %d 16412 16413## AFAIK, only the signature is different 16414# same as Apple Partition Map 16415# GRR: This magic is too weak, it is just "TS" 16416#0x200 beshort 0x5453 Apple Old Partition data 16417#>0x2 beshort x block size: %d, 16418#>0x230 string x first type: %s, 16419#>0x210 string x name: %s, 16420#>0x254 belong x number of blocks: %d, 16421#>0x400 beshort 0x504D 16422#>>0x430 string x second type: %s, 16423#>>0x410 string x name: %s, 16424#>>0x454 belong x number of blocks: %d, 16425#>>0x800 beshort 0x504D 16426#>>>0x830 string x third type: %s, 16427#>>>0x810 string x name: %s, 16428#>>>0x854 belong x number of blocks: %d, 16429#>>>0xa00 beshort 0x504D 16430#>>>>0xa30 string x fourth type: %s, 16431#>>>>0xa10 string x name: %s, 16432#>>>>0xa54 belong x number of blocks: %d 16433 16434# From: Remi Mommsen <mommsen@slac.stanford.edu> 164350 string BOMStore Mac OS X bill of materials (BOM) file 16436 16437# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16438# URL: http://en.wikipedia.org/wiki/Datafork_TrueType 16439# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 16440# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 16441# don't know what they mean. 164420 belong 0x100 16443>(0x4.L+24) beshort x 16444>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 16445>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 16446>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 16447>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 16448 16449#------------------------------------------------------------------------------ 16450# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 16451# MacOS files 16452# 16453 164540 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 16455 16456#------------------------------------------------------------------------------ 16457# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 16458# magic: file(1) magic for magic files 16459# 164600 string/t #\ Magic magic text file for file(1) cmd 164610 lelong 0xF11E041C magic binary file for file(1) cmd 16462>4 lelong x (version %d) (little endian) 164630 belong 0xF11E041C magic binary file for file(1) cmd 16464>4 belong x (version %d) (big endian) 16465#------------------------------------------------------------------------------ 16466# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $ 16467# mail.news: file(1) magic for mail and news 16468# 16469# Unfortunately, saved netnews also has From line added in some news software. 16470#0 string From mail text 164710 string/t Relay-Version: old news text 16472!:mime message/rfc822 164730 string/t #!\ rnews batched news text 16474!:mime message/rfc822 164750 string/t N#!\ rnews mailed, batched news text 16476!:mime message/rfc822 164770 string/t Forward\ to mail forwarding text 16478!:mime message/rfc822 164790 string/t Pipe\ to mail piping text 16480!:mime message/rfc822 164810 string/tc delivered-to: SMTP mail text 16482!:mime message/rfc822 164830 string/tc return-path: SMTP mail text 16484!:mime message/rfc822 164850 string/t Path: news text 16486!:mime message/news 164870 string/t Xref: news text 16488!:mime message/news 164890 string/t From: news or mail text 16490!:mime message/rfc822 164910 string/t Article saved news text 16492!:mime message/news 164930 string/t BABYL Emacs RMAIL text 164940 string/t Received: RFC 822 mail text 16495!:mime message/rfc822 164960 string/t MIME-Version: MIME entity text 16497#0 string/t Content- MIME entity text 16498 16499# TNEF files... 165000 lelong 0x223E9F78 Transport Neutral Encapsulation Format 16501!:mime application/vnd.ms-tnef 16502 16503# From: Kevin Sullivan <ksulliva@psc.edu> 165040 string *mbx* MBX mail folder 16505 16506# From: Simon Matter <simon.matter@invoca.ch> 165070 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 165080 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB 16509 16510# JAM(mbp) Fidonet message area databases 16511# JHR file 165120 string JAM\0 JAM message area header file 16513>12 leshort >0 (%d messages) 16514 16515# Squish Fidonet message area databases 16516# SQD file (requires at least one message in the area) 16517# XXX: Weak magic 16518#256 leshort 0xAFAE4453 Squish message area data file 16519#>4 leshort >0 (%d messages) 16520 16521#0 string \<!--\ MHonArc text/html; x-type=mhonarc 16522 16523# Cyrus: file(1) magic for compiled Cyrus sieve scripts 16524# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 16525# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 16526# From: Philipp Hahn <hahn@univention.de> 16527 16528# Compiled Cyrus sieve script 165290 string CyrSBytecode Cyrus sieve bytecode data, 16530>12 belong =1 version 1, big-endian 16531>12 lelong =1 version 1, little-endian 16532>12 belong x version %d, network-endian 16533#------------------------------------------------------------------------------ 16534# $File: make,v 1.3 2016/12/10 14:21:29 christos Exp $ 16535# make: file(1) magic for makefiles 16536# 16537# URL: https://en.wikipedia.org/wiki/Make_(software) 165380 regex/100l \^CFLAGS makefile script text 16539!:mime text/x-makefile 165400 regex/100l \^VPATH makefile script text 16541!:mime text/x-makefile 165420 regex/100l \^LDFLAGS makefile script text 16543!:mime text/x-makefile 165440 regex/100l \^all: makefile script text 16545!:mime text/x-makefile 165460 regex/100l \^\\.PRECIOUS makefile script text 16547!:mime text/x-makefile 16548# Update: Joerg Jenderek 16549# Reference: https://www.freebsd.org/cgi/man.cgi?make(1) 16550# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST" 16551# by additional escaping point character 165520 regex/100l \^\\.BEGIN BSD makefile script text with "%s" 16553!:mime text/x-makefile 16554!:ext /mk 16555# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT" 16556# and NSIS script with "!include" by additional escaping point character 165570 regex/100l \^\\.include BSD makefile script text with "%s" 16558!:mime text/x-makefile 16559!:ext /mk 165600 regex/100l \^SUBDIRS automake makefile script text 16561!:mime text/x-makefile 16562 16563 16564#------------------------------------------------------------------------------ 16565# $File: map,v 1.4 2015/08/10 05:18:27 christos Exp $ 16566# map: file(1) magic for Map data 16567# 16568 16569# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 165708 string .FIT FIT Map data 16571>15 byte 0 16572>>35 belong x \b, unit id %d 16573>>39 lelong x \b, serial %u 16574# http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 16575# 20 years after unix epoch 16576# TZ=GMT date -d '1989-12-31 0:00' +%s 16577>>43 leldate+631065600 x \b, %s 16578 16579>>47 leshort x \b, manufacturer %d 16580>>47 leshort 1 \b (garmin) 16581>>49 leshort x \b, product %d 16582>>53 byte x \b, type %d 16583>>53 byte 1 \b (Device) 16584>>53 byte 2 \b (Settings) 16585>>53 byte 3 \b (Sports/Cycling) 16586>>53 byte 4 \b (Activity) 16587>>53 byte 8 \b (Elevations) 16588>>53 byte 10 \b (Totals) 16589 16590# TOM TOM GPS watches ttbin files: 16591# http://github.com/ryanbinns/ttwatch/tree/master/ttbin 16592# From: Daniel Lenski 165930 byte 0x20 16594>1 leshort 0x0007 16595>>0x76 byte 0x20 16596>>>0x77 leshort 0x0075 TomTom activity file, v7 16597>>>>8 leldate x (%s, 16598>>>>3 byte x device firmware %d. 16599>>>>4 byte x \b%d. 16600>>>>5 byte x \b%d, 16601>>>>6 leshort x product ID %04d) 16602 16603 16604#------------------------------------------------------------------------------ 16605# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $ 16606# maple: file(1) magic for maple files 16607# "H. Nanosecond" <aldomel@ix.netcom.com> 16608# Maple V release 4, a multi-purpose math program 16609# 16610 16611# maple library .lib 166120 string \000MVR4\nI MapleVr4 library 16613 16614# .ind 16615# no magic for these :-( 16616# they are compiled indexes for maple files 16617 16618# .hdb 166190 string \000\004\000\000 Maple help database 16620 16621# .mhp 16622# this has the form <PACKAGE=name> 166230 string \<PACKAGE= Maple help file 166240 string \<HELP\ NAME= Maple help file 166250 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 16626#0 string #\ Newton Maple help file, old style 166270 string #\ daub Maple help file, old style 16628#0 string #=========== Maple help file, old style 16629 16630# .mws 166310 string \000\000\001\044\000\221 Maple worksheet 16632#this is anomalous 166330 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 16634# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 16635# that is {VERSION major_version miunor_version computer_type version_string} 166360 string {VERSION\ Maple worksheet 16637>9 string >\0 version %.1s. 16638>>11 string >\0 %.1s 16639 16640# .mps 166410 string \0\0\001$ Maple something 16642# from byte 4 it is either 'nul E' or 'soh R' 16643# I think 'nul E' means a file that was saved as a different name 16644# a sort of revision marking 16645# 'soh R' means new 16646>4 string \000\105 An old revision 16647>4 string \001\122 The latest save 16648 16649# .mpl 16650# some of these are the same as .mps above 16651#0000000 000 000 001 044 000 105 same as .mps 16652#0000000 000 000 001 044 001 122 same as .mps 16653 166540 string #\n##\ <SHAREFILE= Maple something 166550 string \n#\n##\ <SHAREFILE= Maple something 166560 string ##\ <SHAREFILE= Maple something 166570 string #\r##\ <SHAREFILE= Maple something 166580 string \r#\r##\ <SHAREFILE= Maple something 166590 string #\ \r##\ <DESCRIBE> Maple something anomalous. 16660#-------------------------------------------- 16661# marc21: file(1) magic for MARC 21 Format 16662# 16663# Kevin Ford (kefo@loc.gov) 16664# 16665# MARC21 formats are for the representation and communication 16666# of bibliographic and related information in machine-readable 16667# form. For more info, see http://www.loc.gov/marc/ 16668 16669 16670# leader position 20-21 must be 45 16671# and 22-23 also 00 so far, but we check that later. 1667220 string 45 16673>0 search/2048 \x1e 16674 16675# leader starts with 5 digits, followed by codes specific to MARC format 16676>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 16677!:mime application/marc 16678>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority 16679!:mime application/marc 16680>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 16681!:mime application/marc 16682>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification 16683!:mime application/marc 16684>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community 16685!:mime application/marc 16686 16687# leader position 22-23, should be "00" but is it? 16688>>0 regex/1l (^.{21})([^0]{2}) (non-conforming) 16689!:mime application/marc 16690 16691#------------------------------------------------------------------------------ 16692# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 16693# mathcad: file(1) magic for Mathcad documents 16694# URL: http://www.mathsoft.com/ 16695# From: Josh Triplett <josh@freedesktop.org> 16696 166970 string .MCAD\t Mathcad document 16698 16699#------------------------------------------------------------------------------ 16700# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $ 16701# mathematica: file(1) magic for mathematica files 16702# "H. Nanosecond" <aldomel@ix.netcom.com> 16703# Mathematica a multi-purpose math program 16704# versions 2.2 and 3.0 16705 16706#mathematica .mb 167070 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 16708!:ext mb 167090 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 16710!:ext mb 16711 16712# .ma 16713# multiple possibilites: 16714 167150 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 16716#>41 string >\0 %s 16717!:ext mb 16718 16719#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 16720 16721#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 16722#>675 string >\0 %s #doesn't work well 16723 16724# there may be 'cr' instread of 'nl' in some does this matter? 16725 16726# generic: 167270 string (*^\r\r::[\011 Mathematica notebook version 2.x 16728!:ext mb 167290 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 16730!:ext mb 167310 string (*^\015 Mathematica notebook version 2.x 16732!:ext mb 167330 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 16734!:ext mb 167350 string (*^\r::[\011 Mathematica notebook version 2.x 16736!:ext mb 167370 string (*^\r\n::[\011 Mathematica notebook version 2.x 16738!:ext mb 167390 string (*^\n\n::[\011 Mathematica notebook version 2.x 16740!:ext mb 167410 string (*^\n::[\011 Mathematica notebook version 2.x 16742!:ext mb 16743 16744 16745# Mathematica .mx files 16746 16747#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 167480 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 16749#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 16750# >71... is optional 16751>88 string >\0 from %s 16752 16753 16754# Mathematica files PBF: 16755# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 167560 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 16757 16758# .ml files These are menu resources I think 16759# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 16760# how to put that into a magic rule? 167614 string \ A~ MAthematica .ml file 16762 16763# .nb files 16764#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 167650 string (*********************** Mathematica 3.0 notebook 16766 16767# other (* matches it is a comment start in these langs 16768# GRR: Too weak; also matches other languages e.g. ML 16769#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 16770 16771######################### 16772# MatLab v5 167730 string MATLAB Matlab v5 mat-file 16774>126 short 0x494d (big endian) 16775>>124 beshort x version 0x%04x 16776>126 short 0x4d49 (little endian) 16777>>124 leshort x version 0x%04x 16778 16779 16780#------------------------------------------------------------------------------ 16781# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $ 16782# matroska: file(1) magic for Matroska files 16783# 16784# See http://www.matroska.org/ 16785# 16786 16787# EBML id: 167880 belong 0x1a45dfa3 16789# DocType id: 16790>4 search/4096 \x42\x82 16791# DocType contents: 16792>>&1 string webm WebM 16793!:mime video/webm 16794>>&1 string matroska Matroska data 16795!:mime video/x-matroska 16796 16797#------------------------------------------------------------------------------ 16798# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 16799# Mavroyanopoulos Nikos <nmav@hellug.gr> 16800# mcrypt: file(1) magic for mcrypt 2.2.x; 168010 string \0m\3 mcrypt 2.5 encrypted data, 16802>4 string >\0 algorithm: %s, 16803>>&1 leshort >0 keysize: %d bytes, 16804>>>&0 string >\0 mode: %s, 16805 168060 string \0m\2 mcrypt 2.2 encrypted data, 16807>3 byte 0 algorithm: blowfish-448, 16808>3 byte 1 algorithm: DES, 16809>3 byte 2 algorithm: 3DES, 16810>3 byte 3 algorithm: 3-WAY, 16811>3 byte 4 algorithm: GOST, 16812>3 byte 6 algorithm: SAFER-SK64, 16813>3 byte 7 algorithm: SAFER-SK128, 16814>3 byte 8 algorithm: CAST-128, 16815>3 byte 9 algorithm: xTEA, 16816>3 byte 10 algorithm: TWOFISH-128, 16817>3 byte 11 algorithm: RC2, 16818>3 byte 12 algorithm: TWOFISH-192, 16819>3 byte 13 algorithm: TWOFISH-256, 16820>3 byte 14 algorithm: blowfish-128, 16821>3 byte 15 algorithm: blowfish-192, 16822>3 byte 16 algorithm: blowfish-256, 16823>3 byte 100 algorithm: RC6, 16824>3 byte 101 algorithm: IDEA, 16825>4 byte 0 mode: CBC, 16826>4 byte 1 mode: ECB, 16827>4 byte 2 mode: CFB, 16828>4 byte 3 mode: OFB, 16829>4 byte 4 mode: nOFB, 16830>5 byte 0 keymode: 8bit 16831>5 byte 1 keymode: 4bit 16832>5 byte 2 keymode: SHA-1 hash 16833>5 byte 3 keymode: MD5 hash 16834 16835#------------------------------------------------------------------------------ 16836# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $ 16837# mercurial: file(1) magic for Mercurial changeset bundles 16838# http://www.selenic.com/mercurial/wiki/ 16839# 16840# Jesse Glick (jesse.glick@sun.com) 16841# 16842 168430 string HG10 Mercurial changeset bundle 16844>4 string UN (uncompressed) 16845>4 string GZ (gzip compressed) 16846>4 string BZ (bzip2 compressed) 16847 16848#------------------------------------------------------------------------------ 16849# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $ 16850# metastore: file(1) magic for metastore files 16851# From: Thomas Wissen 16852# see http://david.hardeman.nu/software.php#metastore 168530 string MeTaSt00r3 Metastore data file, 16854>10 bequad x version %0llx 16855 16856#------------------------------------------------------------------------------ 16857# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $ 16858# rinex: file(1) magic for RINEX files 16859# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 16860# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 16861# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 1686260 string RINEX 16863>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 16864>>&32 string x \b, date %15.15s 16865>>5 string x \b, version %6.6s 16866!:mime rinex/broadcast 16867>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 16868>>&32 string x \b, date %15.15s 16869>>5 string x \b, version %6.6s 16870!:mime rinex/observation 16871>80 search/256 XXRINEXC RINEX Data, Clock 16872>>&32 string x \b, date %15.15s 16873>>5 string x \b, version %6.6s 16874!:mime rinex/clock 16875>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 16876>>&32 string x \b, date %15.15s 16877>>5 string x \b, version %6.6s 16878!:mime rinex/navigation 16879>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 16880>>&32 string x \b, date %15.15s 16881>>5 string x \b, version %6.6s 16882!:mime rinex/navigation 16883>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 16884>>&32 string x \b, date %15.15s 16885>>5 string x \b, version %6.6s 16886!:mime rinex/navigation 16887>80 search/256 XXRINEXM RINEX Data, Meteorological 16888>>&32 string x \b, date %15.15s 16889>>5 string x \b, version %6.6s 16890!:mime rinex/meteorological 16891>80 search/256 XXRINEXN RINEX Data, Navigation 16892>>&32 string x \b, date %15.15s 16893>>5 string x \b, version %6.6s 16894!:mime rinex/navigation 16895>80 search/256 XXRINEXO RINEX Data, Observation 16896>>&32 string x \b, date %15.15s 16897>>5 string x \b, version %6.6s 16898!:mime rinex/observation 16899 16900# https://en.wikipedia.org/wiki/GRIB 169010 string GRIB 16902>7 byte =1 Gridded binary (GRIB) version 1 16903>7 byte =2 Gridded binary (GRIB) version 2 16904 16905#------------------------------------------------------------------------------ 16906# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $ 16907# Micro Focus COBOL data files. 16908 16909# http://documentation.microfocus.com/help/index.jsp?topic=\ 16910# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html 16911# http://www.cobolproducts.com/datafile/data-viewer.html 16912# https://github.com/miracle2k/mfcobol-export 16913 169140 string \x30\x00\x00\x7C 16915>36 string \x00\x3E Micro Focus File with Header (DAT) 16916!:mime application/octet-stream 16917 169180 string \x30\x7E\x00\x00 16919>36 string \x00\x3E Micro Focus File with Header (DAT) 16920!:mime application/octet-stream 16921 1692239 string \x02 16923>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX) 16924!:mime application/octet-stream 16925 16926#------------------------------------------------------------------------------ 16927# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $ 16928# mime: file(1) magic for MIME encoded files 16929# 169300 string/t Content-Type:\040 16931>14 string >\0 %s 169320 string/t Content-Type: 16933>13 string >\0 %s 16934 16935#------------------------------------------------------------------------------ 16936# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $ 16937# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 16938# and DEC Ultrix 16939# 169400 beshort 0x0160 MIPSEB ECOFF executable 16941>20 beshort 0407 (impure) 16942>20 beshort 0410 (swapped) 16943>20 beshort 0413 (paged) 16944>8 belong >0 not stripped 16945>8 belong 0 stripped 16946>22 byte x - version %d 16947>23 byte x \b.%d 16948# 169490 beshort 0x0162 MIPSEL-BE ECOFF executable 16950>20 beshort 0407 (impure) 16951>20 beshort 0410 (swapped) 16952>20 beshort 0413 (paged) 16953>8 belong >0 not stripped 16954>8 belong 0 stripped 16955>23 byte x - version %d 16956>22 byte x \b.%d 16957# 169580 beshort 0x6001 MIPSEB-LE ECOFF executable 16959>20 beshort 03401 (impure) 16960>20 beshort 04001 (swapped) 16961>20 beshort 05401 (paged) 16962>8 belong >0 not stripped 16963>8 belong 0 stripped 16964>23 byte x - version %d 16965>22 byte x \b.%d 16966# 169670 beshort 0x6201 MIPSEL ECOFF executable 16968>20 beshort 03401 (impure) 16969>20 beshort 04001 (swapped) 16970>20 beshort 05401 (paged) 16971>8 belong >0 not stripped 16972>8 belong 0 stripped 16973>23 byte x - version %d 16974>22 byte x \b.%d 16975# 16976# MIPS 2 additions 16977# 169780 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 16979>20 beshort 0407 (impure) 16980>20 beshort 0410 (swapped) 16981>20 beshort 0413 (paged) 16982>8 belong >0 not stripped 16983>8 belong 0 stripped 16984>22 byte x - version %d 16985>23 byte x \b.%d 16986# 169870 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 16988>20 beshort 0407 (impure) 16989>20 beshort 0410 (swapped) 16990>20 beshort 0413 (paged) 16991>8 belong >0 not stripped 16992>8 belong 0 stripped 16993>22 byte x - version %d 16994>23 byte x \b.%d 16995# 169960 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 16997>20 beshort 03401 (impure) 16998>20 beshort 04001 (swapped) 16999>20 beshort 05401 (paged) 17000>8 belong >0 not stripped 17001>8 belong 0 stripped 17002>23 byte x - version %d 17003>22 byte x \b.%d 17004# 170050 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 17006>20 beshort 03401 (impure) 17007>20 beshort 04001 (swapped) 17008>20 beshort 05401 (paged) 17009>8 belong >0 not stripped 17010>8 belong 0 stripped 17011>23 byte x - version %d 17012>22 byte x \b.%d 17013# 17014# MIPS 3 additions 17015# 170160 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 17017>20 beshort 0407 (impure) 17018>20 beshort 0410 (swapped) 17019>20 beshort 0413 (paged) 17020>8 belong >0 not stripped 17021>8 belong 0 stripped 17022>22 byte x - version %d 17023>23 byte x \b.%d 17024# 170250 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 17026>20 beshort 0407 (impure) 17027>20 beshort 0410 (swapped) 17028>20 beshort 0413 (paged) 17029>8 belong >0 not stripped 17030>8 belong 0 stripped 17031>22 byte x - version %d 17032>23 byte x \b.%d 17033# 170340 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 17035>20 beshort 03401 (impure) 17036>20 beshort 04001 (swapped) 17037>20 beshort 05401 (paged) 17038>8 belong >0 not stripped 17039>8 belong 0 stripped 17040>23 byte x - version %d 17041>22 byte x \b.%d 17042# 170430 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 17044>20 beshort 03401 (impure) 17045>20 beshort 04001 (swapped) 17046>20 beshort 05401 (paged) 17047>8 belong >0 not stripped 17048>8 belong 0 stripped 17049>23 byte x - version %d 17050>22 byte x \b.%d 17051# 170520 beshort 0x180 MIPSEB Ucode 170530 beshort 0x182 MIPSEL-BE Ucode 17054 17055#------------------------------------------------------------------------------ 17056# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 17057# mirage: file(1) magic for Mirage executables 17058# 17059# XXX - byte order? 17060# 170610 long 31415 Mirage Assembler m.out executable 17062 17063#----------------------------------------------------------------------------- 17064# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $ 17065# misctools: file(1) magic for miscellaneous UNIX tools. 17066# 170670 search/1 %%!! X-Post-It-Note text 170680 string/c BEGIN:VCALENDAR vCalendar calendar file 17069!:mime text/calendar 17070# updated by Joerg Jenderek at Apr 2015 17071# Extension: .vcf 17072# http://en.wikipedia.org/wiki/VCard 170730 string/c BEGIN:VCARD vCard visiting card 17074# deprecated 17075#!:mime text/x-vcard 17076!:mime text/vcard 17077# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere 17078>12 search/14000/c VERSION: 17079# VERSION 2.1 , 3.0 or 4.0 17080>>&0 string x \b, version %-.3s 17081 17082# Summary: Libtool library file 17083# Extension: .la 17084# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 170850 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 17086 17087# Summary: Libtool object file 17088# Extension: .lo 17089# Submitted by: Abel Cheung <abelcheung@gmail.com> 170900 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 17091 17092# From: Daniel Novotny <dnovotny@redhat.com> 17093# Update: Joerg Jenderek 17094# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps 17095# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx 17096# 17097# "Windows Minidump" by TrID 17098# ./misctools (version 5.25) labeled the entry as "MDMP crash report data" 170990 string MDMP Mini DuMP crash report 17100# http://filext.com/file-extension/DMP 17101!:mime application/x-dmp 17102!:ext dmp/mdmp 17103# The high-order word is an internal value that is implementation specific. 17104# The low-order word is MINIDUMP_VERSION 0xA793 17105>4 ulelong&0x0000FFFF !0xA793 \b, version 0x%4.4x 17106# NumberOfStreams 8,9,10,13 17107>8 ulelong x \b, %d streams 17108# StreamDirectoryRva 0x20 17109>12 ulelong !0x20 \b, 0x%8.8x RVA 17110# CheckSum 0 17111>16 ulelong !0 \b, CheckSum 0x%8.8x 17112# Reserved or TimeDateStamp 17113>20 ledate x \b, %s 17114# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx 17115# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800 17116>24 ulelong x \b, 0x%x type 17117# >24 ulelong >0 \b; include 17118# >>24 ulelong &0x00000001 \b data sections, 17119# >>24 ulelong &0x00000020 \b list of unloaded modules, 17120# >>24 ulelong &0x00000100 \b process and thread information, 17121# >>24 ulelong &0x00000800 \b memory information, 17122 17123# Summary: abook addressbook file 17124# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu> 171250 string #\x20abook\x20addressbook\x20file abook address book 17126!:mime application/x-abook-addressbook 17127 17128#------------------------------------------------------------------------------ 17129# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 17130# mkid: file(1) magic for mkid(1) databases 17131# 17132# ID is the binary tags database produced by mkid(1). 17133# 17134# XXX - byte order? 17135# 171360 string \311\304 ID tags data 17137>2 short >0 version %d 17138 17139#------------------------------------------------------------------------------ 17140# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 17141# mlssa: file(1) magic for MLSSA datafiles 17142# 171430 lelong 0xffffabcd MLSSA datafile, 17144>4 leshort x algorithm %d, 17145>10 lelong x %d samples 17146 17147#------------------------------------------------------------------------------ 17148# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 17149# mmdf: file(1) magic for MMDF mail files 17150# 171510 string \001\001\001\001 MMDF mailbox 17152 17153#------------------------------------------------------------------------------ 17154# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $ 17155# modem: file(1) magic for modem programs 17156# 17157# From: Florian La Roche <florian@knorke.saar.de> 171581 string PC\ Research,\ Inc Digifax-G3-File 17159>29 byte 1 \b, fine resolution 17160>29 byte 0 \b, normal resolution 17161 17162# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header). 17163# Modified by: Joerg Jenderek 17164# URL: https://de.wikipedia.org/wiki/Fax 17165# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm 17166# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others 171670 short 0x0100 17168# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER 17169>2 search/9 \0\0 17170# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 17171>2 default x 17172# skip IRCAM file (VAX big-endian) ./audio 17173>>0 belong !0x0001a364 17174# skip GEM Image data ./images 17175>>>2 beshort !0x0008 17176# look for first keyword of Panorama database *.pan 17177>>>>11 search/262 \x06DESIGN 17178# skip Panorama database 17179>>>>11 default x 17180# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files 17181>>>>>27118 search/1864 DreamWorld 17182>>>>>27118 default x 17183# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom 17184>>>>>>8 ubequad !0x2e01010454010203 17185# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom 17186>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded 17187# version 5.25 labeled the entry above "raw G3 data, byte-padded" 17188!:mime image/g3fax 17189#!:apple ????TIFF 17190!:ext g3 17191# unusual image starting with black pixel 17192#0 short 0x1300 raw G3 (Group 3) FAX 171930 short 0x1400 17194# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom 17195>2 search/9 \0\0 17196# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 17197>2 default x raw G3 (Group 3) FAX 17198# version 5.25 labeled the above entry as "raw G3 data" 17199!:mime image/g3fax 17200!:ext g3 17201# unusual image with black pixel near beginning 17202#0 short 0x1900 raw G3 (Group 3) FAX 17203 17204# 17205# Magic data for vgetty voice formats 17206# (Martin Seine & Marc Eberhard) 17207 17208# 17209# raw modem data version 1 17210# 172110 string RMD1 raw modem data 17212>4 string >\0 (%s / 17213>20 short >0 compression type 0x%04x) 17214 17215# 17216# portable voice format 1 17217# 172180 string PVF1\n portable voice format 17219>5 string >\0 (binary %s) 17220 17221# 17222# portable voice format 2 17223# 172240 string PVF2\n portable voice format 17225>5 string >\0 (ascii %s) 17226 17227# From: Bernd Nuernberger <bernd.nuernberger@web.de> 17228# Brooktrout G3 fax data incl. 128 byte header 17229# Common suffixes: 3??, BRK, BRT, BTR 172300 leshort 0x01bb 17231>2 leshort 0x0100 Brooktrout 301 fax image, 17232>>9 leshort x %d x 17233>>0x2d leshort x %d 17234>>6 leshort 200 \b, fine resolution 17235>>6 leshort 100 \b, normal resolution 17236>>11 byte 1 \b, G3 compression 17237>>11 byte 2 \b, G32D compression 17238 17239#------------------------------------------------------------------------------ 17240# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $ 17241# motorola: file(1) magic for Motorola 68K and 88K binaries 17242# 17243# 68K 17244# 172450 beshort 0520 mc68k COFF 17246>18 beshort ^00000020 object 17247>18 beshort &00000020 executable 17248>12 belong >0 not stripped 17249>168 string .lowmem Apple toolbox 17250>20 beshort 0407 (impure) 17251>20 beshort 0410 (pure) 17252>20 beshort 0413 (demand paged) 17253>20 beshort 0421 (standalone) 172540 beshort 0521 mc68k executable (shared) 17255>12 belong >0 not stripped 172560 beshort 0522 mc68k executable (shared demand paged) 17257>12 belong >0 not stripped 17258# 17259# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 17260# 172610 beshort 0554 68K BCS executable 17262# 17263# 88K 17264# 17265# Motorola/88Open BCS 17266# 172670 beshort 0555 88K BCS executable 17268# 17269# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 172700 string S0 Motorola S-Record; binary data in text format 17271 17272# ATARI ST relocatable PRG 17273# 17274# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 17275# (according to Roland Waldi, Oct 21, 1987) 17276# besides the magic 0x601a, the text segment size is checked to be 17277# not larger than 1 MB (which is a lot on ST). 17278# The additional 0x601b distinction I took from Doug Lee's magic. 172790 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 17280>2 belong x (txt=%d, 17281>6 belong x dat=%d, 17282>10 belong x bss=%d, 17283>14 belong x sym=%d) 172840 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 17285>2 belong x (txt=%d, 17286>6 belong x dat=%d, 17287>10 belong x bss=%d, 17288>14 belong x sym=%d) 17289 17290# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 172910 beshort 0x601A Atari 68xxx executable, 17292>2 belong x text len %u, 17293>6 belong x data len %u, 17294>10 belong x BSS len %u, 17295>14 belong x symboltab len %u, 17296>18 belong 0 17297>22 belong &0x01 fastload flag, 17298>22 belong &0x02 may be loaded to alternate RAM, 17299>22 belong &0x04 malloc may be from alternate RAM, 17300>22 belong x flags: 0x%X, 17301>26 beshort 0 no relocation tab 17302>26 beshort !0 + relocation tab 17303>30 string SFX [Self-Extracting LZH SFX archive] 17304>38 string SFX [Self-Extracting LZH SFX archive] 17305>44 string ZIP! [Self-Extracting ZIP SFX archive] 17306 173070 beshort 0x0064 Atari 68xxx CPX file 17308>8 beshort x (version %04x) 17309 17310#------------------------------------------------------------------------------ 17311# $File: mozilla,v 1.7 2017/03/17 21:35:28 christos Exp $ 17312# mozilla: file(1) magic for Mozilla XUL fastload files 17313# (XUL.mfasl and XPC.mfasl) 17314# URL: http://www.mozilla.org/ 17315# From: Josh Triplett <josh@freedesktop.org> 17316 173170 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 173180 string mozLz4a Mozilla lz4 compressed bookmark data 17319 17320#------------------------------------------------------------------------------ 17321# $File: msdos,v 1.118 2017/05/20 19:55:27 christos Exp $ 17322# msdos: file(1) magic for MS-DOS files 17323# 17324 17325# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 17326# updated by Joerg Jenderek at Oct 2008,Apr 2011 173270 string/t @ 17328>1 string/cW \ echo\ off DOS batch file text 17329!:mime text/x-msdos-batch 17330>1 string/cW echo\ off DOS batch file text 17331!:mime text/x-msdos-batch 17332>1 string/cW rem DOS batch file text 17333!:mime text/x-msdos-batch 17334>1 string/cW set\ DOS batch file text 17335!:mime text/x-msdos-batch 17336 17337 17338# OS/2 batch files are REXX. the second regex is a bit generic, oh well 17339# the matched commands seem to be common in REXX and uncommon elsewhere 17340100 search/0xffff rxfuncadd 17341>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 17342100 search/0xffff say 17343>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 17344 17345# updated by Joerg Jenderek at Oct 2015 17346# https://de.wikipedia.org/wiki/Common_Object_File_Format 17347# http://www.delorie.com/djgpp/doc/coff/filhdr.html 17348# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 17349#0 leshort 0x14c MS Windows COFF Intel 80386 object file 17350#>4 ledate x stamp %s 173510 leshort 0x166 MS Windows COFF MIPS R4000 object file 17352#>4 ledate x stamp %s 173530 leshort 0x184 MS Windows COFF Alpha object file 17354#>4 ledate x stamp %s 173550 leshort 0x268 MS Windows COFF Motorola 68000 object file 17356#>4 ledate x stamp %s 173570 leshort 0x1f0 MS Windows COFF PowerPC object file 17358#>4 ledate x stamp %s 173590 leshort 0x290 MS Windows COFF PA-RISC object file 17360#>4 ledate x stamp %s 17361 17362# Tests for various EXE types. 17363# 17364# Many of the compressed formats were extraced from IDARC 1.23 source code. 17365# 173660 string/b MZ 17367# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 17368>0x18 leshort <0x40 MS-DOS executable 17369!:mime application/x-dosexec 17370# These traditional tests usually work but not always. When test quality support is 17371# implemented these can be turned on. 17372#>>0x18 leshort 0x1c (Borland compiler) 17373#>>0x18 leshort 0x1e (MS compiler) 17374 17375# If the relocation table is 0x40 or more bytes into the file, it's definitely 17376# not a DOS EXE. 17377>0x18 leshort >0x3f 17378 17379# Maybe it's a PE? 17380>>(0x3c.l) string PE\0\0 PE 17381!:mime application/x-dosexec 17382>>>(0x3c.l+24) leshort 0x010b \b32 executable 17383>>>(0x3c.l+24) leshort 0x020b \b32+ executable 17384>>>(0x3c.l+24) leshort 0x0107 ROM image 17385>>>(0x3c.l+24) default x Unknown PE signature 17386>>>>&0 leshort x 0x%x 17387>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 17388>>>(0x3c.l+92) leshort 1 (native) 17389>>>(0x3c.l+92) leshort 2 (GUI) 17390>>>(0x3c.l+92) leshort 3 (console) 17391>>>(0x3c.l+92) leshort 7 (POSIX) 17392>>>(0x3c.l+92) leshort 9 (Windows CE) 17393>>>(0x3c.l+92) leshort 10 (EFI application) 17394>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 17395>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 17396>>>(0x3c.l+92) leshort 13 (EFI ROM) 17397>>>(0x3c.l+92) leshort 14 (XBOX) 17398>>>(0x3c.l+92) leshort 15 (Windows boot application) 17399>>>(0x3c.l+92) default x (Unknown subsystem 17400>>>>&0 leshort x 0x%x) 17401>>>(0x3c.l+4) leshort 0x14c Intel 80386 17402>>>(0x3c.l+4) leshort 0x166 MIPS R4000 17403>>>(0x3c.l+4) leshort 0x168 MIPS R10000 17404>>>(0x3c.l+4) leshort 0x184 Alpha 17405>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 17406>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 17407>>>(0x3c.l+4) leshort 0x1c0 ARM 17408>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 17409>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 17410>>>(0x3c.l+4) leshort 0x1f0 PowerPC 17411>>>(0x3c.l+4) leshort 0x200 Intel Itanium 17412>>>(0x3c.l+4) leshort 0x266 MIPS16 17413>>>(0x3c.l+4) leshort 0x268 Motorola 68000 17414>>>(0x3c.l+4) leshort 0x290 PA-RISC 17415>>>(0x3c.l+4) leshort 0x366 MIPSIV 17416>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 17417>>>(0x3c.l+4) leshort 0xebc EFI byte code 17418>>>(0x3c.l+4) leshort 0x8664 x86-64 17419>>>(0x3c.l+4) leshort 0xc0ee MSIL 17420>>>(0x3c.l+4) default x Unknown processor type 17421>>>>&0 leshort x 0x%x 17422>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 17423>>>(0x3c.l+22) leshort&0x1000 >0 system file 17424>>>(0x3c.l+24) leshort 0x010b 17425>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 17426>>>(0x3c.l+24) leshort 0x020b 17427>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 17428 17429# hooray, there's a DOS extender using the PE format, with a valid PE 17430# executable inside (which just prints a message and exits if run in win) 17431>>>(8.s*16) string 32STUB \b, 32rtm DOS extender 17432>>>(8.s*16) string !32STUB \b, for MS Windows 17433>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 17434>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 17435>>>(0x3c.l+0xf8) search/0x140 UPX2 17436>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 17437>>>(0x3c.l+0xf8) search/0x140 .idata 17438>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 17439>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 17440>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 17441>>>(0x3c.l+0xf8) search/0x140 .rsrc 17442>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 17443>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 17444>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 17445>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 17446>>>(0x3c.l+0xf8) search/0x140 .data 17447>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 17448>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 17449>>>>(0x3c.l+0xf7) byte x 17450>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 17451>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 17452>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 17453>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 17454>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 17455>>>0x30 string Inno \b, InnoSetup self-extracting archive 17456 17457# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 17458# must be one of the unusual subformats. 17459>>(0x3c.l) string !PE\0\0 MS-DOS executable 17460!:mime application/x-dosexec 17461 17462>>(0x3c.l) string NE \b, NE 17463!:mime application/x-dosexec 17464>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 17465>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 17466>>>(0x3c.l+0x36) byte 3 for MS-DOS 17467>>>(0x3c.l+0x36) byte 4 for Windows 386 17468>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 17469>>>(0x3c.l+0x36) default x 17470>>>>(0x3c.l+0x36) byte x (unknown OS %x) 17471>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 17472>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) 17473>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) 17474>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 17475>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 17476 17477>>(0x3c.l) string LX\0\0 \b, LX 17478!:mime application/x-dosexec 17479>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 17480>>>(0x3c.l+0x0a) leshort 1 for OS/2 17481>>>(0x3c.l+0x0a) leshort 2 for MS Windows 17482>>>(0x3c.l+0x0a) leshort 3 for DOS 17483>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 17484>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 17485>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 17486>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 17487>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 17488>>>(0x3c.l+0x08) leshort 1 i80286 17489>>>(0x3c.l+0x08) leshort 2 i80386 17490>>>(0x3c.l+0x08) leshort 3 i80486 17491>>>(8.s*16) string emx \b, emx 17492>>>>&1 string x %s 17493>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 17494 17495# MS Windows system file, supposedly a collection of LE executables 17496>>(0x3c.l) string W3 \b, W3 for MS Windows 17497!:mime application/x-dosexec 17498 17499>>(0x3c.l) string LE\0\0 \b, LE executable 17500!:mime application/x-dosexec 17501>>>(0x3c.l+0x0a) leshort 1 17502# some DOS extenders use LE files with OS/2 header 17503>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 17504>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 17505>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 17506>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 17507>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 17508>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 17509>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 17510# this is a wild guess; hopefully it is a specific signature 17511>>>>&0x24 lelong <0x50 17512>>>>>(&0x4c.l) string \xfc\xb8WATCOM 17513>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 17514# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 17515#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 17516# fails with DOS-Extenders. 17517>>>(0x3c.l+0x0a) leshort 2 for MS Windows 17518>>>(0x3c.l+0x0a) leshort 3 for DOS 17519>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 17520>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 17521>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 17522 17523# looks like ASCII, probably some embedded copyright message. 17524# and definitely not NE/LE/LX/PE 17525>>0x3c lelong >0x20000000 17526>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 17527!:mime application/x-dosexec 17528# header data too small for extended executable 17529>2 long !0 17530>>0x18 leshort <0x40 17531>>>(4.s*512) leshort !0x014c 17532 17533>>>>&(2.s-514) string !LE 17534>>>>>&-2 string !BW \b, MZ for MS-DOS 17535!:mime application/x-dosexec 17536>>>>&(2.s-514) string LE \b, LE 17537>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 17538# educated guess since indirection is still not capable enough for complex offset 17539# calculations (next embedded executable would be at &(&2*512+&0-2) 17540# I suspect there are only LE executables in these multi-exe files 17541>>>>&(2.s-514) string BW 17542>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 17543>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 17544 17545# This sequence skips to the first COFF segment, usually .text 17546>(4.s*512) leshort 0x014c \b, COFF 17547!:mime application/x-dosexec 17548>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 17549>>(8.s*16) string emx 17550>>>&1 string x for DOS, Win or OS/2, emx %s 17551>>&(&0x42.l-3) byte x 17552>>>&0x26 string UPX \b, UPX compressed 17553# and yet another guess: small .text, and after large .data is unusal, could be 32lite 17554>>&0x2c search/0xa0 .text 17555>>>&0x0b lelong <0x2000 17556>>>>&0 lelong >0x6000 \b, 32lite compressed 17557 17558>(8.s*16) string $WdX \b, WDos/X DOS extender 17559 17560# By now an executable type should have been printed out. The executable 17561# may be a self-uncompressing archive, so look for evidence of that and 17562# print it out. 17563# 17564# Some signatures below from Greg Roelofs, newt@uchicago.edu. 17565# 17566>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 17567>0xe7 string LH/2\ Self-Extract \b, %s 17568>0x1c string UC2X \b, UCEXE compressed 17569>0x1c string WWP\ \b, WWPACK compressed 17570>0x1c string RJSX \b, ARJ self-extracting archive 17571>0x1c string diet \b, diet compressed 17572>0x1c string LZ09 \b, LZEXE v0.90 compressed 17573>0x1c string LZ91 \b, LZEXE v0.91 compressed 17574>0x1c string tz \b, TinyProg compressed 17575>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 17576!:mime application/zip 17577# Yes, this really is "Copr", not "Corp." 17578>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 17579!:mime application/zip 17580# winarj stores a message in the stub instead of the sig in the MZ header 17581>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 17582>0x20 string AIN 17583>>0x23 string 2 \b, AIN 2.x compressed 17584>>0x23 string <2 \b, AIN 1.x compressed 17585>>0x23 string >2 \b, AIN 1.x compressed 17586>0x24 string LHa's\ SFX \b, LHa self-extracting archive 17587!:mime application/x-lha 17588>0x24 string LHA's\ SFX \b, LHa self-extracting archive 17589!:mime application/x-lha 17590>0x24 string \ $ARX \b, ARX self-extracting archive 17591>0x24 string \ $LHarc \b, LHarc self-extracting archive 17592>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 17593>0x40 string aPKG \b, aPackage self-extracting archive 17594>0x64 string W\ Collis\0\0 \b, Compack compressed 17595>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 17596>>&0xf4 search/0x140 \x0\x40\x1\x0 17597>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 17598>1638 string -lh5- \b, LHa self-extracting archive v2.13S 17599>0x17888 string Rar! \b, RAR self-extracting archive 17600 17601# Skip to the end of the EXE. This will usually work fine in the PE case 17602# because the MZ image is hardcoded into the toolchain and almost certainly 17603# won't match any of these signatures. 17604>(4.s*512) long x 17605>>&(2.s-517) byte x 17606>>>&0 string PK\3\4 \b, ZIP self-extracting archive 17607>>>&0 string Rar! \b, RAR self-extracting archive 17608>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 17609>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 17610>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 17611>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 17612>>>&7 search/400 **ACE** \b, ACE self-extracting archive 17613>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 17614 17615# a few unknown ZIP sfxes, no idea if they are needed or if they are 17616# already captured by the generic patterns above 17617>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 17618# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 17619# 17620 17621# TELVOX Teleinformatica CODEC self-extractor for OS/2: 17622>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 17623>>49824 leshort =1 \b, 1 file 17624>>49824 leshort >1 \b, %u files 17625 17626# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc 17627# and http://www.freedos.org/software/?prog=kpdos 17628# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 176290 string/b KCF FreeDOS KEYBoard Layout collection 17630# only version=0x100 found 17631>3 uleshort x \b, version 0x%x 17632# length of string containing author,info and special characters 17633>6 ubyte >0 17634#>>6 pstring x \b, name=%s 17635>>7 string >\0 \b, author=%-.14s 17636>>7 search/254 \xff \b, info= 17637#>>>&0 string x \b%-s 17638>>>&0 string x \b%-.15s 17639# for FreeDOS *.KL files 176400 string/b KLF FreeDOS KEYBoard Layout file 17641# only version=0x100 or 0x101 found 17642>3 uleshort x \b, version 0x%x 17643# stringlength 17644>5 ubyte >0 17645>>8 string x \b, name=%-.2s 176460 string \xffKEYB\ \ \ \0\0\0\0 17647>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 17648 17649# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017 17650# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 176510 ulequad&0x07a0ffffffff 0xffffffff 17652>0 use msdos-driver 176530 name msdos-driver DOS executable ( 17654#!:mime application/octet-stream 17655!:mime application/x-dosdriver 17656# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 17657!:ext sys/dev/bin 17658>40 search/7 UPX! \bUPX compressed 17659# DOS device driver attributes 17660>4 uleshort&0x8000 0x0000 \bblock device driver 17661# character device 17662>4 uleshort&0x8000 0x8000 \b 17663>>4 uleshort&0x0008 0x0008 \bclock 17664# fast video output by int 29h 17665>>4 uleshort&0x0010 0x0010 \bfast 17666# standard input/output device 17667>>4 uleshort&0x0003 >0 \bstandard 17668>>>4 uleshort&0x0001 0x0001 \binput 17669>>>4 uleshort&0x0003 0x0003 \b/ 17670>>>4 uleshort&0x0002 0x0002 \boutput 17671>>4 uleshort&0x8000 0x8000 \bcharacter device driver 17672>0 ubyte x 17673# upx compressed device driver has garbage instead of real in name field of header 17674>>40 search/7 UPX! 17675>>40 default x 17676# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 17677>>>12 ubyte >0x2E \b 17678>>>>10 ubyte >0x20 17679>>>>>10 ubyte !0x2E 17680>>>>>>10 ubyte !0x2A \b%c 17681>>>>11 ubyte >0x20 17682>>>>>11 ubyte !0x2E \b%c 17683>>>>12 ubyte >0x20 17684>>>>>12 ubyte !0x39 17685>>>>>>12 ubyte !0x2E \b%c 17686>>>13 ubyte >0x20 17687>>>>13 ubyte !0x2E \b%c 17688>>>>14 ubyte >0x20 17689>>>>>14 ubyte !0x2E \b%c 17690>>>>15 ubyte >0x20 17691>>>>>15 ubyte !0x2E \b%c 17692>>>>16 ubyte >0x20 17693>>>>>16 ubyte !0x2E 17694>>>>>>16 ubyte <0xCB \b%c 17695>>>>17 ubyte >0x20 17696>>>>>17 ubyte !0x2E 17697>>>>>>17 ubyte <0x90 \b%c 17698# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 17699>>>12 ubyte <0x2F 17700# they have their real name at offset 22 17701# also block device drivers like DUMBDRV.SYS 17702>>>>22 string >\056 %-.6s 17703>4 uleshort&0x8000 0x0000 17704# 32 bit sector addressing ( > 32 MB) for block devices 17705>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 17706# support by driver functions 13h, 17h, 18h 17707>4 uleshort&0x0040 0x0040 \b,IOCTL- 17708# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 17709>4 uleshort&0x0800 0x0800 \b,close media- 17710# output until busy support by int 10h for character device driver 17711>4 uleshort&0x8000 0x8000 17712>>4 uleshort&0x2000 0x2000 \b,until busy- 17713# direct read/write support by driver functions 03h,0Ch 17714>4 uleshort&0x4000 0x4000 \b,control strings- 17715>4 uleshort&0x8000 0x8000 17716>>4 uleshort&0x6840 >0 \bsupport 17717>4 uleshort&0x8000 0x0000 17718>>4 uleshort&0x4842 >0 \bsupport 17719>0 ubyte x \b) 17720# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 177210 ulequad 0x0513c00000000012 17722>0 use msdos-driver 17723# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 177240 ulequad 0x32f28000ffff0016 17725>0 use msdos-driver 177260 ulequad 0x007f00000000ffff 17727>0 use msdos-driver 177280 ulequad 0x001600000000ffff 17729>0 use msdos-driver 17730# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 177310 ulequad 0x0bf708c2ffffffff 17732>0 use msdos-driver 177330 ulequad 0x07bd08c2ffffffff 17734>0 use msdos-driver 17735 17736# updated by Joerg Jenderek 17737# GRR: line below too general as it catches also 17738# rt.lib DYADISKS.PIC and many more 17739# start with assembler instruction MOV 177400 ubyte 0x8c 17741# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 17742>4 string !O==== 17743# skip some unknown basic binaries like RocketRnger.SHR 17744>>5 string !MAIN 17745# skip "GPG symmetrically encrypted data" ./gnu 17746# skip "PGP symmetric key encrypted data" ./pgp 17747# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 17748>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 17749# the remaining files should be DOS *.COM executables 17750# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 17751# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 17752# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 17753# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 17754# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 17755# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 17756# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 17757# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 17758!:mime application/x-dosexec 17759!:ext com 17760 17761# updated by Joerg Jenderek at Oct 2008 177620 ulelong 0xffff10eb DR-DOS executable (COM) 17763# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 177640 ubeshort&0xeb8d >0xeb00 17765# DR-DOS STACKER.COM SCREATE.SYS missed 17766 177670 name msdos-com 17768>0 byte x DOS executable (COM) 17769>6 string SFX\ of\ LHarc \b, %s 17770>0x1FE leshort 0xAA55 \b, boot code 17771>85 string UPX \b, UPX compressed 17772>4 string \ $ARX \b, ARX self-extracting archive 17773>4 string \ $LHarc \b, LHarc self-extracting archive 17774>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 17775 17776# JMP 8bit 177770 byte 0xeb 17778# allow forward jumps only 17779>1 byte >-1 17780# that offset must be accessible 17781>>(1.b+2) byte x 17782>>>0 use msdos-com 17783 17784# JMP 16bit 177850 byte 0xe9 17786# forward jumps 17787>1 short >-1 17788# that offset must be accessible 17789>>(1.s+3) byte x 17790>>>0 use msdos-com 17791# negative offset, must not lead into PSP 17792>1 short <-259 17793# that offset must be accessible 17794>>(1,s+65539) byte x 17795>>>0 use msdos-com 17796 17797# updated by Joerg Jenderek at Oct 2008,2015 17798# following line is too general 177990 ubyte 0xb8 17800# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 17801>0 string !\xb8\xc0\x07\x8e 17802# modified by Joerg Jenderek 17803# syslinux COM32 or COM32R executable 17804>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 17805# http://www.syslinux.org/wiki/index.php/Comboot_API 17806# Since version 5.00 c32 modules switched from the COM32 object format to ELF 17807!:mime application/x-c32-comboot-syslinux-exec 17808!:ext c32 17809# http://syslinux.zytor.com/comboot.php 17810# older syslinux version ( <4 ) 17811# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 17812# start with assembler instructions mov eax,21cd4cffh 17813>>>1 lelong 0x21CD4CFf \b) 17814# syslinux:doc/comboot.txt 17815# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 17816# eax,21cd4cfeh) as a magic number. 17817# syslinux version (4.x) 17818# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 17819>>>1 lelong 0x21CD4CFe \b, relocatable) 17820# remaining are DOS COM executables starting with assembler instruction MOV 17821# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 17822# MS-DOS SYS.COM RESTART.COM 17823# SYSLINUX.COM (version 1.40 - 2.13) 17824# GFXBOOT.COM (version 3.75) 17825# COPYBS.COM POWEROFF.COM INT18.COM 17826>>1 default x COM executable for DOS 17827!:mime application/x-dosexec 17828#!:mime application/x-ms-dos-executable 17829#!:mime application/x-msdos-program 17830!:ext com 17831 178320 string/b \x81\xfc 17833>4 string \x77\x02\xcd\x20\xb9 17834>>36 string UPX! FREE-DOS executable (COM), UPX compressed 17835252 string Must\ have\ DOS\ version DR-DOS executable (COM) 17836# added by Joerg Jenderek at Oct 2008 17837# GRR search is not working 17838#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 1783934 string UPX! FREE-DOS executable (COM), UPX compressed 1784035 string UPX! FREE-DOS executable (COM), UPX compressed 17841# GRR search is not working 17842#2 search/28 \xcd\x21 COM executable for MS-DOS 17843#WHICHFAT.cOM 178442 string \xcd\x21 COM executable for DOS 17845#DELTREE.cOM DELTREE2.cOM 178464 string \xcd\x21 COM executable for DOS 17847#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 178485 string \xcd\x21 COM executable for DOS 17849#DELTMP.COm HASFAT32.cOM 178507 string \xcd\x21 17851>0 byte !0xb8 COM executable for DOS 17852#COMP.cOM MORE.COm 1785310 string \xcd\x21 17854>5 string !\xcd\x21 COM executable for DOS 17855#comecho.com 1785613 string \xcd\x21 COM executable for DOS 17857#HELP.COm EDIT.coM 1785818 string \xcd\x21 COM executable for MS-DOS 17859#NWRPLTRM.COm 1786023 string \xcd\x21 COM executable for MS-DOS 17861#LOADFIX.cOm LOADFIX.cOm 1786230 string \xcd\x21 COM executable for MS-DOS 17863#syslinux.com 3.11 1786470 string \xcd\x21 COM executable for DOS 17865# many compressed/converted COMs start with a copy loop instead of a jump 178660x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 178670x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 17868>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 178690x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 17870# FIXME: missing diet .com compression 17871 17872# miscellaneous formats 178730 string/b LZ MS-DOS executable (built-in) 17874#0 byte 0xf0 MS-DOS program library data 17875# 17876 17877# AAF files: 17878# <stuartc@rd.bbc.co.uk> Stuart Cunningham 178790 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 17880>30 byte 9 (512B sectors) 17881>30 byte 12 (4kB sectors) 178820 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 17883>30 byte 9 (512B sectors) 17884>30 byte 12 (4kB sectors) 17885 17886# Popular applications 178872080 string Microsoft\ Word\ 6.0\ Document %s 17888!:mime application/msword 178892080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 17890!:mime application/msword 17891# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 178922112 string MSWordDoc Microsoft Word document data 17893!:mime application/msword 17894# 178950 belong 0x31be0000 Microsoft Word Document 17896!:mime application/msword 17897# 178980 string/b PO^Q` Microsoft Word 6.0 Document 17899!:mime application/msword 17900# 179014 long 0 17902>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 17903!:mime application/msword 17904!:ext mcw 17905>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 17906!:mime application/msword 17907!:ext mcw 17908>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 17909!:mime application/msword 17910!:ext mcw 17911>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 17912!:mime application/msword 17913!:ext mcw 17914 179150 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 17916!:mime application/msword 17917!:ext doc 17918512 string/b \354\245\301 Microsoft Word Document 17919!:mime application/msword 17920 17921# 179220 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 17923!:mime application/msword 17924# 179252080 string Microsoft\ Excel\ 5.0\ Worksheet %s 17926!:mime application/vnd.ms-excel 17927# 179280 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 17929!:mime application/msword 17930 179312080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 17932!:mime application/vnd.ms-excel 17933# 17934# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 179352114 string Biff5 Microsoft Excel 5.0 Worksheet 17936!:mime application/vnd.ms-excel 17937# Italian MS-Excel 179382121 string Biff5 Microsoft Excel 5.0 Worksheet 17939!:mime application/vnd.ms-excel 179400 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 17941!:mime application/vnd.ms-excel 17942# 17943# Update: Joerg Jenderek 17944# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 17945# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 17946# Note: newer Lotus versions >2 use longer BOF record 17947# record type (BeginningOfFile=0000h) + length (001Ah) 179480 belong 0x00001a00 17949# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 17950#>18 uleshort&0x73E0 0 17951# Lotus Multi Byte Character Set (LMBCS=1-31) 17952>20 ubyte >0 17953>>20 ubyte <32 Lotus 1-2-3 17954#!:mime application/x-123 17955!:mime application/vnd.lotus-1-2-3 17956!:apple ????L123 17957# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 17958>>>4 uleshort 0x1000 WorKsheet, version 3 17959!:ext wk3 17960# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 17961>>>4 uleshort 0x1002 WorKsheet, version 4 17962# also worksheet template 4 (.wt4) 17963!:ext wk4/wt4 17964# no example or documentation for wk5 17965#>>4 uleshort 0x???? WorKsheet, version 4 17966#!:ext wk5 17967# only MacrotoScript.123 example 17968>>>4 uleshort 0x1003 WorKsheet, version 97 17969# also worksheet template Smartmaster (.12M)? 17970!:ext 123 17971# only Set_Y2K.123 example 17972>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 17973!:ext 123 17974# no example for this version 17975>>>4 uleshort 0x8001 FoRMatting data 17976!:ext frm 17977# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 17978# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 17979>>>4 uleshort 0x8007 ForMatting data, version 3 17980!:ext fm3 17981>>>4 default x unknown 17982# file revision sub code 0004h for worksheets 17983>>>>6 uleshort =0x0004 worksheet 17984!:ext wXX 17985>>>>6 uleshort !0x0004 formatting data 17986!:ext fXX 17987# main revision number 17988>>>>4 uleshort x \b, revision 0x%x 17989>>>6 uleshort =0x0004 \b, cell range 17990# active cellcoord range (start row, page,column ; end row, page, column) 17991# start values normally 0~1st sheet A1 17992>>>>8 ulelong !0 17993>>>>>10 ubyte >0 \b%d* 17994>>>>>8 uleshort x \b%d, 17995>>>>>11 ubyte x \b%d- 17996# end page mostly 0 17997>>>>14 ubyte >0 \b%d* 17998# end raw, column normally not 0 17999>>>>12 uleshort x \b%d, 18000>>>>15 ubyte x \b%d 18001# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 18002>>>>20 ubyte >1 \b, character set 0x%x 18003# flags 18004>>>>21 ubyte x \b, flags 0x%x 18005>>>6 uleshort !0x0004 18006# record type (FONTNAME=00AEh) 18007>>>>30 search/29 \0\xAE 18008# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 18009>>>>>&4 string >\0 \b, 1st font "%s" 18010# 18011# Update: Joerg Jenderek 18012# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 18013# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 18014# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 18015# record type (BeginningOfFile=0000h) + length (0002h) 180160 belong 0x00000200 18017# GRR: line above is too general as it catches also MS Windows CURsor 18018# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 18019!:strength -1 18020# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 18021>7 ubyte 0 18022# skip Windows cursors with image width 256 and keep Lotus with positiv opcode 18023>>6 ubyte >0 Lotus 18024# !:mime application/x-123 18025!:mime application/vnd.lotus-1-2-3 18026!:apple ????L123 18027# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 18028# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 18029>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 18030!:ext cnf 18031>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 18032!:ext cnf 18033>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 18034!:ext cnf 18035>>>4 uleshort 0x0802 Symphony CoNFiguration 18036!:ext cnf 18037>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 18038!:ext cnf 18039>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 18040!:ext cnf 18041>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 18042!:ext cnf 18043>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 18044!:ext cnf 18045# (version 5.26) labeled the entry as "Lotus 123" 18046# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 18047>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 18048# extension "wks" also for Microsoft Works document 18049!:ext wks 18050# (version 5.26) labeled the entry as "Lotus 123" 18051# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 18052>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 18053!:ext wrk/wr1 18054# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 18055# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 18056>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 18057# Symphony (.wr1) 18058!:ext wk1/wr1 18059# no example for this japan version 18060>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 18061!:ext wj1 18062# no example or documentation for wk2 18063#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 18064#!:ext wk2 18065# undocumented japan version 18066>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 18067!:ext wj3 18068# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 18069>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 18070# japan version 2.4J (fj3) 18071!:ext fmt/fj3 18072# no example for this version 18073>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 18074!:ext frm 18075# (version 5.26) labeled the entry as "Lotus 1-2-3" 18076>>>4 default x unknown worksheet or configuration 18077!:ext cnf 18078>>>>4 uleshort x \b, revision 0x%x 18079# 2nd record for most worksheets describes cells range 18080>>>6 use lotus-cells 18081# 3nd record for most japan worksheets describes cells range 18082>>>(8.s+10) use lotus-cells 18083# check and then display Lotus worksheet cells range 180840 name lotus-cells 18085# look for type (RANGE=0006h) + length (0008h) at record begin 18086>0 ubelong 0x06000800 \b, cell range 18087# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 18088>>4 ulong !0 18089>>>4 uleshort x \b%d, 18090>>>6 uleshort x \b%d- 18091# end of cell range 18092>>8 uleshort x \b%d, 18093>>10 uleshort x \b%d 18094# EndOfLotus123 180950 string/b WordPro\0 Lotus WordPro 18096!:mime application/vnd.lotus-wordpro 180970 string/b WordPro\r\373 Lotus WordPro 18098!:mime application/vnd.lotus-wordpro 18099 18100 18101# Summary: Script used by InstallScield to uninstall applications 18102# Extension: .isu 18103# Submitted by: unknown 18104# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 181050 string \x71\xa8\x00\x00\x01\x02 18106>12 string Stirling\ Technologies, InstallShield Uninstall Script 18107 18108# Winamp .avs 18109#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 181100 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 18111 18112# Windows Metafont .WMF 181130 string/b \327\315\306\232 ms-windows metafont .wmf 181140 string/b \002\000\011\000 ms-windows metafont .wmf 181150 string/b \001\000\011\000 ms-windows metafont .wmf 18116 18117#tz3 files whatever that is (MS Works files) 181180 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 181190 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 181200 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 18121 18122# PGP sig files .sig 18123#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 181240 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 181250 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 181260 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 181270 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 181280 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 181290 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 18130 18131# windows zips files .dmf 181320 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 18133 18134 18135#ico files 181360 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 18137 18138# Windows icons 18139# Update: Joerg Jenderek 18140# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 18141# Note: similiar to Windows CURsor. container for BMP (only DIB part) or PNG 181420 belong 0x00000100 18143>9 byte 0 18144>>0 byte x 18145>>0 use cur-ico-dir 18146>9 ubyte 0xff 18147>>0 byte x 18148>>0 use cur-ico-dir 18149# displays number of icons and information for icon or cursor 181500 name cur-ico-dir 18151# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 18152# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 18153>18 ulelong &0x00000006 18154# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 18155>>(18.l) ulelong x MS Windows 18156>>>0 ubelong 0x00000100 icon resource 18157#!:mime image/vnd.microsoft.icon 18158!:mime image/x-icon 18159!:ext ico 18160>>>>4 uleshort x - %d icon 18161# plural s 18162>>>>4 uleshort >1 \bs 18163# 1st icon 18164>>>>0x06 use ico-entry 18165# 2nd icon 18166>>>>4 uleshort >1 18167>>>>>0x16 use ico-entry 18168>>>0 ubelong 0x00000200 cursor resource 18169#!:mime image/x-cur 18170!:mime image/x-win-bitmap 18171!:ext cur 18172>>>>4 uleshort x - %d icon 18173>>>>4 uleshort >1 \bs 18174# 1st cursor 18175>>>>0x06 use cur-entry 18176#>>>>0x16 use cur-entry 18177# display information of one cursor entry 181780 name cur-entry 18179>0 use cur-ico-entry 18180>4 uleshort x \b, hotspot @%dx 18181>6 uleshort x \b%d 18182# display information of one icon entry 181830 name ico-entry 18184>0 use cur-ico-entry 18185# normally 0 1 but also found 14 18186>4 uleshort >1 \b, %d planes 18187# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 18188>6 uleshort >1 \b, %d bits/pixel 18189# display shared information of cursor or icon entry 181900 name cur-ico-entry 18191>0 byte =0 \b, 256x 18192>0 byte !0 \b, %dx 18193>1 byte =0 \b256 18194>1 byte !0 \b%d 18195# number of colors in palette 18196>2 ubyte !0 \b, %d colors 18197# reserved 0 FFh 18198#>3 ubyte x \b, reserved %x 18199#>8 ulelong x \b, image size %d 18200# offset of PNG or DIB image 18201#>12 ulelong x \b, offset 0x%x 18202# PNG header (\x89PNG) 18203>(12.l) ubelong =0x89504e47 18204>>&-4 indirect x \b with 18205# DIB image 18206>(12.l) ubelong !0x89504e47 18207#>>&-4 use dib-image 18208 18209# Windows non-animated cursors 18210# Update: Joerg Jenderek 18211# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 18212# Note: similiar to Windows ICOn. container for BMP ( only DIB part) 18213# GRR: line below is too general as it catches also Lotus 1-2-3 files 182140 belong 0x00000200 18215>9 byte 0 18216>>0 use cur-ico-dir 18217>9 ubyte 0xff 18218>>0 use cur-ico-dir 18219 18220# .chr files 182210 string/b PK\010\010BGI Borland font 18222>4 string >\0 %s 18223# then there is a copyright notice 18224 18225 18226# .bgi files 182270 string/b pk\010\010BGI Borland device 18228>4 string >\0 %s 18229# then there is a copyright notice 18230 18231 18232# Windows Recycle Bin record file (named INFO2) 18233# By Abel Cheung (abelcheung AT gmail dot com) 18234# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 18235# Since Vista uses another structure, INFO2 structure probably won't change 18236# anymore. Detailed analysis in: 18237# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 182380 lelong 0x00000004 18239>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 18240 182410 lelong 0x00000005 18242>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 18243 18244# From Doug Lee via a FreeBSD pr 182459 string GERBILDOC First Choice document 182469 string GERBILDB First Choice database 182479 string GERBILCLIP First Choice database 182480 string GERBIL First Choice device file 182499 string RABBITGRAPH RabbitGraph file 182500 string DCU1 Borland Delphi .DCU file 182510 string =!<spell> MKS Spell hash list (old format) 182520 string =!<spell2> MKS Spell hash list 18253# Too simple - MPi 18254#0 string AH Halo(TM) bitmapped font file 182550 lelong 0x08086b70 TurboC BGI file 182560 lelong 0x08084b50 TurboC Font file 18257 18258# Debian#712046: The magic below identifies "Delphi compiled form data". 18259# An additional source of information is available at: 18260# http://www.woodmann.com/fravia/dafix_t1.htm 182610 string TPF0 18262>4 pstring >\0 Delphi compiled form '%s' 18263 18264# tests for DBase files moved, updated and merged to database 18265 182660 string PMCC Windows 3.x .GRP file 182671 string RDC-meg MegaDots 18268>8 byte >0x2F version %c 18269>9 byte >0x2F \b.%c file 182700 lelong 0x4C 18271>4 lelong 0x00021401 Windows shortcut file 18272 18273# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm 18274# only for windows versions equal or greater 3.0 182750x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 18276!:mime application/x-dosexec 18277#>2 string >\0 \b, Title:%.30s 18278>0x24 string >\0 \b for %.63s 18279>0x65 string >\0 \b, directory=%.64s 18280>0xA5 string >\0 \b, parameters=%.64s 18281#>0x181 leshort x \b, offset %x 18282#>0x183 leshort x \b, offsetdata %x 18283#>0x185 leshort x \b, section length %x 18284>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 18285>>&0x5e ubyte >0 18286>>>&-1 string <PIFMGR.DLL \b, icon=%s 18287#>>>&-1 string PIFMGR.DLL \b, icon=%s 18288>>>&-1 string >PIFMGR.DLL \b, icon=%s 18289>>&0xF0 ubyte >0 18290>>>&-1 string <Terminal \b, font=%.32s 18291#>>>&-1 string =Terminal \b, font=%.32s 18292>>>&-1 string >Terminal \b, font=%.32s 18293>>&0x110 ubyte >0 18294>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 18295#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 18296>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 18297#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 18298#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 18299>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 18300#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 18301>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 18302#>>&06 string x \b:%s 18303>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 18304#>>&06 string x \b:%s 18305 18306# DOS EPS Binary File Header 18307# From: Ed Sznyter <ews@Black.Market.NET> 183080 belong 0xC5D0D3C6 DOS EPS Binary File 18309!:mime image/x-eps 18310>4 long >0 Postscript starts at byte %d 18311>>8 long >0 length %d 18312>>>12 long >0 Metafile starts at byte %d 18313>>>>16 long >0 length %d 18314>>>20 long >0 TIFF starts at byte %d 18315>>>>24 long >0 length %d 18316 18317# TNEF magic From "Joomy" <joomy@se-ed.net> 18318# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 183190 leshort 0x223e9f78 TNEF 18320!:mime application/vnd.ms-tnef 18321 18322# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 18323# of http://www.davep.org/norton-guides/ng2h-105.tgz 18324# http://en.wikipedia.org/wiki/Norton_Guides 183250 string NG\0\001 18326# only value 0x100 found at offset 2 18327>2 ulelong 0x00000100 Norton Guide 18328# Title[40] 18329>>8 string >\0 "%-.40s" 18330#>>6 uleshort x \b, MenuCount=%u 18331# szCredits[5][66] 18332>>48 string >\0 \b, %-.66s 18333>>114 string >\0 %-.66s 18334 18335# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 18336# of http://www.4dos.info/ 18337# pointer,HelpID[8]=4DHnnnmm 183380 ulelong 0x48443408 4DOS help file 18339>4 string x \b, version %-4.4s 18340 18341# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 183420 ulequad 0x3a000000024e4c MS Advisor help file 18343 18344# HtmlHelp files (.chm) 183450 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 18346 18347# GFA-BASIC (Wolfram Kleff) 183482 string/b GFA-BASIC3 GFA-BASIC 3 data 18349 18350#------------------------------------------------------------------------------ 18351# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 18352# Microsoft Cabinet files 183530 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 18354!:mime application/vnd.ms-cab-compressed 18355>8 lelong x \b, %u bytes 18356>28 leshort 1 \b, 1 file 18357>28 leshort >1 \b, %u files 18358 18359# InstallShield Cabinet files 183600 string/b ISc( InstallShield Cabinet archive data 18361>5 byte&0xf0 =0x60 version 6, 18362>5 byte&0xf0 !0x60 version 4/5, 18363>(12.l+40) lelong x %u files 18364 18365# Windows CE package files 183660 string/b MSCE\0\0\0\0 Microsoft WinCE install header 18367>20 lelong 0 \b, architecture-independent 18368>20 lelong 103 \b, Hitachi SH3 18369>20 lelong 104 \b, Hitachi SH4 18370>20 lelong 0xA11 \b, StrongARM 18371>20 lelong 4000 \b, MIPS R4000 18372>20 lelong 10003 \b, Hitachi SH3 18373>20 lelong 10004 \b, Hitachi SH3E 18374>20 lelong 10005 \b, Hitachi SH4 18375>20 lelong 70001 \b, ARM 7TDMI 18376>52 leshort 1 \b, 1 file 18377>52 leshort >1 \b, %u files 18378>56 leshort 1 \b, 1 registry entry 18379>56 leshort >1 \b, %u registry entries 18380 18381 18382# Windows Enhanced Metafile (EMF) 18383# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 18384# for further information. 183850 ulelong 1 18386>40 string \ EMF Windows Enhanced Metafile (EMF) image data 18387>>44 ulelong x version 0x%x 18388 18389# from http://filext.com by Derek M Jones <derek@knosof.co.uk> 18390# False positive with PPT (also currently this string is too long) 18391#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 183920 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document 18393#>48 byte 0x1B Excel Document 18394#!:mime application/vnd.ms-excel 18395>546 string bjbj Microsoft Word Document 18396!:mime application/msword 18397>546 string jbjb Microsoft Word Document 18398!:mime application/msword 18399 184000 string/b \224\246\056 Microsoft Word Document 18401!:mime application/msword 18402 18403512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 18404!:mime application/msword 18405 18406# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 18407# Magic type for Dell's BIOS .hdr files 18408# Dell's .hdr 184090 string/b $RBU 18410>23 string Dell %s system BIOS 18411>5 byte 2 18412>>48 byte x version %d. 18413>>49 byte x \b%d. 18414>>50 byte x \b%d 18415>5 byte <2 18416>>48 string x version %.3s 18417 18418# Type: Microsoft DirectDraw Surface 18419# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 18420# From: Morten Hustveit <morten@debian.org> 184210 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS), 18422>16 lelong >0 %d x 18423>12 lelong >0 %d, 18424>84 string x %.4s 18425 18426# Type: Microsoft Document Imaging Format (.mdi) 18427# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 18428# From: Daniele Sempione <scrows@oziosi.org> 18429# Too weak (EP) 18430#0 short 0x5045 Microsoft Document Imaging Format 18431 18432# MS eBook format (.lit) 184330 string/b ITOLITLS Microsoft Reader eBook Data 18434>8 lelong x \b, version %u 18435!:mime application/x-ms-reader 18436 18437# Windows CE Binary Image Data Format 18438# From: Dr. Jesus <j@hug.gs> 184390 string/b B000FF\n Windows Embedded CE binary image 18440 18441# Windows Imaging (WIM) Image 184420 string/b MSWIM\000\000\000 Windows imaging (WIM) image 184430 string/b WLPWM\000\000\000 Windows imaging (WIM) image, wimlib pipable format 18444 18445# The second byte of these signatures is a file version; I don't know what, 18446# if anything, produced files with version numbers 0-2. 18447# From: John Elliott <johne@seasip.demon.co.uk> 184480 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 184490 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 184500 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 184510 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 18452 184530 string MIOPEN Mallard BASIC Jetsam data 184540 string Jetsam0 Mallard BASIC Jetsam index data 18455 18456# DOS backup 2.0 to 3.2 18457 18458# backupid.@@@ 18459 18460# plausibility check for date 184610x3 ushort >1979 18462>0x5 ubyte-1 <31 18463>>0x6 ubyte-1 <12 18464# actually 121 nul bytes 18465>>>0x7 string \0\0\0\0\0\0\0\0 18466>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 18467!:ext @@@ 18468>>>>0x0 ubyte 0xff \b, last disk 18469 18470# backed up file 18471 18472# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 18473# by looking for trailing nul of maximal file name string 184740x52 ubyte 0 18475# test for flag byte: FFh~complete file, 00h~split file 18476# FFh -127 = -1 -127 = -128 18477# 00h -127 = 0 -127 = -127 18478>0 byte-127 <-126 18479# plausibility check for file name length 18480>>0x53 ubyte-1 <78 18481# looking for terminating nul of file name string 18482>>>(0x53.b+4) ubyte 0 18483# looking if last char of string is valid DOS file name 18484>>>>(0x53.b+3) ubyte >0x1F 18485# actually 44 nul bytes 18486# but sometimes garbage according to Ralf Quint. So can not be used as test 18487#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 18488# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 18489# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 18490>>>>>5 ubyte&0x8C 0x0C 18491# ./msdos (version 5.30) labeled the entry as 18492# "DOS 2.0 backed up file %s, split file, sequence %d" or 18493# "DOS 2.0 backed up file %s, complete file" 18494>>>>>>0 ubyte x DOS 2.0-3.2 backed up 18495#>>>>>>0 ubyte 0xff complete 18496>>>>>>0 ubyte 0 18497>>>>>>>1 uleshort x sequence %d of 18498# full file name with path but without drive letter and colon stored from 0x05 til 0x52 18499>>>>>>0x5 string x file %s 18500# backup name is original filename 18501#!:ext * 18502# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 18503# file: line 1169: Bad magic entry ' *' 18504# after header original file content 18505>>>>>>128 indirect x \b; 18506 18507 18508# DOS backup 3.3 to 5.x 18509 18510# CONTROL.nnn files 185110 string \x8bBACKUP\x20 18512# actually 128 nul bytes 18513>0xa string \0\0\0\0\0\0\0\0 18514>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 18515>>0x8a ubyte 0xff \b, last disk 18516 18517# NB: The BACKUP.nnn files consist of the files backed up, 18518# concatenated. 18519 18520#------------------------------------------------------------------------------ 18521# $File: msooxml,v 1.5 2014/08/05 07:38:45 christos Exp $ 18522# msooxml: file(1) magic for Microsoft Office XML 18523# From: Ralf Brown <ralf.brown@gmail.com> 18524 18525# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 18526# archive. The first member file is normally "[Content_Types].xml". 18527# but some libreoffice generated files put this later. Perhaps skip 18528# the "[Content_Types].xml" test? 18529# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 18530# file of ePub or OpenDocument, we'll have to scan for a filename 18531# which can distinguish between the three types 18532 18533# start by checking for ZIP local file header signature 185340 string PK\003\004 18535!:strength +10 18536# make sure the first file is correct 18537>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels 18538# skip to the second local file header 18539# since some documents include a 520-byte extra field following the file 18540# header, we need to scan for the next header 18541>>(18.l+49) search/2000 PK\003\004 18542# now skip to the *third* local file header; again, we need to scan due to a 18543# 520-byte extra field following the file header 18544>>>&26 search/1000 PK\003\004 18545# and check the subdirectory name to determine which type of OOXML 18546# file we have. Correct the mimetype with the registered ones: 18547# http://technet.microsoft.com/en-us/library/cc179224.aspx 18548>>>>&26 string word/ Microsoft Word 2007+ 18549!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 18550>>>>&26 string ppt/ Microsoft PowerPoint 2007+ 18551!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 18552>>>>&26 string xl/ Microsoft Excel 2007+ 18553!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 18554>>>>&26 default x Microsoft OOXML 18555 18556#------------------------------------------------------------------------------ 18557# $File: msvc,v 1.8 2017/03/17 22:20:22 christos Exp $ 18558# msvc: file(1) magic for msvc 18559# "H. Nanosecond" <aldomel@ix.netcom.com> 18560# Microsoft visual C 18561# 18562# I have version 1.0 18563 18564# .aps 185650 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 18566 18567# .ide 18568#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 185690 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 18570 18571# .res 185720 string \000\000\000\000\040\000\000\000\377 MSVC .res 185730 string \377\003\000\377\001\000\020\020\350 MSVC .res 185740 string \377\003\000\377\001\000\060\020\350 MSVC .res 18575 18576#.lib 185770 string \360\015\000\000 Microsoft Visual C library 185780 string \360\075\000\000 Microsoft Visual C library 185790 string \360\175\000\000 Microsoft Visual C library 18580 18581#.pch 185820 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 18583 18584# Summary: Symbol Table / Debug info used by Microsoft compilers 18585# URL: https://en.wikipedia.org/wiki/Program_database 18586# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format 18587# Update: Joerg Jenderek 18588# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86 18589# info does only applies partly for older files like msvbvm50.pdb about year 2001 185900 string Microsoft\ C/C++\040 18591# "Microsoft Program DataBase" by TrID 18592>24 search/14 \r\n\x1A MSVC program database 18593!:mime application/x-ms-pdb 18594!:ext pdb 18595# "MSF 7.00" "program database 2.00" for msvbvm50.pdb 18596>>16 regex \([0-9.]+\) ver %s 18597#>>>0x38 search/128123456 /LinkInfo \b with linkinfo 18598# "MSF 7.00" variant 18599>>0x1e leshort 0 18600# PageSize 400h 1000h 18601>>>0x20 lelong x \b, %d 18602# Page Count 18603>>>0x28 lelong x \b*%d bytes 18604# "program database 2.00" variant 18605>>0x1e leshort !0 18606# PageSize 400h 18607>>>0x2c lelong x \b, %d 18608# Page Count for msoo-dll.pdb 4379h 18609>>>0x32 leshort x \b*%d bytes 18610 18611#.sbr 186120 string \000\002\000\007\000 MSVC .sbr 18613>5 string >\0 %s 18614 18615#.bsc 186160 string \002\000\002\001 MSVC .bsc 18617 18618#.wsp 186190 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 18620# these seem to start with the version and contain menus 18621 18622#------------------------------------------------------------------------------ 18623# msx: file(1) magic for the MSX Home Computer 18624# v1.3 18625# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 18626 18627############## MSX Music file formats ############## 18628 18629# Gigamix MGSDRV music file 186300 string/b MGS MSX Gigamix MGSDRV3 music file, 18631>6 ubeshort 0x0D0A 18632>>3 byte x \bv%c 18633>>4 byte x \b.%c 18634>>5 byte x \b%c 18635>>8 string >\0 \b, title: %s 18636 186371 string/b mgs2\ MSX Gigamix MGSDRV2 music file 18638>6 uleshort 0x80 18639>>0x2E uleshort 0 18640>>>0x30 string >\0 \b, title: %s 18641 18642# KSS music file 186430 string/b KSCC KSS music file v1.03 18644>0xE byte 0 18645>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 18646>>0xF byte&0x02 2 \b, soundchip(s): SN76489 18647>>>0xF byte&0x04 4 stereo 18648>>0xF byte&0x01 1 \b, YM2413 18649>>0xF byte&0x08 8 \b, Y8950 18650 186510 string/b KSSX KSS music file v1.20 18652>0xE byte&0xEF 0 18653>>0xF byte&0x40 0x00 \b, 60Hz 18654>>0xF byte&0x40 0x40 \b, 50Hz 18655>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 18656>>0xF byte&0x02 0x02 \b, soundchips: SN76489 18657>>>0xF byte&0x04 0x04 stereo 18658>>0xF byte&0x01 0x01 \b, 18659>>>0xF byte&0x18 0x00 \bYM2413 18660>>>0xF byte&0x18 0x08 \bYM2413, Y8950 18661>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 18662>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 18663 18664# Moonblaster for Moonsound 186650 string/b MBMS 18666>4 byte 0x10 MSX Moonblaster for MoonSound music 18667 18668# Music Player K-kaz 186690 string/b MPK MSX Music Player K-kaz song 18670>6 ubeshort 0x0D0A 18671>>3 byte x v%c 18672>>4 byte x \b.%c 18673>>5 byte x \b%c 18674 18675# I don't know why these don't work 18676#0 search/0xFFFF \r\n.FM9 18677#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 18678#0 search/0xFFFF \r\nFM1\ \= 18679#>0 search/0xFFFF \r\nPSG1\= 18680#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 18681 18682# OPX Music file 186830x35 beshort 0x0d0a 18684>0x7B beshort 0x0d0a 18685>>0x7D byte 0x1a 18686>>>0x87 uleshort 0 MSX OPX Music file 18687>>>>0x86 byte 0 v1.5 18688>>>>>0 string >\32 \b, title: %s 18689>>>>0x86 byte 1 v2.4 18690>>>>>0 string >\32 \b, title: %s 18691 18692# SCMD music file 186930x8B string/b SCMD 18694>0xCE uleshort 0 MSX SCMD Music file 18695#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 18696>>0x8F string >\0 \b, title: %s 18697 186980 search/0xFFFF \r\n@title 18699>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 18700 18701 18702############## MSX image file formats ############## 18703 18704# MSX raw VRAM dump 187050 ubyte 0xFE 18706>1 uleshort 0 18707>>5 uleshort 0 18708>>>3 uleshort 0x37FF MSX SC2/GRP raw image 18709>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 18710>>>3 uleshort >0x769E 18711>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 18712>>>>>3 uleshort 0x7FFF \b, with sprite patterns 18713>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 18714>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 18715 18716# Graph Saurus compressed images 187170 ubyte 0xFD 18718>1 uleshort 0 18719>>5 uleshort 0 18720>>>3 uleshort >0x013D MSX Graph Saurus compressed image 18721 18722# MSX G9B image file 187230 string/b G9B 18724>1 uleshort 11 18725>>3 uleshort >10 18726>>>5 ubyte >0 MSX G9B image, depth=%d 18727>>>>8 uleshort x \b, %dx 18728>>>>10 uleshort x \b%d 18729>>>>5 ubyte <9 18730>>>>>6 ubyte 0 18731>>>>>>7 ubyte x \b, codec=%d RGB color palettes 18732>>>>>6 ubyte 64 \b, codec=RGB fixed color 18733>>>>>6 ubyte 128 \b, codec=YJK 18734>>>>>6 ubyte 192 \b, codec=YUV 18735>>>>5 ubyte >8 codec=RGB fixed color 18736>>>>12 ubyte 0 \b, raw 18737>>>>12 ubyte 1 \b, bitbuster compression 18738 18739############## Other MSX file formats ############## 18740 18741# MSX internal ROMs 187420 ubeshort 0xF3C3 18743>2 uleshort <0x4000 18744>>8 ubyte 0xC3 18745>>>9 uleshort <0x4000 18746>>>>0x0B ubeshort 0x00C3 18747>>>>>0x0D uleshort <0x4000 18748>>>>>>0x0F ubeshort 0x00C3 18749>>>>>>>0x11 uleshort <0x4000 18750>>>>>>>>0x13 ubeshort 0x00C3 18751>>>>>>>>>0x15 uleshort <0x4000 18752>>>>>>>>>>0x50 ubyte 0xC3 18753>>>>>>>>>>>0x51 uleshort <0x4000 18754>>>>>>>>>>>>(9.s) ubyte 0xC3 18755>>>>>>>>>>>>>&0 uleshort >0x4000 18756>>>>>>>>>>>>>>&0 ubyte 0xC3 MSX BIOS+BASIC 18757>>>>>>>>>>>>>>>0x002D ubyte+1 <3 \b. version=MSX%d 18758>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+ 18759>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R 18760>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version 18761>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=0x%2x 18762>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=0x%2x 18763>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese 18764>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International 18765>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean 18766>>>>>>>>>>>>>>>0x002B ubyte&0xF >2 \b, charset=Unknown id:%d 18767>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x00 \b, date format=Y-M-D 18768>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x10 \b, date format=M-D-Y 18769>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x20 \b, date format=D-M-Y 18770>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x00 \b, vfreq=60Hz 18771>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x80 \b, vfreq=50Hz 18772>>>>>>>>>>>>>>>0x002C ubyte&0x0F 0 \b, keyboard=Japanese 18773>>>>>>>>>>>>>>>0x002C ubyte&0x0F 1 \b, keyboard=International 18774>>>>>>>>>>>>>>>0x002C ubyte&0x0F 2 \b, keyboard=French 18775>>>>>>>>>>>>>>>0x002C ubyte&0x0F 3 \b, keyboard=UK 18776>>>>>>>>>>>>>>>0x002C ubyte&0x0F 4 \b, keyboard=German 18777>>>>>>>>>>>>>>>0x002C ubyte&0x0F 5 \b, keyboard=Unknown id:%d 18778>>>>>>>>>>>>>>>0x002C ubyte&0x0F 6 \b, keyboard=Spanish 18779>>>>>>>>>>>>>>>0x002C ubyte&0x0F >6 \b, keyboard=Unknown id:%d 18780>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x00 \b, basic=Japanese 18781>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x10 \b, basic=International 18782>>>>>>>>>>>>>>>0x002C ubyte&0xF0 >0x10 \b, basic=Unknown id:%d 18783>>>>>>>>>>>>>>>0x002E ubyte&1 1 \b, built-in MIDI 18784 18785 187860 string/b CD 18787>2 uleshort >0x10 18788>>2 uleshort <0x4000 18789>>>4 uleshort <0x4000 18790>>>>6 uleshort <0x4000 18791>>>>>8 ubyte 0xC3 18792>>>>>>9 uleshort <0x4000 18793>>>>>>>0x10 ubyte 0xC3 18794>>>>>>>>0x11 uleshort <0x4000 18795>>>>>>>>>0x14 ubyte 0xC3 18796>>>>>>>>>>0x15 uleshort <0x4000 MSX2/2+/TR SubROM 18797 187980 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 18799>0x5F0 ubequad 0x8282828244380000 18800>>0x150 ubyte 0x38 18801>>>0x170 string \20\20\20 18802>>>>0x1E32 string ()) 18803>>>>>0x2130 ubequad 0xA5A5594924231807 18804>>>>>0x2138 ubequad 0x4A4A3424488830C0 MSX Kanji Font 18805 18806 18807 18808# MSX extension ROMs 188090 string/b AB 18810>2 uleshort 0x0010 MSX ROM 18811>>2 uleshort x \b, init=0x%4x 18812>>4 uleshort >0 \b, stahdl=0x%4x 18813>>6 uleshort >0 \b, devhdl=0x%4x 18814>>8 uleshort >0 \b, bas=0x%4x 18815>2 uleshort 0x4010 MSX ROM 18816>>2 uleshort x \b, init=0x%04x 18817>>4 uleshort >0 \b, stahdl=0x%04x 18818>>6 uleshort >0 \b, devhdl=0x%04x 18819>>8 uleshort >0 \b, bas=0x%04x 18820>2 uleshort 0x8010 MSX ROM 18821>>2 uleshort x \b, init=0x%04x 18822>>4 uleshort >0 \b, stahdl=0x%04x 18823>>6 uleshort >0 \b, devhdl=0x%04x 18824>>8 uleshort >0 \b, bas=0x%04x 188250 string/b AB\0\0 18826>6 uleshort 0 18827>>4 uleshort >0x400F MSX-BASIC extension ROM 18828>>>4 uleshort >0 \b, stahdl=0x%04x 18829>>>6 uleshort >0 \b, devhdl=0x%04x 18830>>>0x1C string OPLL \b, MSX-Music 18831>>>>0x18 string PAC2 \b (external) 18832>>>>0x18 string APRL \b (internal) 18833 188340 string/b AB\0\0\0\0 18835>6 uleshort >0x400F MSX device BIOS 18836>>6 uleshort >0 \b, devhdl=0x%04x 18837 18838 188390 string/b AB 18840#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 18841#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 18842#>3 string @3\x80IA862 Golvellius MSX1 ROM 18843>2 uleshort >15 18844>>2 uleshort <0xC000 18845>>>8 string \0\0\0\0\0\0\0\0 18846>>>>(2.s&0x3FFF) uleshort >0 MSX ROM 18847>>>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 18848>>>>>0x10 string CD \b, Konami RC- 18849>>>>>>0x12 ubyte x \b%d 18850>>>>>>0x13 ubyte/16 x \b%d 18851>>>>>>0x13 ubyte&0xF x \b%d 18852>>>>>0x10 string EF \b, Konami RC- 18853>>>>>>0x12 ubyte x \b%d 18854>>>>>>0x13 ubyte/16 x \b%d 18855>>>>>>0x13 ubyte&0xF x \b%d 18856>>>>>2 uleshort x \b, init=0x%04x 18857>>>>>4 uleshort >0 \b, stahdl=0x%04x 18858>>>>>6 uleshort >0 \b, devhdl=0x%04x 18859>>>>>8 uleshort >0 \b, bas=0x%04x 18860>>>2 uleshort 0 18861>>>>4 uleshort 0 18862>>>>>6 uleshort 0 18863>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x 18864 188650x4000 string/b AB 18866>0x4002 uleshort >0x400F 18867>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 18868>>>0x4002 uleshort x \b, init=0x%04x 18869>>>0x4004 uleshort >0 \b, stahdl=0x%04x 18870>>>0x4006 uleshort >0 \b, devhdl=0x%04x 18871>>>0x4008 uleshort >0 \b, bas=0x%04x 18872 188730x8000 string/b AB 18874>0x8002 uleshort >0x400F 18875>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 18876>>>0x8002 uleshort x \b, init=0x%04x 18877>>>0x8004 uleshort >0 \b, stahdl=0x%04x 18878>>>0x8006 uleshort >0 \b, devhdl=0x%04x 18879>>>0x8008 uleshort >0 \b, bas=0x%04x 18880 18881 188820x3C000 string/b AB 18883>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 18884>>0x3C002 uleshort x \b, init=0x%04x 18885>>0x3C004 uleshort >0 \b, stahdl=0x%04x 18886>>0x3C006 uleshort >0 \b, devhdl=0x%04x 18887>>0x3C008 uleshort >0 \b, bas=0x%04x 18888 18889# MSX BIN file 18890#0 byte 0xFE 18891#>1 uleshort >0x8000 18892#>>3 uleshort >0x8004 18893#>>>5 uleshort >0x8000 MSX BIN file 18894 18895# MSX-BASIC file 188960 byte 0xFF 18897>3 uleshort 0x000A 18898>>1 uleshort >0x8000 MSX-BASIC program 18899 18900# MSX .CAS file 189010 string/b \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 18902 18903# Mega-Assembler file 189040 byte 0xFE 18905>1 uleshort 0x0001 18906>>5 uleshort 0xffff 18907>>>6 byte 0x0A MSX Mega-Assembler source 18908 18909# Execrom Patchfile 189100 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 18911>0x12 ubyte/16 x v%d 18912>0x12 ubyte&0xF x \b.%d 18913>0x13 ubyte x \b, contains %d patches 18914 18915# Konami's King's Valley-2 custom stage (ELG file) 189164 uleshort 0x0900 18917>0xF byte 1 18918>>0x14 byte 0 18919>>>0x1E string \040\040\040 18920>>>>0x23 byte 1 18921>>>>>0x25 byte 0 18922>>>>>>0x15 string >\x30 18923>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 18924>>>>>>>>0x1D byte <32 \b, theme: %d 18925 18926# Metal Gear 1 savegame 18927#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 18928#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 18929#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 18930 18931# ------------------------------------------------------------------------ 18932# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $ 18933# mup: file(1) magic for Mup (Music Publisher) input file. 18934# 18935# From: Abel Cheung <abel (@) oaka.org> 18936# 18937# NOTE: This header is mainly proposed in the Arkkra mailing list, 18938# and is not a mandatory header because of old mup input file 18939# compatibility. Noteedit also use mup format, but is not forcing 18940# user to use any header as well. 18941# 189420 search/1 //!Mup Mup music publication program input text 18943>6 string -Arkkra (Arkkra) 18944>>13 string - 18945>>>16 string . 18946>>>>14 string x \b, need V%.4s 18947>>>15 string . 18948>>>>14 string x \b, need V%.3s 18949>6 string - 18950>>9 string . 18951>>>7 string x \b, need V%.4s 18952>>8 string . 18953>>>7 string x \b, need V%.3s 18954#------------------------------------------------------------------------------ 18955# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 18956# music: file (1) magic for music formats 18957 18958# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 18959# and Bagpipe Writer by Doug Wickstrom 18960# 189610 string Bagpipe Bagpipe 18962>8 string Reader Reader 18963>>15 string >\0 (version %.3s) 18964>8 string Music\ Writer Music Writer 18965>>20 string : 18966>>>21 string >\0 (version %.3s) 18967>>21 string Gold Gold 18968>>>25 string : 18969>>>>26 string >\0 (version %.3s) 18970 18971 18972#------------------------------------------------------------------------------ 18973# nasa: file(1) magic 18974 18975# From: Barry Carter <carter.barry@gmail.com> 189760 string DAF/SPK NASA SPICE file (binary format) 189770 string DAFETF\ NAIF\ DAF\ ENCODED NASA SPICE file (transfer format) 18978 18979#----------------------------------------------------------------------------- 18980# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $ 18981# natinst: file(1) magic for National Instruments Code Files 18982 18983# 18984# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 18985# version 1 18986# Many formats still missing, we use, for the moment LabVIEW 18987# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 18988# 189890 string RSRC National Instruments, 18990# Check if it's a LabVIEW File 18991>8 string LV LabVIEW File, 18992# Check which kind of file it is 18993>>10 string SB Code Resource File, data 18994>>10 string IN Virtual Instrument Program, data 18995>>10 string AR VI Library, data 18996# This is for Menu Libraries 18997>8 string LMNULBVW Portable File Names, data 18998# This is for General Resources 18999>8 string rsc Resources File, data 19000# This is for VXI Package 190010 string VMAP National Instruments, VXI File, data 19002 19003#------------------------------------------------------------------------------ 19004# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $ 19005# ncr: file(1) magic for NCR Tower objects 19006# 19007# contributed by 19008# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 19009# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 19010# 190110 beshort 000610 Tower/XP rel 2 object 19012>12 belong >0 not stripped 19013>20 beshort 0407 executable 19014>20 beshort 0410 pure executable 19015>22 beshort >0 - version %d 190160 beshort 000615 Tower/XP rel 2 object 19017>12 belong >0 not stripped 19018>20 beshort 0407 executable 19019>20 beshort 0410 pure executable 19020>22 beshort >0 - version %d 190210 beshort 000620 Tower/XP rel 3 object 19022>12 belong >0 not stripped 19023>20 beshort 0407 executable 19024>20 beshort 0410 pure executable 19025>22 beshort >0 - version %d 190260 beshort 000625 Tower/XP rel 3 object 19027>12 belong >0 not stripped 19028>20 beshort 0407 executable 19029>20 beshort 0410 pure executable 19030>22 beshort >0 - version %d 190310 beshort 000630 Tower32/600/400 68020 object 19032>12 belong >0 not stripped 19033>20 beshort 0407 executable 19034>20 beshort 0410 pure executable 19035>22 beshort >0 - version %d 190360 beshort 000640 Tower32/800 68020 19037>18 beshort &020000 w/68881 object 19038>18 beshort &040000 compatible object 19039>18 beshort &060000 object 19040>20 beshort 0407 executable 19041>20 beshort 0413 pure executable 19042>12 belong >0 not stripped 19043>22 beshort >0 - version %d 190440 beshort 000645 Tower32/800 68010 19045>18 beshort &040000 compatible object 19046>18 beshort &060000 object 19047>20 beshort 0407 executable 19048>20 beshort 0413 pure executable 19049>12 belong >0 not stripped 19050>22 beshort >0 - version %d 19051 19052#------------------------------------------------------------ 19053# $File: neko,v 1.1 2009/11/10 20:36:10 christos Exp $ 19054 19055# From: Mikhail Gusarov <dottedmag@dottedmag.net> 19056# NekoVM (http://nekovm.org/) bytecode 190570 string NEKO NekoVM bytecode 19058>4 lelong x (%d global symbols, 19059>8 lelong x %d global fields, 19060>12 lelong x %d bytecode ops) 19061!:mime application/x-nekovm-bytecode 19062 19063 19064#------------------------------------------------------------------------------ 19065# $File: netbsd,v 1.24 2017/03/17 21:35:28 christos Exp $ 19066# netbsd: file(1) magic for NetBSD objects 19067# 19068# All new-style magic numbers are in network byte order. 19069# The old-style magic numbers are indistinguishable from the same magic 19070# numbers used in other systems, and are handled, for all those systems, 19071# in aout. 19072# 19073 190740 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 19075>0 byte &0x80 19076>>20 lelong <4096 shared library 19077>>20 lelong =4096 dynamically linked executable 19078>>20 lelong >4096 dynamically linked executable 19079>0 byte ^0x80 executable 19080>16 lelong >0 not stripped 190810 belong&0377777777 041400410 a.out NetBSD/i386 pure 19082>0 byte &0x80 dynamically linked executable 19083>0 byte ^0x80 executable 19084>16 lelong >0 not stripped 190850 belong&0377777777 041400407 a.out NetBSD/i386 19086>0 byte &0x80 dynamically linked executable 19087>0 byte ^0x80 19088>>0 byte &0x40 position independent 19089>>20 lelong !0 executable 19090>>20 lelong =0 object file 19091>16 lelong >0 not stripped 190920 belong&0377777777 041400507 a.out NetBSD/i386 core 19093>12 string >\0 from '%s' 19094>32 lelong !0 (signal %d) 19095 190960 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 19097>0 byte &0x80 19098>>20 belong <8192 shared library 19099>>20 belong =8192 dynamically linked executable 19100>>20 belong >8192 dynamically linked executable 19101>0 byte ^0x80 executable 19102>16 belong >0 not stripped 191030 belong&0377777777 041600410 a.out NetBSD/m68k pure 19104>0 byte &0x80 dynamically linked executable 19105>0 byte ^0x80 executable 19106>16 belong >0 not stripped 191070 belong&0377777777 041600407 a.out NetBSD/m68k 19108>0 byte &0x80 dynamically linked executable 19109>0 byte ^0x80 19110>>0 byte &0x40 position independent 19111>>20 belong !0 executable 19112>>20 belong =0 object file 19113>16 belong >0 not stripped 191140 belong&0377777777 041600507 a.out NetBSD/m68k core 19115>12 string >\0 from '%s' 19116>32 belong !0 (signal %d) 19117 191180 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 19119>0 byte &0x80 19120>>20 belong <4096 shared library 19121>>20 belong =4096 dynamically linked executable 19122>>20 belong >4096 dynamically linked executable 19123>0 byte ^0x80 executable 19124>16 belong >0 not stripped 191250 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 19126>0 byte &0x80 dynamically linked executable 19127>0 byte ^0x80 executable 19128>16 belong >0 not stripped 191290 belong&0377777777 042000407 a.out NetBSD/m68k4k 19130>0 byte &0x80 dynamically linked executable 19131>0 byte ^0x80 19132>>0 byte &0x40 position independent 19133>>20 belong !0 executable 19134>>20 belong =0 object file 19135>16 belong >0 not stripped 191360 belong&0377777777 042000507 a.out NetBSD/m68k4k core 19137>12 string >\0 from '%s' 19138>32 belong !0 (signal %d) 19139 191400 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 19141>0 byte &0x80 19142>>20 lelong <4096 shared library 19143>>20 lelong =4096 dynamically linked executable 19144>>20 lelong >4096 dynamically linked executable 19145>0 byte ^0x80 executable 19146>16 lelong >0 not stripped 191470 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 19148>0 byte &0x80 dynamically linked executable 19149>0 byte ^0x80 executable 19150>16 lelong >0 not stripped 191510 belong&0377777777 042200407 a.out NetBSD/ns32532 19152>0 byte &0x80 dynamically linked executable 19153>0 byte ^0x80 19154>>0 byte &0x40 position independent 19155>>20 lelong !0 executable 19156>>20 lelong =0 object file 19157>16 lelong >0 not stripped 191580 belong&0377777777 042200507 a.out NetBSD/ns32532 core 19159>12 string >\0 from '%s' 19160>32 lelong !0 (signal %d) 19161 191620 belong&0377777777 045200507 a.out NetBSD/powerpc core 19163>12 string >\0 from '%s' 19164 191650 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged 19166>0 byte &0x80 19167>>20 belong <8192 shared library 19168>>20 belong =8192 dynamically linked executable 19169>>20 belong >8192 dynamically linked executable 19170>0 byte ^0x80 executable 19171>16 belong >0 not stripped 191720 belong&0377777777 042400410 a.out NetBSD/SPARC pure 19173>0 byte &0x80 dynamically linked executable 19174>0 byte ^0x80 executable 19175>16 belong >0 not stripped 191760 belong&0377777777 042400407 a.out NetBSD/SPARC 19177>0 byte &0x80 dynamically linked executable 19178>0 byte ^0x80 19179>>0 byte &0x40 position independent 19180>>20 belong !0 executable 19181>>20 belong =0 object file 19182>16 belong >0 not stripped 191830 belong&0377777777 042400507 a.out NetBSD/SPARC core 19184>12 string >\0 from '%s' 19185>32 belong !0 (signal %d) 19186 191870 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 19188>0 byte &0x80 19189>>20 lelong <4096 shared library 19190>>20 lelong =4096 dynamically linked executable 19191>>20 lelong >4096 dynamically linked executable 19192>0 byte ^0x80 executable 19193>16 lelong >0 not stripped 191940 belong&0377777777 042600410 a.out NetBSD/pmax pure 19195>0 byte &0x80 dynamically linked executable 19196>0 byte ^0x80 executable 19197>16 lelong >0 not stripped 191980 belong&0377777777 042600407 a.out NetBSD/pmax 19199>0 byte &0x80 dynamically linked executable 19200>0 byte ^0x80 19201>>0 byte &0x40 position independent 19202>>20 lelong !0 executable 19203>>20 lelong =0 object file 19204>16 lelong >0 not stripped 192050 belong&0377777777 042600507 a.out NetBSD/pmax core 19206>12 string >\0 from '%s' 19207>32 lelong !0 (signal %d) 19208 192090 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 19210>0 byte &0x80 19211>>20 lelong <4096 shared library 19212>>20 lelong =4096 dynamically linked executable 19213>>20 lelong >4096 dynamically linked executable 19214>0 byte ^0x80 executable 19215>16 lelong >0 not stripped 192160 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 19217>0 byte &0x80 dynamically linked executable 19218>0 byte ^0x80 executable 19219>16 lelong >0 not stripped 192200 belong&0377777777 043000407 a.out NetBSD/vax 1k 19221>0 byte &0x80 dynamically linked executable 19222>0 byte ^0x80 19223>>0 byte &0x40 position independent 19224>>20 lelong !0 executable 19225>>20 lelong =0 object file 19226>16 lelong >0 not stripped 192270 belong&0377777777 043000507 a.out NetBSD/vax 1k core 19228>12 string >\0 from '%s' 19229>32 lelong !0 (signal %d) 19230 192310 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 19232>0 byte &0x80 19233>>20 lelong <4096 shared library 19234>>20 lelong =4096 dynamically linked executable 19235>>20 lelong >4096 dynamically linked executable 19236>0 byte ^0x80 executable 19237>16 lelong >0 not stripped 192380 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 19239>0 byte &0x80 dynamically linked executable 19240>0 byte ^0x80 executable 19241>16 lelong >0 not stripped 192420 belong&0377777777 045400407 a.out NetBSD/vax 4k 19243>0 byte &0x80 dynamically linked executable 19244>0 byte ^0x80 19245>>0 byte &0x40 position independent 19246>>20 lelong !0 executable 19247>>20 lelong =0 object file 19248>16 lelong >0 not stripped 192490 belong&0377777777 045400507 a.out NetBSD/vax 4k core 19250>12 string >\0 from '%s' 19251>32 lelong !0 (signal %d) 19252 19253# NetBSD/alpha does not support (and has never supported) a.out objects, 19254# so no rules are provided for them. NetBSD/alpha ELF objects are 19255# dealt with in "elf". 192560 lelong 0x00070185 ECOFF NetBSD/alpha binary 19257>10 leshort 0x0001 not stripped 19258>10 leshort 0x0000 stripped 192590 belong&0377777777 043200507 a.out NetBSD/alpha core 19260>12 string >\0 from '%s' 19261>32 lelong !0 (signal %d) 19262 192630 belong&0377777777 043400413 a.out NetBSD/mips demand paged 19264>0 byte &0x80 19265>>20 belong <8192 shared library 19266>>20 belong =8192 dynamically linked executable 19267>>20 belong >8192 dynamically linked executable 19268>0 byte ^0x80 executable 19269>16 belong >0 not stripped 192700 belong&0377777777 043400410 a.out NetBSD/mips pure 19271>0 byte &0x80 dynamically linked executable 19272>0 byte ^0x80 executable 19273>16 belong >0 not stripped 192740 belong&0377777777 043400407 a.out NetBSD/mips 19275>0 byte &0x80 dynamically linked executable 19276>0 byte ^0x80 19277>>0 byte &0x40 position independent 19278>>20 belong !0 executable 19279>>20 belong =0 object file 19280>16 belong >0 not stripped 192810 belong&0377777777 043400507 a.out NetBSD/mips core 19282>12 string >\0 from '%s' 19283>32 belong !0 (signal %d) 19284 192850 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 19286>0 byte &0x80 19287>>20 lelong <4096 shared library 19288>>20 lelong =4096 dynamically linked executable 19289>>20 lelong >4096 dynamically linked executable 19290>0 byte ^0x80 executable 19291>16 lelong >0 not stripped 192920 belong&0377777777 043600410 a.out NetBSD/arm32 pure 19293>0 byte &0x80 dynamically linked executable 19294>0 byte ^0x80 executable 19295>16 lelong >0 not stripped 192960 belong&0377777777 043600407 a.out NetBSD/arm32 19297>0 byte &0x80 dynamically linked executable 19298>0 byte ^0x80 19299>>0 byte &0x40 position independent 19300>>20 lelong !0 executable 19301>>20 lelong =0 object file 19302>16 lelong >0 not stripped 19303# NetBSD/arm26 has always used ELF objects, but it shares a core file 19304# format with NetBSD/arm32. 193050 belong&0377777777 043600507 a.out NetBSD/arm core 19306>12 string >\0 from '%s' 19307>32 lelong !0 (signal %d) 19308 19309# Kernel core dump format 193100 belong&0x0000ffff 0x00008fca NetBSD kernel core file 19311>0 belong&0x03ff0000 0x00000000 \b, Unknown 19312>0 belong&0x03ff0000 0x00010000 \b, sun 68010/68020 19313>0 belong&0x03ff0000 0x00020000 \b, sun 68020 19314>0 belong&0x03ff0000 0x00640000 \b, 386 PC 19315>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 19316>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 19317>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 19318>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 19319>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD 19320>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 19321>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 19322>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 19323>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 19324>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 19325>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 19326>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 19327>0 belong&0x03ff0000 0x00950000 \b, ppc BSD (Big Endian) 19328>0 belong&0x03ff0000 0x00960000 \b, vax BSD (4K pages) 19329>0 belong&0x03ff0000 0x00970000 \b, mips1 BSD 19330>0 belong&0x03ff0000 0x00980000 \b, mips2 BSD 19331>0 belong&0x03ff0000 0x00990000 \b, m88k BSD 19332>0 belong&0x03ff0000 0x00920000 \b, parisc BSD 19333>0 belong&0x03ff0000 0x009b0000 \b, sh5/64 BSD 19334>0 belong&0x03ff0000 0x009c0000 \b, SPARC/64 BSD 19335>0 belong&0x03ff0000 0x009d0000 \b, amd64 BSD 19336>0 belong&0x03ff0000 0x009e0000 \b, sh5/32 BSD 19337>0 belong&0x03ff0000 0x009f0000 \b, ia64 BSD 19338>0 belong&0x03ff0000 0x00b70000 \b, aarch64 BSD 19339>0 belong&0x03ff0000 0x00b80000 \b, or1k BSD 19340>0 belong&0x03ff0000 0x00b90000 \b, Risk-V BSD 19341>0 belong&0x03ff0000 0x00c80000 \b, hp200 BSD 19342>0 belong&0x03ff0000 0x012c0000 \b, hp300 BSD 19343>0 belong&0x03ff0000 0x020b0000 \b, hp800 HP-UX 19344>0 belong&0x03ff0000 0x020c0000 \b, hp200/hp300 HP-UX 19345>0 belong&0xfc000000 0x04000000 \b, CPU 19346>0 belong&0xfc000000 0x08000000 \b, DATA 19347>0 belong&0xfc000000 0x10000000 \b, STACK 19348>4 leshort x \b, (headersize = %d 19349>6 leshort x \b, segmentsize = %d 19350>6 lelong x \b, segments = %d) 19351 19352# little endian only for now. 193530 name ktrace 19354>4 leshort 7 19355>>6 leshort <3 NetBSD ktrace file version %d 19356>>>12 string x from %s 19357>>>56 string x \b, emulation %s 19358>>>8 lelong <65536 \b, pid=%d 19359 1936056 string netbsd 19361>0 use ktrace 1936256 string linux 19363>0 use ktrace 1936456 string sunos 19365>0 use ktrace 1936656 string hpux 19367>0 use ktrace 19368 19369#------------------------------------------------------------------------------ 19370# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $ 19371# netscape: file(1) magic for Netscape files 19372# "H. Nanosecond" <aldomel@ix.netcom.com> 19373# version 3 and 4 I think 19374# 19375 19376# Netscape Address book .nab 193770 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 19378 19379# Netscape Communicator address book 193800 string \000\017\102\111 Netscape Communicator address book 19381 19382# .snm Caches 193830 string #\ Netscape\ folder\ cache Netscape folder cache 193840 string \000\036\204\220\000 Netscape folder cache 19385# .n2p 19386# Net 2 Phone 19387#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 193880 string SX961999 Net2phone 19389 19390# 19391#This is files ending in .art, FIXME add more rules 193920 string JG\004\016\0\0\0\0 AOL ART image 193930 string JG\003\016\0\0\0\0 AOL ART image 19394 19395#------------------------------------------------------------------------------ 19396# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ 19397# netware: file(1) magic for NetWare Loadable Modules (NLMs) 19398# From: Mads Martin Joergensen <mmj@suse.de> 19399 194000 string NetWare\ Loadable\ Module NetWare Loadable Module 19401 19402#------------------------------------------------------------------------------ 19403# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 19404# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 19405# 194060 string StartFontMetrics ASCII font metrics 194070 string StartFont ASCII font bits 194080 belong 0x137A2944 NeWS bitmap font 194090 belong 0x137A2947 NeWS font family 194100 belong 0x137A2950 scalable OpenFont binary 194110 belong 0x137A2951 encrypted scalable OpenFont binary 194128 belong 0x137A2B45 X11/NeWS bitmap font 194138 belong 0x137A2B48 X11/NeWS font family 19414 19415#------------------------------------------------------------------------------ 19416# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $ 19417# nitpicker: file(1) magic for Flowfiles. 19418# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de 194190 string NPFF NItpicker Flow File 19420>4 byte x V%d. 19421>5 byte x %d 19422>6 bedate x started: %s 19423>10 bedate x stopped: %s 19424>14 belong x Bytes: %u 19425>18 belong x Bytes1: %u 19426>22 belong x Flows: %u 19427>26 belong x Pkts: %u 19428 19429#------------------------------------------------------------------------------ 19430# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $ 19431# OASIS 19432# Summary: OASIS stream file 19433# Long description: Open Artwork System Interchange Standard 19434# File extension: .oas 19435# Full name: Ben Cowley (bcowley@broadcom.com) 19436# Philip Dixon (pdixon@broadcom.com) 19437# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 19438# (see page 3) 194390 string %SEMI-OASIS\r\n OASIS Stream file 19440 19441#------------------------------------------------------------------------------ 19442# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 19443# ocaml: file(1) magic for Objective Caml files. 194440 string Caml1999 OCaml 19445>8 string X exec file 19446>8 string I interface file (.cmi) 19447>8 string O object file (.cmo) 19448>8 string A library file (.cma) 19449>8 string Y native object file (.cmx) 19450>8 string Z native library file (.cmxa) 19451>8 string M abstract syntax tree implementation file 19452>8 string N abstract syntax tree interface file 19453>9 string >\0 (Version %3.3s) 19454 19455#------------------------------------------------------------------------------ 19456# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 19457# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 194580 string Octave-1-L Octave binary data (little endian) 194590 string Octave-1-B Octave binary data (big endian) 19460 19461#------------------------------------------------------------------------------ 19462# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $ 19463# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 19464# storage (http://en.wikipedia.org/wiki/Structured_Storage) 19465# Additional tests for OLE 2 Compound Documents should be under this recipe. 19466 194670 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document 19468# - Microstation V8 DGN files (www.bentley.com) 19469# Last update on 10/23/2006 by Lester Hightower 19470> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN 19471# - Visio documents 19472# Last update on 10/23/2006 by Lester Hightower 19473> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document 19474 19475#------------------------------------------------------------------------------ 19476# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 19477# olf: file(1) magic for OLF executables 19478# 19479# We have to check the byte order flag to see what byte order all the 19480# other stuff in the header is in. 19481# 19482# MIPS R3000 may also be for MIPS R2000. 19483# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 19484# 19485# Created by Erik Theisen <etheisen@openbsd.org> 19486# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 194870 string \177OLF OLF 19488>4 byte 0 invalid class 19489>4 byte 1 32-bit 19490>4 byte 2 64-bit 19491>7 byte 0 invalid os 19492>7 byte 1 OpenBSD 19493>7 byte 2 NetBSD 19494>7 byte 3 FreeBSD 19495>7 byte 4 4.4BSD 19496>7 byte 5 Linux 19497>7 byte 6 SVR4 19498>7 byte 7 esix 19499>7 byte 8 Solaris 19500>7 byte 9 Irix 19501>7 byte 10 SCO 19502>7 byte 11 Dell 19503>7 byte 12 NCR 19504>5 byte 0 invalid byte order 19505>5 byte 1 LSB 19506>>16 leshort 0 no file type, 19507>>16 leshort 1 relocatable, 19508>>16 leshort 2 executable, 19509>>16 leshort 3 shared object, 19510# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 19511# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 19512>>16 leshort 4 core file 19513>>>(0x38+0xcc) string >\0 of '%s' 19514>>>(0x38+0x10) lelong >0 (signal %d), 19515>>16 leshort &0xff00 processor-specific, 19516>>18 leshort 0 no machine, 19517>>18 leshort 1 AT&T WE32100 - invalid byte order, 19518>>18 leshort 2 SPARC - invalid byte order, 19519>>18 leshort 3 Intel 80386, 19520>>18 leshort 4 Motorola 68000 - invalid byte order, 19521>>18 leshort 5 Motorola 88000 - invalid byte order, 19522>>18 leshort 6 Intel 80486, 19523>>18 leshort 7 Intel 80860, 19524>>18 leshort 8 MIPS R3000_BE - invalid byte order, 19525>>18 leshort 9 Amdahl - invalid byte order, 19526>>18 leshort 10 MIPS R3000_LE, 19527>>18 leshort 11 RS6000 - invalid byte order, 19528>>18 leshort 15 PA-RISC - invalid byte order, 19529>>18 leshort 16 nCUBE, 19530>>18 leshort 17 VPP500, 19531>>18 leshort 18 SPARC32PLUS, 19532>>18 leshort 20 PowerPC, 19533>>18 leshort 0x9026 Alpha, 19534>>20 lelong 0 invalid version 19535>>20 lelong 1 version 1 19536>>36 lelong 1 MathCoPro/FPU/MAU Required 19537>8 string >\0 (%s) 19538>5 byte 2 MSB 19539>>16 beshort 0 no file type, 19540>>16 beshort 1 relocatable, 19541>>16 beshort 2 executable, 19542>>16 beshort 3 shared object, 19543>>16 beshort 4 core file, 19544>>>(0x38+0xcc) string >\0 of '%s' 19545>>>(0x38+0x10) belong >0 (signal %d), 19546>>16 beshort &0xff00 processor-specific, 19547>>18 beshort 0 no machine, 19548>>18 beshort 1 AT&T WE32100, 19549>>18 beshort 2 SPARC, 19550>>18 beshort 3 Intel 80386 - invalid byte order, 19551>>18 beshort 4 Motorola 68000, 19552>>18 beshort 5 Motorola 88000, 19553>>18 beshort 6 Intel 80486 - invalid byte order, 19554>>18 beshort 7 Intel 80860, 19555>>18 beshort 8 MIPS R3000_BE, 19556>>18 beshort 9 Amdahl, 19557>>18 beshort 10 MIPS R3000_LE - invalid byte order, 19558>>18 beshort 11 RS6000, 19559>>18 beshort 15 PA-RISC, 19560>>18 beshort 16 nCUBE, 19561>>18 beshort 17 VPP500, 19562>>18 beshort 18 SPARC32PLUS, 19563>>18 beshort 20 PowerPC or cisco 4500, 19564>>18 beshort 21 cisco 7500, 19565>>18 beshort 24 cisco SVIP, 19566>>18 beshort 25 cisco 7200, 19567>>18 beshort 36 cisco 12000, 19568>>18 beshort 0x9026 Alpha, 19569>>20 belong 0 invalid version 19570>>20 belong 1 version 1 19571>>36 belong 1 MathCoPro/FPU/MAU Required 19572 19573#------------------------------------------------------------------------------ 19574# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $ 19575# os2: file(1) magic for OS/2 files 19576# 19577 19578# Provided 1998/08/22 by 19579# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 195801 search/100 InternetShortcut MS Windows 95 Internet shortcut text 19581>17 search/100 URL= (URL=< 19582>>&0 string x \b%s>) 19583 19584# OS/2 URL objects 19585# Provided 1998/08/22 by 19586# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 19587#0 string http: OS/2 URL object text 19588#>5 string >\ (WWW) <http:%s> 19589#0 string mailto: OS/2 URL object text 19590#>7 string >\ (email) <%s> 19591#0 string news: OS/2 URL object text 19592#>5 string >\ (Usenet) <%s> 19593#0 string ftp: OS/2 URL object text 19594#>4 string >\ (FTP) <ftp:%s> 19595#0 string file: OS/2 URL object text 19596#>5 string >\ (Local file) <%s> 19597 19598# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 19599# Carl Hauser (chauser.parc@xerox.com) and 19600# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 19601# list the following header format in inf02a.doc: 19602# 19603# int16 ID; // ID magic word (5348h = "HS") 19604# int8 unknown1; // unknown purpose, could be third letter of ID 19605# int8 flags; // probably a flag word... 19606# // bit 0: set if INF style file 19607# // bit 4: set if HLP style file 19608# // patching this byte allows reading HLP files 19609# // using the VIEW command, while help files 19610# // seem to work with INF settings here as well. 19611# int16 hdrsize; // total size of header 19612# int16 unknown2; // unknown purpose 19613# 196140 string HSP\x01\x9b\x00 OS/2 INF 19615>107 string >0 (%s) 196160 string HSP\x10\x9b\x00 OS/2 HLP 19617>107 string >0 (%s) 19618 19619# OS/2 INI (this is a guess) 196200 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 19621 19622#------------------------------------------------------------------------------ 19623# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 19624# os400: file(1) magic for IBM OS/400 files 19625# 19626# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 19627# In spite of its quite variable format (due to internal memory page 19628# length differences between CISC and RISC versions of the OS) the 19629# SAVF structure hasn't suitable offsets to identify the catalog 19630# header in the first descriptor where there are some useful infos, 19631# so we must search in a somewhat large area for a particular string 19632# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 19633# descriptor space) preceded by a two byte constant. 19634# 196351090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 19636>&212 byte 0x01 \b, created with SAVOBJ 19637>&212 byte 0x02 \b, created with SAVLIB 19638>&212 byte 0x07 \b, created with SAVCFG 19639>&212 byte 0x08 \b, created with SAVSECDTA 19640>&212 byte 0x0A \b, created with SAVSECDTA 19641>&212 byte 0x0B \b, created with SAVDLO 19642>&212 byte 0x0D \b, created with SAVLICPGM 19643>&212 byte 0x11 \b, created with SAVCHGOBJ 19644>&213 byte 0x44 \b, at least V5R4 to open 19645>&213 byte 0x43 \b, at least V5R3 to open 19646>&213 byte 0x42 \b, at least V5R2 to open 19647>&213 byte 0x41 \b, at least V5R1 to open 19648>&213 byte 0x40 \b, at least V4R5 to open 19649>&213 byte 0x3F \b, at least V4R4 to open 19650>&213 byte 0x3E \b, at least V4R3 to open 19651>&213 byte 0x3C \b, at least V4R2 to open 19652>&213 byte 0x3D \b, at least V4R1M4 to open 19653>&213 byte 0x3B \b, at least V4R1 to open 19654>&213 byte 0x3A \b, at least V3R7 to open 19655>&213 byte 0x35 \b, at least V3R6 to open 19656>&213 byte 0x36 \b, at least V3R2 to open 19657>&213 byte 0x34 \b, at least V3R1 to open 19658>&213 byte 0x31 \b, at least V3R0M5 to open 19659>&213 byte 0x30 \b, at least V2R3 to open 19660 19661#------------------------------------------------------------------------------ 19662# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $ 19663# 19664# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 19665# 19666# Redistribution and use in source and binary forms, with or without 19667# modification, are permitted provided that the following conditions 19668# are met: 19669# 1. Redistributions of source code must retain the above copyright 19670# notice, this list of conditions and the following disclaimer. 19671# 2. Redistributions in binary form must reproduce the above copyright 19672# notice, this list of conditions and the following disclaimer in the 19673# documentation and/or other materials provided with the distribution. 19674# 19675# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19676# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19677# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19678# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 19679# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 19680# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 19681# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 19682# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 19683# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 19684# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 19685# 19686# 19687# 19688# OS9/6809 module descriptions: 19689# 196900 beshort 0x87CD OS9/6809 module: 19691# 19692>6 byte&0x0f 0x00 non-executable 19693>6 byte&0x0f 0x01 machine language 19694>6 byte&0x0f 0x02 BASIC I-code 19695>6 byte&0x0f 0x03 Pascal P-code 19696>6 byte&0x0f 0x04 C I-code 19697>6 byte&0x0f 0x05 COBOL I-code 19698>6 byte&0x0f 0x06 Fortran I-code 19699# 19700>6 byte&0xf0 0x10 program executable 19701>6 byte&0xf0 0x20 subroutine 19702>6 byte&0xf0 0x30 multi-module 19703>6 byte&0xf0 0x40 data module 19704# 19705>6 byte&0xf0 0xC0 system module 19706>6 byte&0xf0 0xD0 file manager 19707>6 byte&0xf0 0xE0 device driver 19708>6 byte&0xf0 0xF0 device descriptor 19709# 19710# OS9/m68k stuff (to be continued) 19711# 197120 beshort 0x4AFC OS9/68K module: 19713# 19714# attr 19715>0x14 byte&0x80 0x80 re-entrant 19716>0x14 byte&0x40 0x40 ghost 19717>0x14 byte&0x20 0x20 system-state 19718# 19719# lang: 19720# 19721>0x13 byte 1 machine language 19722>0x13 byte 2 BASIC I-code 19723>0x13 byte 3 Pascal P-code 19724>0x13 byte 4 C I-code 19725>0x13 byte 5 COBOL I-code 19726>0x13 byte 6 Fortran I-code 19727# 19728# 19729# type: 19730# 19731>0x12 byte 1 program executable 19732>0x12 byte 2 subroutine 19733>0x12 byte 3 multi-module 19734>0x12 byte 4 data module 19735>0x12 byte 11 trap library 19736>0x12 byte 12 system module 19737>0x12 byte 13 file manager 19738>0x12 byte 14 device driver 19739>0x12 byte 15 device descriptor 19740 19741#------------------------------------------------------------------------------ 19742# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 19743# 19744# Mach magic number info 19745# 197460 long 0xefbe OSF/Rose object 19747# I386 magic number info 19748# 197490 short 0565 i386 COFF object 19750 19751#------------------------------------------------------------------------------ 19752# $File: palm,v 1.13 2014/03/30 21:40:08 christos Exp $ 19753# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 19754# 19755# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 19756 19757# These are weak, byte 59 is not guaranteed to be 0 and there are 19758# 8 character identifiers at byte 60, one I found for appl is BIGb. 19759# What are the possibilities and where is this documented? 19760 19761# The common header format for PalmOS .pdb/.prc files is 19762# { 19763# char name[ 32 ]; 19764# Word attributes; 19765# Word version; 19766# DWord creationDate; 19767# DWord modificationDate; 19768# DWord lastBackupDate; 19769# DWord modificationNumber; 19770# DWord appInfoID; 19771# DWord sortInfoID; 19772# char type[4]; 19773# char creator[4]; 19774# DWord uniqueIDSeed; 19775# RecordListType recordList; 19776# }; 19777# 19778# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 19779# or Unix/POSIX time + 2082844800. 19780 197810 name aportisdoc 19782# date is supposed to be big-endian seconds since 1 Jan 1904, but many 19783# files contain the timestamp in little-endian or a completely 19784# nonsensical value... 19785#>36 bedate-2082844800 >0 \b, created %s 19786# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 19787>(78.L) beshort =1 \b, uncompressed 19788# compressed 19789>(78.L) beshort >1 19790>>(78.L+4) belong x \b, %d bytes uncompressed 19791 19792# appl 19793#60 string appl PalmOS application 19794#>0 string >\0 "%s" 19795 19796# HACK 19797#60 string HACK HackMaster hack 19798#>0 string >\0 "%s" 19799 19800# iSiloX e-book 1980160 string SDocSilX iSiloX E-book 19802>0 string >\0 "%s" 19803 19804# Mobipocket (www.mobipocket.com), donated by Carl Witty 19805# expanded by Ralf Brown 1980660 string BOOKMOBI Mobipocket E-book 19807# MobiPocket stores a full title, pointed at by the belong at offset 19808# 0x54 in its header at (78.L), with length given by the belong at 19809# offset 0x58. 19810# there's no guarantee that the title string is null-terminated, but 19811# we currently can't specify a variable-length string where the length 19812# field is not at the start of the string; in practice, the data 19813# following the string always seems to start with a zero byte 19814>(78.L) belong x 19815>>&(&0x50.L-4) string >\0 "%s" 19816>0 use aportisdoc 19817>>(78.L+0x68) belong >0 \b, version %d 19818>>(78.L+0x1C) belong !0 \b, codepage %d 19819>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 19820 19821# AportisDoc/PalmDOC 1982260 string TEXtREAd AportisDoc/PalmDOC E-book 19823>0 string >\0 "%s" 19824>0 use aportisdoc 19825 19826# Variety of PalmOS document types 19827# Michael-John Turner <mj@debian.org> 19828# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 1982960 string BVokBDIC BDicty PalmOS document 19830>0 string >\0 "%s" 1983160 string DB99DBOS DB PalmOS document 19832>0 string >\0 "%s" 1983360 string vIMGView FireViewer/ImageViewer PalmOS document 19834>0 string >\0 "%s" 1983560 string PmDBPmDB HanDBase PalmOS document 19836>0 string >\0 "%s" 1983760 string InfoINDB InfoView PalmOS document 19838>0 string >\0 "%s" 1983960 string ToGoToGo iSilo PalmOS document 19840>0 string >\0 "%s" 1984160 string JfDbJBas JFile PalmOS document 19842>0 string >\0 "%s" 1984360 string JfDbJFil JFile Pro PalmOS document 19844>0 string >\0 "%s" 1984560 string DATALSdb List PalmOS document 19846>0 string >\0 "%s" 1984760 string Mdb1Mdb1 MobileDB PalmOS document 19848>0 string >\0 "%s" 1984960 string PNRdPPrs PeanutPress PalmOS document 19850>0 string >\0 "%s" 1985160 string DataPlkr Plucker PalmOS document 19852>0 string >\0 "%s" 1985360 string DataSprd QuickSheet PalmOS document 19854>0 string >\0 "%s" 1985560 string SM01SMem SuperMemo PalmOS document 19856>0 string >\0 "%s" 1985760 string TEXtTlDc TealDoc PalmOS document 19858>0 string >\0 "%s" 1985960 string InfoTlIf TealInfo PalmOS document 19860>0 string >\0 "%s" 1986160 string DataTlMl TealMeal PalmOS document 19862>0 string >\0 "%s" 1986360 string DataTlPt TealPaint PalmOS document 19864>0 string >\0 "%s" 1986560 string dataTDBP ThinkDB PalmOS document 19866>0 string >\0 "%s" 1986760 string TdatTide Tides PalmOS document 19868>0 string >\0 "%s" 1986960 string ToRaTRPW TomeRaider PalmOS document 19870>0 string >\0 "%s" 19871 19872# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 19873# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 19874# annotations. 19875# For other versions, just outputs version. 19876# 1987760 string zTXT A GutenPalm zTXT e-book 19878>0 string >\0 "%s" 19879>(0x4E.L) byte 0 19880>>(0x4E.L+1) byte x (v0.%02d) 19881>(0x4E.L) byte 1 19882>>(0x4E.L+1) byte x (v1.%02d) 19883>>>(0x4E.L+10) beshort >0 19884>>>>(0x4E.L+10) beshort <2 - 1 bookmark 19885>>>>(0x4E.L+10) beshort >1 - %d bookmarks 19886>>>(0x4E.L+14) beshort >0 19887>>>>(0x4E.L+14) beshort <2 - 1 annotation 19888>>>>(0x4E.L+14) beshort >1 - %d annotations 19889>(0x4E.L) byte >1 (v%d. 19890>>(0x4E.L+1) byte x %02d) 19891 19892# Palm OS .prc file types 1989360 string libr 19894# flags, only bit 0 or bit 6 19895# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29 19896# http://web.mit.edu/tytso/www/pilot/prc-format.html 19897>0x20 beshort&0xffbe 0 19898>>0 string >\0 Palm OS dynamic library data "%s" 1989960 string ptch Palm OS operating system patch data 19900>0 string >\0 "%s" 19901 19902# Mobipocket (www.mobipocket.com), donated by Carl Witty 1990360 string BOOKMOBI Mobipocket E-book 19904>0 string >\0 "%s" 19905 19906#------------------------------------------------------------------------------ 19907# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ 19908# 19909# Parix COFF executables 19910# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 19911# 199120 beshort&0xfff 0xACE PARIX 19913>0 byte&0xf0 0x80 T800 19914>0 byte&0xf0 0x90 T9000 19915>19 byte&0x02 0x02 executable 19916>19 byte&0x02 0x00 object 19917>19 byte&0x0c 0x00 not stripped 19918#------------------------------------------------------------------------------ 19919# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $ 19920# parrot: file(1) magic for Parrot Virtual Machine 19921# URL: http://www.lua.org/ 19922# From: Lubomir Rintel <lkundrak@v3.sk> 19923 19924# Compiled Parrot byte code 199250 string \376PBC\r\n\032\n Parrot bytecode 19926>64 byte x %d. 19927>72 byte x \b%d, 19928>8 byte >0 %d byte words, 19929>16 byte 0 little-endian, 19930>16 byte 1 big-endian, 19931>32 byte 0 IEEE-754 8 byte double floats, 19932>32 byte 1 x86 12 byte long double floats, 19933>32 byte 2 IEEE-754 16 byte long double floats, 19934>32 byte 3 MIPS 16 byte long double floats, 19935>32 byte 4 AIX 16 byte long double floats, 19936>32 byte 5 4-byte floats, 19937>40 byte x Parrot %d. 19938>48 byte x \b%d. 19939>56 byte x \b%d 19940#------------------------------------------------------------------------------ 19941# $File: pascal,v 1.2 2014/07/14 14:21:33 rrt Exp $ 19942# pascal: file(1) magic for Pascal source 19943# 199440 search/8192 (input, Pascal source text 19945!:mime text/x-pascal 19946#0 regex \^program Pascal source text 19947#!:mime text/x-pascal 19948#0 regex \^record Pascal source text 19949#!:mime text/x-pascal 19950 19951#------------------------------------------------------------------------------ 19952# $File: pbf,v 1.2 2017/01/18 16:16:21 christos Exp $ 19953# file(1) magic(5) data for OpenStreetMap 19954 19955# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 19956# http://wiki.openstreetmap.org/wiki/PBF_Format 19957# From: Markus Heidelberg <markus.heidelberg@web.de> 199580 belong&0xfffffff0 0 19959>4 beshort 0x0A09 19960>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 19961 19962#------------------------------------------------------------------------------ 19963# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 19964# pbm: file(1) magic for Portable Bitmap files 19965# 19966# XXX - byte order? 19967# 199680 short 0x2a17 "compact bitmap" format (Poskanzer) 19969#------------------------------------------------------------------------------ 19970# pc88: file(1) magic for the NEC Home Computer 19971# v1.0 19972# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 19973 19974# PC88 2D disk image 199750x20 ulelong&0xFFFFFEFF 0x2A0 19976>0x10 string \0\0\0\0\0\0\0\0\0\0 19977>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 19978>>>0x1A ubyte&0xEF 0 19979>>>>0x1B ubyte&0x8F 0 19980>>>>>0x1B ubyte&70 <0x40 19981>>>>>>0x1C ulelong >0x21 19982>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 19983>>>>>>>>0x1B ubyte 0 \b, media=2D 19984>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 19985>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 19986>>>>>>>>0x1B ubyte 0x30 \b, media=1D 19987>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 19988>>>>>>>>0x1A ubyte 0x10 \b, write-protected 19989 19990 19991 19992 19993#------------------------------------------------------------------------------ 19994# pc98: file(1) magic for the MSX Home Computer 19995# v1.0 19996# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 19997 19998# Maki-chan v1 Graphic format 19999# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so 20000# http://www.jisyo.com/viewer/faq/maki_tech.htm 200010 string/b MAKI01 Maki-chan v1. 20002>6 ubyte|0x20 x \b%c image 20003>8 ubelong >0x40404040 \b, system ID: 20004>>8 byte x %c 20005>>9 byte x \b%c 20006>>10 byte x \b%c 20007>>11 byte x \b%c 20008>44 ubeshort x \b, %dx 20009>46 ubeshort x \b%d 20010>38 ubeshort&2 0 \b, 16 paletted RGB colors 20011>38 ubeshort&2 2 \b, 8 fixed RGB colors 20012>38 ubeshort&1 1 \b, 2:1 dot aspect ratio 20013 20014# Maki-chan v2 Graphic format 20015# http://www.jisyo.com/viewer/faq/mag_tech.htm 20016# http://mooncore.eu/bunny/txt/makichan.htm 20017# http://metanest.jp/mag/mag.xhtml 200180 string/b MAKI02\ \ Maki-chan v2 image, 20019>8 byte x system ID: %c 20020>9 byte x \b%c 20021>10 byte x \b%c 20022>11 byte x \b%c, 20023>13 search/0x200 \x1A 20024#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing: 20025#1) When offset1(ubeshort) !=0x0344: 20026# 1.1) And offset3(ubyte).b7=0: 20027# - b0=pixel aspect ratio: 1=2:1 (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1) 20028# - b1=number of colors: 0=16 colors, 1=8 colors 20029# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data 20030# 1.2) And offset3(ubyte).B7=1: 20031# - b0=256 paletted colors 20032# - b1=256 fixed colors using the MSX SCR8 palette 20033#2) When offset1(ubeshort) =0x0344: 20034# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored 20035>>&1 ubeshort 0x0344 256x212, 19268 fixed YJK colors 20036>>&1 ubeshort !0x0344 20037>>>&5 uleshort+1 x %dx 20038>>>&7 uleshort+1 x \b%d, 20039>>>&0 ubyte&0x86 0x00 16 paletted RGB colors 20040>>>&0 ubyte&0x86 0x02 8 paletted RGB colors 20041>>>&0 ubyte&0x86 0x04 16 fixed RGB colors 20042>>>&0 ubyte&0x86 0x06 8 fixed RGB colors 20043>>>&0 ubyte&0x81 0x80 256 paletted RGB colors 20044>>>&0 ubyte&0x81 0x81 256 fixed MSX-SCR8 colors 20045>>>&0 ubyte&0x01 1 \b, 2:1 dot aspect ratio 20046 20047# XLD4 (Q4) picture 2004811 string/b MAJYO XLD4(Q4) picture 20049 20050# Yanagisawa Pi picture 20051#0 string Pi\x1A\0 Yanagisawa Pi picture 20052#>3 search/0x200 \x04 200530 string Pi 20054>2 search/0x200 \x1A 20055>>&0 ubyte 0 20056>>>&3 ubyte 4 Yanagisawa Pi 16 color picture, 20057>>>&4 byte x system ID: %c 20058>>>&5 byte x \b%c 20059>>>&6 byte x \b%c 20060>>>&7 byte x \b%c, 20061>>>&10 ubeshort x %dx 20062>>>&12 ubeshort x \b%d 20063>>>&3 ubyte 8 Yanagisawa Pi 256 color picture 20064>>>&4 byte x system ID: %c 20065>>>&5 byte x \b%c 20066>>>&6 byte x \b%c 20067>>>&7 byte x \b%c, 20068>>>&10 ubeshort x %dx 20069>>>&12 ubeshort x \b%d 20070 20071#------------------------------------------------------------------------------ 20072# $File: pdf,v 1.8 2015/01/11 18:19:18 christos Exp $ 20073# pdf: file(1) magic for Portable Document Format 20074# 20075 200760 string %PDF- PDF document 20077!:mime application/pdf 20078>5 byte x \b, version %c 20079>7 byte x \b.%c 20080 200810 string \012%PDF- PDF document 20082!:mime application/pdf 20083>6 byte x \b, version %c 20084>8 byte x \b.%c 20085 20086# From: Nick Schmalenberger <nick@schmalenberger.us> 20087# Forms Data Format 200880 string %FDF- FDF document 20089!:mime application/vnd.fdf 20090>5 byte x \b, version %c 20091>7 byte x \b.%c 20092 20093#------------------------------------------------------------------------------ 20094# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $ 20095# pdp: file(1) magic for PDP-11 executable/object and APL workspace 20096# 200970 lelong 0101555 PDP-11 single precision APL workspace 200980 lelong 0101554 PDP-11 double precision APL workspace 20099# 20100# PDP-11 a.out 20101# 201020 leshort 0407 PDP-11 executable 20103>8 leshort >0 not stripped 20104>15 byte >0 - version %d 20105 20106# updated by Joerg Jenderek at Mar 2013 20107# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 201080 leshort 0401 20109# skip *.PNF with WinDirPathOffset 58h 20110>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 20111# skip *.PNF with high byte of InfVersionDatumCount zero 20112#>>15 byte !0 PDP-11 UNIX/RT ldp 201130 leshort 0405 PDP-11 old overlay 20114 201150 leshort 0410 PDP-11 pure executable 20116>8 leshort >0 not stripped 20117>15 byte >0 - version %d 20118 201190 leshort 0411 PDP-11 separate I&D executable 20120>8 leshort >0 not stripped 20121>15 byte >0 - version %d 20122 201230 leshort 0437 PDP-11 kernel overlay 20124 20125# These last three are derived from 2.11BSD file(1) 201260 leshort 0413 PDP-11 demand-paged pure executable 20127>8 leshort >0 not stripped 20128 201290 leshort 0430 PDP-11 overlaid pure executable 20130>8 leshort >0 not stripped 20131 201320 leshort 0431 PDP-11 overlaid separate executable 20133>8 leshort >0 not stripped 20134#------------------------------------------------------------------------------ 20135# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $ 20136# perl: file(1) magic for Larry Wall's perl language. 20137# 20138# The `eval' lines recognizes an outrageously clever hack. 20139# Keith Waclena <keith@cerberus.uchicago.edu> 20140# Send additions to <perl5-porters@perl.org> 201410 search/1024 eval\ "exec\ perl Perl script text 20142!:mime text/x-perl 201430 search/1024 eval\ "exec\ /bin/perl Perl script text 20144!:mime text/x-perl 201450 search/1024 eval\ "exec\ /usr/bin/perl Perl script text 20146!:mime text/x-perl 201470 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text 20148!:mime text/x-perl 201490 search/1024 eval\ 'exec\ perl Perl script text 20150!:mime text/x-perl 201510 search/1024 eval\ 'exec\ /bin/perl Perl script text 20152!:mime text/x-perl 201530 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text 20154!:mime text/x-perl 201550 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text 20156!:mime text/x-perl 201570 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 20158!:mime text/x-perl 201590 string #!/usr/bin/env\ perl Perl script text executable 20160!:mime text/x-perl 201610 string #!\ /usr/bin/env\ perl Perl script text executable 20162!:mime text/x-perl 201630 string #! 20164>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable 20165!:mime text/x-perl 20166 20167# by Dmitry V. Levin and Alexey Tourbin 20168# check the first line 201690 search/8192 package 20170>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 20171!:strength + 40 20172# not 'p', check other lines 201730 search/8192 !p 20174>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 20175>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 20176!:strength + 75 20177 20178# Perl POD documents 20179# From: Tom Hukins <tom@eborcom.com> 201800 search/1024/W \=pod\n Perl POD document text 201810 search/1024/W \n\=pod\n Perl POD document text 201820 search/1024/W \=head1\ Perl POD document text 201830 search/1024/W \n\=head1\ Perl POD document text 201840 search/1024/W \=head2\ Perl POD document text 201850 search/1024/W \n\=head2\ Perl POD document text 201860 search/1024/W \=encoding\ Perl POD document text 201870 search/1024/W \n\=encoding\ Perl POD document text 20188 20189 20190# Perl Storable data files. 201910 string perl-store perl Storable (v0.6) data 20192>4 byte >0 (net-order %d) 20193>>4 byte &01 (network-ordered) 20194>>4 byte =3 (major 1) 20195>>4 byte =2 (major 1) 20196 201970 string pst0 perl Storable (v0.7) data 20198>4 byte >0 20199>>4 byte &01 (network-ordered) 20200>>4 byte =5 (major 2) 20201>>4 byte =4 (major 2) 20202>>5 byte >0 (minor %d) 20203 20204# This is Debian #742949 by Zefram <zefram@fysh.org>: 20205# ----------------------------------------------------------- 20206# The Perl module Hash::SharedMem 20207# <https://metacpan.org/release/Hash-SharedMem> defines a file format 20208# for a key/value store. Details of the file format are in the "DESIGN" 20209# file in the module distribution. Magic: 202100 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian 20211>8 bequad <0x1000000 20212>>15 byte >2 \b, line size 2^%d byte 20213>>14 byte >2 \b, page size 2^%d byte 20214>>13 byte &1 20215>>>13 byte >1 \b, max fanout %d 202160 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian 20217>8 lequad <0x1000000 20218>>8 byte >2 \b, line size 2^%d byte 20219>>9 byte >2 \b, page size 2^%d byte 20220>>10 byte &1 20221>>>10 byte >1 \b, max fanout %d 202220 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian 20223>8 bequad <0x1000000 20224>>15 byte >2 \b, line size 2^%d byte 20225>>14 byte >2 \b, page size 2^%d byte 20226>>13 byte &1 20227>>>13 byte >1 \b, max fanout %d 202280 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian 20229>8 lequad <0x1000000 20230>>8 byte >2 \b, line size 2^%d byte 20231>>9 byte >2 \b, page size 2^%d byte 20232>>10 byte &1 20233>>>10 byte >1 \b, max fanout %d 20234 20235#------------------------------------------------------------------------------ 20236# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $ 20237# pgf: file(1) magic for Progressive Graphics File (PGF) 20238# 20239# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf> 20240# 2013 by Philipp Hahn <pmhahn debian org> 202410 string PGF Progressive Graphics image data, 20242!:mime image/x-pgf 20243>3 string 2 version %s, 20244>3 string 4 version %s, 20245>3 string 5 version %s, 20246>3 string 6 version %s, 20247# PGFPreHeader 20248#>>4 lelong x header size %d, 20249# PGFHeader 20250>>8 lelong x %d x 20251>>12 lelong x %d, 20252>>16 byte x %d levels, 20253>>17 byte x compression level %d, 20254>>18 byte x %d bpp, 20255>>19 byte x %d channels, 20256>>20 clear x 20257>>20 byte 0 bitmap, 20258>>20 byte 1 gray scale, 20259>>20 byte 2 indexed color, 20260>>20 byte 3 RGB color, 20261>>20 byte 4 CYMK color, 20262>>20 byte 5 HSL color, 20263>>20 byte 6 HSB color, 20264>>20 byte 7 multi-channel, 20265>>20 byte 8 duo tone, 20266>>20 byte 9 LAB color, 20267>>20 byte 10 gray scale 16, 20268>>20 byte 11 RGB color 48, 20269>>20 byte 12 LAB color 48, 20270>>20 byte 13 CYMK color 64, 20271>>20 byte 14 deep multi-channel, 20272>>20 byte 15 duo tone 16, 20273>>20 byte 17 RGBA color, 20274>>20 byte 18 gray scale 32, 20275>>20 byte 19 RGB color 12, 20276>>20 byte 20 RGB color 16, 20277>>20 byte 255 unknown format, 20278>>20 default x format 20279>>>20 byte x \b %d, 20280>>21 byte x %d bpc 20281# PGFPostHeader 20282# Level-Sizes 20283#>>(4.l+4) lelong x level 0 size: %d 20284#>>(4.l+8) lelong x level 1 size: %d 20285#>>(4.l+12) lelong x level 2 size: %d 20286 20287#------------------------------------------------------------------------------ 20288# $File: pgp,v 1.14 2017/03/17 21:35:28 christos Exp $ 20289# pgp: file(1) magic for Pretty Good Privacy 20290# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 20291# 202920 beshort 0x9900 PGP key public ring 20293!:mime application/x-pgp-keyring 202940 beshort 0x9501 PGP key security ring 20295!:mime application/x-pgp-keyring 202960 beshort 0x9500 PGP key security ring 20297!:mime application/x-pgp-keyring 202980 beshort 0xa600 PGP encrypted data 20299#!:mime application/pgp-encrypted 20300#0 string -----BEGIN\040PGP text/PGP armored data 20301!:mime text/PGP # encoding: armored data 20302#>15 string PUBLIC\040KEY\040BLOCK- public key block 20303#>15 string MESSAGE- message 20304#>15 string SIGNED\040MESSAGE- signed message 20305#>15 string PGP\040SIGNATURE- signature 20306 203072 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 20308!:mime application/pgp-keys 20309>10 search/100 \n\n 20310>>&0 use pgp 203110 string -----BEGIN\040PGP\040MESSAGE- PGP message 20312!:mime application/pgp 20313>10 search/100 \n\n 20314>>&0 use pgp 203150 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 20316!:mime application/pgp-signature 20317>10 search/100 \n\n 20318>>&0 use pgp 20319 20320# Decode the type of the packet based on it's base64 encoding. 20321# Idea from Mark Martinec 20322# The specification is in RFC 4880, section 4.2 and 4.3: 20323# http://tools.ietf.org/html/rfc4880#section-4.2 20324 203250 name pgp 20326>0 byte 0x67 Reserved (old) 20327>0 byte 0x68 Public-Key Encrypted Session Key (old) 20328>0 byte 0x69 Signature (old) 20329>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 20330>0 byte 0x6b One-Pass Signature (old) 20331>0 byte 0x6c Secret-Key (old) 20332>0 byte 0x6d Public-Key (old) 20333>0 byte 0x6e Secret-Subkey (old) 20334>0 byte 0x6f Compressed Data (old) 20335>0 byte 0x70 Symmetrically Encrypted Data (old) 20336>0 byte 0x71 Marker (old) 20337>0 byte 0x72 Literal Data (old) 20338>0 byte 0x73 Trust (old) 20339>0 byte 0x74 User ID (old) 20340>0 byte 0x75 Public-Subkey (old) 20341>0 byte 0x76 Unused (old) 20342>0 byte 0x77 20343>>1 byte&0xc0 0x00 Reserved 20344>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 20345>>1 byte&0xc0 0x80 Signature 20346>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 20347>0 byte 0x78 20348>>1 byte&0xc0 0x00 One-Pass Signature 20349>>1 byte&0xc0 0x40 Secret-Key 20350>>1 byte&0xc0 0x80 Public-Key 20351>>1 byte&0xc0 0xc0 Secret-Subkey 20352>0 byte 0x79 20353>>1 byte&0xc0 0x00 Compressed Data 20354>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 20355>>1 byte&0xc0 0x80 Marker 20356>>1 byte&0xc0 0xc0 Literal Data 20357>0 byte 0x7a 20358>>1 byte&0xc0 0x00 Trust 20359>>1 byte&0xc0 0x40 User ID 20360>>1 byte&0xc0 0x80 Public-Subkey 20361>>1 byte&0xc0 0xc0 Unused [z%x] 20362>0 byte 0x30 20363>>1 byte&0xc0 0x00 Unused [0%x] 20364>>1 byte&0xc0 0x40 User Attribute 20365>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 20366>>1 byte&0xc0 0xc0 Modification Detection Code 20367 20368# magic signatures to detect PGP crypto material (from stef) 20369# detects and extracts metadata from: 20370# - symmetric encrypted packet header 20371# - RSA (e=65537) secret (sub-)keys 20372 20373# 1024b RSA encrypted data 20374 203750 string \x84\x8c\x03 PGP RSA encrypted session key - 20376>3 lelong x keyid: %X 20377>7 lelong x %X 20378>11 byte 0x01 RSA (Encrypt or Sign) 1024b 20379>11 byte 0x02 RSA Encrypt-Only 1024b 20380>12 string \x04\x00 20381>12 string \x03\xff 20382>12 string \x03\xfe 20383>12 string \x03\xfd 20384>12 string \x03\xfc 20385>12 string \x03\xfb 20386>12 string \x03\xfa 20387>12 string \x03\xf9 20388>142 byte 0xd2 . 20389 20390# 2048b RSA encrypted data 20391 203920 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 20393>4 lelong x keyid: %X 20394>8 lelong x %X 20395>12 byte 0x01 RSA (Encrypt or Sign) 2048b 20396>12 byte 0x02 RSA Encrypt-Only 2048b 20397>13 string \x08\x00 20398>13 string \x07\xff 20399>13 string \x07\xfe 20400>13 string \x07\xfd 20401>13 string \x07\xfc 20402>13 string \x07\xfb 20403>13 string \x07\xfa 20404>13 string \x07\xf9 20405>271 byte 0xd2 . 20406 20407# 3072b RSA encrypted data 20408 204090 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 20410>4 lelong x keyid: %X 20411>8 lelong x %X 20412>12 byte 0x01 RSA (Encrypt or Sign) 3072b 20413>12 byte 0x02 RSA Encrypt-Only 3072b 20414>13 string \x0c\x00 20415>13 string \x0b\xff 20416>13 string \x0b\xfe 20417>13 string \x0b\xfd 20418>13 string \x0b\xfc 20419>13 string \x0b\xfb 20420>13 string \x0b\xfa 20421>13 string \x0b\xf9 20422>399 byte 0xd2 . 20423 20424# 3072b RSA encrypted data 20425 204260 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 20427>4 lelong x keyid: %X 20428>8 lelong x %X 20429>12 byte 0x01 RSA (Encrypt or Sign) 4096b 20430>12 byte 0x02 RSA Encrypt-Only 4096b 20431>13 string \x10\x00 20432>13 string \x0f\xff 20433>13 string \x0f\xfe 20434>13 string \x0f\xfd 20435>13 string \x0f\xfc 20436>13 string \x0f\xfb 20437>13 string \x0f\xfa 20438>13 string \x0f\xf9 20439>527 byte 0xd2 . 20440 20441# 4096b RSA encrypted data 20442 204430 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 20444>4 lelong x keyid: %X 20445>8 lelong x %X 20446>12 byte 0x01 RSA (Encrypt or Sign) 8129b 20447>12 byte 0x02 RSA Encrypt-Only 8129b 20448>13 string \x20\x00 20449>13 string \x1f\xff 20450>13 string \x1f\xfe 20451>13 string \x1f\xfd 20452>13 string \x1f\xfc 20453>13 string \x1f\xfb 20454>13 string \x1f\xfa 20455>13 string \x1f\xf9 20456>1039 byte 0xd2 . 20457 20458# crypto algo mapper 20459 204600 name crypto 20461>0 byte 0x00 Plaintext or unencrypted data 20462>0 byte 0x01 IDEA 20463>0 byte 0x02 TripleDES 20464>0 byte 0x03 CAST5 (128 bit key) 20465>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 20466>0 byte 0x07 AES with 128-bit key 20467>0 byte 0x08 AES with 192-bit key 20468>0 byte 0x09 AES with 256-bit key 20469>0 byte 0x0a Twofish with 256-bit key 20470 20471# hash algo mapper 20472 204730 name hash 20474>0 byte 0x01 MD5 20475>0 byte 0x02 SHA-1 20476>0 byte 0x03 RIPE-MD/160 20477>0 byte 0x08 SHA256 20478>0 byte 0x09 SHA384 20479>0 byte 0x0a SHA512 20480>0 byte 0x0b SHA224 20481 20482# display public key algorithms as human readable text 204830 name key_algo 20484>0 byte 0x01 RSA (Encrypt or Sign) 20485# keep old look of version 5.28 without parentheses 20486>0 byte 0x02 RSA Encrypt-Only 20487>0 byte 0x03 RSA (Sign-Only) 20488>0 byte 16 ElGamal (Encrypt-Only) 20489>0 byte 17 DSA 20490>0 byte 18 Elliptic Curve 20491>0 byte 19 ECDSA 20492>0 byte 20 ElGamal (Encrypt or Sign) 20493>0 byte 21 Diffie-Hellman 20494>0 default x 20495>>0 ubyte <22 unknown (pub %d) 20496# this should never happen 20497>>0 ubyte >21 invalid (%d) 20498 20499# pgp symmetric encrypted data 20500 205010 byte 0x8c PGP symmetric key encrypted data - 20502>1 byte 0x0d 20503>1 byte 0x0c 20504>2 byte 0x04 20505>3 use crypto 20506>4 byte 0x01 salted - 20507>>5 use hash 20508>>14 byte 0xd2 . 20509>>14 byte 0xc9 . 20510>4 byte 0x03 salted & iterated - 20511>>5 use hash 20512>>15 byte 0xd2 . 20513>>15 byte 0xc9 . 20514 20515# encrypted keymaterial needs s2k & can be checksummed/hashed 20516 205170 name chkcrypto 20518>0 use crypto 20519>1 byte 0x00 Simple S2K 20520>1 byte 0x01 Salted S2K 20521>1 byte 0x03 Salted&Iterated S2K 20522>2 use hash 20523 20524# all PGP keys start with this prolog 20525# containing version, creation date, and purpose 20526 205270 name keyprolog 20528>0 byte 0x04 20529>1 beldate x created on %s - 20530>5 byte 0x01 RSA (Encrypt or Sign) 20531>5 byte 0x02 RSA Encrypt-Only 20532 20533# end of secret keys known signature 20534# contains e=65537 and the prolog to 20535# the encrypted parameters 20536 205370 name keyend 20538>0 string \x00\x11\x01\x00\x01 e=65537 20539>5 use crypto 20540>5 byte 0xff checksummed 20541>>6 use chkcrypto 20542>5 byte 0xfe hashed 20543>>6 use chkcrypto 20544 20545# PGP secret keys contain also the public parts 20546# these vary by bitsize of the key 20547 205480 name x1024 20549>0 use keyprolog 20550>6 string \x03\xfe 20551>6 string \x03\xff 20552>6 string \x04\x00 20553>136 use keyend 20554 205550 name x2048 20556>0 use keyprolog 20557>6 string \x80\x00 20558>6 string \x07\xfe 20559>6 string \x07\xff 20560>264 use keyend 20561 205620 name x3072 20563>0 use keyprolog 20564>6 string \x0b\xfe 20565>6 string \x0b\xff 20566>6 string \x0c\x00 20567>392 use keyend 20568 205690 name x4096 20570>0 use keyprolog 20571>6 string \x10\x00 20572>6 string \x0f\xfe 20573>6 string \x0f\xff 20574>520 use keyend 20575 20576# \x00|\x1f[\xfe\xff]).{1024})' 205770 name x8192 20578>0 use keyprolog 20579>6 string \x20\x00 20580>6 string \x1f\xfe 20581>6 string \x1f\xff 20582>1032 use keyend 20583 20584# depending on the size of the pkt 20585# we branch into the proper key size 20586# signatures defined as x{keysize} 20587 20588>0 name pgpkey 20589>0 string \x01\xd8 1024b 20590>>2 use x1024 20591>0 string \x01\xeb 1024b 20592>>2 use x1024 20593>0 string \x01\xfb 1024b 20594>>2 use x1024 20595>0 string \x01\xfd 1024b 20596>>2 use x1024 20597>0 string \x01\xf3 1024b 20598>>2 use x1024 20599>0 string \x01\xee 1024b 20600>>2 use x1024 20601>0 string \x01\xfe 1024b 20602>>2 use x1024 20603>0 string \x01\xf4 1024b 20604>>2 use x1024 20605>0 string \x02\x0d 1024b 20606>>2 use x1024 20607>0 string \x02\x03 1024b 20608>>2 use x1024 20609>0 string \x02\x05 1024b 20610>>2 use x1024 20611>0 string \x02\x15 1024b 20612>>2 use x1024 20613>0 string \x02\x00 1024b 20614>>2 use x1024 20615>0 string \x02\x10 1024b 20616>>2 use x1024 20617>0 string \x02\x04 1024b 20618>>2 use x1024 20619>0 string \x02\x06 1024b 20620>>2 use x1024 20621>0 string \x02\x16 1024b 20622>>2 use x1024 20623>0 string \x03\x98 2048b 20624>>2 use x2048 20625>0 string \x03\xab 2048b 20626>>2 use x2048 20627>0 string \x03\xbb 2048b 20628>>2 use x2048 20629>0 string \x03\xbd 2048b 20630>>2 use x2048 20631>0 string \x03\xcd 2048b 20632>>2 use x2048 20633>0 string \x03\xb3 2048b 20634>>2 use x2048 20635>0 string \x03\xc3 2048b 20636>>2 use x2048 20637>0 string \x03\xc5 2048b 20638>>2 use x2048 20639>0 string \x03\xd5 2048b 20640>>2 use x2048 20641>0 string \x03\xae 2048b 20642>>2 use x2048 20643>0 string \x03\xbe 2048b 20644>>2 use x2048 20645>0 string \x03\xc0 2048b 20646>>2 use x2048 20647>0 string \x03\xd0 2048b 20648>>2 use x2048 20649>0 string \x03\xb4 2048b 20650>>2 use x2048 20651>0 string \x03\xc4 2048b 20652>>2 use x2048 20653>0 string \x03\xc6 2048b 20654>>2 use x2048 20655>0 string \x03\xd6 2048b 20656>>2 use x2048 20657>0 string \x05X 3072b 20658>>2 use x3072 20659>0 string \x05k 3072b 20660>>2 use x3072 20661>0 string \x05{ 3072b 20662>>2 use x3072 20663>0 string \x05} 3072b 20664>>2 use x3072 20665>0 string \x05\x8d 3072b 20666>>2 use x3072 20667>0 string \x05s 3072b 20668>>2 use x3072 20669>0 string \x05\x83 3072b 20670>>2 use x3072 20671>0 string \x05\x85 3072b 20672>>2 use x3072 20673>0 string \x05\x95 3072b 20674>>2 use x3072 20675>0 string \x05n 3072b 20676>>2 use x3072 20677>0 string \x05\x7e 3072b 20678>>2 use x3072 20679>0 string \x05\x80 3072b 20680>>2 use x3072 20681>0 string \x05\x90 3072b 20682>>2 use x3072 20683>0 string \x05t 3072b 20684>>2 use x3072 20685>0 string \x05\x84 3072b 20686>>2 use x3072 20687>0 string \x05\x86 3072b 20688>>2 use x3072 20689>0 string \x05\x96 3072b 20690>>2 use x3072 20691>0 string \x07[ 4096b 20692>>2 use x4096 20693>0 string \x07\x18 4096b 20694>>2 use x4096 20695>0 string \x07+ 4096b 20696>>2 use x4096 20697>0 string \x07; 4096b 20698>>2 use x4096 20699>0 string \x07= 4096b 20700>>2 use x4096 20701>0 string \x07M 4096b 20702>>2 use x4096 20703>0 string \x073 4096b 20704>>2 use x4096 20705>0 string \x07C 4096b 20706>>2 use x4096 20707>0 string \x07E 4096b 20708>>2 use x4096 20709>0 string \x07U 4096b 20710>>2 use x4096 20711>0 string \x07. 4096b 20712>>2 use x4096 20713>0 string \x07> 4096b 20714>>2 use x4096 20715>0 string \x07@ 4096b 20716>>2 use x4096 20717>0 string \x07P 4096b 20718>>2 use x4096 20719>0 string \x074 4096b 20720>>2 use x4096 20721>0 string \x07D 4096b 20722>>2 use x4096 20723>0 string \x07F 4096b 20724>>2 use x4096 20725>0 string \x07V 4096b 20726>>2 use x4096 20727>0 string \x0e[ 8192b 20728>>2 use x8192 20729>0 string \x0e\x18 8192b 20730>>2 use x8192 20731>0 string \x0e+ 8192b 20732>>2 use x8192 20733>0 string \x0e; 8192b 20734>>2 use x8192 20735>0 string \x0e= 8192b 20736>>2 use x8192 20737>0 string \x0eM 8192b 20738>>2 use x8192 20739>0 string \x0e3 8192b 20740>>2 use x8192 20741>0 string \x0eC 8192b 20742>>2 use x8192 20743>0 string \x0eE 8192b 20744>>2 use x8192 20745>0 string \x0eU 8192b 20746>>2 use x8192 20747>0 string \x0e. 8192b 20748>>2 use x8192 20749>0 string \x0e> 8192b 20750>>2 use x8192 20751>0 string \x0e@ 8192b 20752>>2 use x8192 20753>0 string \x0eP 8192b 20754>>2 use x8192 20755>0 string \x0e4 8192b 20756>>2 use x8192 20757>0 string \x0eD 8192b 20758>>2 use x8192 20759>0 string \x0eF 8192b 20760>>2 use x8192 20761>0 string \x0eV 8192b 20762>>2 use x8192 20763 20764# PGP RSA (e=65537) secret (sub-)key header 20765 207660 byte 0x95 PGP Secret Key - 20767>1 use pgpkey 207680 byte 0x97 PGP Secret Sub-key - 20769>1 use pgpkey 207700 byte 0x9d 20771# Update: Joerg Jenderek 20772# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 20773# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 20774>1 ubeshort >0 20775#>1 ubeshort x \b, body length 0x%x 20776# next packet type often 88h,89h~(tag 2)~Signature Packet 20777#>>(1.S+3) ubyte x \b, next packet type 0x%x 20778# skip Dragon.SHR DEMO.INIT by looking for positive version 20779>>3 ubyte >0 20780# skip BUISSON.13 GUITAR1 by looking for low version number 20781>>>3 ubyte <5 PGP Secret Sub-key 20782# sub-key are normally part of secret key. So it does not occur as standalone file 20783#!:ext bin 20784# version 2,3~old 4~new . Comment following line for version 5.28 look 20785>>>>3 ubyte x (v%d) 20786>>>>3 ubyte x - 20787# old versions 2 or 3 but no real example found 20788>>>>3 ubyte <4 20789# 2 byte for key bits in version 5.28 look 20790>>>>>11 ubeshort x %db 20791>>>>>4 beldate x created on %s - 20792# old versions use 2 additional bytes after time stamp 20793#>>>>>8 ubeshort x 0x%x 20794# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 20795>>>>>10 use key_algo 20796>>>>>(11.S/8) ubequad x 20797# look after first key 20798>>>>>>&5 use keyend 20799# new version 20800>>>>3 ubyte >3 20801>>>>>9 ubeshort x %db 20802>>>>>4 beldate x created on %s - 20803# display key algorithm 20804>>>>>8 use key_algo 20805>>>>>(9.S/8) ubequad x 20806# look after first key for something like s2k 20807>>>>>>&3 use keyend 20808 20809#------------------------------------------------------------------------------ 20810# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 20811# pkgadd: file(1) magic for SysV R4 PKG Datastreams 20812# 208130 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 20814!:mime application/x-svr4-package 20815 20816#------------------------------------------------------------------------------ 20817# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 20818# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 20819# From: "Stefan A. Haubenthal" <polluks@web.de> 20820# 208210 belong 0x00000107 Plan 9 executable, Motorola 68k 208220 belong 0x000001EB Plan 9 executable, Intel 386 208230 belong 0x00000247 Plan 9 executable, Intel 960 208240 belong 0x000002AB Plan 9 executable, SPARC 208250 belong 0x00000407 Plan 9 executable, MIPS R3000 208260 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 208270 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 208280 belong 0x000005AB Plan 9 executable, AMD 29000 208290 belong 0x00000647 Plan 9 executable, ARM 7-something 208300 belong 0x000006EB Plan 9 executable, PowerPC 208310 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 208320 belong 0x0000084B Plan 9 executable, DEC Alpha 20833 20834#------------------------------------------------------------------------------ 20835# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 20836# plus5: file(1) magic for Plus Five's UNIX MUMPS 20837# 20838# XXX - byte order? Paging Hokey.... 20839# 208400 short 0x259 mumps avl global 20841>2 byte >0 (V%d) 20842>6 byte >0 with %d byte name 20843>7 byte >0 and %d byte data cells 208440 short 0x25a mumps blt global 20845>2 byte >0 (V%d) 20846>8 short >0 - %d byte blocks 20847>15 byte 0x00 - P/D format 20848>15 byte 0x01 - P/K/D format 20849>15 byte 0x02 - K/D format 20850>15 byte >0x02 - Bad Flags 20851 20852#------------------------------------------------------------------------------ 20853# $File: polyml,v 1.1 2016/02/26 15:52:45 christos Exp $ 20854# polyml: file(1) magic for PolyML 20855# 20856# PolyML 20857# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 20858# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 20859 20860# [0]: http://www.polyml.org/ 20861# [1]: https://github.com/polyml/polyml/blob/master/\ 20862# libpolyml/savestate.cpp#L146-L147 20863# [2]: https://github.com/polyml/polyml/blob/master/\ 20864# libpolyml/savestate.cpp#L1262-L1263 20865 20866# Type: Poly/ML saved data 20867# From: Matthew Fernandez <matthew.fernandez@gmail.com> 20868 208690 string POLYSAVE Poly/ML saved state 20870>8 long x version %u 20871 208720 string POLYMODU Poly/ML saved module 20873>8 long x version %u 20874 20875#------------------------------------------------------------------------------ 20876# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $ 20877# printer: file(1) magic for printer-formatted files 20878# 20879 20880# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 208810 string %! PostScript document text 20882!:mime application/postscript 20883!:apple ASPSTEXT 20884>2 string PS-Adobe- conforming 20885>>11 string >\0 DSC level %.3s 20886>>>15 string EPS \b, type %s 20887>>>15 string Query \b, type %s 20888>>>15 string ExitServer \b, type %s 20889>>>15 search/1000 %%LanguageLevel:\040 20890>>>>&0 string >\0 \b, Level %s 20891# Some PCs have the annoying habit of adding a ^D as a document separator 208920 string \004%! PostScript document text 20893!:mime application/postscript 20894!:apple ASPSTEXT 20895>3 string PS-Adobe- conforming 20896>>12 string >\0 DSC level %.3s 20897>>>16 string EPS \b, type %s 20898>>>16 string Query \b, type %s 20899>>>16 string ExitServer \b, type %s 20900>>>16 search/1000 %%LanguageLevel:\040 20901>>>>&0 string >\0 \b, Level %s 209020 string \033%-12345X%!PS PostScript document 20903 20904# DOS EPS Binary File Header 20905# From: Ed Sznyter <ews@Black.Market.NET> 209060 belong 0xC5D0D3C6 DOS EPS Binary File 20907>4 long >0 Postscript starts at byte %d 20908>>8 long >0 length %d 20909>>>12 long >0 Metafile starts at byte %d 20910>>>>16 long >0 length %d 20911>>>20 long >0 TIFF starts at byte %d 20912>>>>24 long >0 length %d 20913 20914# Summary: Adobe's PostScript Printer Description File 20915# Extension: .ppd 20916# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 20917# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 20918# 209190 string *PPD-Adobe:\x20 PPD file 20920>&0 string x \b, version %s 20921 20922# HP Printer Job Language 209230 string \033%-12345X@PJL HP Printer Job Language data 20924# HP Printer Job Language 20925# The header found on Win95 HP plot files is the "Silliest Thing possible" 20926# (TM) 20927# Every driver puts the language at some random position, with random case 20928# (LANGUAGE and Language) 20929# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 20930# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 20931# 209320 string \033%-12345X@PJL HP Printer Job Language data 20933>&0 string >\0 %s 20934>>&0 string >\0 %s 20935>>>&0 string >\0 %s 20936>>>>&0 string >\0 %s 20937#>15 string \ ENTER\ LANGUAGE\ = 20938#>31 string PostScript PostScript 20939 20940# From: Stefan Thurner <thurners@nicsys.de> 209410 string \033%-12345X@PJL 20942>&0 search/10000 %! PJL encapsulated PostScript document text 20943 20944# Rick Richardson <rickrich@gmail.com> 20945 20946# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language 20947# For Oki Data Printers - HIPERC 20948# For Konica Minolta Printers - LAVAFLOW 20949# For Samsung Printers - QPDL 20950# For HP Printers - ZJS stands for Zenographics ZJStream 209510 string \033%-12345X@PJL HP Printer Job Language data 20952>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL 20953>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC 20954>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW 20955>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL 20956>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL 20957>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS 20958 20959 20960# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 209610 string \033E\033 HP PCL printer data 20962>3 string \&l0A - default page size 20963>3 string \&l1A - US executive page size 20964>3 string \&l2A - US letter page size 20965>3 string \&l3A - US legal page size 20966>3 string \&l26A - A4 page size 20967>3 string \&l80A - Monarch envelope size 20968>3 string \&l81A - No. 10 envelope size 20969>3 string \&l90A - Intl. DL envelope size 20970>3 string \&l91A - Intl. C5 envelope size 20971>3 string \&l100A - Intl. B5 envelope size 20972>3 string \&l-81A - No. 10 envelope size (landscape) 20973>3 string \&l-90A - Intl. DL envelope size (landscape) 20974 20975# IMAGEN printer-ready files: 209760 string @document( Imagen printer 20977# this only works if "language xxx" is first item in Imagen header. 20978>10 string language\ impress (imPRESS data) 20979>10 string language\ daisy (daisywheel text) 20980>10 string language\ diablo (daisywheel text) 20981>10 string language\ printer (line printer emulation) 20982>10 string language\ tektronix (Tektronix 4014 emulation) 20983# Add any other languages that your Imagen uses - remember 20984# to keep the word `text' if the file is human-readable. 20985# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 20986# 20987# Now magic for IMAGEN font files... 209880 string Rast RST-format raster font data 20989>45 string >0 face %s 20990# From Jukka Ukkonen 209910 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 20992 20993# From <mike@flyn.org> 20994# These are the /etc/magic entries to decode data sent to an Epson printer. 209950 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 20996 20997 20998#------------------------------------------------------------------------------ 20999# zenographics: file(1) magic for Zenographics ZjStream printer data 21000# Rick Richardson <rickrich@gmail.com> 210010 string JZJZ 21002>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 210030 string ZJZJ 21004>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 21005 21006 21007#------------------------------------------------------------------------------ 21008# Oak Technologies printer stream 21009# Rick Richardson <rickrich@gmail.com> 210100 string OAK 21011>0x07 byte 0 21012>0x0b byte 0 Oak Technologies printer stream 21013 21014# This would otherwise be recognized as PostScript - nick@debian.org 210150 string %!VMF SunClock's Vector Map Format data 21016 21017#------------------------------------------------------------------------------ 21018# HP LaserJet 1000 series downloadable firmware file 210190 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 21020 21021# From: Paolo <oopla@users.sf.net> 21022# Epson ESC/Page, ESC/PageColor 210230 string \x1b\x01@EJL Epson ESC/Page language printer data 21024 21025#------------------------------------------------------------------------------ 21026# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $ 21027# project: file(1) magic for Project management 21028# 21029# Magic strings for ftnchek project files. Alexander Mai 210300 string FTNCHEK_\ P project file for ftnchek 21031>10 string 1 version 2.7 21032>10 string 2 version 2.8 to 2.10 21033>10 string 3 version 2.11 or later 21034 21035#------------------------------------------------------------------------------ 21036# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $ 21037# psdbms: file(1) magic for psdatabase 21038# 21039# Update: Joerg Jenderek 21040# GRR: line below too general as it catches also some Panorama database *.pan , 21041# AppleWorks word processor 210420 belong&0xff00ffff 0x56000000 21043# assume version starts with digit 21044>1 regex/s =^[0-9] ps database 21045>>1 string >\0 version %s 21046# kernel name 21047>>4 string >\0 from kernel %s 21048 21049#------------------------------------------------------------------------------ 21050# $File: psl,v 1.2 2016/07/14 17:34:27 christos Exp $ 21051# psl: file(1) magic for Public Suffix List representations 21052# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> 21053# URL: https://publicsuffix.org 21054# see also: http://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166 21055 210560 search/512 \n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data 21057 210580 string .DAFSA@PSL_ 21059>15 string \n Public Suffix List data (optimized) 21060>>11 byte >0x2f 21061>>>11 byte <0x3a (Version %c) 21062 21063#------------------------------------------------------------------------------ 21064# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 21065# pulsar: file(1) magic for Pulsar POP3 daemon binary files 21066# 21067# http://pulsar.sourceforge.net 21068# mailto:rok.papez@lugos.si 21069# 21070 210710 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 21072>4 ubelong x Version: %d. 21073>8 ubelong x \b%d 21074 21075 21076#------------------------------------------------------------------------------ 21077# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $ 21078# pwsafe: file(1) magic for passwordsafe file 21079# 21080# Password Safe 21081# http://passwordsafe.sourceforge.net/ 21082# file format specs 21083# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 21084# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 21085# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 21086# V2 and V1 have no easy identifier that I can find 21087# .psafe3 210880 string PWS3 Password Safe V3 database 21089 21090#------------------------------------------------------------------------------ 21091# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 21092# pyramid: file(1) magic for Pyramids 21093# 21094# XXX - byte order? 21095# 210960 long 0x50900107 Pyramid 90x family executable 210970 long 0x50900108 Pyramid 90x family pure executable 21098>16 long >0 not stripped 210990 long 0x5090010b Pyramid 90x family demand paged pure executable 21100>16 long >0 not stripped 21101 21102#------------------------------------------------------------------------------ 21103# $File: python,v 1.31 2017/04/11 14:59:28 christos Exp $ 21104# python: file(1) magic for python 21105# 21106# Outlook puts """ too for urgent messages 21107# From: David Necas <yeti@physics.muni.cz> 21108# often the module starts with a multiline string 211090 string/t """ Python script text executable 21110# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming 21111# that Py_UnicodeFlag is off for Python 2) 21112# two bytes of magic followed by "\r\n" in little endian order 211130 belong 0x994e0d0a python 1.5/1.6 byte-compiled 211140 belong 0x87c60d0a python 2.0 byte-compiled 211150 belong 0x2aeb0d0a python 2.1 byte-compiled 211160 belong 0x2ded0d0a python 2.2 byte-compiled 211170 belong 0x3bf20d0a python 2.3 byte-compiled 211180 belong 0x6df20d0a python 2.4 byte-compiled 211190 belong 0xb3f20d0a python 2.5 byte-compiled 211200 belong 0xd1f20d0a python 2.6 byte-compiled 211210 belong 0x03f30d0a python 2.7 byte-compiled 211220 belong 0x3b0c0d0a python 3.0 byte-compiled 211230 belong 0x4f0c0d0a python 3.1 byte-compiled 211240 belong 0x6c0c0d0a python 3.2 byte-compiled 211250 belong 0x9e0c0d0a python 3.3 byte-compiled 211260 belong 0xee0c0d0a python 3.4 byte-compiled 211270 belong 0x160d0d0a python 3.5 byte-compiled 21128 211290 search/1/w #!\ /usr/bin/python Python script text executable 21130!:strength + 15 21131!:mime text/x-python 211320 search/1/w #!\ /usr/local/bin/python Python script text executable 21133!:strength + 15 21134!:mime text/x-python 211350 search/1 #!/usr/bin/env\ python Python script text executable 21136!:strength + 15 21137!:mime text/x-python 211380 search/10 #!\ /usr/bin/env\ python Python script text executable 21139!:strength + 15 21140!:mime text/x-python 21141 21142 21143# from module.submodule import func1, func2 211440 regex \^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$ Python script text executable 21145!:strength + 15 21146!:mime text/x-python 21147 21148# def __init__ (self, ...): 211490 search/4096 def\ __init__ 21150>&0 search/64 self Python script text executable 21151!:strength + 15 21152!:mime text/x-python 21153 21154# comments 21155#0 search/4096 ''' 21156#>&0 regex .*'''$ Python script text executable 21157#!:mime text/x-python 21158 21159#0 search/4096 """ 21160#>&0 regex .*"""$ Python script text executable 21161#!:mime text/x-python 21162 21163# try: 21164# except: or finally: 21165# block 211660 search/4096 try: 21167>&0 regex \^[\040\t\f\r\n]*except.*: Python script text executable 21168!:strength + 15 21169!:mime text/x-python 21170>&0 search/4096 finally: Python script text executable 21171!:mime text/x-python 21172 21173# def name(args, args): 211740 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100} 21175>&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable 21176!:mime text/x-python 21177!:strength + 15 21178 21179#------------------------------------------------------------------------------ 21180# $File: qt,v 1.2 2014/12/16 19:49:29 christos Exp $ 21181# qt: file(1) magic for Qt 21182 21183# http://doc.qt.io/qt-5/resources.html 211840 string \<!DOCTYPE\040RCC\> Qt Resource Collection file 21185 21186# https://qt.gitorious.org/qt/qtbase/source/\ 21187# 5367fa356233da4c0f28172a8f817791525f5457:\ 21188# src/tools/rcc/rcc.cpp#L840 211890 string qres\0\0 Qt Binary Resource file 211900 search/1024 The\040Resource\040Compiler\040for\040Qt Qt C-code resource file 21191 21192# https://qt.gitorious.org/qt/qtbase/source/\ 21193# 5367fa356233da4c0f28172a8f817791525f5457:\ 21194# src/corelib/kernel/qtranslator.cpp#L62 211950 string \x3c\xb8\x64\x18\xca\xef\x9c\x95 21196>8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file 21197 21198#------------------------------------------------------------------------------ 21199# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $ 21200# file(1) magic for revision control files 21201# From Hendrik Scholz <hendrik@scholz.net> 212020 string/t /1\ :pserver: cvs password text file 21203 21204# Conary changesets 21205# From: Jonathan Smith <smithj@rpath.com> 212060 belong 0xea3f81bb Conary changeset data 21207 21208# Type: Git bundles (git-bundle) 21209# From: Josh Triplett <josh@freedesktop.org> 212100 string #\ v2\ git\ bundle\n Git bundle 21211 21212# Type: Git pack 21213# From: Adam Buchbinder <adam.buchbinder@gmail.com> 21214# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 21215# those have a little-endian offset immediately following the magic 'PACK', 21216# the first byte of which is never 0, while the first byte of the Git pack 21217# version, since it's a tiny number stored in big-endian format, is always 0. 212180 string PACK\0 Git pack 21219>4 belong >0 \b, version %d 21220>>8 belong >0 \b, %d objects 21221 21222# Type: Git pack index 21223# From: Adam Buchbinder <adam.buchbinder@gmail.com> 212240 string \377tOc Git pack index 21225>4 belong =2 \b, version 2 21226 21227# Type: Git index file 21228# From: Frederic Briare <fbriere@fbriere.net> 212290 string DIRC Git index 21230>4 belong >0 \b, version %d 21231>>8 belong >0 \b, %d entries 21232 21233# Type: Mercurial bundles 21234# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 212350 string HG10 Mercurial bundle, 21236>4 string UN uncompressed 21237>4 string BZ bzip2 compressed 21238 21239# Type: Subversion (SVN) dumps 21240# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 212410 string SVN-fs-dump-format-version: Subversion dumpfile 21242>28 string >\0 (version: %s) 21243 21244# Type: Bazaar revision bundles and merge requests 21245# URL: http://www.bazaar-vcs.org/ 21246# From: Jelmer Vernooij <jelmer@samba.org> 212470 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 212480 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 21249 21250#------------------------------------------------------------------------------ 21251# $File: riff,v 1.32 2017/03/17 21:35:28 christos Exp $ 21252# riff: file(1) magic for RIFF format 21253# See 21254# 21255# http://www.seanet.com/users/matts/riffmci/riffmci.htm 21256# 21257 21258# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz 212590 name riff-wave 21260>0 leshort 1 \b, Microsoft PCM 21261>>14 leshort >0 21262>>>14 leshort <1024 \b, %d bit 21263>0 leshort 2 \b, Microsoft ADPCM 21264>0 leshort 6 \b, ITU G.711 A-law 21265>0 leshort 7 \b, ITU G.711 mu-law 21266>0 leshort 8 \b, Microsoft DTS 21267>0 leshort 17 \b, IMA ADPCM 21268>0 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 21269>0 leshort 49 \b, GSM 6.10 21270>0 leshort 64 \b, ITU G.721 ADPCM 21271>0 leshort 80 \b, MPEG 21272>0 leshort 85 \b, MPEG Layer 3 21273>0 leshort 0x2001 \b, DTS 21274>2 leshort =1 \b, mono 21275>2 leshort =2 \b, stereo 21276>2 leshort >2 21277>>2 leshort <128 \b, %d channels 21278>4 lelong >0 21279>>4 lelong <1000000 %d Hz 21280 21281# try to find "fmt " 212820 name riff-walk 21283>0 string fmt\x20 21284>>4 lelong <0x80 21285>>>8 use riff-wave 21286>0 string LIST 21287>>&(4.l+4) use riff-walk 21288>0 string DISP 21289>>&(4.l+4) use riff-walk 21290>0 string bext 21291>>&(4.l+4) use riff-walk 21292>0 string Fake 21293>>&(4.l+4) use riff-walk 21294>0 string fact 21295>>&(4.l+4) use riff-walk 21296>0 string VP8 21297>>11 byte 0x9d 21298>>>12 byte 0x01 21299>>>>13 byte 0x2a \b, VP8 encoding 21300>>>>>14 leshort&0x3fff x \b, %d 21301>>>>>16 leshort&0x3fff x \bx%d, Scaling: 21302>>>>>14 leshort&0xc000 0x0000 \b [none] 21303>>>>>14 leshort&0xc000 0x1000 \b [5/4] 21304>>>>>14 leshort&0xc000 0x2000 \b [5/3] 21305>>>>>14 leshort&0xc000 0x3000 \b [2] 21306>>>>>14 leshort&0xc000 0x0000 \bx[none] 21307>>>>>14 leshort&0xc000 0x1000 \bx[5/4] 21308>>>>>14 leshort&0xc000 0x2000 \bx[5/3] 21309>>>>>14 leshort&0xc000 0x3000 \bx[2] 21310>>>>>15 byte&0x80 =0x00 \b, YUV color 21311>>>>>15 byte&0x80 =0x80 \b, bad color specification 21312>>>>>15 byte&0x40 =0x40 \b, no clamping required 21313>>>>>15 byte&0x40 =0x00 \b, decoders should clamp 21314#>0 string x we got %s 21315#>>&(4.l+4) use riff-walk 21316 21317# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 21318# 213190 string RIFF RIFF (little-endian) data 21320# RIFF Palette format 21321>8 string PAL \b, palette 21322>>16 leshort x \b, version %d 21323>>18 leshort x \b, %d entries 21324# RIFF Device Independent Bitmap format 21325>8 string RDIB \b, device-independent bitmap 21326>>16 string BM 21327>>>30 leshort 12 \b, OS/2 1.x format 21328>>>>34 leshort x \b, %d x 21329>>>>36 leshort x %d 21330>>>30 leshort 64 \b, OS/2 2.x format 21331>>>>34 leshort x \b, %d x 21332>>>>36 leshort x %d 21333>>>30 leshort 40 \b, Windows 3.x format 21334>>>>34 lelong x \b, %d x 21335>>>>38 lelong x %d x 21336>>>>44 leshort x %d 21337# RIFF MIDI format 21338>8 string RMID \b, MIDI 21339# RIFF Multimedia Movie File format 21340>8 string RMMP \b, multimedia movie 21341# RIFF wrapper for MP3 21342>8 string RMP3 \b, MPEG Layer 3 audio 21343# Microsoft WAVE format (*.wav) 21344>8 string WAVE \b, WAVE audio 21345!:mime audio/x-wav 21346>>12 string >\0 21347>>>12 use riff-walk 21348# Corel Draw Picture 21349>8 string CDRA \b, Corel Draw Picture 21350!:mime image/x-coreldraw 21351>8 string CDR6 \b, Corel Draw Picture, version 6 21352!:mime image/x-coreldraw 21353>8 string NUNDROOT \b, Steinberg CuBase 21354# AVI == Audio Video Interleave 21355>8 string AVI\040 \b, AVI 21356!:mime video/x-msvideo 21357>>12 string LIST 21358>>>20 string hdrlavih 21359>>>>&36 lelong x \b, %u x 21360>>>>&40 lelong x %u, 21361>>>>&4 lelong >1000000 <1 fps, 21362>>>>&4 lelong 1000000 1.00 fps, 21363>>>>&4 lelong 500000 2.00 fps, 21364>>>>&4 lelong 333333 3.00 fps, 21365>>>>&4 lelong 250000 4.00 fps, 21366>>>>&4 lelong 200000 5.00 fps, 21367>>>>&4 lelong 166667 6.00 fps, 21368>>>>&4 lelong 142857 7.00 fps, 21369>>>>&4 lelong 125000 8.00 fps, 21370>>>>&4 lelong 111111 9.00 fps, 21371>>>>&4 lelong 100000 10.00 fps, 21372# ]9.9,10.1[ 21373>>>>&4 lelong <101010 21374>>>>>&-4 lelong >99010 21375>>>>>>&-4 lelong !100000 ~10 fps, 21376>>>>&4 lelong 83333 12.00 fps, 21377# ]11.9,12.1[ 21378>>>>&4 lelong <84034 21379>>>>>&-4 lelong >82645 21380>>>>>>&-4 lelong !83333 ~12 fps, 21381>>>>&4 lelong 66667 15.00 fps, 21382# ]14.9,15.1[ 21383>>>>&4 lelong <67114 21384>>>>>&-4 lelong >66225 21385>>>>>>&-4 lelong !66667 ~15 fps, 21386>>>>&4 lelong 50000 20.00 fps, 21387>>>>&4 lelong 41708 23.98 fps, 21388>>>>&4 lelong 41667 24.00 fps, 21389# ]23.9,24.1[ 21390>>>>&4 lelong <41841 21391>>>>>&-4 lelong >41494 21392>>>>>>&-4 lelong !41708 21393>>>>>>>&-4 lelong !41667 ~24 fps, 21394>>>>&4 lelong 40000 25.00 fps, 21395# ]24.9,25.1[ 21396>>>>&4 lelong <40161 21397>>>>>&-4 lelong >39841 21398>>>>>>&-4 lelong !40000 ~25 fps, 21399>>>>&4 lelong 33367 29.97 fps, 21400>>>>&4 lelong 33333 30.00 fps, 21401# ]29.9,30.1[ 21402>>>>&4 lelong <33445 21403>>>>>&-4 lelong >33223 21404>>>>>>&-4 lelong !33367 21405>>>>>>>&-4 lelong !33333 ~30 fps, 21406>>>>&4 lelong <32224 >30 fps, 21407##>>>>&4 lelong x (%lu) 21408##>>>>&20 lelong x %lu frames, 21409# Note: The tests below assume that the AVI has 1 or 2 streams, 21410# "vids" optionally followed by "auds". 21411# (Should cover 99.9% of all AVIs.) 21412# assuming avih length = 56 21413>>>88 string LIST 21414>>>>96 string strlstrh 21415>>>>>108 string vids video: 21416>>>>>>&0 lelong 0 uncompressed 21417# skip past vids strh 21418>>>>>>(104.l+108) string strf 21419>>>>>>>(104.l+132) lelong 1 RLE 8bpp 21420>>>>>>>(104.l+132) string/c cvid Cinepak 21421>>>>>>>(104.l+132) string/c i263 Intel I.263 21422>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 21423>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 21424>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 21425>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 21426>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 21427>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 21428>>>>>>>(104.l+132) string/c mjpg Motion JPEG 21429>>>>>>>(104.l+132) string/c div3 DivX 3 21430>>>>>>>>112 string/c div3 Low-Motion 21431>>>>>>>>112 string/c div4 Fast-Motion 21432>>>>>>>(104.l+132) string/c divx DivX 4 21433>>>>>>>(104.l+132) string/c dx50 DivX 5 21434>>>>>>>(104.l+132) string/c xvid XviD 21435>>>>>>>(104.l+132) string/c h264 H.264 21436>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 21437>>>>>>>(104.l+132) string/c h264 X.264 or H.264 21438>>>>>>>(104.l+132) lelong 0 21439##>>>>>>>(104.l+132) string x (%.4s) 21440# skip past first (video) LIST 21441>>>>(92.l+96) string LIST 21442>>>>>(92.l+104) string strlstrh 21443>>>>>>(92.l+116) string auds \b, audio: 21444# auds strh length = 56: 21445>>>>>>>(92.l+172) string strf 21446>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 21447>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 21448>>>>>>>>(92.l+180) leshort 0x0006 aLaw 21449>>>>>>>>(92.l+180) leshort 0x0007 uLaw 21450>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 21451>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 21452>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 21453>>>>>>>>(92.l+180) leshort 0x0161 DivX 21454##>>>>>>>>(92.l+180) leshort x (0x%.4x) 21455>>>>>>>>(92.l+182) leshort 1 (mono, 21456>>>>>>>>(92.l+182) leshort 2 (stereo, 21457>>>>>>>>(92.l+182) leshort >2 (%d channels, 21458>>>>>>>>(92.l+184) lelong x %d Hz) 21459# auds strh length = 64: 21460>>>>>>>(92.l+180) string strf 21461>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 21462>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 21463>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 21464>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 21465>>>>>>>>(92.l+188) leshort 0x0161 DivX 21466##>>>>>>>>(92.l+188) leshort x (0x%.4x) 21467>>>>>>>>(92.l+190) leshort 1 (mono, 21468>>>>>>>>(92.l+190) leshort 2 (stereo, 21469>>>>>>>>(92.l+190) leshort >2 (%d channels, 21470>>>>>>>>(92.l+192) lelong x %d Hz) 21471# Animated Cursor format 21472>8 string ACON \b, animated cursor 21473# SoundFont 2 <mpruett@sgi.com> 21474>8 string sfbk SoundFont/Bank 21475# MPEG-1 wrapped in a RIFF, apparently 21476>8 string CDXA \b, wrapped MPEG-1 (CDXA) 21477>8 string 4XMV \b, 4X Movie file 21478# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV 21479>8 string AMV\040 \b, AMV 21480>8 string WEBP \b, Web/P image 21481!:mime image/webp 21482>>12 use riff-walk 21483 21484# 21485# XXX - some of the below may only appear in little-endian form. 21486# 21487# Also "MV93" appears to be for one form of Macromedia Director 21488# files, and "GDMF" appears to be another multimedia format. 21489# 214900 string RIFX RIFF (big-endian) data 21491# RIFF Palette format 21492>8 string PAL \b, palette 21493>>16 beshort x \b, version %d 21494>>18 beshort x \b, %d entries 21495# RIFF Device Independent Bitmap format 21496>8 string RDIB \b, device-independent bitmap 21497>>16 string BM 21498>>>30 beshort 12 \b, OS/2 1.x format 21499>>>>34 beshort x \b, %d x 21500>>>>36 beshort x %d 21501>>>30 beshort 64 \b, OS/2 2.x format 21502>>>>34 beshort x \b, %d x 21503>>>>36 beshort x %d 21504>>>30 beshort 40 \b, Windows 3.x format 21505>>>>34 belong x \b, %d x 21506>>>>38 belong x %d x 21507>>>>44 beshort x %d 21508# RIFF MIDI format 21509>8 string RMID \b, MIDI 21510# RIFF Multimedia Movie File format 21511>8 string RMMP \b, multimedia movie 21512# Microsoft WAVE format (*.wav) 21513>8 string WAVE \b, WAVE audio 21514>>20 leshort 1 \b, Microsoft PCM 21515>>>34 leshort >0 \b, %d bit 21516>>22 beshort =1 \b, mono 21517>>22 beshort =2 \b, stereo 21518>>22 beshort >2 \b, %d channels 21519>>24 belong >0 %d Hz 21520# Corel Draw Picture 21521>8 string CDRA \b, Corel Draw Picture 21522>8 string CDR6 \b, Corel Draw Picture, version 6 21523# AVI == Audio Video Interleave 21524>8 string AVI\040 \b, AVI 21525# Animated Cursor format 21526>8 string ACON \b, animated cursor 21527# Notation Interchange File Format (big-endian only) 21528>8 string NIFF \b, Notation Interchange File Format 21529# SoundFont 2 <mpruett@sgi.com> 21530>8 string sfbk SoundFont/Bank 21531 21532#------------------------------------------------------------------------------ 21533# Sony Wave64 21534# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 21535# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 215360 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 21537# 128 bit + total file size (64 bits) so 24 bytes 21538# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 21539>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 21540!:mime audio/x-w64 21541# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 21542>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 21543>>>&10 leshort =1 \b, mono 21544>>>&10 leshort =2 \b, stereo 21545>>>&10 leshort >2 \b, %d channels 21546>>>&12 lelong >0 %d Hz 21547 21548#------------------------------------------------------------------------------ 21549# MBWF/RF64 21550# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf 215510 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 21552!:mime audio/x-wav 21553>40 search/256 fmt\x20 \b 21554>>&6 leshort =1 \b, mono 21555>>&6 leshort =2 \b, stereo 21556>>&6 leshort >2 \b, %d channels 21557>>&8 lelong >0 %d Hz 21558 21559#------------------------------------------------------------------------------ 21560# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 21561# 21562# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 21563# 215640 belong 0xedabeedb RPM 21565!:mime application/x-rpm 21566>4 byte x v%d 21567>5 byte x \b.%d 21568>6 beshort 1 src 21569>6 beshort 0 bin 21570>>8 beshort 1 i386/x86_64 21571>>8 beshort 2 Alpha/Sparc64 21572>>8 beshort 3 Sparc 21573>>8 beshort 4 MIPS 21574>>8 beshort 5 PowerPC 21575>>8 beshort 6 68000 21576>>8 beshort 7 SGI 21577>>8 beshort 8 RS6000 21578>>8 beshort 9 IA64 21579>>8 beshort 10 Sparc64 21580>>8 beshort 11 MIPSel 21581>>8 beshort 12 ARM 21582>>8 beshort 13 MiNT 21583>>8 beshort 14 S/390 21584>>8 beshort 15 S/390x 21585>>8 beshort 16 PowerPC64 21586>>8 beshort 17 SuperH 21587>>8 beshort 18 Xtensa 21588>>8 beshort 255 noarch 21589>>10 string x %s 21590 21591#delta RPM Daniel Novotny (dnovotny@redhat.com) 215920 string drpm Delta RPM 21593!:mime application/x-rpm 21594>12 string x %s 21595>>8 beshort 11 MIPSel 21596>>8 beshort 12 ARM 21597>>8 beshort 13 MiNT 21598>>8 beshort 14 S/390 21599>>8 beshort 15 S/390x 21600>>8 beshort 16 PowerPC64 21601>>8 beshort 17 SuperH 21602>>8 beshort 18 Xtensa 21603>>10 string x %s 21604 21605#------------------------------------------------------------------------------ 21606# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ 21607# rtf: file(1) magic for Rich Text Format (RTF) 21608# 21609# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 21610# 216110 string {\\rtf Rich Text Format data, 21612!:mime text/rtf 21613>5 string 1 version 1, 21614>>6 string \\ansi ANSI 21615>>6 string \\mac Apple Macintosh 21616>>6 string \\pc IBM PC, code page 437 21617>>6 string \\pca IBM PS/2, code page 850 21618>>6 default x unknown character set 21619>5 default x unknown version 21620 21621#------------------------------------------------------------------------------ 21622# $File: ruby,v 1.6 2016/07/27 09:46:29 rrt Exp $ 21623# ruby: file(1) magic for Ruby scripting language 21624# URL: http://www.ruby-lang.org/ 21625# From: Reuben Thomas <rrt@sc3d.org> 21626 21627# Ruby scripts 216280 search/1/w #!\ /usr/bin/ruby Ruby script text executable 21629!:strength + 15 21630!:mime text/x-ruby 216310 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 21632!:strength + 15 21633!:mime text/x-ruby 216340 search/1 #!/usr/bin/env\ ruby Ruby script text executable 21635!:strength + 15 21636!:mime text/x-ruby 216370 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 21638!:strength + 15 21639!:mime text/x-ruby 21640 21641# What looks like ruby, but does not have a shebang 21642# (modules and such) 21643# From: Lubomir Rintel <lkundrak@v3.sk> 216440 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+' 21645>0 regex include\ [A-Z]|def\ [a-z]|\ do$ 21646>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text 21647!:mime text/x-ruby 216480 regex \^[\ \t]*(class|module)[\ \t][A-Z] 21649>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 21650>>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text 21651!:mime text/x-ruby 21652 21653#------------------------------------------------------------------------------ 21654# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 21655# sc: file(1) magic for "sc" spreadsheet 21656# 2165738 string Spreadsheet sc spreadsheet file 21658!:mime application/x-sc 21659 21660#------------------------------------------------------------------------------ 21661# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $ 21662# sccs: file(1) magic for SCCS archives 21663# 21664# SCCS archive structure: 21665# \001h01207 21666# \001s 00276/00000/00000 21667# \001d D 1.1 87/09/23 08:09:20 ian 1 0 21668# \001c date and time created 87/09/23 08:09:20 by ian 21669# \001e 21670# \001u 21671# \001U 21672# ... etc. 21673# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 21674# *Sigh*. And these both came from various parts of the USG. 21675# Maybe we should just switch everybody from SCCS to RCS! 21676# Further, you can't just say '\001h0', because the five-digit number 21677# is a checksum that could (presumably) have any leading digit, 21678# and we don't have regular expression matching yet. 21679# Hence the following official kludge: 216808 string \001s\ SCCS archive data 21681 21682#------------------------------------------------------------------------------ 21683# $File: scientific,v 1.12 2017/03/17 22:20:22 christos Exp $ 21684# scientific: file(1) magic for scientific formats 21685# 21686# From: Joe Krahn <krahn@niehs.nih.gov> 21687 21688######################################################## 21689# CCP4 data and plot files: 216900 string MTZ\040 MTZ reflection file 21691 2169292 string PLOT%%84 Plot84 plotting file 21693>52 byte 1 , Little-endian 21694>55 byte 1 , Big-endian 21695 21696######################################################## 21697# Electron density MAP/MASK formats 21698 216990 string EZD_MAP NEWEZD Electron Density Map 21700109 string MAP\040( Old EZD Electron Density Map 21701 217020 string/c :-)\040Origin BRIX Electron Density Map 21703>170 string >0 , Sigma:%.12s 21704#>4 string >0 %.178s 21705#>4 addr x %.178s 21706 217077 string 18\040!NTITLE XPLOR ASCII Electron Density Map 217089 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 21709 21710208 string MAP\040 CCP4 Electron Density Map 21711# Assumes same stamp for float and double (normal case) 21712>212 byte 17 \b, Big-endian 21713>212 byte 34 \b, VAX format 21714>212 byte 68 \b, Little-endian 21715>212 byte 85 \b, Convex native 21716 21717############################################################ 21718# X-Ray Area Detector images 217190 string R-AXIS4\ \ \ R-Axis Area Detector Image: 21720>796 lelong <20 Little-endian, IP #%d, 21721>>768 lelong >0 Size=%dx 21722>>772 lelong >0 \b%d 21723>796 belong <20 Big-endian, IP #%d, 21724>>768 belong >0 Size=%dx 21725>>772 belong >0 \b%d 21726 217270 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 21728>796 lelong <20 Little-endian, IP #%d, 21729>>768 lelong >0 Size=%dx 21730>>772 lelong >0 \b%d 21731>796 belong <20 Big-endian, IP #%d, 21732>>768 belong >0 Size=%dx 21733>>772 belong >0 \b%d 21734 21735 217361028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 21737>1072 ulong >1 Compressed(%d), 21738>1100 ulong >1 %d headers, 21739>1104 ulong >0 %d x 21740>1108 ulong >0 %d, 21741>1120 ulong >0 %d bits/pixel 21742 21743# Type: GEDCOM genealogical (family history) data 21744# From: Giuseppe Bilotta 217450 search/1/c 0\ HEAD GEDCOM genealogy text 21746>&0 search 1\ GEDC 21747>>&0 search 2\ VERS version 21748>>>&1 string >\0 %s 21749# From: Phil Endecott <phil05@chezphil.org> 217500 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 217510 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 217520 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 217530 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 21754 21755# PDB: Protein Data Bank files 21756# Adam Buchbinder <adam.buchbinder@gmail.com> 21757# 21758# http://www.wwpdb.org/documentation/format32/sect2.html 21759# http://www.ch.ic.ac.uk/chemime/ 21760# 21761# The PDB file format is fixed-field, 80 columns. From the spec: 21762# 21763# COLS DATA 21764# 1 - 6 "HEADER" 21765# 11 - 50 String(40) 21766# 51 - 59 Date 21767# 63 - 66 IDcode 21768# 21769# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 21770# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 21771# uppercase letters. However, examples have been seen without the date string, 21772# e.g., the example on the chemime site. 217730 string HEADER\ \ \ \040 21774>&0 regex/1l \^.{40} 21775>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 21776>>>&0 regex/1ls [A-Z0-9]{4}.{14}$ 21777>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s 21778!:mime chemical/x-pdb 21779>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 21780 21781# Type: GDSII Stream file 217820 belong 0x00060002 GDSII Stream file 21783>4 byte 0x00 21784>>5 byte x version %d.0 21785>4 byte >0x00 version %d 21786>>5 byte x \b.%d 21787 21788# Type: LXT (interLaced eXtensible Trace) 21789# chrysn <chrysn@fsfe.org> 217900 beshort 0x0138 interLaced eXtensible Trace (LXT) file 21791>2 beshort >0 (Version %u) 21792 21793#------------------------------------------------------------------------------ 21794# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 217950 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 217960 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 217970 belong 0xedfeedfe Sun 'jks' Java Keystore File data 21798 217990 string \0volume_key volume_key escrow packet 21800# Type: SE Linux policy modules *.pp reference policy 21801# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 21802# URL: http://doc.coker.com.au/computers/selinux-magic 21803# From: Russell Coker <russell@coker.com.au> 21804 218050 lelong 0xf97cff8f SE Linux modular policy 21806>4 lelong x version %d, 21807>8 lelong x %d sections, 21808>>(12.l) lelong 0xf97cff8d 21809>>>(12.l+27) lelong x mod version %d, 21810>>>(12.l+31) lelong 0 Not MLS, 21811>>>(12.l+31) lelong 1 MLS, 21812>>>(12.l+23) lelong 2 21813>>>>(12.l+47) string >\0 module name %s 21814>>>(12.l+23) lelong 1 base 21815 218161 string policy_module( SE Linux policy module source 218172 string policy_module( SE Linux policy module source 21818 218190 string ##\ <summary> SE Linux policy interface source 21820 21821#0 search gen_context( SE Linux policy file contexts 21822 21823#0 search gen_sens( SE Linux policy MLS constraints source 21824 21825#------------------------------------------------------------------------------ 21826# $File: sendmail,v 1.9 2017/03/17 21:35:28 christos Exp $ 21827# sendmail: file(1) magic for sendmail config files 21828# 21829# XXX - byte order? 21830# 21831# Update: Joerg Jenderek 21832# GRR: this test is too general as it catches also 21833# READ.ME.FIRST.AWP Sendmail frozen configuration 21834# - version ====|====|====|====|====|====|====|====|====|====|====|====|=== 21835# Email_23_f217153422.ts Sendmail frozen configuration 21836# - version \330jK\354 218370 byte 046 21838# http://www.sendmail.com/sm/open_source/docs/older_release_notes/ 21839# freezed configuration file (dbm format?) created from sendmal.cf with -bz 21840# by older sendmail. til version 8.6 support for frozen configuration files is removed 21841# valid version numbers look like "7.14.4" and should be simliar to output of commands 21842# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf" 21843>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 21844# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc 21845!:ext fc 21846>>16 string >\0 - version %s 218470 short 0x271c 21848# look for valid version number 21849>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 21850!:ext fc 21851>>16 string >\0 - version %s 21852 21853#------------------------------------------------------------------------------ 21854# sendmail: file(1) magic for sendmail m4(1) files 21855# 21856# From Hendrik Scholz <hendrik@scholz.net> 21857# i.e. files in /usr/share/sendmail/cf/ 21858# 218590 string divert(-1)\n sendmail m4 text file 21860 21861 21862#------------------------------------------------------------------------------ 21863# $File: sequent,v 1.13 2017/03/17 21:35:28 christos Exp $ 21864# sequent: file(1) magic for Sequent machines 21865# 21866# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 21867# For Sequent's multiprocessor systems (incomplete). 218680 lelong 0x00ea BALANCE NS32000 .o 21869>16 lelong >0 not stripped 21870>124 lelong >0 version %d 218710 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 21872>16 lelong >0 not stripped 21873>124 lelong >0 version %d 218740 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 21875>16 lelong >0 not stripped 21876>124 lelong >0 version %d 218770 lelong 0x30ea BALANCE NS32000 standalone executable 21878>16 lelong >0 not stripped 21879>124 lelong >0 version %d 21880# 21881# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 21882# Symmetry magic nums will not be reached if DOS COM comes before them; 21883# byte 0xeb is matched before these get a chance. 218840 leshort 0x12eb SYMMETRY i386 .o 21885>16 lelong >0 not stripped 21886>124 lelong >0 version %d 218870 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 21888>16 lelong >0 not stripped 21889>124 lelong >0 version %d 218900 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 21891>16 lelong >0 not stripped 21892>124 lelong >0 version %d 21893# http://en.wikipedia.org/wiki/Sequent_Computer_Systems 21894# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader 21895#0 leshort 0x42eb SYMMETRY i386 standalone executable 218960 leshort 0x42eb 21897# skip unlike negative version 21898>124 lelong >-1 21899# assuming version 28867614 is very low probable 21900>>124 lelong !28867614 SYMMETRY i386 standalone executable 21901>>>16 lelong >0 not stripped 21902>>>124 lelong >0 version %d 21903 21904#------------------------------------------------------------------------------ 21905# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $ 21906# sereal: file(1) magic the Sereal binary serialization format 21907# 21908# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com> 21909# 21910# See the specification of the format at 21911# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format 21912# 21913# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by 21914# doing (byte&0xF0)>>4 here, but unfortunately that's not 21915# supported. So when we print out a message about an unknown format 21916# we'll print out e.g. 0x30 instead of the more human-readable 21917# 0x30>>4. 21918# 21919# See https://github.com/Sereal/Sereal/commit/35372ae01d in the 21920# Sereal.git repository for test Sereal data. 219210 name sereal 21922>4 byte&0x0F x (version %d, 21923>4 byte&0xF0 0x00 uncompressed) 21924>4 byte&0xF0 0x10 compressed with non-incremental Snappy) 21925>4 byte&0xF0 0x20 compressed with incremental Snappy) 21926>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4) 21927 219280 string/b \=srl Sereal data packet 21929!:mime application/sereal 21930>&0 use sereal 219310 string/b \=\xF3rl Sereal data packet 21932!:mime application/sereal 21933>&0 use sereal 219340 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded 21935!:mime application/sereal 21936>&0 use sereal 21937 21938 21939#------------------------------------------------------------------------------ 21940# $File: sgi,v 1.22 2015/08/29 07:10:35 christos Exp $ 21941# sgi: file(1) magic for Silicon Graphics operating systems and applications 21942# 21943# Executable images are handled either in aout (for old-style a.out 21944# files for 68K; they are indistinguishable from other big-endian 32-bit 21945# a.out files) or in mips (for MIPS ECOFF and Ucode files) 21946# 21947 21948# kbd file definitions 219490 string kbd!map kbd map file 21950>8 byte >0 Ver %d: 21951>10 short >0 with %d table(s) 21952 219530 beshort 0x8765 disk quotas file 21954 219550 beshort 0x0506 IRIS Showcase file 21956>2 byte 0x49 - 21957>3 byte x - version %d 219580 beshort 0x0226 IRIS Showcase template 21959>2 byte 0x63 - 21960>3 byte x - version %d 219610 belong 0x5343464d IRIS Showcase file 21962>4 byte x - version %d 219630 belong 0x5443464d IRIS Showcase template 21964>4 byte x - version %d 219650 belong 0xdeadbabe IRIX Parallel Arena 21966>8 belong >0 - version %d 21967 21968# core files 21969# 21970# 32bit core file 219710 belong 0xdeadadb0 IRIX core dump 21972>4 belong 1 of 21973>16 string >\0 '%s' 21974# 64bit core file 219750 belong 0xdeadad40 IRIX 64-bit core dump 21976>4 belong 1 of 21977>16 string >\0 '%s' 21978# N32bit core file 219790 belong 0xbabec0bb IRIX N32 core dump 21980>4 belong 1 of 21981>16 string >\0 '%s' 21982# New style crash dump file 219830 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 21984>36 string >\0 '%s' 21985 21986# Trusted IRIX info 219870 string SGIAUDIT SGI Audit file 21988>8 byte x - version %d 21989>9 byte x \b.%d 21990# 219910 string WNGZWZSC Wingz compiled script 219920 string WNGZWZSS Wingz spreadsheet 219930 string WNGZWZHP Wingz help file 21994# 219950 string #Inventor\040V IRIS Inventor 1.0 file 219960 string #Inventor\040V2 Open Inventor 2.0 file 21997# GLF is OpenGL stream encoding 219980 string glfHeadMagic(); GLF_TEXT 219994 belong 0x7d000000 GLF_BINARY_LSB_FIRST 22000!:strength -30 220014 belong 0x0000007d GLF_BINARY_MSB_FIRST 22002!:strength -30 22003# GLS is OpenGL stream encoding; GLS is the successor of GLF 220040 string glsBeginGLS( GLS_TEXT 220054 belong 0x10000000 GLS_BINARY_LSB_FIRST 22006!:strength -30 220074 belong 0x00000010 GLS_BINARY_MSB_FIRST 22008!:strength -30 22009 22010# 22011# 22012# Performance Co-Pilot file types 220130 string PmNs PCP compiled namespace (V.0) 220140 string PmN PCP compiled namespace 22015>3 string >\0 (V.%1.1s) 22016#3 lelong 0x84500526 PCP archive 220173 belong 0x84500526 PCP archive 22018>7 byte x (V.%d) 22019#>20 lelong -2 temporal index 22020#>20 lelong -1 metadata 22021#>20 lelong 0 log volume #0 22022#>20 lelong >0 log volume #%d 22023>20 belong -2 temporal index 22024>20 belong -1 metadata 22025>20 belong 0 log volume #0 22026>20 belong >0 log volume #%d 22027>24 string >\0 host: %s 220280 string PCPFolio PCP 22029>9 string Version: Archive Folio 22030>18 string >\0 (V.%s) 220310 string #pmchart PCP pmchart view 22032>9 string Version 22033>17 string >\0 (V%-3.3s) 220340 string #kmchart PCP kmchart view 22035>9 string Version 22036>17 string >\0 (V.%s) 220370 string pmview PCP pmview config 22038>7 string Version 22039>15 string >\0 (V%-3.3s) 220400 string #pmlogger PCP pmlogger config 22041>10 string Version 22042>18 string >\0 (V%1.1s) 220430 string #pmdahotproc PCP pmdahotproc config 22044>13 string Version 22045>21 string >\0 (V%-3.3s) 220460 string PcPh PCP Help 22047>4 string 1 Index 22048>4 string 2 Text 22049>5 string >\0 (V.%1.1s) 220500 string #pmieconf-rules PCP pmieconf rules 22051>16 string >\0 (V.%1.1s) 220523 string pmieconf-pmie PCP pmie config 22053>17 string >\0 (V.%1.1s) 22054 22055# SpeedShop data files 220560 lelong 0x13130303 SpeedShop data file 22057 22058# mdbm files 220590 lelong 0x01023962 mdbm file, version 0 (obsolete) 220600 string mdbm mdbm file, 22061>5 byte x version %d, 22062>6 byte x 2^%d pages, 22063>7 byte x pagesize 2^%d, 22064>17 byte x hash %d, 22065>11 byte x dataformat %d 22066 22067# Alias Maya files 220680 string/t //Maya\040ASCII Alias Maya Ascii File, 22069>13 string >\0 version %s 220708 string MAYAFOR4 Alias Maya Binary File, 22071>32 string >\0 version %s scene 220728 string MayaFOR4 Alias Maya Binary File, 22073>32 string >\0 version %s scene 220748 string CIMG Alias Maya Image File 220758 string DEEP Alias Maya Image File 22076 22077#------------------------------------------------------------------------------ 22078# $File: sgml,v 1.36 2016/12/01 15:40:52 christos Exp $ 22079# Type: SVG Vectorial Graphics 22080# From: Noel Torres <tecnico@ejerciciosresueltos.com> 220810 string \<?xml\ version=" 22082>15 string >\0 22083>>19 search/4096 \<svg SVG Scalable Vector Graphics image 22084!:mime image/svg+xml 22085>>19 search/4096 \<gnc-v2 GnuCash file 22086!:mime application/x-gnucash 220870 string \<svg SVG Scalable Vector Graphics image 22088!:mime image/svg 22089 22090# Sitemap file 220910 string/t \<?xml\ version=" 22092>15 string >\0 22093>>19 search/4096 \<urlset XML Sitemap document text 22094!:mime application/xml-sitemap 22095 22096# OpenStreetMap XML (.osm) 22097# http://wiki.openstreetmap.org/wiki/OSM_XML 22098# From: Markus Heidelberg <markus.heidelberg@web.de> 220990 string \<?xml\ version=" 22100>15 string >\0 22101>>19 search/4096 \<osm OpenStreetMap XML data 22102 22103# xhtml 221040 string/t \<?xml\ version=" 22105>19 search/4096/cWbt \<!doctype\ html XHTML document text 22106>>15 string >\0 (version %.3s) 22107!:mime text/html 221080 string/t \<?xml\ version=' 22109>19 search/4096/cWbt \<!doctype\ html XHTML document text 22110>>15 string >\0 (version %.3s) 22111!:mime text/html 221120 string/t \<?xml\ version=" 22113>19 search/4096/cWbt \<html broken XHTML document text 22114>>15 string >\0 (version %.3s) 22115!:mime text/html 22116 22117#------------------------------------------------------------------------------ 22118# sgml: file(1) magic for Standard Generalized Markup Language 22119# HyperText Markup Language (HTML) is an SGML document type, 22120# from Daniel Quinlan (quinlan@yggdrasil.com) 22121# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 221220 search/4096/cWt \<!doctype\ html HTML document text 22123!:mime text/html 22124!:strength + 5 22125 22126# SVG document 22127# https://www.w3.org/TR/SVG/single-page.html 221280 search/4096/cWbt \<!doctype\ svg SVG XML document 22129!:mime image/svg+xml 22130!:strength + 5 22131 221320 search/4096/cwt \<head\> HTML document text 22133!:mime text/html 22134!:strength + 5 221350 search/4096/cWt \<head\ HTML document text 22136!:mime text/html 22137!:strength + 5 221380 search/4096/cwt \<title\> HTML document text 22139!:mime text/html 22140!:strength + 5 221410 search/4096/cWt \<title\ HTML document text 22142!:mime text/html 22143!:strength + 5 221440 search/4096/cwt \<html\> HTML document text 22145!:mime text/html 22146!:strength + 5 221470 search/4096/cWt \<html\ HTML document text 22148!:mime text/html 22149!:strength + 5 221500 search/4096/cwt \<script\> HTML document text 22151!:mime text/html 22152!:strength + 5 221530 search/4096/cWt \<script\ HTML document text 22154!:mime text/html 22155!:strength + 5 221560 search/4096/cwt \<style\> HTML document text 22157!:mime text/html 22158!:strength + 5 221590 search/4096/cWt \<style\ HTML document text 22160!:mime text/html 22161!:strength + 5 221620 search/4096/cwt \<table\> HTML document text 22163!:mime text/html 22164!:strength + 5 221650 search/4096/cWt \<table\ HTML document text 22166!:mime text/html 22167!:strength + 5 22168 221690 search/4096/cwt \<a\ href= HTML document text 22170!:mime text/html 22171!:strength + 5 22172 22173# Extensible markup language (XML), a subset of SGML 22174# from Marc Prud'hommeaux (marc@apocalypse.org) 221750 search/1/cwt \<?xml XML document text 22176!:mime text/xml 22177!:strength + 5 221780 string/t \<?xml\ version\ " XML 22179!:mime text/xml 22180!:strength + 5 221810 string/t \<?xml\ version=" XML 22182!:mime text/xml 22183!:strength + 5 22184>15 string/t >\0 %.3s document text 22185>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 22186>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 221870 string \<?xml\ version=' XML 22188!:mime text/xml 22189!:strength + 5 22190>15 string/t >\0 %.3s document text 22191>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 22192>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 221930 search/1/wt \<?XML broken XML document text 22194!:mime text/xml 22195!:strength - 10 22196 22197 22198# SGML, mostly from rph@sq 221990 search/4096/cwt \<!doctype exported SGML document text 222000 search/4096/cwt \<!subdoc exported SGML subdocument text 222010 search/4096/cwt \<!-- exported SGML document text 22202!:strength - 10 22203 22204# Web browser cookie files 22205# (Mozilla, Galeon, Netscape 4, Konqueror..) 22206# Ulf Harnhammar <ulfh@update.uu.se> 222070 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 222080 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 222090 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 22210 22211#------------------------------------------------------------------------ 22212# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $ 22213# file(1) magic for sharc files 22214# 22215# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 22216# FutureGroove Music (dsp@futuregroove.de) 22217 22218#------------------------------------------------------------------------ 22219#0 string Draw RiscOS Drawfile 22220#0 string PACK RiscOS PackdDir archive 22221 22222#------------------------------------------------------------------------ 22223# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 22224 22225#0 string =! Assembler source 22226#0 string Analog ADi asm listing file 222270 string .SYSTEM SHARC architecture file 222280 string .system SHARC architecture file 22229 222300 leshort 0x521C SHARC COFF binary 22231>2 leshort >1 , %d sections 22232>>12 lelong >0 , not stripped 22233 22234#------------------------------------------------------------------------------ 22235# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $ 22236# sinclair: file(1) sinclair QL 22237 22238# additions to /etc/magic by Thomas M. Ott (ThMO) 22239 22240# Sinclair QL floppy disk formats (ThMO) 222410 string =QL5 QL disk dump data, 22242>3 string =A 720 KB, 22243>3 string =B 1.44 MB, 22244>3 string =C 3.2 MB, 22245>4 string >\0 label:%.10s 22246 22247# Sinclair QL OS dump (ThMO) 222480 belong =0x30000 22249>49124 belong <47104 22250>>49128 belong <47104 22251>>>49132 belong <47104 22252>>>>49136 belong <47104 QL OS dump data, 22253>>>>>49148 string >\0 type %.3s, 22254>>>>>49142 string >\0 version %.4s 22255 22256# Sinclair QL firmware executables (ThMO) 222570 string NqNqNq`\004 QL firmware executable (BCPL) 22258 22259# Sinclair QL libraries (was ThMO) 222600 beshort 0xFB01 QDOS object 22261>2 pstring x '%s' 22262 22263# Sinclair QL executables (was ThMO) 222644 belong 0x4AFB QDOS executable 22265>9 pstring x '%s' 22266 22267# Sinclair QL ROM (ThMO) 222680 belong =0x4AFB0001 QL plugin-ROM data, 22269>9 pstring =\0 un-named 22270>9 pstring >\0 named: %s 22271# Type: SiSU Markup Language 22272# URL: http://www.sisudoc.org/ 22273# From: Ralph Amissah <ralph.amissah@gmail.com> 22274 222750 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 22276>5 regex [0-9.]+ %s 22277 222780 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 22279>5 regex [0-9.]+ %s 22280 222810 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 22282>5 regex [0-9.]+ %s 22283 222840 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 22285>5 regex [0-9.]+ %s 22286 222870 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 22288>5 regex [0-9.]+ %s 22289 22290#------------------------------------------------------------------------------ 22291# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $ 22292# Sketch Drawings: http://sketch.sourceforge.net/ 22293# From: Edwin Mons <e@ik.nu> 222940 search/1 ##Sketch Sketch document text 22295 22296#----------------------------------------------- 22297# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 22298# GNU Smalltalk image, starting at version 1.6.2 22299# From: catull_us@yahoo.com 22300# 223010 string GSTIm\0\0 GNU SmallTalk 22302# little-endian 22303>7 byte&1 =0 LE image version 22304>>10 byte x %d. 22305>>9 byte x \b%d. 22306>>8 byte x \b%d 22307#>>12 lelong x , data: %ld 22308#>>16 lelong x , table: %ld 22309#>>20 lelong x , memory: %ld 22310# big-endian 22311>7 byte&1 =1 BE image version 22312>>8 byte x %d. 22313>>9 byte x \b%d. 22314>>10 byte x \b%d 22315#>>12 belong x , data: %ld 22316#>>16 belong x , table: %ld 22317#>>20 belong x , memory: %ld 22318 22319 22320 22321#------------------------------------------------------------------------------ 22322# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 22323# smile: file(1) magic for Smile serialization 22324# 22325# The Smile serialization format uses a 4-byte header: 22326# 22327# Constant byte #0: 0x3A (ASCII ':') 22328# Constant byte #1: 0x29 (ASCII ')') 22329# Constant byte #2: 0x0A (ASCII linefeed, '\n') 22330# Variable byte #3, consisting of bits: 22331# Bits 4-7 (4 MSB): 4-bit version number 22332# Bits 3: Reserved 22333# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 22334# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 22335# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 22336# 22337# Reference: http://wiki.fasterxml.com/SmileFormatSpec 22338# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 22339 22340# Detection 223410 string :)\n Smile binary data 22342 22343# Versioning 22344>3 byte&0xF0 x version %d: 22345 22346# Properties 22347>3 byte&0x04 0x04 binary raw, 22348>3 byte&0x04 0x00 binary encoded, 22349>3 byte&0x02 0x02 shared String values enabled, 22350>3 byte&0x02 0x00 shared String values disabled, 22351>3 byte&0x01 0x01 shared field names enabled 22352>3 byte&0x01 0x00 shared field names disabled 22353 22354 22355#------------------------------------------------------------------------------ 22356# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $ 22357# sniffer: file(1) magic for packet capture files 22358# 22359# From: guy@alum.mit.edu (Guy Harris) 22360# 22361 22362# 22363# Microsoft Network Monitor 1.x capture files. 22364# 223650 string RTSS NetMon capture file 22366>5 byte x - version %d 22367>4 byte x \b.%d 22368>6 leshort 0 (Unknown) 22369>6 leshort 1 (Ethernet) 22370>6 leshort 2 (Token Ring) 22371>6 leshort 3 (FDDI) 22372>6 leshort 4 (ATM) 22373>6 leshort >4 (type %d) 22374 22375# 22376# Microsoft Network Monitor 2.x capture files. 22377# 223780 string GMBU NetMon capture file 22379>5 byte x - version %d 22380>4 byte x \b.%d 22381>6 leshort 0 (Unknown) 22382>6 leshort 1 (Ethernet) 22383>6 leshort 2 (Token Ring) 22384>6 leshort 3 (FDDI) 22385>6 leshort 4 (ATM) 22386>6 leshort 5 (IP-over-IEEE 1394) 22387>6 leshort 6 (802.11) 22388>6 leshort 7 (Raw IP) 22389>6 leshort 8 (Raw IP) 22390>6 leshort 9 (Raw IP) 22391>6 leshort >9 (type %d) 22392 22393# 22394# Network General Sniffer capture files. 22395# Sorry, make that "Network Associates Sniffer capture files." 22396# Sorry, make that "Network General old DOS Sniffer capture files." 22397# 223980 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file 22399>33 byte 2 (compressed) 22400>23 leshort x - version %d 22401>25 leshort x \b.%d 22402>32 byte 0 (Token Ring) 22403>32 byte 1 (Ethernet) 22404>32 byte 2 (ARCNET) 22405>32 byte 3 (StarLAN) 22406>32 byte 4 (PC Network broadband) 22407>32 byte 5 (LocalTalk) 22408>32 byte 6 (Znet) 22409>32 byte 7 (Internetwork Analyzer) 22410>32 byte 9 (FDDI) 22411>32 byte 10 (ATM) 22412 22413# 22414# Cinco Networks NetXRay capture files. 22415# Sorry, make that "Network General Sniffer Basic capture files." 22416# Sorry, make that "Network Associates Sniffer Basic capture files." 22417# Sorry, make that "Network Associates Sniffer Basic, and Windows 22418# Sniffer Pro", capture files." 22419# Sorry, make that "Network General Sniffer capture files." 22420# Sorry, make that "NetScout Sniffer capture files." 22421# 224220 string XCP\0 NetXRay capture file 22423>4 string >\0 - version %s 22424>44 leshort 0 (Ethernet) 22425>44 leshort 1 (Token Ring) 22426>44 leshort 2 (FDDI) 22427>44 leshort 3 (WAN) 22428>44 leshort 8 (ATM) 22429>44 leshort 9 (802.11) 22430 22431# 22432# "libpcap" capture files. 22433# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 22434# the main program that uses that format, but there are other programs 22435# that use "libpcap", or that use the same capture file format.) 22436# 224370 name pcap-be 22438>4 beshort x - version %d 22439>6 beshort x \b.%d 22440>20 belong 0 (No link-layer encapsulation 22441>20 belong 1 (Ethernet 22442>20 belong 2 (3Mb Ethernet 22443>20 belong 3 (AX.25 22444>20 belong 4 (ProNET 22445>20 belong 5 (CHAOS 22446>20 belong 6 (Token Ring 22447>20 belong 7 (BSD ARCNET 22448>20 belong 8 (SLIP 22449>20 belong 9 (PPP 22450>20 belong 10 (FDDI 22451>20 belong 11 (RFC 1483 ATM 22452>20 belong 12 (raw IP 22453>20 belong 13 (BSD/OS SLIP 22454>20 belong 14 (BSD/OS PPP 22455>20 belong 19 (Linux ATM Classical IP 22456>20 belong 50 (PPP or Cisco HDLC 22457>20 belong 51 (PPP-over-Ethernet 22458>20 belong 99 (Symantec Enterprise Firewall 22459>20 belong 100 (RFC 1483 ATM 22460>20 belong 101 (raw IP 22461>20 belong 102 (BSD/OS SLIP 22462>20 belong 103 (BSD/OS PPP 22463>20 belong 104 (BSD/OS Cisco HDLC 22464>20 belong 105 (802.11 22465>20 belong 106 (Linux Classical IP over ATM 22466>20 belong 107 (Frame Relay 22467>20 belong 108 (OpenBSD loopback 22468>20 belong 109 (OpenBSD IPsec encrypted 22469>20 belong 112 (Cisco HDLC 22470>20 belong 113 (Linux "cooked" 22471>20 belong 114 (LocalTalk 22472>20 belong 117 (OpenBSD PFLOG 22473>20 belong 119 (802.11 with Prism header 22474>20 belong 122 (RFC 2625 IP over Fibre Channel 22475>20 belong 123 (SunATM 22476>20 belong 127 (802.11 with radiotap header 22477>20 belong 129 (Linux ARCNET 22478>20 belong 138 (Apple IP over IEEE 1394 22479>20 belong 139 (MTP2 with pseudo-header 22480>20 belong 140 (MTP2 22481>20 belong 141 (MTP3 22482>20 belong 142 (SCCP 22483>20 belong 143 (DOCSIS 22484>20 belong 144 (IrDA 22485>20 belong 147 (Private use 0 22486>20 belong 148 (Private use 1 22487>20 belong 149 (Private use 2 22488>20 belong 150 (Private use 3 22489>20 belong 151 (Private use 4 22490>20 belong 152 (Private use 5 22491>20 belong 153 (Private use 6 22492>20 belong 154 (Private use 7 22493>20 belong 155 (Private use 8 22494>20 belong 156 (Private use 9 22495>20 belong 157 (Private use 10 22496>20 belong 158 (Private use 11 22497>20 belong 159 (Private use 12 22498>20 belong 160 (Private use 13 22499>20 belong 161 (Private use 14 22500>20 belong 162 (Private use 15 22501>20 belong 163 (802.11 with AVS header 22502>20 belong 165 (BACnet MS/TP 22503>20 belong 166 (PPPD 22504>20 belong 169 (GPRS LLC 22505>20 belong 177 (Linux LAPD 22506>20 belong 187 (Bluetooth HCI H4 22507>20 belong 189 (Linux USB 22508>20 belong 192 (PPI 22509>20 belong 195 (802.15.4 22510>20 belong 196 (SITA 22511>20 belong 197 (Endace ERF 22512>20 belong 201 (Bluetooth HCI H4 with pseudo-header 22513>20 belong 202 (AX.25 with KISS header 22514>20 belong 203 (LAPD 22515>20 belong 204 (PPP with direction pseudo-header 22516>20 belong 205 (Cisco HDLC with direction pseudo-header 22517>20 belong 206 (Frame Relay with direction pseudo-header 22518>20 belong 209 (Linux IPMB 22519>20 belong 215 (802.15.4 with non-ASK PHY header 22520>20 belong 220 (Memory-mapped Linux USB 22521>20 belong 224 (Fibre Channel FC-2 22522>20 belong 225 (Fibre Channel FC-2 with frame delimiters 22523>20 belong 226 (Solaris IPNET 22524>20 belong 227 (SocketCAN 22525>20 belong 228 (Raw IPv4 22526>20 belong 229 (Raw IPv6 22527>20 belong 230 (802.15.4 without FCS 22528>20 belong 231 (D-Bus messages 22529>20 belong 235 (DVB-CI 22530>20 belong 236 (MUX27010 22531>20 belong 237 (STANAG 5066 D_PDUs 22532>20 belong 239 (Linux netlink NFLOG messages 22533>20 belong 240 (Hilscher netAnalyzer 22534>20 belong 241 (Hilscher netAnalyzer with delimiters 22535>20 belong 242 (IP-over-Infiniband 22536>20 belong 243 (MPEG-2 Transport Stream packets 22537>20 belong 244 (ng4t ng40 22538>20 belong 245 (NFC LLCP 22539>20 belong 247 (Infiniband 22540>20 belong 248 (SCTP 22541>16 belong x \b, capture length %d) 22542 225430 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian) 22544!:mime application/vnd.tcpdump.pcap 22545>0 use pcap-be 225460 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) 22547!:mime application/vnd.tcpdump.pcap 22548>0 use \^pcap-be 22549 22550# 22551# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 22552# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 22553# the main program that uses that format, but there are other programs 22554# that use "libpcap", or that use the same capture file format.) 22555# 225560 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian) 22557>0 use pcap-be 225580 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian) 22559>0 use \^pcap-be 22560 22561# 22562# "pcap-ng" capture files. 22563# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html 22564# Pcap-ng files can contain multiple sections. Printing the endianness, 22565# snaplen, or other information from the first SHB may be misleading. 22566# 225670 ubelong 0x0a0d0d0a 22568>8 ubelong 0x1a2b3c4d pcap-ng capture file 22569>>12 beshort x - version %d 22570>>14 beshort x \b.%d 225710 ulelong 0x0a0d0d0a 22572>8 ulelong 0x1a2b3c4d pcap-ng capture file 22573>>12 leshort x - version %d 22574>>14 leshort x \b.%d 22575 22576# 22577# AIX "iptrace" capture files. 22578# 225790 string iptrace\ 1.0 "iptrace" capture file 225800 string iptrace\ 2.0 "iptrace" capture file 22581 22582# 22583# Novell LANalyzer capture files. 22584# 225850 leshort 0x1001 LANalyzer capture file 225860 leshort 0x1007 LANalyzer capture file 22587 22588# 22589# HP-UX "nettl" capture files. 22590# 225910 string \x54\x52\x00\x64\x00 "nettl" capture file 22592 22593# 22594# RADCOM WAN/LAN Analyzer capture files. 22595# 225960 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 22597 22598# 22599# NetStumbler log files. Not really packets, per se, but about as 22600# close as you can get. These are log files from NetStumbler, a 22601# Windows program, that scans for 802.11b networks. 22602# 226030 string NetS NetStumbler log file 22604>8 lelong x \b, %d stations found 22605 22606# 22607# *Peek tagged capture files. 22608# 226090 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 22610 22611# 22612# Visual Networks traffic capture files. 22613# 226140 string \x05VNF Visual Networks traffic capture file 22615 22616# 22617# Network Instruments Observer capture files. 22618# 226190 string ObserverPktBuffe Network Instruments Observer capture file 22620 22621# 22622# Files from Accellent Group's 5View products. 22623# 226240 string \xaa\xaa\xaa\xaa 5View capture file 22625 22626#------------------------------------------------------------------------------ 22627# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 22628# softquad: file(1) magic for SoftQuad Publishing Software 22629# 22630# Author/Editor and RulesBuilder 22631# 22632# XXX - byte order? 22633# 226340 string \<!SQ\ DTD> Compiled SGML rules file 22635>9 string >\0 Type %s 226360 string \<!SQ\ A/E> A/E SGML Document binary 22637>9 string >\0 Type %s 226380 string \<!SQ\ STS> A/E SGML binary styles file 22639>9 string >\0 Type %s 226400 short 0xc0de Compiled PSI (v1) data 226410 short 0xc0da Compiled PSI (v2) data 22642>3 string >\0 (%s) 22643# Binary sqtroff font/desc files... 226440 short 0125252 SoftQuad DESC or font file binary 22645>2 short >0 - version %d 22646# Bitmaps... 226470 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 22648#0 string SQ\ BITMAP2 SoftQuad Raster Format data 22649# sqtroff intermediate language (replacement for ditroff int. lang.) 226500 string X\ SoftQuad troff Context intermediate 22651>2 string 495 for AT&T 495 laser printer 22652>2 string hp for Hewlett-Packard LaserJet 22653>2 string impr for IMAGEN imPRESS 22654>2 string ps for PostScript 22655 22656# From: Michael Piefel <piefel@debian.org> 22657# sqtroff intermediate language (replacement for ditroff int. lang.) 226580 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 226590 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 226600 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 226610 string X\ ps SoftQuad troff Context intermediate for PostScript 22662 22663#------------------------------------------------------------------------------ 22664# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 22665# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 22666# 22667# Cloyce D. Spradling <cloyce@headgear.org> 22668 226690 string spec SPEC 22670>4 string .cpu CPU 22671>>8 string <: \b%.4s 22672>>12 string . raw result text 22673 2267417 string version=SPECjbb SPECjbb 22675>32 string <: \b%.4s 22676>>37 string <: v%.4s raw result text 22677 226780 string BEGIN\040SPECWEB SPECweb 22679>13 string <: \b%.2s 22680>>15 string _SSL \b_SSL 22681>>>20 string <: v%.4s raw result text 22682>>16 string <: v%.4s raw result text 22683 22684#------------------------------------------------------------------------------ 22685# $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $ 22686# spectrum: file(1) magic for Spectrum emulator files. 22687# 22688# John Elliott <jce@seasip.demon.co.uk> 22689 22690# 22691# Spectrum +3DOS header 22692# 226930 string PLUS3DOS\032 Spectrum +3 data 22694>15 byte 0 - BASIC program 22695>15 byte 1 - number array 22696>15 byte 2 - character array 22697>15 byte 3 - memory block 22698>>16 belong 0x001B0040 (screen) 22699>15 byte 4 - Tasword document 22700>15 string TAPEFILE - ZXT tapefile 22701# 22702# Tape file. This assumes the .TAP starts with a Spectrum-format header, 22703# which nearly all will. 22704# 22705# Update: Sanity-check string contents to be printable. 22706# -Adam Buchbinder <adam.buchbinder@gmail.com> 22707# 227080 string \023\000\000 22709>4 string >\0 22710>>4 string <\177 Spectrum .TAP data "%-10.10s" 22711>>>3 byte 0 - BASIC program 22712>>>3 byte 1 - number array 22713>>>3 byte 2 - character array 22714>>>3 byte 3 - memory block 22715>>>>14 belong 0x001B0040 (screen) 22716 22717# The following three blocks are from pak21-spectrum@srcf.ucam.org 22718# TZX tape images 227190 string ZXTape!\x1a Spectrum .TZX data 22720>8 byte x version %d 22721>9 byte x \b.%d 22722 22723# RZX input recording files 227240 string RZX! Spectrum .RZX data 22725>4 byte x version %d 22726>5 byte x \b.%d 22727 22728# Floppy disk images 227290 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 227300 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 227310 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 227320 string SINCLAIR Spectrum .SCL Betadisk image 22733 22734# Hard disk images 227350 string RS-IDE\x1a Spectrum .HDF hard disk image 22736>7 byte x \b, version 0x%02x 22737 22738#------------------------------------------------------------------------------ 22739# $File: sql,v 1.21 2017/03/17 21:35:28 christos Exp $ 22740# sql: file(1) magic for SQL files 22741# 22742# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 22743# Recognize some MySQL files. 22744# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 22745# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 22746# 227470 beshort 0xfe01 MySQL table definition file 22748>2 byte x Version %d 22749>3 byte 0 \b, type UNKNOWN 22750>3 byte 1 \b, type DIAM_ISAM 22751>3 byte 2 \b, type HASH 22752>3 byte 3 \b, type MISAM 22753>3 byte 4 \b, type PISAM 22754>3 byte 5 \b, type RMS_ISAM 22755>3 byte 6 \b, type HEAP 22756>3 byte 7 \b, type ISAM 22757>3 byte 8 \b, type MRG_ISAM 22758>3 byte 9 \b, type MYISAM 22759>3 byte 10 \b, type MRG_MYISAM 22760>3 byte 11 \b, type BERKELEY_DB 22761>3 byte 12 \b, type INNODB 22762>3 byte 13 \b, type GEMINI 22763>3 byte 14 \b, type NDBCLUSTER 22764>3 byte 15 \b, type EXAMPLE_DB 22765>3 byte 16 \b, type CSV_DB 22766>3 byte 17 \b, type FEDERATED_DB 22767>3 byte 18 \b, type BLACKHOLE_DB 22768>3 byte 19 \b, type PARTITION_DB 22769>3 byte 20 \b, type BINLOG 22770>3 byte 21 \b, type SOLID 22771>3 byte 22 \b, type PBXT 22772>3 byte 23 \b, type TABLE_FUNCTION 22773>3 byte 24 \b, type MEMCACHE 22774>3 byte 25 \b, type FALCON 22775>3 byte 26 \b, type MARIA 22776>3 byte 27 \b, type PERFORMANCE_SCHEMA 22777>3 byte 127 \b, type DEFAULT 22778>0x0033 ulong x \b, MySQL version %d 227790 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 22780>3 byte x Version %d 227810 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 22782>3 byte x Version %d 227830 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 22784>3 byte x Version %d 22785>14 beshort x \b, %d key parts 22786>16 beshort x \b, %d unique key parts 22787>18 byte x \b, %d keys 22788>28 bequad x \b, %lld records 22789>36 bequad x \b, %lld deleted records 227900 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 22791>3 byte x Version %d 227920 belong&0xffffff00 0xfefe0900 MySQL Maria index file 22793>3 byte x Version %d 227940 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file 22795>3 byte x Version %d 227960 belong&0xffffff00 0xfefe0c00 22797>4 string MACF MySQL Maria control file 22798>>3 byte x Version %d 227990 string \376bin MySQL replication log, 22800>9 long x server id %d 22801>8 byte 1 22802>>13 long 69 \b, MySQL V3.2.3 22803>>>19 string x \b, server version %s 22804>>13 long 75 \b, MySQL V4.0.2-V4.1 22805>>>25 string x \b, server version %s 22806>8 byte 15 MySQL V5+, 22807>>25 string x server version %s 22808>4 string MARIALOG MySQL Maria transaction log file 22809>>3 byte x Version %d 22810 22811#------------------------------------------------------------------------------ 22812# iRiver H Series database file 22813# From Ken Guest <ken@linux.ie> 22814# As observed from iRivNavi.iDB and unencoded firmware 22815# 228160 string iRivDB iRiver Database file 22817>11 string >\0 Version %s 22818>39 string iHP-100 [H Series] 22819 22820#------------------------------------------------------------------------------ 22821# SQLite database files 22822# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 22823# 22824# Version 1 used GDBM internally; its files cannot be distinguished 22825# from other GDBM files. 22826# 22827# Version 2 used this format: 228280 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 22829 22830# Version 3 of SQLite allows applications to embed their own "user version" 22831# number in the database at offset 60. Later, SQLite added an "application id" 22832# at offset 68 that is preferred over "user version" for indicating the 22833# associated application. 22834# 228350 string SQLite\ format\ 3 SQLite 3.x database 22836!:mime application/x-sqlite3 22837# seldom found extension sqlite3 like in SyncData.sqlite3 22838# db 22839# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe 22840# Unfortunately extension sqlite also used for other databases starting with string 22841# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite 22842# and with string "ZV-zlib" in like extra.sqlite 22843!:ext sqlite/sqlite3/db/dbe 22844>60 belong =0x5f4d544e (Monotone source repository) 22845>68 belong =0x0f055112 (Fossil checkout) 22846>68 belong =0x0f055113 (Fossil global configuration) 22847>68 belong =0x0f055111 (Fossil repository) 22848>68 belong =0x42654462 (Bentley Systems BeSQLite Database) 22849>68 belong =0x42654c6e (Bentley Systems Localization File) 22850>68 belong =0x47504b47 (OGC GeoPackage file) 22851>68 default x 22852>>68 belong !0 \b, application id %u 22853>>60 belong !0 \b, user version %d 22854>96 belong x \b, last written using SQLite version %d 22855 22856 22857# SQLite Write-Ahead Log from SQLite version >= 3.7.0 22858# http://www.sqlite.org/fileformat.html#walformat 228590 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 22860!:ext sqlite-wal/db-wal 22861>4 belong x version %d 22862 22863# SQLite Rollback Journal 22864# http://www.sqlite.org/fileformat.html#rollbackjournal 228650 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 22866 22867# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 22868# https://github.com/PredatH0r/ChanSort 228690 string PSDB\0 Panasonic channel list DataBase 22870!:ext db/bin 22871#!:mime application/x-db-svl-panasonic 22872>126 string SQLite\ format\ 3 22873#!:mime application/x-panasonic-sqlite3 22874>>&-15 indirect x \b; contains 22875 22876# H2 Database from http://www.h2database.com/ 228770 string --\ H2\ 0.5/B\ --\ \n H2 Database file 22878# Type: OpenSSH key files 22879# From: Nicolas Collignon <tsointsoin@gmail.com> 22880 228810 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 22882>28 string >\0 version %s 228830 string -----BEGIN\ OPENSSH\ PRIVATE\ KEY----- OpenSSH private key 22884 228850 string ssh-dss\ OpenSSH DSA public key 228860 string ssh-rsa\ OpenSSH RSA public key 228870 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 228880 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 228890 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 228900 string ssh-ed25519 OpenSSH ED25519 public key 22891 22892#------------------------------------------------------------------------------ 22893# $File: ssl,v 1.4 2017/01/22 21:14:25 christos Exp $ 22894# ssl: file(1) magic for SSL file formats 22895 22896# Type: OpenSSL certificates/key files 22897# From: Nicolas Collignon <tsointsoin@gmail.com> 22898 228990 string -----BEGIN\040CERTIFICATE----- PEM certificate 229000 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request 229010 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key 229020 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key 229030 string -----BEGIN\040EC\040PRIVATE PEM EC private key 229040 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key 22905 22906# From Luc Gommans 22907# OpenSSL enc file (recognized by a magic string preceding the password's salt) 229080 string Salted__ openssl enc'd data with salted password 22909# Using the -a or -base64 option, OpenSSL will base64-encode the data. 229100 string U2FsdGVkX19 openssl enc'd data with salted password, base64 encoded 22911 22912#------------------------------------------------------------------------------ 22913# $File: sun,v 1.27 2014/04/30 21:41:02 christos Exp $ 22914# sun: file(1) magic for Sun machines 22915# 22916# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 22917# releases. (5.x uses ELF.) Entries for executables without an 22918# architecture type, used before the 68020-based Sun-3's came out, 22919# are in aout, as they're indistinguishable from other big-endian 22920# 32-bit a.out files. 22921# 229220 belong&077777777 0600413 a.out SunOS SPARC demand paged 22923>0 byte &0x80 22924>>20 belong <4096 shared library 22925>>20 belong =4096 dynamically linked executable 22926>>20 belong >4096 dynamically linked executable 22927>0 byte ^0x80 executable 22928>16 belong >0 not stripped 22929 229300 belong&077777777 0600410 a.out SunOS SPARC pure 22931>0 byte &0x80 dynamically linked executable 22932>0 byte ^0x80 executable 22933>16 belong >0 not stripped 22934 229350 belong&077777777 0600407 a.out SunOS SPARC 22936>0 byte &0x80 dynamically linked executable 22937>0 byte ^0x80 executable 22938>16 belong >0 not stripped 22939 229400 belong&077777777 0400413 a.out SunOS mc68020 demand paged 22941>0 byte &0x80 22942>>20 belong <4096 shared library 22943>>20 belong =4096 dynamically linked executable 22944>>20 belong >4096 dynamically linked executable 22945>0 byte ^0x80 executable 22946>16 belong >0 not stripped 22947 229480 belong&077777777 0400410 a.out SunOS mc68020 pure 22949>0 byte &0x80 dynamically linked executable 22950>0 byte ^0x80 executable 22951>16 belong >0 not stripped 22952 229530 belong&077777777 0400407 a.out SunOS mc68020 22954>0 byte &0x80 dynamically linked executable 22955>0 byte ^0x80 executable 22956>16 belong >0 not stripped 22957 229580 belong&077777777 0200413 a.out SunOS mc68010 demand paged 22959>0 byte &0x80 22960>>20 belong <4096 shared library 22961>>20 belong =4096 dynamically linked executable 22962>>20 belong >4096 dynamically linked executable 22963>0 byte ^0x80 executable 22964>16 belong >0 not stripped 22965 229660 belong&077777777 0200410 a.out SunOS mc68010 pure 22967>0 byte &0x80 dynamically linked executable 22968>0 byte ^0x80 executable 22969>16 belong >0 not stripped 22970 229710 belong&077777777 0200407 a.out SunOS mc68010 22972>0 byte &0x80 dynamically linked executable 22973>0 byte ^0x80 executable 22974>16 belong >0 not stripped 22975 22976# 22977# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 22978# binary executed in compatibility mode under SunOS 5.x". 22979# 229800 belong 0x080456 SunOS core file 22981>4 belong 432 (SPARC) 22982>>132 string >\0 from '%s' 22983>>116 belong =3 (quit) 22984>>116 belong =4 (illegal instruction) 22985>>116 belong =5 (trace trap) 22986>>116 belong =6 (abort) 22987>>116 belong =7 (emulator trap) 22988>>116 belong =8 (arithmetic exception) 22989>>116 belong =9 (kill) 22990>>116 belong =10 (bus error) 22991>>116 belong =11 (segmentation violation) 22992>>116 belong =12 (bad argument to system call) 22993>>116 belong =29 (resource lost) 22994>>120 belong x (T=%dK, 22995>>124 belong x D=%dK, 22996>>128 belong x S=%dK) 22997>4 belong 826 (68K) 22998>>128 string >\0 from '%s' 22999>4 belong 456 (SPARC 4.x BCP) 23000>>152 string >\0 from '%s' 23001# Sun SunPC 230020 long 0xfa33c08e SunPC 4.0 Hard Disk 230030 string #SUNPC_CONFIG SunPC 4.0 Properties Values 23004# Sun snoop (see RFC 1761, which describes the capture file format, 23005# RFC 3827, which describes some additional datalink types, and 23006# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 23007# which is the IANA registry of Snoop datalink types) 23008# 230090 string snoop Snoop capture file 23010>8 belong >0 - version %d 23011>12 belong 0 (IEEE 802.3) 23012>12 belong 1 (IEEE 802.4) 23013>12 belong 2 (IEEE 802.5) 23014>12 belong 3 (IEEE 802.6) 23015>12 belong 4 (Ethernet) 23016>12 belong 5 (HDLC) 23017>12 belong 6 (Character synchronous) 23018>12 belong 7 (IBM channel-to-channel adapter) 23019>12 belong 8 (FDDI) 23020>12 belong 9 (Other) 23021>12 belong 10 (type %d) 23022>12 belong 11 (type %d) 23023>12 belong 12 (type %d) 23024>12 belong 13 (type %d) 23025>12 belong 14 (type %d) 23026>12 belong 15 (type %d) 23027>12 belong 16 (Fibre Channel) 23028>12 belong 17 (ATM) 23029>12 belong 18 (ATM Classical IP) 23030>12 belong 19 (type %d) 23031>12 belong 20 (type %d) 23032>12 belong 21 (type %d) 23033>12 belong 22 (type %d) 23034>12 belong 23 (type %d) 23035>12 belong 24 (type %d) 23036>12 belong 25 (type %d) 23037>12 belong 26 (IP over Infiniband) 23038>12 belong >26 (type %d) 23039 23040#--------------------------------------------------------------------------- 23041# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 23042# lead Sun/Cobalt developer) who agrees that they are good and worthy of 23043# inclusion. 23044 23045# Boot ROM images for Sun/Cobalt Linux server appliances 230460 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 23047>38 string x V%.4s 23048 23049# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 23050# at the very end where file(1) can't get it. 230510 string CRfs COBALT boot rom data (Flat boot rom or file system) 23052 23053#------------------------------------------------------------------------------ 23054# msx: file(1) magic for the SymbOS operating system 23055# http://www.symbos.de 23056# Fabio R. Schmidlin <frs@pop.com.br> 23057 23058# SymbOS EXE file 230590x30 string SymExe SymbOS executable 23060>0x36 ubyte x v%c 23061>0x37 ubyte x \b.%c 23062>0xF string x \b, name: %s 23063 23064# SymbOS DOX document 230650 string INFOq\0 SymbOS DOX document 23066 23067# Symbos driver 230680 string SMD1 SymbOS driver 23069>19 byte x \b, name: %c 23070>20 byte x \b%c 23071>21 byte x \b%c 23072>22 byte x \b%c 23073>23 byte x \b%c 23074>24 byte x \b%c 23075>25 byte x \b%c 23076>26 byte x \b%c 23077>27 byte x \b%c 23078>28 byte x \b%c 23079>29 byte x \b%c 23080>30 byte x \b%c 23081>31 byte x \b%c 23082 23083# Symbos video 230840 string SymVid SymbOS video 23085>6 ubyte x v%c 23086>7 ubyte x \b.%c 23087 23088# Soundtrakker 128 ST2 music 230890 byte 0 23090>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 23091>>1 string x name: %s 23092 23093 23094 23095#------------------------------------------------------------------------ 23096# $File: sysex,v 1.9 2017/03/17 21:35:28 christos Exp $ 23097# sysex: file(1) magic for MIDI sysex files 23098# 23099# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 23100# where real SYStem EXclusive messages at offset 1 are limited to seven bits 23101# http://en.wikipedia.org/wiki/MIDI 231020 ubeshort&0xFF80 0xF000 SysEx File - 23103 23104# North American Group 23105>1 byte 0x01 Sequential 23106>1 byte 0x02 IDP 23107>1 byte 0x03 OctavePlateau 23108>1 byte 0x04 Moog 23109>1 byte 0x05 Passport 23110>1 byte 0x06 Lexicon 23111>1 byte 0x07 Kurzweil/Future Retro 23112>>3 byte 0x77 777 23113>>4 byte 0x00 Bank 23114>>4 byte 0x01 Song 23115>>5 byte 0x0f 16 23116>>5 byte 0x0e 15 23117>>5 byte 0x0d 14 23118>>5 byte 0x0c 13 23119>>5 byte 0x0b 12 23120>>5 byte 0x0a 11 23121>>5 byte 0x09 10 23122>>5 byte 0x08 9 23123>>5 byte 0x07 8 23124>>5 byte 0x06 7 23125>>5 byte 0x05 6 23126>>5 byte 0x04 5 23127>>5 byte 0x03 4 23128>>5 byte 0x02 3 23129>>5 byte 0x01 2 23130>>5 byte 0x00 1 23131>>5 byte 0x10 (ALL) 23132>>2 byte x \b, Channel %d 23133>1 byte 0x08 Fender 23134>1 byte 0x09 Gulbransen 23135>1 byte 0x0a AKG 23136>1 byte 0x0b Voyce 23137>1 byte 0x0c Waveframe 23138>1 byte 0x0d ADA 23139>1 byte 0x0e Garfield 23140>1 byte 0x0f Ensoniq 23141>1 byte 0x10 Oberheim 23142>>2 byte 0x06 Matrix 6 series 23143>>3 byte 0x0A Dump (All) 23144>>3 byte 0x01 Dump (Bank) 23145>>4 belong 0x0002040E Matrix 1000 23146>>>11 byte <2 User bank %d 23147>>>11 byte >1 Preset bank %d 23148>1 byte 0x11 Apple 23149>1 byte 0x12 GreyMatter 23150>1 byte 0x14 PalmTree 23151>1 byte 0x15 JLCooper 23152>1 byte 0x16 Lowrey 23153>1 byte 0x17 AdamsSmith 23154>1 byte 0x18 E-mu 23155>1 byte 0x19 Harmony 23156>1 byte 0x1a ART 23157>1 byte 0x1b Baldwin 23158>1 byte 0x1c Eventide 23159>1 byte 0x1d Inventronics 23160>1 byte 0x1f Clarity 23161 23162# European Group 23163>1 byte 0x21 SIEL 23164>1 byte 0x22 Synthaxe 23165>1 byte 0x24 Hohner 23166>1 byte 0x25 Twister 23167>1 byte 0x26 Solton 23168>1 byte 0x27 Jellinghaus 23169>1 byte 0x28 Southworth 23170>1 byte 0x29 PPG 23171>1 byte 0x2a JEN 23172>1 byte 0x2b SSL 23173>1 byte 0x2c AudioVertrieb 23174 23175>1 byte 0x2f ELKA 23176>>3 byte 0x09 EK-44 23177 23178>1 byte 0x30 Dynacord 23179>1 byte 0x31 Jomox 23180>1 byte 0x33 Clavia 23181>1 byte 0x39 Soundcraft 23182# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 23183>1 byte 0x3e Waldorf 23184>>2 byte 0x00 microWave 23185>>2 byte 0x0E microwave2 / XT 23186>>2 byte 0x0F Q / Q+ 23187>>3 byte =0 (default id) 23188>>3 byte >0 ( 23189>>>3 byte <0x7F \bdevice %d) 23190>>>3 byte =0x7F \bbroadcast id) 23191>>3 byte 0x7f Microwave I 23192>>>4 byte 0x00 SNDR (Sound Request) 23193>>>4 byte 0x10 SNDD (Sound Dump) 23194>>>4 byte 0x20 SNDP (Sound Parameter Change) 23195>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 23196>>>4 byte 0x70 BOOT (Sound Reserved) 23197>>>4 byte 0x01 MULR (Multi Request) 23198>>>4 byte 0x11 MULD (Multi Dump) 23199>>>4 byte 0x21 MULP (Multi Parameter Change) 23200>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 23201>>>4 byte 0x71 OS (Multi Reserved) 23202>>>4 byte 0x02 DRMR (Drum Map Request) 23203>>>4 byte 0x12 DRMD (Drum Map Dump) 23204>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 23205>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 23206>>>4 byte 0x72 BIN (Drum Map Reserved) 23207>>>4 byte 0x03 PATR (Sequencer Pattern Request) 23208>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 23209>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 23210>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 23211>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 23212>>>4 byte 0x04 GLBR (Global Parameter Request) 23213>>>4 byte 0x14 GLBD (Global Parameter Dump) 23214>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 23215>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 23216>>>4 byte 0x07 MODR (Mode Parameter Request) 23217>>>4 byte 0x17 MODD (Mode Parameter Dump) 23218>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 23219>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 23220>>2 byte 0x10 microQ 23221>>>4 byte 0x00 SNDR (Sound Request) 23222>>>4 byte 0x10 SNDD (Sound Dump) 23223>>>4 byte 0x20 SNDP (Sound Parameter Change) 23224>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 23225>>>4 byte 0x70 (Sound Reserved) 23226>>>4 byte 0x01 MULR (Multi Request) 23227>>>4 byte 0x11 MULD (Multi Dump) 23228>>>4 byte 0x21 MULP (Multi Parameter Change) 23229>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 23230>>>4 byte 0x71 OS (Multi Reserved) 23231>>>4 byte 0x02 DRMR (Drum Map Request) 23232>>>4 byte 0x12 DRMD (Drum Map Dump) 23233>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 23234>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 23235>>>4 byte 0x72 BIN (Drum Map Reserved) 23236>>>4 byte 0x04 GLBR (Global Parameter Request) 23237>>>4 byte 0x14 GLBD (Global Parameter Dump) 23238>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 23239>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 23240>>2 byte 0x11 rackAttack 23241>>>4 byte 0x00 SNDR (Sound Parameter Request) 23242>>>4 byte 0x10 SNDD (Sound Parameter Dump) 23243>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 23244>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 23245>>>4 byte 0x01 PRGR (Program Parameter Request) 23246>>>4 byte 0x11 PRGD (Program Parameter Dump) 23247>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 23248>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 23249>>>4 byte 0x71 OS (Program Parameter Reserved) 23250>>>4 byte 0x03 PATR (Pattern Parameter Request) 23251>>>4 byte 0x13 PATD (Pattern Parameter Dump) 23252>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 23253>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 23254>>>4 byte 0x04 GLBR (Global Parameter Request) 23255>>>4 byte 0x14 GLBD (Global Parameter Dump) 23256>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 23257>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 23258>>>4 byte 0x05 EFXR (FX Parameter Request) 23259>>>4 byte 0x15 EFXD (FX Parameter Dump) 23260>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 23261>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 23262>>>4 byte 0x07 MODR (Mode Command Request) 23263>>>4 byte 0x17 MODD (Mode Command Dump) 23264>>>4 byte 0x27 MODP (Mode Command Parameter Change) 23265>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 23266>>2 byte 0x03 Wave 23267>>>4 byte 0x00 SBPR (Soundprogram) 23268>>>4 byte 0x01 SAPR (Performance) 23269>>>4 byte 0x02 SWAVE (Wave) 23270>>>4 byte 0x03 SWTBL (Wave control table) 23271>>>4 byte 0x04 SVT (Velocity Curve) 23272>>>4 byte 0x05 STT (Tuning Table) 23273>>>4 byte 0x06 SGLB (Global Parameters) 23274>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 23275>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 23276>>>4 byte 0x09 SBPRPAR (Sound Parameter) 23277>>>4 byte 0x0A SARRPAR (Performance Parameter) 23278>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 23279>>>4 byte 0x0F SBULK (Bulk Switch on/off) 23280 23281# Japanese Group 23282>1 byte 0x40 Kawai 23283>>3 byte 0x20 K1 23284>>3 byte 0x22 K4 23285 23286>1 byte 0x41 Roland 23287>>3 byte 0x14 D-50 23288>>3 byte 0x2b U-220 23289>>3 byte 0x02 TR-707 23290 23291>1 byte 0x42 Korg 23292>>3 byte 0x19 M1 23293 23294>1 byte 0x43 Yamaha 23295>1 byte 0x44 Casio 23296>1 byte 0x46 Kamiya 23297>1 byte 0x47 Akai 23298>1 byte 0x48 Victor 23299>1 byte 0x49 Mesosha 23300>1 byte 0x4b Fujitsu 23301>1 byte 0x4c Sony 23302>1 byte 0x4e Teac 23303>1 byte 0x50 Matsushita 23304>1 byte 0x51 Fostex 23305>1 byte 0x52 Zoom 23306>1 byte 0x54 Matsushita 23307>1 byte 0x57 Acoustic tech. lab. 23308# http://www.midi.org/techspecs/manid.php 23309>1 belong&0xffffff00 0x00007400 Ta Horng 23310>1 belong&0xffffff00 0x00007500 e-Tek 23311>1 belong&0xffffff00 0x00007600 E-Voice 23312>1 belong&0xffffff00 0x00007700 Midisoft 23313>1 belong&0xffffff00 0x00007800 Q-Sound 23314>1 belong&0xffffff00 0x00007900 Westrex 23315>1 belong&0xffffff00 0x00007a00 Nvidia* 23316>1 belong&0xffffff00 0x00007b00 ESS 23317>1 belong&0xffffff00 0x00007c00 Mediatrix 23318>1 belong&0xffffff00 0x00007d00 Brooktree 23319>1 belong&0xffffff00 0x00007e00 Otari 23320>1 belong&0xffffff00 0x00007f00 Key Electronics 23321>1 belong&0xffffff00 0x00010000 Shure 23322>1 belong&0xffffff00 0x00010100 AuraSound 23323>1 belong&0xffffff00 0x00010200 Crystal 23324>1 belong&0xffffff00 0x00010300 Rockwell 23325>1 belong&0xffffff00 0x00010400 Silicon Graphics 23326>1 belong&0xffffff00 0x00010500 Midiman 23327>1 belong&0xffffff00 0x00010600 PreSonus 23328>1 belong&0xffffff00 0x00010800 Topaz 23329>1 belong&0xffffff00 0x00010900 Cast Lightning 23330>1 belong&0xffffff00 0x00010a00 Microsoft 23331>1 belong&0xffffff00 0x00010b00 Sonic Foundry 23332>1 belong&0xffffff00 0x00010c00 Line 6 23333>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 23334>1 belong&0xffffff00 0x00010e00 Van Koerving 23335>1 belong&0xffffff00 0x00010f00 Altech Systems 23336>1 belong&0xffffff00 0x00011000 S & S Research 23337>1 belong&0xffffff00 0x00011100 VLSI Technology 23338>1 belong&0xffffff00 0x00011200 Chromatic 23339>1 belong&0xffffff00 0x00011300 Sapphire 23340>1 belong&0xffffff00 0x00011400 IDRC 23341>1 belong&0xffffff00 0x00011500 Justonic Tuning 23342>1 belong&0xffffff00 0x00011600 TorComp 23343>1 belong&0xffffff00 0x00011700 Newtek Inc. 23344>1 belong&0xffffff00 0x00011800 Sound Sculpture 23345>1 belong&0xffffff00 0x00011900 Walker Technical 23346>1 belong&0xffffff00 0x00011a00 Digital Harmony 23347>1 belong&0xffffff00 0x00011b00 InVision 23348>1 belong&0xffffff00 0x00011c00 T-Square 23349>1 belong&0xffffff00 0x00011d00 Nemesys 23350>1 belong&0xffffff00 0x00011e00 DBX 23351>1 belong&0xffffff00 0x00011f00 Syndyne 23352>1 belong&0xffffff00 0x00012000 Bitheadz 23353>1 belong&0xffffff00 0x00012100 Cakewalk 23354>1 belong&0xffffff00 0x00012200 Staccato 23355>1 belong&0xffffff00 0x00012300 National Semicon. 23356>1 belong&0xffffff00 0x00012400 Boom Theory 23357>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 23358>1 belong&0xffffff00 0x00012600 Antares 23359>1 belong&0xffffff00 0x00012700 Angel Software 23360>1 belong&0xffffff00 0x00012800 St Louis Music 23361>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 23362>1 belong&0xffffff00 0x00012a00 Ashley Audio 23363>1 belong&0xffffff00 0x00012b00 Vari-Lite 23364>1 belong&0xffffff00 0x00012c00 Summit Audio 23365>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 23366>1 belong&0xffffff00 0x00012e00 SeaSound 23367>1 belong&0xffffff00 0x00012f00 U.S. Robotics 23368>1 belong&0xffffff00 0x00013000 Aurisis 23369>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 23370>1 belong&0xffffff00 0x00013200 FM7 Inc. 23371>1 belong&0xffffff00 0x00013300 Swivel Systems 23372>1 belong&0xffffff00 0x00013400 Hyperactive 23373>1 belong&0xffffff00 0x00013500 MidiLite 23374>1 belong&0xffffff00 0x00013600 Radical 23375>1 belong&0xffffff00 0x00013700 Roger Linn 23376>1 belong&0xffffff00 0x00013800 Helicon 23377>1 belong&0xffffff00 0x00013900 Event 23378>1 belong&0xffffff00 0x00013a00 Sonic Network 23379>1 belong&0xffffff00 0x00013b00 Realtime Music 23380>1 belong&0xffffff00 0x00013c00 Apogee Digital 23381 23382>1 belong&0xffffff00 0x00202b00 Medeli Electronics 23383>1 belong&0xffffff00 0x00202c00 Charlie Lab 23384>1 belong&0xffffff00 0x00202d00 Blue Chip Music 23385>1 belong&0xffffff00 0x00202e00 BEE OH Corp 23386>1 belong&0xffffff00 0x00202f00 LG Semicon America 23387>1 belong&0xffffff00 0x00203000 TESI 23388>1 belong&0xffffff00 0x00203100 EMAGIC 23389>1 belong&0xffffff00 0x00203200 Behringer 23390>1 belong&0xffffff00 0x00203300 Access Music 23391>1 belong&0xffffff00 0x00203400 Synoptic 23392>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 23393>1 belong&0xffffff00 0x00203600 Terratec 23394>1 belong&0xffffff00 0x00203700 Proel SpA 23395>1 belong&0xffffff00 0x00203800 IBK MIDI 23396>1 belong&0xffffff00 0x00203900 IRCAM 23397>1 belong&0xffffff00 0x00203a00 Propellerhead Software 23398>1 belong&0xffffff00 0x00203b00 Red Sound Systems 23399>1 belong&0xffffff00 0x00203c00 Electron ESI AB 23400>1 belong&0xffffff00 0x00203d00 Sintefex Audio 23401>1 belong&0xffffff00 0x00203e00 Music and More 23402>1 belong&0xffffff00 0x00203f00 Amsaro 23403>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 23404>1 belong&0xffffff00 0x00204100 Touched by Sound 23405>1 belong&0xffffff00 0x00204200 DSP Arts 23406>1 belong&0xffffff00 0x00204300 Phil Rees Music 23407>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 23408>1 belong&0xffffff00 0x00204500 Soundart 23409>1 belong&0xffffff00 0x00204600 C-Mexx Software 23410>1 belong&0xffffff00 0x00204700 Klavis Tech. 23411>1 belong&0xffffff00 0x00204800 Noteheads AB 23412 234130 string T707 Roland TR-707 Data 23414#------------------------------------------------------------------------------ 23415# file: file(1) magic for Tcl scripting language 23416# URL: http://www.tcl.tk/ 23417# From: gustaf neumann 23418 23419# Tcl scripts 234200 search/1/w #!\ /usr/bin/tcl Tcl script text executable 23421!:mime text/x-tcl 234220 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 23423!:mime text/x-tcl 234240 search/1 #!/usr/bin/env\ tcl Tcl script text executable 23425!:mime text/x-tcl 234260 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 23427!:mime text/x-tcl 234280 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 23429!:mime text/x-tcl 234300 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 23431!:mime text/x-tcl 234320 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 23433!:mime text/x-tcl 234340 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 23435!:mime text/x-tcl 23436 23437# check the first line 234380 search/1 package\ req 23439>0 regex \^package[\ \t]+req Tcl script 23440# not 'p', check other lines 234410 search/1 !p 23442>0 regex \^package[\ \t]+req Tcl script 23443 23444#------------------------------------------------------------------------------ 23445# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 23446# teapot: file(1) magic for "teapot" spreadsheet 23447# 234480 string #!teapot\012xdr teapot work sheet (XDR format) 23449 23450#------------------------------------------------------------------------------ 23451# $File: terminfo,v 1.9 2017/04/28 16:28:58 christos Exp $ 23452# terminfo: file(1) magic for terminfo 23453# 23454# URL: http://invisible-island.net/ncurses/man/term.5.html 23455# URL: http://invisible-island.net/ncurses/man/scr_dump.5.html 23456# 23457# Workaround for Targa image type by Joerg Jenderek 23458# GRR: line below too general as it catches also 23459# Targa image type 1 with 26 long identification field 23460# and HELP.DSK 234610 string \032\001 23462# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32) 23463>16 ubyte >32 23464# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1" 23465>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s" 23466!:mime application/x-terminfo 23467# no extension 23468#!:ext 23469# 23470# While the compiled terminfo uses little-endian format irregardless of 23471# platform, SystemV screen dumps do not. They came later, and that detail was 23472# overlooked. 23473# 23474# AIX and HPUX use the SVr4 big-endian format 23475# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness) 234760 beshort 0433 SVr2 curses screen image, big-endian 234770 beshort 0434 SVr3 curses screen image, big-endian 234780 beshort 0435 SVr4 curses screen image, big-endian 23479# 234800 leshort 0433 SVr2 curses screen image, little-endian 234810 leshort 0434 SVr3 curses screen image, little-endian 234820 leshort 0435 SVr4 curses screen image, little-endian 23483# 23484# Rather than SVr4, Solaris "xcurses" writes this header: 234850 regex \^MAX=[0-9]+,[0-9]+$ 23486>1 regex \^BEG=[0-9]+,[0-9]+$ 23487>2 regex \^SCROLL=[0-9]+,[0-9]+$ 23488>3 regex \^VMIN=[0-9]+$ 23489>4 regex \^VTIME=[0-9]+$ 23490>5 regex \^FLAGS=0x[[:xdigit:]]+$ 23491>6 regex \^FG=[0-9],[0-9]+$ 23492>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image 23493# 23494# ncurses5 (and before) did not use a magic number, making screen dumps "data". 23495# ncurses6 (2015) uses this format, ignoring byte-order 234960 string \210\210\210\210ncurses ncurses6 screen image 23497# 23498# PDCurses added this in 2005 234990 string PDC\001 PDCurses screen image 23500 23501#------------------------------------------------------------------------------ 23502# $File: tex,v 1.20 2014/03/16 02:53:03 christos Exp $ 23503# tex: file(1) magic for TeX files 23504# 23505# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 23506# 23507# From <conklin@talisman.kaleida.com> 23508 23509# Although we may know the offset of certain text fields in TeX DVI 23510# and font files, we can't use them reliably because they are not 23511# zero terminated. [but we do anyway, christos] 235120 string \367\002 TeX DVI file 23513!:mime application/x-dvi 23514>16 string >\0 (%s) 235150 string \367\203 TeX generic font data 235160 string \367\131 TeX packed font data 23517>3 string >\0 (%s) 235180 string \367\312 TeX virtual font data 235190 search/1 This\ is\ TeX, TeX transcript text 235200 search/1 This\ is\ METAFONT, METAFONT transcript text 23521 23522# There is no way to detect TeX Font Metric (*.tfm) files without 23523# breaking them apart and reading the data. The following patterns 23524# match most *.tfm files generated by METAFONT or afm2tfm. 235252 string \000\021 TeX font metric data 23526!:mime application/x-tex-tfm 23527>33 string >\0 (%s) 235282 string \000\022 TeX font metric data 23529!:mime application/x-tex-tfm 23530>33 string >\0 (%s) 23531 23532# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 235330 search/1 \\input\ texinfo Texinfo source text 23534!:mime text/x-texinfo 235350 search/1 This\ is\ Info\ file GNU Info text 23536!:mime text/x-info 23537 23538# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 235390 search/4096 \\input TeX document text 23540!:mime text/x-tex 23541!:strength + 15 235420 search/4096 \\begin LaTeX document text 23543!:mime text/x-tex 23544!:strength + 15 235450 search/4096 \\section LaTeX document text 23546!:mime text/x-tex 23547!:strength + 18 235480 search/4096 \\setlength LaTeX document text 23549!:mime text/x-tex 23550!:strength + 15 235510 search/4096 \\documentstyle LaTeX document text 23552!:mime text/x-tex 23553!:strength + 18 235540 search/4096 \\chapter LaTeX document text 23555!:mime text/x-tex 23556!:strength + 18 235570 search/4096 \\documentclass LaTeX 2e document text 23558!:mime text/x-tex 23559!:strength + 15 235600 search/4096 \\relax LaTeX auxiliary file 23561!:mime text/x-tex 23562!:strength + 15 235630 search/4096 \\contentsline LaTeX table of contents 23564!:mime text/x-tex 23565!:strength + 15 235660 search/4096 %\ -*-latex-*- LaTeX document text 23567!:mime text/x-tex 23568 23569# Tex document, from Hendrik Scholz <hendrik@scholz.net> 235700 search/1 \\ifx TeX document text 23571 23572# Index and glossary files 235730 search/4096 \\indexentry LaTeX raw index file 235740 search/4096 \\begin{theindex} LaTeX sorted index 235750 search/4096 \\glossaryentry LaTeX raw glossary 235760 search/4096 \\begin{theglossary} LaTeX sorted glossary 235770 search/4096 This\ is\ makeindex Makeindex log file 23578 23579# End of TeX 23580 23581#------------------------------------------------------------------------------ 23582# file(1) magic for BibTex text files 23583# From Hendrik Scholz <hendrik@scholz.net> 23584 235850 search/1/c @article{ BibTeX text file 235860 search/1/c @book{ BibTeX text file 235870 search/1/c @inbook{ BibTeX text file 235880 search/1/c @incollection{ BibTeX text file 235890 search/1/c @inproceedings{ BibTeX text file 235900 search/1/c @manual{ BibTeX text file 235910 search/1/c @misc{ BibTeX text file 235920 search/1/c @preamble{ BibTeX text file 235930 search/1/c @phdthesis{ BibTeX text file 235940 search/1/c @techreport{ BibTeX text file 235950 search/1/c @unpublished{ BibTeX text file 23596 2359773 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 23598 2359973 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 23600 236010 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 23602 236030 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 23604 236050 search/1 @c\ @mapfile{ TeX font aliases text file 23606 236070 string #LyX LyX document text 23608 23609# ConTeXt documents 23610# http://wiki.contextgarden.net/ 236110 search/4096 \\setupcolors[ ConTeXt document text 23612!:strength + 15 236130 search/4096 \\definecolor[ ConTeXt document text 23614!:strength + 15 236150 search/4096 \\setupinteraction[ ConTeXt document text 23616!:strength + 15 236170 search/4096 \\useURL[ ConTeXt document text 23618!:strength + 15 236190 search/4096 \\setuppapersize[ ConTeXt document text 23620!:strength + 15 236210 search/4096 \\setuplayout[ ConTeXt document text 23622!:strength + 15 236230 search/4096 \\setupfooter[ ConTeXt document text 23624!:strength + 15 236250 search/4096 \\setupfootertexts[ ConTeXt document text 23626!:strength + 15 236270 search/4096 \\setuppagenumbering[ ConTeXt document text 23628!:strength + 15 236290 search/4096 \\setupbodyfont[ ConTeXt document text 23630!:strength + 15 236310 search/4096 \\setuphead[ ConTeXt document text 23632!:strength + 15 236330 search/4096 \\setupitemize[ ConTeXt document text 23634!:strength + 15 236350 search/4096 \\setupwhitespace[ ConTeXt document text 23636!:strength + 15 236370 search/4096 \\setupindenting[ ConTeXt document text 23638!:strength + 15 23639 23640#------------------------------------------------------------------------------ 23641# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 23642# file(1) magic for tgif(1) files 23643# From Hendrik Scholz <hendrik@scholz.net> 236440 string %TGIF\ Tgif file version 23645>6 string x %s 23646 23647#------------------------------------------------------------------------------ 23648# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $ 23649# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 23650# 23651# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 23652# 23653# Update: Romain Lievin (roms@lpg.ticalc.org). 23654# 23655# NOTE: This list is not complete. 23656# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 23657# program/group magic numbers in here because I cannot find any. 236580 string **TI80** TI-80 Graphing Calculator File. 236590 string **TI81** TI-81 Graphing Calculator File. 23660# 23661# Magic Numbers for the TI-73 23662# 236630 string **TI73** TI-73 Graphing Calculator 23664>0x00003B byte 0x00 (real number) 23665>0x00003B byte 0x01 (list) 23666>0x00003B byte 0x02 (matrix) 23667>0x00003B byte 0x03 (equation) 23668>0x00003B byte 0x04 (string) 23669>0x00003B byte 0x05 (program) 23670>0x00003B byte 0x06 (assembly program) 23671>0x00003B byte 0x07 (picture) 23672>0x00003B byte 0x08 (gdb) 23673>0x00003B byte 0x0C (complex number) 23674>0x00003B byte 0x0F (window settings) 23675>0x00003B byte 0x10 (zoom) 23676>0x00003B byte 0x11 (table setup) 23677>0x00003B byte 0x13 (backup) 23678 23679# Magic Numbers for the TI-82 23680# 236810 string **TI82** TI-82 Graphing Calculator 23682>0x00003B byte 0x00 (real) 23683>0x00003B byte 0x01 (list) 23684>0x00003B byte 0x02 (matrix) 23685>0x00003B byte 0x03 (Y-variable) 23686>0x00003B byte 0x05 (program) 23687>0x00003B byte 0x06 (protected prgm) 23688>0x00003B byte 0x07 (picture) 23689>0x00003B byte 0x08 (gdb) 23690>0x00003B byte 0x0B (window settings) 23691>0x00003B byte 0x0C (window settings) 23692>0x00003B byte 0x0D (table setup) 23693>0x00003B byte 0x0E (screenshot) 23694>0x00003B byte 0x0F (backup) 23695# 23696# Magic Numbers for the TI-83 23697# 236980 string **TI83** TI-83 Graphing Calculator 23699>0x00003B byte 0x00 (real) 23700>0x00003B byte 0x01 (list) 23701>0x00003B byte 0x02 (matrix) 23702>0x00003B byte 0x03 (Y-variable) 23703>0x00003B byte 0x04 (string) 23704>0x00003B byte 0x05 (program) 23705>0x00003B byte 0x06 (protected prgm) 23706>0x00003B byte 0x07 (picture) 23707>0x00003B byte 0x08 (gdb) 23708>0x00003B byte 0x0B (window settings) 23709>0x00003B byte 0x0C (window settings) 23710>0x00003B byte 0x0D (table setup) 23711>0x00003B byte 0x0E (screenshot) 23712>0x00003B byte 0x13 (backup) 23713# 23714# Magic Numbers for the TI-83+ 23715# 237160 string **TI83F* TI-83+ Graphing Calculator 23717>0x00003B byte 0x00 (real number) 23718>0x00003B byte 0x01 (list) 23719>0x00003B byte 0x02 (matrix) 23720>0x00003B byte 0x03 (equation) 23721>0x00003B byte 0x04 (string) 23722>0x00003B byte 0x05 (program) 23723>0x00003B byte 0x06 (assembly program) 23724>0x00003B byte 0x07 (picture) 23725>0x00003B byte 0x08 (gdb) 23726>0x00003B byte 0x0C (complex number) 23727>0x00003B byte 0x0F (window settings) 23728>0x00003B byte 0x10 (zoom) 23729>0x00003B byte 0x11 (table setup) 23730>0x00003B byte 0x13 (backup) 23731>0x00003B byte 0x15 (application variable) 23732>0x00003B byte 0x17 (group of variable) 23733 23734# 23735# Magic Numbers for the TI-85 23736# 237370 string **TI85** TI-85 Graphing Calculator 23738>0x00003B byte 0x00 (real number) 23739>0x00003B byte 0x01 (complex number) 23740>0x00003B byte 0x02 (real vector) 23741>0x00003B byte 0x03 (complex vector) 23742>0x00003B byte 0x04 (real list) 23743>0x00003B byte 0x05 (complex list) 23744>0x00003B byte 0x06 (real matrix) 23745>0x00003B byte 0x07 (complex matrix) 23746>0x00003B byte 0x08 (real constant) 23747>0x00003B byte 0x09 (complex constant) 23748>0x00003B byte 0x0A (equation) 23749>0x00003B byte 0x0C (string) 23750>0x00003B byte 0x0D (function GDB) 23751>0x00003B byte 0x0E (polar GDB) 23752>0x00003B byte 0x0F (parametric GDB) 23753>0x00003B byte 0x10 (diffeq GDB) 23754>0x00003B byte 0x11 (picture) 23755>0x00003B byte 0x12 (program) 23756>0x00003B byte 0x13 (range) 23757>0x00003B byte 0x17 (window settings) 23758>0x00003B byte 0x18 (window settings) 23759>0x00003B byte 0x19 (window settings) 23760>0x00003B byte 0x1A (window settings) 23761>0x00003B byte 0x1B (zoom) 23762>0x00003B byte 0x1D (backup) 23763>0x00003B byte 0x1E (unknown) 23764>0x00003B byte 0x2A (equation) 23765>0x000032 string ZS4 - ZShell Version 4 File. 23766>0x000032 string ZS3 - ZShell Version 3 File. 23767# 23768# Magic Numbers for the TI-86 23769# 237700 string **TI86** TI-86 Graphing Calculator 23771>0x00003B byte 0x00 (real number) 23772>0x00003B byte 0x01 (complex number) 23773>0x00003B byte 0x02 (real vector) 23774>0x00003B byte 0x03 (complex vector) 23775>0x00003B byte 0x04 (real list) 23776>0x00003B byte 0x05 (complex list) 23777>0x00003B byte 0x06 (real matrix) 23778>0x00003B byte 0x07 (complex matrix) 23779>0x00003B byte 0x08 (real constant) 23780>0x00003B byte 0x09 (complex constant) 23781>0x00003B byte 0x0A (equation) 23782>0x00003B byte 0x0C (string) 23783>0x00003B byte 0x0D (function GDB) 23784>0x00003B byte 0x0E (polar GDB) 23785>0x00003B byte 0x0F (parametric GDB) 23786>0x00003B byte 0x10 (diffeq GDB) 23787>0x00003B byte 0x11 (picture) 23788>0x00003B byte 0x12 (program) 23789>0x00003B byte 0x13 (range) 23790>0x00003B byte 0x17 (window settings) 23791>0x00003B byte 0x18 (window settings) 23792>0x00003B byte 0x19 (window settings) 23793>0x00003B byte 0x1A (window settings) 23794>0x00003B byte 0x1B (zoom) 23795>0x00003B byte 0x1D (backup) 23796>0x00003B byte 0x1E (unknown) 23797>0x00003B byte 0x2A (equation) 23798# 23799# Magic Numbers for the TI-89 23800# 238010 string **TI89** TI-89 Graphing Calculator 23802>0x000048 byte 0x00 (expression) 23803>0x000048 byte 0x04 (list) 23804>0x000048 byte 0x06 (matrix) 23805>0x000048 byte 0x0A (data) 23806>0x000048 byte 0x0B (text) 23807>0x000048 byte 0x0C (string) 23808>0x000048 byte 0x0D (graphic data base) 23809>0x000048 byte 0x0E (figure) 23810>0x000048 byte 0x10 (picture) 23811>0x000048 byte 0x12 (program) 23812>0x000048 byte 0x13 (function) 23813>0x000048 byte 0x14 (macro) 23814>0x000048 byte 0x1C (zipped) 23815>0x000048 byte 0x21 (assembler) 23816# 23817# Magic Numbers for the TI-92 23818# 238190 string **TI92** TI-92 Graphing Calculator 23820>0x000048 byte 0x00 (expression) 23821>0x000048 byte 0x04 (list) 23822>0x000048 byte 0x06 (matrix) 23823>0x000048 byte 0x0A (data) 23824>0x000048 byte 0x0B (text) 23825>0x000048 byte 0x0C (string) 23826>0x000048 byte 0x0D (graphic data base) 23827>0x000048 byte 0x0E (figure) 23828>0x000048 byte 0x10 (picture) 23829>0x000048 byte 0x12 (program) 23830>0x000048 byte 0x13 (function) 23831>0x000048 byte 0x14 (macro) 23832>0x000048 byte 0x1D (backup) 23833# 23834# Magic Numbers for the TI-92+/V200 23835# 238360 string **TI92P* TI-92+/V200 Graphing Calculator 23837>0x000048 byte 0x00 (expression) 23838>0x000048 byte 0x04 (list) 23839>0x000048 byte 0x06 (matrix) 23840>0x000048 byte 0x0A (data) 23841>0x000048 byte 0x0B (text) 23842>0x000048 byte 0x0C (string) 23843>0x000048 byte 0x0D (graphic data base) 23844>0x000048 byte 0x0E (figure) 23845>0x000048 byte 0x10 (picture) 23846>0x000048 byte 0x12 (program) 23847>0x000048 byte 0x13 (function) 23848>0x000048 byte 0x14 (macro) 23849>0x000048 byte 0x1C (zipped) 23850>0x000048 byte 0x21 (assembler) 23851# 23852# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 23853# 238540x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 238550 string **TIFL** TI-XX Graphing Calculator (FLASH) 23856>8 byte >0 - Revision %d 23857>>9 byte x \b.%d, 23858>12 byte >0 Revision date %02x 23859>>13 byte x \b/%02x 23860>>14 beshort x \b/%04x, 23861>17 string >/0 name: '%s', 23862>48 byte 0x74 device: TI-73, 23863>48 byte 0x73 device: TI-83+, 23864>48 byte 0x98 device: TI-89, 23865>48 byte 0x88 device: TI-92+, 23866>49 byte 0x23 type: OS upgrade, 23867>49 byte 0x24 type: application, 23868>49 byte 0x25 type: certificate, 23869>49 byte 0x3e type: license, 23870>74 lelong >0 size: %d bytes 23871 23872# VTi & TiEmu skins (TI Graphing Calculators). 23873# From: Romain Lievin (roms@lpg.ticalc.org). 23874# Magic Numbers for the VTi skins 238750 string VTI Virtual TI skin 23876>3 string v - Version 23877>>4 byte >0 \b %c 23878>>6 byte x \b.%c 23879# Magic Numbers for the TiEmu skins 238800 string TiEmu TiEmu skin 23881>6 string v - Version 23882>>7 byte >0 \b %c 23883>>9 byte x \b.%c 23884>>10 byte x \b%c 23885 23886#------------------------------------------------------------------------------ 23887# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ 23888# timezone: file(1) magic for timezone data 23889# 23890# from Daniel Quinlan (quinlan@yggdrasil.com) 23891# this should work on Linux, SunOS, and maybe others 23892# Added new official magic number for recent versions of the Olson code 238930 string TZif timezone data 23894>4 byte 0 \b, old version 23895>4 byte >0 \b, version %c 23896>20 belong 0 \b, no gmt time flags 23897>20 belong 1 \b, 1 gmt time flag 23898>20 belong >1 \b, %d gmt time flags 23899>24 belong 0 \b, no std time flags 23900>20 belong 1 \b, 1 std time flag 23901>24 belong >1 \b, %d std time flags 23902>28 belong 0 \b, no leap seconds 23903>28 belong 1 \b, 1 leap second 23904>28 belong >1 \b, %d leap seconds 23905>32 belong 0 \b, no transition times 23906>32 belong 1 \b, 1 transition time 23907>32 belong >1 \b, %d transition times 23908>36 belong 0 \b, no abbreviation chars 23909>36 belong 1 \b, 1 abbreviation char 23910>36 belong >1 \b, %d abbreviation chars 239110 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 239120 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 239130 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 239140 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 239150 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 239160 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 23917 23918#------------------------------------------------------------------------------ 23919# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $ 23920# troff: file(1) magic for *roff 23921# 23922# updated by Daniel Quinlan (quinlan@yggdrasil.com) 23923 23924# troff input 239250 search/1 .\\" troff or preprocessor input text 23926!:mime text/troff 239270 search/1 '\\" troff or preprocessor input text 23928!:mime text/troff 239290 search/1 '.\\" troff or preprocessor input text 23930!:mime text/troff 239310 search/1 \\" troff or preprocessor input text 23932!:mime text/troff 239330 search/1 ''' troff or preprocessor input text 23934!:mime text/troff 239350 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text 23936!:mime text/troff 239370 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text 23938!:mime text/troff 23939 23940# ditroff intermediate output text 239410 search/1 x\ T ditroff output text 23942>4 search/1 cat for the C/A/T phototypesetter 23943>4 search/1 ps for PostScript 23944>4 search/1 dvi for DVI 23945>4 search/1 ascii for ASCII 23946>4 search/1 lj4 for LaserJet 4 23947>4 search/1 latin1 for ISO 8859-1 (Latin 1) 23948>4 search/1 X75 for xditview at 75dpi 23949>>7 search/1 -12 (12pt) 23950>4 search/1 X100 for xditview at 100dpi 23951>>8 search/1 -12 (12pt) 23952 23953# output data formats 239540 string \100\357 very old (C/A/T) troff output data 23955 23956#------------------------------------------------------------------------------ 23957# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 23958# tuxedo: file(1) magic for BEA TUXEDO data files 23959# 23960# from Ian Springer <ispringer@hotmail.com> 23961# 239620 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 23963 23964#------------------------------------------------------------------------------ 23965# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 23966# typeset: file(1) magic for other typesetting 23967# 239680 string Interpress/Xerox Xerox InterPress data 23969>16 string / (version 23970>>17 string >\0 %s) 23971 23972#------------------------------------------------------------------------------ 23973# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $ 23974# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 23975# GRR: These types should be recognised in file_ascmagic so these 23976# encodings can be treated by text patterns. 23977# Missing types are already dealt with internally. 23978# 239790 string +/v8 Unicode text, UTF-7 239800 string +/v9 Unicode text, UTF-7 239810 string +/v+ Unicode text, UTF-7 239820 string +/v/ Unicode text, UTF-7 239830 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 239840 string \000\000\376\377 Unicode text, UTF-32, big-endian 239850 string \377\376\000\000 Unicode text, UTF-32, little-endian 239860 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 23987 23988#------------------------------------------------------------------------------ 23989# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 23990# unknown: file(1) magic for unknown machines 23991# 23992# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 23993# (executable, pure, and split I&D, respectively), but the PDP-11 version 23994# doesn't have the "version %ld", which may be a bogus COFFism (I don't 23995# think there was ever COFF for the PDP-11). 23996# 23997# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 23998# long, as it would be on a VAX. In any case, that could collide with 23999# VAX demand-paged files, as the magic number is little-endian on those 24000# binaries, so the first 16 bits of the file would contain 0x10B. 24001# 24002# Therefore, those entries are commented out. 24003# 24004# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 24005# 24006#0 short 0x107 unknown machine executable 24007#>8 short >0 not stripped 24008#>15 byte >0 - version %ld 24009#0 short 0x108 unknown pure executable 24010#>8 short >0 not stripped 24011#>15 byte >0 - version %ld 24012#0 short 0x109 PDP-11 separate I&D 24013#>8 short >0 not stripped 24014#>15 byte >0 - version %ld 24015#0 short 0x10b unknown pure executable 24016#>8 short >0 not stripped 24017#>15 byte >0 - version %ld 240180 long 0x10c unknown demand paged pure executable 24019>16 long >0 not stripped 240200 long 0x10e unknown readable demand paged pure executable 24021 24022#------------------------------------------------------------------------------ 24023# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $ 24024# file(1) magic for uterus files 24025# http://freecode.com/projects/uterus 24026# 240270 string UTE+ uterus file 24028>4 string v \b, version 24029>5 byte x %c 24030>6 string . \b. 24031>7 byte x \b%c 24032>8 string \<\> \b, big-endian 24033>>16 belong >0 \b, slut size %u 24034>8 string \>\< \b, litte-endian 24035>>16 lelong >0 \b, slut size %u 24036>10 byte &8 \b, compressed 24037 24038#------------------------------------------------------------------------------ 24039# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ 24040# uuencode: file(1) magic for ASCII-encoded files 24041# 24042 24043# GRR: the first line of xxencoded files is identical to that in uuencoded 24044# files, but the first character in most subsequent lines is 'h' instead of 24045# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 24046# punctuation and survives BITNET gateways better.) If regular expressions 24047# were supported, this entry could possibly be split into two with 24048# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 240490 search/1 begin\ uuencoded or xxencoded text 24050 24051# btoa(1) is an alternative to uuencode that requires less space. 240520 search/1 xbtoa\ Begin btoa'd text 24053 24054# ship(1) is another, much cooler alternative to uuencode. 24055# Greg Roelofs, newt@uchicago.edu 240560 search/1 $\012ship ship'd binary text 24057 24058# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 24059# Greg Roelofs, newt@uchicago.edu 240600 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 24061 24062# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 24063# Daniel Quinlan, quinlan@yggdrasil.com 2406411 search/1 must\ be\ converted\ with\ BinHex BinHex binary text 24065>41 search/1 x \b, version %.3s 24066 24067# GRR: handle BASE64 24068 24069#------------------------------------------------------------------------------ 24070# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $ 24071# vacuum cleaner magic by Thomas M. Ott (ThMO) 24072# 24073# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx 24074# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk 24075# -> yyyymmdd: year, month, day of cleaning 24076# -> hhmmss: hour, minute, second of cleaning 24077# -> xxxxxx: 6 digits 24078# -> cc: cleaning runs counter 24079# size: 136044 bytes 24080# 24081# struct maphdr { 24082# int32_t map_cnt; /* 0: single map */ 24083# int32_t min_ceil; /* 4: 100 mm == 10 cm == min. ceil */ 24084# int32_t max_ceil; /* 8: 10000 mm == 100 m == max. ceil */ 24085# int32_t max_climb; /* 12: 50 mm = 5 cm == max. height to climb */ 24086# int32_t unknown; /* 16: 50000 ??? */ 24087# int32_t cell_bytes; /* 20: # of bytes for cells per block */ 24088# int32_t block_max; /* 24: 1000 == max. # of blocks */ 24089# int32_t route_max; /* 28: 1000 == max. # of routes */ 24090# int32_t used_blocks; /* 32: 5/45/33/... == # of block entries used! */ 24091# int32_t cell_dim; /* 36: 10 == cell dimension */ 24092# int32_t clock_tick; /* 40: 100 == clock ticks */ 24093# #if 0 24094# struct { /* 44: 1000 blocks for 10x10 cells */ 24095# int32_t yoffset; 24096# int32_t xoffset; 24097# int32_t posxy; 24098# int32_t timecode; 24099# } blocks[ 1000]; 24100# char cells[ 1000* 100]; /* 16044: 1000 10x10 cells */ 24101# int16_t routes[ 1000* 10]; /* 116044: 1000 10-routes */ 24102# #endif 24103# }; 24104 241050 lelong =1 24106>4 lelong =100 24107>>8 lelong =10000 24108>>>12 lelong =50 24109>>>>16 lelong =50000 24110>>>>>20 lelong =100 24111>>>>>>24 lelong =1000 24112>>>>>>>28 lelong =1000 24113>>>>>>>>36 lelong =10 24114>>>>>>>>>40 lelong =100 24115>>>>>>>>>>32 lelong x LG robot VR6[234]xx %dm^2 navigation 24116>>>>>>>>>>136040 lelong =-1 reuse map data 24117>>>>>>>>>>136040 lelong =0 map data 24118>>>>>>>>>>136040 lelong >0 spurious map data 24119>>>>>>>>>>136040 lelong <-1 spurious map data 24120 24121 24122 24123#------------------------------------------------------------------------------ 24124# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $ 24125# varied.out: file(1) magic for various USG systems 24126# 24127# Herewith many of the object file formats used by USG systems. 24128# Most have been moved to files for a particular processor, 24129# and deleted if they duplicate other entries. 24130# 241310 short 0610 Perkin-Elmer executable 24132# AMD 29K 241330 beshort 0572 amd 29k coff noprebar executable 241340 beshort 01572 amd 29k coff prebar executable 241350 beshort 0160007 amd 29k coff archive 24136# Cray 241376 beshort 0407 unicos (cray) executable 24138# Ultrix 4.3 24139596 string \130\337\377\377 Ultrix core file 24140>600 string >\0 from '%s' 24141# BeOS and MAcOS PEF executables 24142# From: hplus@zilker.net (Jon Watte) 241430 string Joy!peffpwpc header for PowerPC PEF executable 24144# 24145# ava assembler/linker Uros Platise <uros.platise@ijs.si> 241460 string avaobj AVR assembler object code 24147>7 string >\0 version '%s' 24148# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 241490 string gmon GNU prof performance data 24150>4 long x - version %d 24151# From: Dave Pearson <davep@davep.org> 24152# Harbour <URL:http://harbour-project.org/> HRB files. 241530 string \xc0HRB Harbour HRB file 24154>4 leshort x version %d 24155# Harbour HBV files 241560 string \xc0HBV Harbour variable dump file 24157>4 leshort x version %d 24158 24159# From: Alex Beregszaszi <alex@fsn.hu> 24160# 0 string exec BugOS executable 24161# 0 string pack BugOS archive 24162 24163# From: Jason Spence <jspence@lightconsulting.com> 24164# Generated by the "examples" in STM's ST40 devkit, and derived code. 241650 lelong 0x13a9f17e ST40 component image format 24166>4 string >\0 \b, name '%s' 24167 24168#------------------------------------------------------------------------------ 24169# $File: varied.script,v 1.11 2015/03/27 17:59:39 christos Exp $ 24170# varied.script: file(1) magic for various interpreter scripts 24171 241720 string/t #!\ / a 24173>3 string >\0 %s script text executable 24174 241750 string/b #!\ / a 24176>3 string >\0 %s script executable (binary data) 24177 241780 string/t #!\t/ a 24179>3 string >\0 %s script text executable 24180 241810 string/b #!\t/ a 24182>3 string >\0 %s script executable (binary data) 24183 241840 string/t #!/ a 24185>2 string >\0 %s script text executable 24186 241870 string/b #!/ a 24188>2 string >\0 %s script executable (binary data) 24189 241900 string/t #!\ script text executable 24191>3 string >\0 for %s 24192 241930 string/b #!\ script executable 24194>3 string >\0 for %s (binary data) 24195 24196# using env 241970 string/t #!/usr/bin/env a 24198>15 string/t >\0 %s script text executable 24199!:strength / 10 24200 242010 string/b #!/usr/bin/env a 24202>15 string/b >\0 %s script executable (binary data) 24203!:strength / 10 24204 242050 string/t #!\ /usr/bin/env a 24206>16 string/t >\0 %s script text executable 24207!:strength / 10 24208 242090 string/b #!\ /usr/bin/env a 24210>16 string/b >\0 %s script executable (binary data) 24211!:strength / 10 24212 24213# From: arno <arenevier@fdn.fr> 24214# mozilla xpconnect typelib 24215# see http://www.mozilla.org/scriptable/typelib_file.html 242160 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 24217>0x10 byte x version %d 24218>>0x11 byte x \b.%d 24219 24220#------------------------------------------------------------------------------ 24221# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $ 24222# vax: file(1) magic for VAX executable/object and APL workspace 24223# 242240 lelong 0101557 VAX single precision APL workspace 242250 lelong 0101556 VAX double precision APL workspace 24226 24227# 24228# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 24229# executables, and are handled in aout) 24230# 242310 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 24232>16 lelong >0 not stripped 24233 24234# 24235# VAX COFF 24236# 24237# The `versions' were commented out, but have been un-commented out. 24238# (Was the problem just one of endianness?) 24239# 242400 leshort 0570 VAX COFF executable 24241>12 lelong >0 not stripped 24242>22 leshort >0 - version %d 242430 leshort 0575 VAX COFF pure executable 24244>12 lelong >0 not stripped 24245>22 leshort >0 - version %d 24246 24247#------------------------------------------------------------------------------ 24248# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 24249# vicar: file(1) magic for VICAR files. 24250# 24251# From: Ossama Othman <othman@astrosun.tn.cornell.edu 24252# VICAR is JPL's in-house spacecraft image processing program 24253# VICAR image 242540 string LBLSIZE= VICAR image data 24255>32 string BYTE \b, 8 bits = VAX byte 24256>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 24257>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 24258>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 24259>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 24260>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 24261# VICAR label file 2426243 string SFDU_LABEL VICAR label file 24263 24264#------------------------------------------------------------------------------ 24265# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $ 24266# From: James Nobis <quel@quelrod.net> 24267# Microsoft hard disk images for: 24268# Virtual Server 24269# Virtual PC 24270# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx 24271# .vhd 242720 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 24273 24274# libvirt 24275# From: Philipp Hahn <hahn@univention.de> 242760 string LibvirtQemudSave Libvirt QEMU Suspend Image 24277>0x10 lelong x \b, version %u 24278>0x14 lelong x \b, XML length %u 24279>0x18 lelong 1 \b, running 24280>0x1c lelong 1 \b, compressed 24281 242820 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 24283# From: Alex Beregszaszi <alex@fsn.hu> 242840 string/b COWD VMWare3 24285>4 byte 3 disk image 24286>>32 lelong x (%d/ 24287>>36 lelong x \b%d/ 24288>>40 lelong x \b%d) 24289>4 byte 2 undoable disk image 24290>>32 string >\0 (%s) 24291 242920 string/b VMDK VMware4 disk image 242930 string/b KDMV VMware4 disk image 24294 24295#-------------------------------------------------------------------- 24296# Qemu Emulator Images 24297# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 24298# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 24299# Made by reading sources, reading documentation, and doing trial and error 24300# on existing QCOW files 243010 string/b QFI\xFB QEMU QCOW Image 24302 24303# Uncomment the following line to display Magic (only used for debugging 24304# this magic number) 24305#>0 string/b x , Magic: %s 24306 24307# There are currently 2 Versions: "1" and "2". 24308# http://www.gnome.org/~markmc/qcow-image-format-version-1.html 24309>4 belong 1 (v1) 24310 24311# Using the existence of the Backing File Offset to determine whether 24312# to read Backing File Information 24313>>12 belong >0 \b, has backing file ( 24314# Note that this isn't a null-terminated string; the length is actually 24315# (16.L). Assuming a null-terminated string happens to work usually, but it 24316# may spew junk until it reaches a \0 in some cases. 24317>>>(12.L) string >\0 \bpath %s 24318 24319# Modification time of the Backing File 24320# Really useful if you want to know if your backing 24321# file is still usable together with this image 24322>>>>20 bedate >0 \b, mtime %s) 24323>>>>20 default x \b) 24324 24325# Size is stored in bytes in a big-endian u64. 24326>>24 bequad x \b, %lld bytes 24327 24328# 1 for AES encryption, 0 for none. 24329>>36 belong 1 \b, AES-encrypted 24330 24331# http://www.gnome.org/~markmc/qcow-image-format.html 24332>4 belong 2 (v2) 24333# Using the existence of the Backing File Offset to determine whether 24334# to read Backing File Information 24335>>8 bequad >0 \b, has backing file 24336# Note that this isn't a null-terminated string; the length is actually 24337# (16.L). Assuming a null-terminated string happens to work usually, but it 24338# may spew junk until it reaches a \0 in some cases. Also, since there's no 24339# .Q modifier, we just use the bottom four bytes as an offset. Note that if 24340# the file is over 4G, and the backing file path is stored after the first 4G, 24341# the wrong filename will be printed. (This should be (8.Q), when that syntax 24342# is introduced.) 24343>>>(12.L) string >\0 (path %s) 24344>>24 bequad x \b, %lld bytes 24345>>32 belong 1 \b, AES-encrypted 24346 24347>4 belong 3 (v3) 24348# Using the existence of the Backing File Offset to determine whether 24349# to read Backing File Information 24350>>8 bequad >0 \b, has backing file 24351# Note that this isn't a null-terminated string; the length is actually 24352# (16.L). Assuming a null-terminated string happens to work usually, but it 24353# may spew junk until it reaches a \0 in some cases. Also, since there's no 24354# .Q modifier, we just use the bottom four bytes as an offset. Note that if 24355# the file is over 4G, and the backing file path is stored after the first 4G, 24356# the wrong filename will be printed. (This should be (8.Q), when that syntax 24357# is introduced.) 24358>>>(12.L) string >\0 (path %s) 24359>>24 bequad x \b, %lld bytes 24360>>32 belong 1 \b, AES-encrypted 24361 24362>4 default x (unknown version) 24363 243640 string/b QEVM QEMU suspend to disk image 24365 24366# QEMU QED Image 24367# http://wiki.qemu.org/Features/QED/Specification 243680 string/b QED\0 QEMU QED Image 24369 24370# VDI Image 24371# Sun xVM VirtualBox Disk Image 24372# From: Richard W.M. Jones <rich@annexia.org> 24373# VirtualBox Disk Image 243740x40 ulelong 0xbeda107f VirtualBox Disk Image 24375>0x44 uleshort >0 \b, major %u 24376>0x46 uleshort >0 \b, minor %u 24377>0 string >\0 (%s) 24378>368 lequad x \b, %lld bytes 24379 243800 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 24381>32 string x type %s, 24382>48 string x subtype %s 24383 243840 lelong 0x02468ace Bochs Sparse disk image 24385 24386 24387#------------------------------------------------------------------------------ 24388# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 24389# Virtutech Compressed Random Access File Format 24390# 24391# From <gustav@virtutech.com> 243920 string \211\277\036\203 Virtutech CRAFF 24393>4 belong x v%d 24394>20 belong 0 uncompressed 24395>20 belong 1 bzipp2ed 24396>20 belong 2 gzipped 24397>24 belong 0 not clean 24398 24399#------------------------------------------------------------------------------ 24400# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 24401# visx: file(1) magic for Visx format files 24402# 244030 short 0x5555 VISX image file 24404>2 byte 0 (zero) 24405>2 byte 1 (unsigned char) 24406>2 byte 2 (short integer) 24407>2 byte 3 (float 32) 24408>2 byte 4 (float 64) 24409>2 byte 5 (signed char) 24410>2 byte 6 (bit-plane) 24411>2 byte 7 (classes) 24412>2 byte 8 (statistics) 24413>2 byte 10 (ascii text) 24414>2 byte 15 (image segments) 24415>2 byte 100 (image set) 24416>2 byte 101 (unsigned char vector) 24417>2 byte 102 (short integer vector) 24418>2 byte 103 (float 32 vector) 24419>2 byte 104 (float 64 vector) 24420>2 byte 105 (signed char vector) 24421>2 byte 106 (bit plane vector) 24422>2 byte 121 (feature vector) 24423>2 byte 122 (feature vector library) 24424>2 byte 124 (chain code) 24425>2 byte 126 (bit vector) 24426>2 byte 130 (graph) 24427>2 byte 131 (adjacency graph) 24428>2 byte 132 (adjacency graph library) 24429>2 string .VISIX (ascii text) 24430 24431#------------------------------------------------------------------------------ 24432# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $ 24433# vms: file(1) magic for VMS executables (experimental) 24434# 24435# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 24436 24437# GRR 950122: I'm just guessing on these, based on inspection of the headers 24438# of three executables each for Alpha and VAX architectures. The VAX files 24439# all had headers similar to this: 24440# 24441# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 24442# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 24443# 244440 string \xb0\0\x30\0 VMS VAX executable 24445>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 24446# 24447# The AXP files all looked like this, except that the byte at offset 0x22 24448# was 06 in some of them and 07 in others: 24449# 24450# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 24451# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 24452# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 24453# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 24454# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 24455# 24456# GRR this test is still too general as it catches example adressen.dbt 244570 belong 0x03000000 24458>8 ubelong 0xec020000 VMS Alpha executable 24459>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 24460 24461#------------------------------------------------------------------------------ 24462# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $ 24463# VMware specific files (deducted from version 1.1 and log file entries) 24464# Anthon van der Neut (anthon@mnt.org) 244650 belong 0x4d52564e VMware nvram 24466 24467#------------------------------------------------------------------------------ 24468# $File: vorbis,v 1.23 2017/03/17 21:35:28 christos Exp $ 24469# vorbis: file(1) magic for Ogg/Vorbis files 24470# 24471# From Felix von Leitner <leitner@fefe.de> 24472# Extended by Beni Cherniavsky <cben@crosswinds.net> 24473# Further extended by Greg Wooledge <greg@wooledge.org> 24474# 24475# Most (everything but the number of channels and bitrate) is commented 24476# out with `##' as it's not interesting to the average user. The most 24477# probable things advanced users would want to uncomment are probably 24478# the number of comments and the encoder version. 24479# 24480# FIXME: The first match has been made a search, so that it can skip 24481# over prepended ID3 tags. This will work for MIME type detection, but 24482# won't work for detecting other properties of the file (they all need 24483# to be made relative to the search). In any case, if the file has ID3 24484# tags, the ID3 information will be printed, not the Ogg information, 24485# so until that's fixed, this doesn't matter. 24486# FIXME[2]: Disable the above for now, since search assumes text mode. 24487# 24488# --- Ogg Framing --- 24489#0 search/1000 OggS Ogg data 244900 string OggS Ogg data 24491>4 byte !0 UNKNOWN REVISION %u 24492##>4 byte 0 revision 0 24493>4 byte 0 24494##>>14 lelong x (Serial %lX) 24495# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 24496>>28 string \x7fFLAC \b, FLAC audio 24497# non-Vorbis content: Theora 24498!:mime audio/ogg 24499>>28 string \x80theora \b, Theora video 24500!:mime video/ogg 24501# non-Vorbis content: Kate 24502>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text) 24503!:mime application/ogg 24504>>>37 ubyte x v%u 24505>>>38 ubyte x \b.%u, 24506>>>40 byte 0 utf8 encoding, 24507>>>40 byte !0 unknown character encoding, 24508>>>60 string >\0 language %s, 24509>>>60 string \0 no language set, 24510>>>76 string >\0 category %s 24511>>>76 string \0 no category set 24512# non-Vorbis content: Skeleton 24513>>28 string fishead\0 \b, Skeleton 24514!:mime video/ogg 24515>>>36 leshort x v%u 24516>>>40 leshort x \b.%u 24517# non-Vorbis content: Speex 24518>>28 string Speex\ \ \ \b, Speex audio 24519!:mime audio/ogg 24520# non-Vorbis content: OGM 24521>>28 string \x01video\0\0\0 \b, OGM video 24522!:mime video/ogg 24523>>>37 string/c div3 (DivX 3) 24524>>>37 string/c divx (DivX 4) 24525>>>37 string/c dx50 (DivX 5) 24526>>>37 string/c xvid (XviD) 24527# --- First vorbis packet - general header --- 24528>>28 string \x01vorbis \b, Vorbis audio, 24529!:mime audio/ogg 24530>>>35 lelong !0 UNKNOWN VERSION %u, 24531##>>>35 lelong 0 version 0, 24532>>>35 lelong 0 24533>>>>39 ubyte 1 mono, 24534>>>>39 ubyte 2 stereo, 24535>>>>39 ubyte >2 %u channels, 24536>>>>40 lelong x %u Hz 24537# Minimal, nominal and maximal bitrates specified when encoding 24538>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 24539# The above tests if at least one of these is specified: 24540>>>>>52 lelong !-1 24541# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 24542# instead of -1. 24543# Vorbis 1.0 uses 0 instead of -1. 24544>>>>>>52 lelong !0 24545>>>>>>>52 lelong !-1000 24546>>>>>>>>52 lelong x <%u 24547>>>>>48 lelong !-1 24548>>>>>>48 lelong x ~%u 24549>>>>>44 lelong !-1 24550>>>>>>44 lelong !-1000 24551>>>>>>>44 lelong !0 24552>>>>>>>>44 lelong x >%u 24553>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 24554# -- Second vorbis header packet - the comments 24555# A kludge to read the vendor string. It's a counted string, not a 24556# zero-terminated one, so file(1) can't read it in a generic way. 24557# libVorbis is the only one existing currently, so I detect specifically 24558# it. The interesting value is the cvs date (8 digits decimal). 24559# Post-RC1 Ogg files have the second header packet (and thus the version) 24560# in a different place, so we must use an indirect offset. 24561>>>(84.b+85) string \x03vorbis 24562>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 24563>>>>>(84.b+120) string >00000000 24564# Map to beta version numbers: 24565>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 24566>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 24567>>>>>>(84.b+120) string >20000508 24568>>>>>>>(84.b+120) string <20001031 (beta2-3) 24569>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 24570>>>>>>(84.b+120) string >20001031 24571>>>>>>>(84.b+120) string <20010225 (beta3-4) 24572>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 24573>>>>>>(84.b+120) string >20010225 24574>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 24575>>>>>>(84.b+120) string 20010615 (1.0 RC1) 24576>>>>>>(84.b+120) string 20010813 (1.0 RC2) 24577>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 24578>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 24579>>>>>>(84.b+120) string 20011217 (1.0 RC3) 24580>>>>>>(84.b+120) string 20011231 (1.0 RC3) 24581# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 24582>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 24583# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 24584>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 24585>>>>>(84.b+117) string >00000000 24586>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 24587>>>>>>(84.b+117) string 20020717 (1.0) 24588>>>>>>(84.b+117) string 20030909 (1.0.1) 24589>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 24590 24591# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5 24592>>28 string OpusHead \b, Opus audio, 24593!:mime audio/ogg 24594>>>36 ubyte >0x0F UNKNOWN VERSION %u, 24595>>>36 ubyte &0x0F version 0.%d 24596>>>>46 ubyte >1 24597>>>>>46 ubyte !255 unknown channel mapping family %u, 24598>>>>>37 ubyte x %u channels 24599>>>>46 ubyte 0 24600>>>>>37 ubyte 1 mono 24601>>>>>37 ubyte 2 stereo 24602>>>>46 ubyte 1 24603>>>>>37 ubyte 1 mono 24604>>>>>37 ubyte 2 stereo 24605>>>>>37 ubyte 3 linear surround 24606>>>>>37 ubyte 4 quadraphonic 24607>>>>>37 ubyte 5 5.0 surround 24608>>>>>37 ubyte 6 5.1 surround 24609>>>>>37 ubyte 7 6.1 surround 24610>>>>>37 ubyte 8 7.1 surround 24611>>>>40 lelong !0 \b, %u Hz 24612 24613#------------------------------------------------------------------------------ 24614# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 24615# VXL: file(1) magic for VXL binary IO data files 24616# 24617# from Ian Scott <scottim@sf.net> 24618# 24619# VXL is a collection of C++ libraries for Computer Vision. 24620# See the vsl chapter in the VXL Book for more info 24621# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 24622# http:/vxl.sf.net 24623 246242 lelong 0x472b2c4e VXL data file, 24625>0 leshort >0 schema version no %d 24626 24627#------------------------------------------------------------------------------ 24628# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $ 24629# warc: file(1) magic for WARC files 24630 246310 string WARC/ WARC Archive 24632>5 string x version %.4s 24633!:mime application/warc 24634 24635#------------------------------------------------------------------------------ 24636# Arc File Format from Internet Archive 24637# see http://www.archive.org/web/researcher/ArcFileFormat.php 246380 string filedesc:// Internet Archive File 24639!:mime application/x-ia-arc 24640>11 search/256 \x0A \b 24641>>&0 ubyte >0 \b version %c 24642 24643#------------------------------------------------------------------------------ 24644# weak: file(1) magic for very weak magic entries, disabled by default 24645# 24646# These entries are so weak that they might interfere identification of 24647# other formats. Example include: 24648# - Only identify for 1 or 2 bytes 24649# - Match against very wide range of values 24650# - Match against generic word in some spoken languages (e.g. English) 24651 24652# Summary: Computer Graphics Metafile 24653# Extension: .cgm 24654#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 24655#0 beshort 0x3020 character Computer Graphics Metafile 24656 24657#0 string =!! Bennet Yee's "face" format 24658#------------------------------------------------------------------------------ 24659# $File: webassembly,v 1.2 2017/05/02 14:05:29 christos Exp $ 24660# webassembly: file(1) magic for WebAssembly modules 24661# 24662# WebAssembly is a virtual architecture developed by a W3C Community 24663# Group at http://webassembly.org/. The file extension is .wasm, and 24664# the MIME type is application/wasm. 24665# 24666# http://webassembly.org/docs/binary-encoding/ is the main 24667# document describing the binary format. 24668# From: Pip Cet <pipcet@gmail.com> and Joel Martin 24669 246700 string \0asm WebAssembly (wasm) binary module 24671>4 lelong =1 version %#x (MVP) 24672>4 lelong >1 version %#x 24673 24674#------------------------------------------------------------------------------ 24675# $File: windows,v 1.16 2017/03/17 22:20:22 christos Exp $ 24676# windows: file(1) magic for Microsoft Windows 24677# 24678# This file is mainly reserved for files where programs 24679# using them are run almost always on MS Windows 3.x or 24680# above, or files only used exclusively in Windows OS, 24681# where there is no better category to allocate for. 24682# For example, even though WinZIP almost run on Windows 24683# only, it is better to treat them as "archive" instead. 24684# For format usable in DOS, such as generic executable 24685# format, please specify under "msdos" file. 24686# 24687 24688 24689# Summary: Outlook Express DBX file 24690# Extension: .dbx 24691# Created by: Christophe Monniez 246920 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 24693>4 byte =0xC5 \b, message database 24694>4 byte =0xC6 \b, folder database 24695>4 byte =0xC7 \b, account information 24696>4 byte =0x30 \b, offline database 24697 24698 24699# Summary: Windows crash dump 24700# Extension: .dmp 24701# Created by: Andreas Schuster (http://computer.forensikblog.de/) 24702# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html 24703# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 247040 string PAGE 24705>4 string DUMP MS Windows 32bit crash dump 24706>>0x05c byte 0 \b, no PAE 24707>>0x05c byte 1 \b, PAE 24708>>0xf88 lelong 1 \b, full dump 24709>>0xf88 lelong 2 \b, kernel dump 24710>>0xf88 lelong 3 \b, small dump 24711>>0x068 lelong x \b, %d pages 24712>4 string DU64 MS Windows 64bit crash dump 24713>>0xf98 lelong 1 \b, full dump 24714>>0xf98 lelong 2 \b, kernel dump 24715>>0xf98 lelong 3 \b, small dump 24716>>0x090 lequad x \b, %lld pages 24717 24718 24719# Summary: Vista Event Log 24720# Extension: .evtx 24721# Created by: Andreas Schuster (http://computer.forensikblog.de/) 24722# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html 247230 string ElfFile\0 MS Windows Vista Event Log 24724>0x2a leshort x \b, %d chunks 24725>>0x10 lelong x \b (no. %d in use) 24726>0x18 lelong >1 \b, next record no. %d 24727>0x18 lelong =1 \b, empty 24728>0x78 lelong &1 \b, DIRTY 24729>0x78 lelong &2 \b, FULL 24730 24731 24732# Summary: Windows 3.1 group files 24733# Extension: .grp 24734# Created by: unknown 247350 string \120\115\103\103 MS Windows 3.1 group files 24736 24737 24738# Summary: Old format help files 24739# URL: https://en.wikipedia.org/wiki/WinHelp 24740# Reference: http://www.oocities.org/mwinterhoff/helpfile.htm 24741# Update: Joerg Jenderek 24742# Created by: Dirk Jagdmann <doj@cubic.org> 24743# 24744# check and then display version and date inside MS Windows HeLP file fragment 247450 name help-ver-date 24746# look for Magic of SYSTEMHEADER 24747>0 leshort 0x036C 24748# version Major 1 for right file fragment 24749>>4 leshort 1 Windows 24750# print non empty string above to avoid error message 24751# Warning: Current entry does not yet have a description for adding a MIME type 24752!:mime application/winhelp 24753!:ext hlp 24754# version Minor of help file format is hint for windows version 24755>>>2 leshort 0x0F 3.x 24756>>>2 leshort 0x15 3.0 24757>>>2 leshort 0x21 3.1 24758>>>2 leshort 0x27 x.y 24759>>>2 leshort 0x33 95 24760>>>2 default x y.z 24761>>>>2 leshort x 0x%x 24762# to complete message string like "MS Windows 3.x help file" 24763>>>2 leshort x help 24764# GenDate often older than file creation date 24765>>>6 ldate x \b, %s 24766# 24767# Magic for HeLP files 247680 lelong 0x00035f3f 24769# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 24770# file header magic 0x293B at DirectoryStart+9 24771>(4.l+9) uleshort 0x293B MS 24772# look for @VERSION bmf.. like IBMAVW.ANN 24773>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 24774!:mime application/x-winhelp 24775!:ext ann 24776>>0xD4 string !\x62\x6D\x66\x01\x00 24777# "GID Help index" by TrID 24778>>>(4.l+0x65) string =|Pete Windows help Global Index 24779!:mime application/x-winhelp 24780!:ext gid 24781# HeLP Bookmark or 24782# "Windows HELP File" by TrID 24783>>>(4.l+0x65) string !|Pete 24784# maybe there exist a cleaner way to detect HeLP fragments 24785# brute search for Magic 0x036C with matching Major maximal 7 iterations 24786# discapp.hlp 24787>>>>16 search/0x49AF/s \x6c\x03 24788>>>>>&0 use help-ver-date 24789>>>>>&4 leshort !1 24790# putty.hlp 24791>>>>>>&0 search/0x69AF/s \x6c\x03 24792>>>>>>>&0 use help-ver-date 24793>>>>>>>&4 leshort !1 24794>>>>>>>>&0 search/0x49AF/s \x6c\x03 24795>>>>>>>>>&0 use help-ver-date 24796>>>>>>>>>&4 leshort !1 24797>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 24798>>>>>>>>>>>&0 use help-ver-date 24799>>>>>>>>>>>&4 leshort !1 24800>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 24801>>>>>>>>>>>>>&0 use help-ver-date 24802>>>>>>>>>>>>>&4 leshort !1 24803>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 24804>>>>>>>>>>>>>>>&0 use help-ver-date 24805>>>>>>>>>>>>>>>&4 leshort !1 24806>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 24807# GCC.HLP is detected after 7 iterations 24808>>>>>>>>>>>>>>>>>&0 use help-ver-date 24809# this only happens if bigger hlp file is detected after used search iterations 24810>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 24811!:mime application/winhelp 24812!:ext hlp 24813# repeat search again or following default line does not work 24814>>>>16 search/0x49AF/s \x6c\x03 24815# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 24816>>>>16 default x Windows help Bookmark 24817!:mime application/x-winhelp 24818!:ext /bmk 24819## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 24820##>>8 lelong x \b, FirstFreeBlock 0x%8.8x 24821# EntireFileSize 24822>>12 lelong x \b, %d bytes 24823## ReservedSpace normally 042Fh AFh for *.ANN 24824#>>(4.l) lelong x \b, ReservedSpace 0x%8.8x 24825## UsedSpace normally 0426h A6h for *.ANN 24826#>>(4.l+4) lelong x \b, UsedSpace 0x%8.8x 24827## FileFlags normally 04... 24828#>>(4.l+5) lelong x \b, FileFlags 0x%8.8x 24829## file header magic 0x293B 24830#>>(4.l+9) uleshort x \b, file header magic 0x%4.4x 24831## file header Flags 0x0402 24832#>>(4.l+11) uleshort x \b, file header Flags 0x%4.4x 24833## file header PageSize 0400h 80h for *.ANN 24834#>>(4.l+13) uleshort x \b, PageSize 0x%4.4x 24835## Structure[16] z4 24836#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 24837## MustBeZero 0 24838#>>(4.l+31) uleshort x \b, MustBeZero 0x%4.4x 24839## PageSplits 24840#>>(4.l+33) uleshort x \b, PageSplits 0x%4.4x 24841## RootPage 24842#>>(4.l+35) uleshort x \b, RootPage 0x%4.4x 24843## MustBeNegOne 0xffff 24844#>>(4.l+37) uleshort x \b, MustBeNegOne 0x%4.4x 24845## TotalPages 1 24846#>>(4.l+39) uleshort x \b, TotalPages 0x%4.4x 24847## NLevels 0x0001 24848#>>(4.l+41) uleshort x \b, NLevels 0x%4.4x 24849## TotalBtreeEntries 24850#>>(4.l+43) ulelong x \b, TotalBtreeEntries 0x%8.8x 24851## pages of the B+ tree 24852#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx 24853 24854# start with colon or semicolon for comment line like Back2Life.cnt 248550 regex \^(:|;) 24856# look for first keyword Base 24857>0 search/45 :Base 24858>>&0 use cnt-name 24859# only solution to search again from beginning , because relative offsets changes when use is called 24860>0 search/45 :Base 24861>0 default x 24862# look for other keyword Title like in putty.cnt 24863>>0 search/45 :Title 24864>>>&0 use cnt-name 24865# 24866# display mime type and name of Windows help Content source 248670 name cnt-name 24868# skip space at beginning 24869>0 string \040 24870# name without extension and greater character or name with hlp extension 24871>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s" 24872!:mime text/plain 24873!:apple ????TEXT 24874!:ext cnt 24875# 24876# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 248770 string tfMR MS Windows help Full Text Search index 24878!:mime application/x-winhelp-fts 24879!:ext fts 24880>16 string >\0 for "%s" 24881 24882# Summary: Hyper terminal 24883# Extension: .ht 24884# Created by: unknown 248850 string HyperTerminal\040 24886>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 24887 24888# http://ithreats.files.wordpress.com/2009/05/\040 24889# lnk_the_windows_shortcut_file_format.pdf 24890# Summary: Windows shortcut 24891# Extension: .lnk 24892# Created by: unknown 24893# 'L' + GUUID 248940 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 24895>20 lelong&1 1 \b, Item id list present 24896>20 lelong&2 2 \b, Points to a file or directory 24897>20 lelong&4 4 \b, Has Description string 24898>20 lelong&8 8 \b, Has Relative path 24899>20 lelong&16 16 \b, Has Working directory 24900>20 lelong&32 32 \b, Has command line arguments 24901>20 lelong&64 64 \b, Icon 24902>>56 lelong x \b number=%d 24903>24 lelong&1 1 \b, Read-Only 24904>24 lelong&2 2 \b, Hidden 24905>24 lelong&4 4 \b, System 24906>24 lelong&8 8 \b, Volume Label 24907>24 lelong&16 16 \b, Directory 24908>24 lelong&32 32 \b, Archive 24909>24 lelong&64 64 \b, Encrypted 24910>24 lelong&128 128 \b, Normal 24911>24 lelong&256 256 \b, Temporary 24912>24 lelong&512 512 \b, Sparse 24913>24 lelong&1024 1024 \b, Reparse point 24914>24 lelong&2048 2048 \b, Compressed 24915>24 lelong&4096 4096 \b, Offline 24916>28 leqwdate x \b, ctime=%s 24917>36 leqwdate x \b, mtime=%s 24918>44 leqwdate x \b, atime=%s 24919>52 lelong x \b, length=%u, window= 24920>60 lelong&1 1 \bhide 24921>60 lelong&2 2 \bnormal 24922>60 lelong&4 4 \bshowminimized 24923>60 lelong&8 8 \bshowmaximized 24924>60 lelong&16 16 \bshownoactivate 24925>60 lelong&32 32 \bminimize 24926>60 lelong&64 64 \bshowminnoactive 24927>60 lelong&128 128 \bshowna 24928>60 lelong&256 256 \brestore 24929>60 lelong&512 512 \bshowdefault 24930#>20 lelong&1 0 24931#>>20 lelong&2 2 24932#>>>(72.l-64) pstring/h x \b [%s] 24933#>20 lelong&1 1 24934#>>20 lelong&2 2 24935#>>>(72.s) leshort x 24936#>>>&75 pstring/h x \b [%s] 24937 24938# Summary: Outlook Personal Folders 24939# Created by: unknown 249400 lelong 0x4E444221 Microsoft Outlook email folder 24941>10 leshort 0x0e (<=2002) 24942>10 leshort 0x17 (>=2003) 24943 24944 24945# Summary: Windows help cache 24946# Created by: unknown 249470 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 24948 24949 24950# Summary: IE cache file 24951# Created by: Christophe Monniez 249520 string Client\ UrlCache\ MMF Internet Explorer cache file 24953>20 string >\0 version %s 24954 24955 24956# Summary: Registry files 24957# Created by: unknown 24958# Modified by (1): Joerg Jenderek 249590 string regf MS Windows registry file, NT/2000 or above 249600 string CREG MS Windows 95/98/ME registry file 249610 string SHCC3 MS Windows 3.1 registry file 24962 24963 24964# Summary: Windows Registry text 24965# Extension: .reg 24966# Submitted by: Abel Cheung <abelcheung@gmail.com> 249670 string REGEDIT4\r\n\r\n Windows Registry text (Win95 or above) 249680 string Windows\ Registry\ Editor\040 24969>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 24970 24971# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013 24972# empty ,comment , section 24973# PR/383: remove unicode BOM because it is not portable across regex impls 249740 regex/s \\`(\\r\\n|;|[[]) 24975# left bracket in section line 24976>&0 search/8192 [ 24977# http://en.wikipedia.org/wiki/Autorun.inf 24978# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 24979>>&0 regex/c \^(autorun)]\r\n 24980>>>&0 ubyte =0x5b INItialization configuration 24981!:mime application/x-wine-extension-ini 24982# From: Pal Tamas <folti@balabit.hu> 24983# Autorun File 24984>>>&0 ubyte !0x5b Microsoft Windows Autorun file 24985!:mime application/x-setupscript 24986# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 24987# version strings ASCII coded case-independent for Windows setup information script file 24988>>&0 regex/c \^(version|strings)] Windows setup INFormation 24989!:mime application/x-setupscript 24990#!:mime application/inf 24991#!:mime application/x-wine-extension-inf 24992>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 24993!:mime text/inf 24994# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 24995# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 24996# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 24997>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 24998!:mime application/x-wine-extension-ini 24999#!:mime text/plain 25000# http://support.microsoft.com/kb/84709/ 25001>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 25002!:mime application/x-wine-extension-ini 25003>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 25004!:mime application/x-wine-extension-ini 25005# http://technet.microsoft.com/en-us/library/cc722567.aspx 25006# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 25007>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 25008!:mime application/x-wine-extension-ini 25009# http://en.wikipedia.org/wiki/SYSTEM.INI 25010>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 25011!:mime application/x-wine-extension-ini 25012# http://www.mdgx.com/newtip6.htm 25013>>&0 regex/c \^(SafeList)] Windows IOS.INI 25014!:mime application/x-wine-extension-ini 25015# http://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 25016>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 25017!:mime application/x-wine-extension-ini 25018>>>&0 ubyte x 25019# http://en.wikipedia.org/wiki/CONFIG.SYS 25020>>&0 regex/c \^(menu)]\r\n MS-DOS CONFIG.SYS 25021# http://support.microsoft.com/kb/118579/ 25022>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 25023# VERS string unicoded case-independent 25024>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 25025# ION] string unicoded case-independent 25026>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 25027!:mime application/x-setupscript 25028# STRI string unicoded case-independent 25029>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0053005400520049 25030# NGS] string unicoded case-independent 25031>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x004e00470053005D Windows setup INFormation 25032!:mime application/x-setupscript 25033# unknown keyword after opening bracket 25034>>&0 default x 25035>>>&0 search/8192 [ 25036# version Strings FileIdentification 25037>>>>&0 string/c version Windows setup INFormation 25038!:mime application/x-setupscript 25039# VERS string unicoded case-independent 25040>>>>&0 ubequad&0xFFdfFFdfFFdfFFdf 0x0056004500520053 25041# ION] string unicoded case-independent 25042>>>>>&0 ubequad&0xFFdfFFdfFFdfFFff 0x0049004f004e005d Windows setup INFormation 25043!:mime application/x-setupscript 25044# http://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 25045#>>>>&0 default x Generic INItialization configuration 25046#!:mime application/x-wine-extension-ini 25047 25048# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 25049# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 25050# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp 250510 leshort&0xFeFe 0x0000 25052!:strength -5 25053# test for unused null bits in PNF_FLAGs 25054>4 ulelong&0xFCffFe00 0x00000000 25055# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure 25056>>68 ulelong >0x57 25057# test for zero high byte of InfValueBlockSize, followed by WinDirPath like 25058# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT 25059>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF 25060!:mime application/x-pnf 25061# currently only found Major Version=1 and Minor Version=1 25062#>>>>0 uleshort =0x0101 25063#>>>>>1 ubyte x \b, version %u 25064#>>>>>0 ubyte x \b.%u 25065>>>>0 uleshort !0x0101 25066>>>>>1 ubyte x \b, version %u 25067>>>>>0 ubyte x \b.%u 25068# 1 ,2 (windows 98 SE) 25069#>>>>2 uleshort =2 \b, InfStyle %u 25070>>>>2 uleshort !2 \b, InfStyle %u 25071# PNF_FLAG_IS_UNICODE 0x00000001 25072# PNF_FLAG_HAS_STRINGS 0x00000002 25073# PNF_FLAG_SRCPATH_IS_URL 0x00000004 25074# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 25075# PNF_FLAG_INF_VERIFIED 0x00000010 25076# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 25077# ?? 0x00000100 25078# ?? 0x01000000 25079# ?? 0x02000000 25080>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded 25081>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed 25082#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x 25083# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 25084#>>>>12 uleshort x \b, InfSubstValueCount 0x%x 25085# only < 9 found 25086#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x 25087# only found values lower 0x0000ffff 25088#>>>>16 ulelong x \b, InfVersionDataSize 0x%x 25089# only found positive values lower 0x00ffFFff for InfVersionDataOffset 25090>>>>20 ulelong x \b, at 0x%x 25091>>>>4 ulelong&0x00000001 =0x00000001 25092# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 25093>>>>>(20.l) lestring16 x "%s" 25094>>>>4 ulelong&0x00000001 !0x00000001 25095>>>>>(20.l) string x "%s" 25096# FILETIME is number of 100-nanosecond intervals since 1 January 1601 25097#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 25098# only found values lower 0x00ffFFff 25099#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x 25100#>>>>36 ulelong x \b, StringTableBlockSize 0x%x 25101#>>>>40 ulelong x \b, InfSectionCount 0x%x 25102#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x 25103#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x 25104#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x 25105#>>>>56 ulelong x \b, InfLineBlockSize 0x%x 25106#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x 25107#>>>>64 ulelong x \b, InfValueBlockSize 0x%x 25108# WinDirPathOffset 25109#>>>>68 ulelong x \b, at 0x%x 25110>>>>68 ulelong >0x57 25111>>>>>4 ulelong&0x00000001 =0x00000001 25112>>>>>>(68.l) ubequad =0x43003a005c005700 25113# normally unicoded C:\Windows 25114#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 25115>>>>>>(68.l) ubequad !0x43003a005c005700 25116>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 25117>>>>>4 ulelong&0x00000001 !0x00000001 25118# normally ASCII C:\WINDOWS 25119#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 25120>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s" 25121# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 25122#>>>>72 ulelong >0 \b, at 0x%x 25123>>>>72 ulelong >0 \b, 25124>>>>>4 ulelong&0x00000001 =0x00000001 25125>>>>>>(72.l) lestring16 x OsLoaderPath "%s" 25126>>>>>4 ulelong&0x00000001 !0x00000001 25127# seldom C:\ instead empty 25128>>>>>>(72.l) string x OsLoaderPath "%s" 25129# 1fdh 25130#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 25131>>>>78 uleshort !0x407 \b, LanguageId %x 25132# only 407h found 25133#>>>>78 uleshort =0x407 \b, LanguageId %x 25134# InfSourcePathOffset often 0 25135#>>>>80 ulelong >0 \b, at 0x%x 25136>>>>80 ulelong >0 \b, 25137>>>>>4 ulelong&0x00000001 =0x00000001 25138>>>>>>(80.l) lestring16 x SourcePath "%s" 25139>>>>>4 ulelong&0x00000001 !0x00000001 25140>>>>>>(80.l) string >\0 SourcePath "%s" 25141# OriginalInfNameOffset often 0 25142#>>>>84 ulelong >0 \b, at 0x%x 25143>>>>84 ulelong >0 \b, 25144>>>>>4 ulelong&0x00000001 =0x00000001 25145>>>>>>(84.l) lestring16 x InfName "%s" 25146>>>>>4 ulelong&0x00000001 !0x00000001 25147>>>>>>(84.l) string >\0 InfName "%s" 25148 25149# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 25150# Extension: .bkf 25151# Created by: Joerg Jenderek 25152# URL: http://en.wikipedia.org/wiki/NTBackup 25153# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 25154# Descriptor BloCK name of Microsoft Tape Format 251550 string TAPE 25156# Format Logical Address is zero 25157>20 ulequad 0 25158# Reserved for MBC is zero 25159>>28 uleshort 0 25160# Control Block ID is zero 25161>>>36 ulelong 0 25162# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 25163>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 25164#!:mime application/x-ntbackup 25165!:ext bkf 25166# OS ID 25167>>>>>10 ubyte 1 \b NetWare 25168>>>>>10 ubyte 13 \b NetWare SMS 25169>>>>>10 ubyte 14 \b NT 25170>>>>>10 ubyte 24 \b 3 25171>>>>>10 ubyte 25 \b OS/2 25172>>>>>10 ubyte 26 \b 95 25173>>>>>10 ubyte 27 \b Macintosh 25174>>>>>10 ubyte 28 \b UNIX 25175# OS Version (2) 25176#>>>>>11 ubyte x OS V=%x 25177# MTF_CONTINUATION Media Sequence Number > 1 25178#>>>>>4 ulelong&0x00000001 !0 \b, continued 25179# MTF_COMPRESSION 25180>>>>>4 ulelong&0x00000004 !0 \b, compressed 25181# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 25182>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 25183>>>>>4 ulelong&0x00020000 0 25184# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 25185>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 25186# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 25187>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 25188# Offset To First Event 238h,240h,28Ch 25189#>>>>>8 uleshort x \b, event offset %4.4x 25190# Displayable Size (20e0230h 20e024ch 20e0224h) 25191#>>>>>8 ulequad x dis. size %16.16llx 25192# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 25193#>>>>>52 ulelong x family ID %8.8x 25194# TAPE Attributes (3) 25195#>>>>>56 ulelong x TAPE %8.8x 25196# Media Sequence Number 25197>>>>>60 uleshort >1 \b, sequence %u 25198# Password Encryption Algorithm (3) 25199>>>>>62 uleshort >0 \b, 0x%x encrypted 25200# Soft Filemark Block Size * 512 (2) 25201#>>>>>64 uleshort =2 \b, soft size %u*512 25202>>>>>64 uleshort !2 \b, soft size %u*512 25203# Media Based Catalog Type (1,2) 25204#>>>>>66 uleshort x \b, catalog type %4.4x 25205# size of Media Name (66,68,6Eh) 25206>>>>>68 uleshort >0 25207# offset of Media Name (5Eh) 25208>>>>>>70 uleshort >0 25209# 0~, 1~ANSI, 2~UNICODE 25210>>>>>>>48 ubyte 1 25211# size terminated ansi coded string normally followed by "MTF Media Label" 25212>>>>>>>>(70.s) string >\0 \b, name: %s 25213>>>>>>>48 ubyte 2 25214# Not null, but size terminated unicoded string 25215>>>>>>>>(70.s) lestring16 x \b, name: %s 25216# size of Media Label (104h) 25217>>>>>72 uleshort >0 25218# offset of Media Label (C4h,C6h,CCh) 25219>>>>>74 uleshort >0 25220>>>>>>48 ubyte 1 25221#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 25222>>>>>>>(74.s) string >\0 \b, label: %s 25223>>>>>>48 ubyte 2 25224>>>>>>>(74.s) lestring16 x \b, label: %s 25225# size of password name (0,1Ch) 25226#>>>>>76 uleshort >0 \b, password size %4.4x 25227# Software Vendor ID (CBEh) 25228>>>>>86 uleshort x \b, software (0x%x) 25229# size of Software Name (6Eh) 25230>>>>>80 uleshort >0 25231# offset of Software Name (1C8h,1CAh,1D0h) 25232>>>>>>82 uleshort >0 25233# 1~ANSI, 2~UNICODE 25234>>>>>>>48 ubyte 1 25235>>>>>>>>(82.s) string >\0 \b: %s 25236>>>>>>>48 ubyte 2 25237# size terminated unicoded coded string normally followed by "SPAD" 25238>>>>>>>>(82.s) lestring16 x \b: %s 25239# Format Logical Block Size (512,1024) 25240#>>>>>84 uleshort =1024 \b, block size %u 25241>>>>>84 uleshort !1024 \b, block size %u 25242# Media Date of MTF_DATE_TIME type with 5 bytes 25243#>>>>>>88 ubequad x DATE %16.16llx 25244# MTF Major Version (1) 25245#>>>>>>93 ubyte x \b, MFT version %x 25246# 25247 25248 25249#------------------------------------------------------------------------------ 25250# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 25251# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 25252# 252530 string RGDB CRDA wireless regulatory database file 25254>4 belong 19 (Version 1) 25255 25256#------------------------------------------------------------------------------ 25257# $File: wordprocessors,v 1.19 2015/10/16 15:11:07 christos Exp $ 25258# wordprocessors: file(1) magic fo word processors. 25259# 25260####### PWP file format used on Smith Corona Personal Word Processors: 252612 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 25262>24 byte 2 \b, single spaced 25263>24 byte 3 \b, 1.5 spaced 25264>24 byte 4 \b, double spaced 25265>25 byte 0x42 \b, letter 25266>25 byte 0x54 \b, legal 25267>26 byte 0x46 \b, A4 25268 25269# Corel/WordPerfect 252700 string \xffWPC 25271# WordPerfect 25272>8 byte 1 25273>>9 byte 1 WordPerfect macro 25274>>9 byte 2 WordPerfect help file 25275>>9 byte 3 WordPerfect keyboard file 25276>>9 byte 10 WordPerfect document 25277>>9 byte 11 WordPerfect dictionary 25278>>9 byte 12 WordPerfect thesaurus 25279>>9 byte 13 WordPerfect block 25280>>9 byte 14 WordPerfect rectangular block 25281>>9 byte 15 WordPerfect column block 25282>>9 byte 16 WordPerfect printer data 25283>>9 byte 19 WordPerfect printer data 25284>>9 byte 20 WordPerfect driver resource data 25285>>9 byte 22 WordPerfect graphic image 25286>>9 byte 23 WordPerfect hyphenation code 25287>>9 byte 24 WordPerfect hyphenation data 25288>>9 byte 25 WordPerfect macro resource data 25289>>9 byte 27 WordPerfect hyphenation lex 25290>>9 byte 29 WordPerfect wordlist 25291>>9 byte 30 WordPerfect equation resource data 25292>>9 byte 33 WordPerfect spell rules 25293>>9 byte 34 WordPerfect dictionary rules 25294>>9 byte 39 WordPerfect spell rules (Microlytics) 25295>>9 byte 43 WordPerfect settings file 25296>>9 byte 44 WordPerfect 3.5 document 25297>>9 byte 45 WordPerfect 4.2 document 25298>>9 byte 69 WordPerfect dialog file 25299>>9 byte 76 WordPerfect button bar 25300>>9 default x 25301>>>9 byte x Corel WordPerfect: Unknown filetype %d 25302# Corel Shell 25303>8 byte 2 25304>>9 byte 1 Corel shell macro 25305>>9 byte 10 Corel shell definition 25306>>9 default x 25307>>>9 byte x Corel Shell: Unknown filetype %d 25308# Corel Notebook 25309>8 byte 3 25310>>9 byte 1 Corel Notebook macro 25311>>9 byte 2 Corel Notebook help file 25312>>9 byte 3 Corel Notebook keyboard file 25313>>9 byte 10 Corel Notebook definition 25314>>9 default x 25315>>>9 byte x Corel Notebook: Unknown filetype %d 25316# Corel Calculator 25317>8 byte 4 25318>>9 byte 2 Corel Calculator help file 25319>>9 default x 25320>>>9 byte x Corel Calculator: Unknown filetype %d 25321# Corel File Manager 25322>8 byte 5 25323>>9 default x 25324>>>9 byte x Corel File Manager: Unknown filetype %d 25325# Corel Calendar 25326>8 byte 6 25327>>9 byte 2 Corel Calendar help file 25328>>9 byte 10 Corel Calendar data file 25329>>9 default x 25330>>>9 byte x Corel Calendar: Unknown filetype %d 25331# Corel Program Editor/Ed Editor 25332>8 byte 7 25333>>9 byte 1 Corel Editor macro 25334>>9 byte 2 Corel Editor help file 25335>>9 byte 3 Corel Editor keyboard file 25336>>9 byte 25 Corel Editor macro resource file 25337>>9 default x 25338>>>9 byte x Corel Program Editor/Ed Editor: Unknown filetype %d 25339# Corel Macro Editor 25340>8 byte 8 25341>>9 byte 1 Corel Macro editor macro 25342>>9 byte 2 Corel Macro editor help file 25343>>9 byte 3 Corel Macro editor keyboard file 25344>>9 default x 25345>>>9 byte x Corel Macro Editor: Unknown filetype %d 25346# Corel Plan Perfect 25347>8 byte 9 25348>>9 default x 25349>>>9 byte x Corel Plan Perfect: Unknown filetype %d 25350# Corel DataPerfect 25351>8 byte 10 25352# CHECK: Don't these belong into product 9? 25353>>9 byte 1 Corel PlanPerfect macro 25354>>9 byte 2 Corel PlanPerfect help file 25355>>9 byte 3 Corel PlanPerfect keyboard file 25356>>9 byte 10 Corel PlanPerfect worksheet 25357>>9 byte 15 Corel PlanPerfect printer definition 25358>>9 byte 18 Corel PlanPerfect graphic definition 25359>>9 byte 19 Corel PlanPerfect data 25360>>9 byte 20 Corel PlanPerfect temporary printer 25361>>9 byte 25 Corel PlanPerfect macro resource data 25362>>9 default x 25363>>>9 byte x Corel DataPerfect: Unknown filetype %d 25364# Corel Mail 25365>8 byte 11 25366>>9 byte 2 Corel Mail help file 25367>>9 byte 5 Corel Mail distribution list 25368>>9 byte 10 Corel Mail out box 25369>>9 byte 11 Corel Mail in box 25370>>9 byte 20 Corel Mail users archived mailbox 25371>>9 byte 21 Corel Mail archived message database 25372>>9 byte 22 Corel Mail archived attachments 25373>>9 default x 25374>>>9 byte x Corel Mail: Unknown filetype %d 25375# Corel Printer 25376>8 byte 12 25377>>9 byte 11 Corel Printer temporary file 25378>>9 default x 25379>>>9 byte x Corel Printer: Unknown filetype %d 25380# Corel Scheduler 25381>8 byte 13 25382>>9 byte 2 Corel Scheduler help file 25383>>9 byte 10 Corel Scheduler in file 25384>>9 byte 11 Corel Scheduler out file 25385>>9 default x 25386>>>9 byte x Corel Scheduler: Unknown filetype %d 25387# Corel WordPerfect Office 25388>8 byte 14 25389>>9 byte 10 Corel GroupWise settings file 25390>>9 byte 17 Corel GroupWise directory services 25391>>9 byte 43 Corel GroupWise settings file 25392>>9 default x 25393>>>9 byte x Corel WordPerfect Office: Unknown filetype %d 25394# Corel DrawPerfect 25395>8 byte 15 25396>>9 default x 25397>>>9 byte x Corel DrawPerfect: Unknown filetype %d 25398# Corel LetterPerfect 25399>8 byte 16 25400>>9 default x 25401>>>9 byte x Corel LetterPerfect: Unknown filetype %d 25402# Corel Terminal 25403>8 byte 17 25404>>9 byte 10 Corel Terminal resource data 25405>>9 byte 11 Corel Terminal resource data 25406>>9 byte 43 Corel Terminal resource data 25407>>9 default x 25408>>>9 byte x Corel Terminal: Unknown filetype %d 25409# Corel loadable file 25410>8 byte 18 25411>>9 byte 10 Corel loadable file 25412>>9 byte 11 Corel GUI loadable text 25413>>9 byte 12 Corel graphics resource data 25414>>9 byte 13 Corel printer settings file 25415>>9 byte 14 Corel port definition file 25416>>9 byte 15 Corel print queue parameters 25417>>9 byte 16 Corel compressed file 25418>>9 default x 25419>>>9 byte x Corel loadable file: Unknown filetype %d 25420>>15 byte 0 \b, optimized for Intel 25421>>15 byte 1 \b, optimized for Non-Intel 25422# Network service 25423>8 byte 20 25424>>9 byte 10 Corel Network service msg file 25425>>9 byte 11 Corel Network service msg file 25426>>9 byte 12 Corel Async gateway login msg 25427>>9 byte 14 Corel GroupWise message file 25428>>9 default x 25429>>>9 byte x Corel Network service: Unknown filetype %d 25430# GroupWise 25431>8 byte 31 25432>>9 byte 20 GroupWise admin domain database 25433>>9 byte 21 GroupWise admin host database 25434>>9 byte 23 GroupWise admin remote host database 25435>>9 byte 24 GroupWise admin ADS deferment data file 25436>>9 default x 25437>>>9 byte x GroupWise: Unknown filetype %d 25438# IntelliTAG 25439>8 byte 33 25440>>9 byte 10 IntelliTAG (SGML) compiled DTD 25441>>9 default x 25442>>>9 byte x IntelliTAG: Unknown filetype %d 25443# everything else 25444>8 default x 25445>>8 byte x Unknown Corel/Wordperfect product %d, 25446>>>9 byte x file type %d 25447>10 byte 0 \b, v5. 25448>10 byte !0 \b, v%d. 25449>11 byte x \b%d 25450 25451# Hangul (Korean) Word Processor File 254520 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 25453# From: Won-Kyu Park <wkpark@kldp.org> 25454512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 25455!:mime application/x-hwp 25456 25457# CosmicBook, from Benoit Rouits 254580 string CSBK Ted Neslson's CosmicBook hypertext file 25459 254602 string EYWR AmigaWriter file 25461 25462# chi: file(1) magic for ChiWriter files 254630 string \\1cw\ ChiWriter file 25464>5 string >\0 version %s 254650 string \\1cw ChiWriter file 25466 25467# Quark Express from http://www.garykessler.net/library/file_sigs.html 254682 string IIXPR3 Intel Quark Express Document (English) 254692 string IIXPRa Intel Quark Express Document (Korean) 254702 string MMXPR3 Motorola Quark Express Document (English) 25471!:mime application/x-quark-xpress-3 254722 string MMXPRa Motorola Quark Express Document (Korean) 25473 25474# adobe indesign (document, whatever...) from querkan 254750 belong 0x0606edf5 Adobe InDesign 25476>16 string DOCUMENT Document 25477 25478#------------------------------------------------------------------------------ 25479# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 25480# 25481# Contributor kenzo-: 25482# Reversed-engineered JS Ichitaro magic numbers 25483# 25484 254850 string DOC 25486>43 byte 0x14 Just System Word Processor Ichitaro v4 25487!:mime application/x-ichitaro4 25488>144 string JDASH application/x-ichitaro4 25489 254900 string DOC 25491>43 byte 0x15 Just System Word Processor Ichitaro v5 25492!:mime application/x-ichitaro5 25493 254940 string DOC 25495>43 byte 0x16 Just System Word Processor Ichitaro v6 25496!:mime application/x-ichitaro6 25497 25498# Type: Freemind mindmap documents 25499# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 255000 string/w \<map\ version Freemind document 25501!:mime application/x-freemind 25502 25503# Type: Freeplane mindmap documents 25504# From: Felix Natter <fnatter@gmx.net> 255050 string/w \<map\ version="freeplane Freeplane document 25506!:mime application/x-freeplane 25507 25508# Type: Scribus 25509# From: Werner Fink <werner@suse.de> 255100 string \<SCRIBUSUTF8\ Version Scribus Document 255110 string \<SCRIBUSUTF8NEW\ Version Scribus Document 25512!:mime application/x-scribus 25513 25514# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 25515# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 255160 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 25517 25518#------------------------------------------------------------------------------ 25519# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $ 25520# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php 25521# Cache format extracted from source: 25522# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 25523# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html 25524# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 255250 string wsdl PHP WSDL cache, 25526>4 byte x version 0x%02x 25527>6 ledate x \b, created %s 25528 25529# uri 25530>10 lelong <0x7fffffff 25531>>10 pstring/l x \b, uri: "%s" 25532 25533# source 25534>>>&0 lelong <0x7fffffff 25535>>>>&-4 pstring/l x \b, source: "%s" 25536 25537# target_ns 25538>>>>>&0 lelong <0x7fffffff 25539>>>>>>&-4 pstring/l x \b, target_ns: "%s" 25540#------------------------------------------------------------------------------ 25541# x68000: file(1) magic for the Sharp Home Computer 25542# v1.0 25543# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 25544 25545# Yanagisawa PIC picture 255460 string PIC 25547>3 search/0x200 \x1A 25548>>&0 search/0x200 \x0 25549>>>&0 ubyte 0 Yanagisawa PIC image file, 25550>>>>&0 ubyte&15 0 model: X68000, 25551>>>>&0 ubyte&15 1 model: PC-88VA, 25552>>>>&0 ubyte&15 2 model: FM-TOWNS, 25553>>>>&0 ubyte&15 3 model: MAC, 25554>>>>&0 ubyte&15 15 model: Generic, 25555>>>>&3 ubeshort x %dx 25556>>>>&5 ubeshort x \b%d, 25557>>>>&1 ubeshort 4 colors: 16 25558>>>>&1 ubeshort 8 colors: 256 25559>>>>&1 ubeshort 12 colors: 4096 25560>>>>&1 ubeshort 15 colors: 32768 25561>>>>&1 ubeshort 16 colors: 65536 25562>>>>&1 ubeshort >16 colors: %d-bit 25563 25564 25565 25566#------------------------------------------------------------------------------ 25567# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 25568# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 25569# 255700 string %XDELTA% XDelta binary patch file 0.14 255710 string %XDZ000% XDelta binary patch file 0.18 255720 string %XDZ001% XDelta binary patch file 0.20 255730 string %XDZ002% XDelta binary patch file 1.0 255740 string %XDZ003% XDelta binary patch file 1.0.4 255750 string %XDZ004% XDelta binary patch file 1.1 25576 255770 string \xD6\xC3\xC4\x00 VCDIFF binary diff 25578 25579#------------------------------------------------------------------------------ 25580# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $ 25581# xenix: file(1) magic for Microsoft Xenix 25582# 25583# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 25584# model" lifted from "magic.xenix", with comment "derived empirically; 25585# treat as folklore until proven" 25586# 25587# "small model", "large model", "huge model" stuff lifted from XXX 25588# 25589# XXX - "x.out" collides with PDP-11 archives 25590# 255910 string core core file (Xenix) 25592# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 25593# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 25594# Update: Joerg Jenderek 25595# recordtype~TranslatorHEADerRecord 255960 byte 0x80 25597# GRR: line above is too general as it catches also Extensible storage engine DataBase 25598# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 25599>1 uleshort <1022 25600# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length 25601>>1 uleshort >0 25602# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length 25603>>>3 ubyte >0 25604# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c" 25605>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft) 25606#!:mime application/octet-stream 25607!:mime application/x-object 25608!:ext o/a 25609>>>>>3 pstring x \b, "%s" 25610# checksum 25611#>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x 256120 leshort 0xff65 x.out 25613>2 string __.SYMDEF randomized 25614>0 byte x archive 256150 leshort 0x206 Microsoft a.out 25616>8 leshort 1 Middle model 25617>0x1e leshort &0x10 overlay 25618>0x1e leshort &0x2 separate 25619>0x1e leshort &0x4 pure 25620>0x1e leshort &0x800 segmented 25621>0x1e leshort &0x400 standalone 25622>0x1e leshort &0x8 fixed-stack 25623>0x1c byte &0x80 byte-swapped 25624>0x1c byte &0x40 word-swapped 25625>0x10 lelong >0 not-stripped 25626>0x1e leshort ^0xc000 pre-SysV 25627>0x1e leshort &0x4000 V2.3 25628>0x1e leshort &0x8000 V3.0 25629>0x1c byte &0x4 86 25630>0x1c byte &0xb 186 25631>0x1c byte &0x9 286 25632>0x1c byte &0xa 386 25633>0x1f byte <0x040 small model 25634>0x1f byte =0x048 large model 25635>0x1f byte =0x049 huge model 25636>0x1e leshort &0x1 executable 25637>0x1e leshort ^0x1 object file 25638>0x1e leshort &0x40 Large Text 25639>0x1e leshort &0x20 Large Data 25640>0x1e leshort &0x120 Huge Objects Enabled 25641>0x10 lelong >0 not stripped 25642 256430 leshort 0x140 old Microsoft 8086 x.out 25644>0x3 byte &0x4 separate 25645>0x3 byte &0x2 pure 25646>0 byte &0x1 executable 25647>0 byte ^0x1 relocatable 25648>0x14 lelong >0 not stripped 25649 256500 lelong 0x206 b.out 25651>0x1e leshort &0x10 overlay 25652>0x1e leshort &0x2 separate 25653>0x1e leshort &0x4 pure 25654>0x1e leshort &0x800 segmented 25655>0x1e leshort &0x400 standalone 25656>0x1e leshort &0x1 executable 25657>0x1e leshort ^0x1 object file 25658>0x1e leshort &0x4000 V2.3 25659>0x1e leshort &0x8000 V3.0 25660>0x1c byte &0x4 86 25661>0x1c byte &0xb 186 25662>0x1c byte &0x9 286 25663>0x1c byte &0x29 286 25664>0x1c byte &0xa 386 25665>0x1e leshort &0x4 Large Text 25666>0x1e leshort &0x2 Large Data 25667>0x1e leshort &0x102 Huge Objects Enabled 25668 256690 leshort 0x580 XENIX 8086 relocatable or 80286 small model 25670 25671#------------------------------------------------------------------------------ 25672# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $ 25673# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 25674# Xilinx-Magic@RevRagnarok.com 25675# Got the info from FPGA-FAQ 0026 25676# 25677# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 25678# fixes at least reading of bitfiles from Spartan 2, 3, 6. 25679# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 25680# 25681# First there is the sync header and its length 256820 beshort 0x0009 25683>2 belong =0x0ff00ff0 25684>>&0 belong =0x0ff00ff0 25685>>>&0 byte =0x00 25686>>>&1 beshort =0x0001 25687>>>&3 string a Xilinx BIT data 25688# Next is a Pascal-style string with the NCD name. We want to capture that. 25689>>>>&0 pstring/H x - from %s 25690# And then 'b' 25691>>>>>&1 string b 25692# Then the model / part number: 25693>>>>>>&0 pstring/H x - for %s 25694# Then 'c' 25695>>>>>>>&1 string c 25696# Then the build-date 25697>>>>>>>>&0 pstring/H x - built %s 25698# Then 'd' 25699>>>>>>>>>&1 string d 25700# Then the build-time 25701>>>>>>>>>>&0 pstring/H x \b(%s) 25702# Then 'e' 25703>>>>>>>>>>>&1 string e 25704# And length of data 25705>>>>>>>>>>>>&0 belong x - data length 0x%x 25706 25707# Raw bitstream files 257080 long 0xffffffff 25709>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 25710 25711#------------------------------------------------------------------------------ 25712# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 25713# xo65 object files 25714# From: "Ullrich von Bassewitz" <uz@cc65.org> 25715# 257160 string \x55\x7A\x6E\x61 xo65 object, 25717>4 leshort x version %d, 25718>6 leshort&0x0001 =0x0001 with debug info 25719>6 leshort&0x0001 =0x0000 no debug info 25720 25721# xo65 library files 257220 string \x6E\x61\x55\x7A xo65 library, 25723>4 leshort x version %d 25724 25725# o65 object files 257260 string \x01\x00\x6F\x36\x35 o65 25727>6 leshort&0x1000 =0x0000 executable, 25728>6 leshort&0x1000 =0x1000 object, 25729>5 byte x version %d, 25730>6 leshort&0x8000 =0x8000 65816, 25731>6 leshort&0x8000 =0x0000 6502, 25732>6 leshort&0x2000 =0x2000 32 bit, 25733>6 leshort&0x2000 =0x0000 16 bit, 25734>6 leshort&0x4000 =0x4000 page reloc, 25735>6 leshort&0x4000 =0x0000 byte reloc, 25736>6 leshort&0x0003 =0x0000 alignment 1 25737>6 leshort&0x0003 =0x0001 alignment 2 25738>6 leshort&0x0003 =0x0002 alignment 4 25739>6 leshort&0x0003 =0x0003 alignment 256 25740 25741#------------------------------------------------------------------------------ 25742# $File: xwindows,v 1.10 2017/03/17 21:35:28 christos Exp $ 25743# xwindows: file(1) magic for various X/Window system file formats. 25744 25745# Compiled X Keymap 25746# XKM (compiled X keymap) files (including version and byte ordering) 257471 string mkx Compiled XKB Keymap: lsb, 25748>0 byte >0 version %d 25749>0 byte =0 obsolete 257500 string xkm Compiled XKB Keymap: msb, 25751>3 byte >0 version %d 25752>3 byte =0 obsolete 25753 25754# xfsdump archive 257550 string xFSdump0 xfsdump archive 25756>8 belong x (version %d) 25757 25758# Jaleo XFS files 257590 long 395726 Jaleo XFS file 25760>4 long x - version %d 25761>8 long x - [%d - 25762>20 long x \b%dx 25763>24 long x \b%dx 25764>28 long 1008 \bYUV422] 25765>28 long 1000 \bRGB24] 25766 25767# Xcursor data 25768# X11 mouse cursor format defined in libXcursor, see 25769# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 25770# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 257710 string Xcur Xcursor data 25772!:mime image/x-xcursor 25773>10 leshort x version %d 25774>>8 leshort x \b.%d 25775 25776 25777#------------------------------------------------------------------------------ 25778# $File: yara,v 1.1 2016/10/30 00:38:01 christos Exp $ 25779# yara: file(1) magic for http://virustotal.github.io/yara/ 25780# 25781 257820 string YARA 25783>4 lelong >2047 25784>8 byte <20 YARA 3.x compiled rule set 25785# version 25786>>8 clear 25787>>8 byte 6 created with version 3.3.0 25788>>8 byte 8 created with version 3.4.0 25789>>8 byte 11 created with version 3.5.0 25790>>8 default x 25791>>>8 byte x development version 0x%02x 25792#------------------------------------------------------------------------------ 25793# zfs: file(1) magic for ZFS dumps 25794# 25795# From <rea-fbsd@codelabs.ru> 25796# ZFS dump header has the following structure (as per zfs_ioctl.h 25797# in FreeBSD with drr_type is set to DRR_BEGIN) 25798# 25799# enum { 25800# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 25801# DRR_WRITE, DRR_FREE, DRR_END, 25802# } drr_type; 25803# uint32_t drr_pad; 25804# uint64_t drr_magic; 25805# uint64_t drr_version; 25806# uint64_t drr_creation_time; 25807# dmu_objset_type_t drr_type; 25808# uint32_t drr_pad; 25809# uint64_t drr_toguid; 25810# uint64_t drr_fromguid; 25811# char drr_toname[MAXNAMELEN]; 25812# 25813# Backup magic is 0x00000002f5bacbac (quad word) 25814# The drr_type is defined as 25815# typedef enum dmu_objset_type { 25816# DMU_OST_NONE, 25817# DMU_OST_META, 25818# DMU_OST_ZFS, 25819# DMU_OST_ZVOL, 25820# DMU_OST_OTHER, /* For testing only! */ 25821# DMU_OST_ANY, /* Be careful! */ 25822# DMU_OST_NUMTYPES 25823# } dmu_objset_type_t; 25824# 25825# Almost all uint64_t fields are printed as the 32-bit ones (with high 25826# 32 bits zeroed), because there is no simple way to print them as the 25827# full 64-bit values. 25828 25829# Big-endian values 258308 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 25831>20 belong x version %u, 25832>32 belong 0 type: NONE, 25833>32 belong 1 type: META, 25834>32 belong 2 type: ZFS, 25835>32 belong 3 type: ZVOL, 25836>32 belong 4 type: OTHER, 25837>32 belong 5 type: ANY, 25838>32 belong >5 type: UNKNOWN (%u), 25839>40 byte x destination GUID: %02X 25840>41 byte x %02X 25841>42 byte x %02X 25842>43 byte x %02X 25843>44 byte x %02X 25844>45 byte x %02X 25845>46 byte x %02X 25846>47 byte x %02X, 25847>48 ulong >0 25848>>52 ulong >0 25849>>>48 byte x source GUID: %02X 25850>>>49 byte x %02X 25851>>>50 byte x %02X 25852>>>51 byte x %02X 25853>>>52 byte x %02X 25854>>>53 byte x %02X 25855>>>54 byte x %02X 25856>>>55 byte x %02X, 25857>56 string >\0 name: '%s' 25858 25859# Little-endian values 258608 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 25861>16 lelong x version %u, 25862>32 lelong 0 type: NONE, 25863>32 lelong 1 type: META, 25864>32 lelong 2 type: ZFS, 25865>32 lelong 3 type: ZVOL, 25866>32 lelong 4 type: OTHER, 25867>32 lelong 5 type: ANY, 25868>32 lelong >5 type: UNKNOWN (%u), 25869>47 byte x destination GUID: %02X 25870>46 byte x %02X 25871>45 byte x %02X 25872>44 byte x %02X 25873>43 byte x %02X 25874>42 byte x %02X 25875>41 byte x %02X 25876>40 byte x %02X, 25877>48 ulong >0 25878>>52 ulong >0 25879>>>55 byte x source GUID: %02X 25880>>>54 byte x %02X 25881>>>53 byte x %02X 25882>>>52 byte x %02X 25883>>>51 byte x %02X 25884>>>50 byte x %02X 25885>>>49 byte x %02X 25886>>>48 byte x %02X, 25887>56 string >\0 name: '%s' 25888 25889#------------------------------------------------------------------------------ 25890# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 25891# zilog: file(1) magic for Zilog Z8000. 25892# 25893# Was it big-endian or little-endian? My Product Specification doesn't 25894# say. 25895# 258960 long 0xe807 object file (z8000 a.out) 258970 long 0xe808 pure object file (z8000 a.out) 258980 long 0xe809 separate object file (z8000 a.out) 258990 long 0xe805 overlay object file (z8000 a.out) 25900 25901#------------------------------------------------------------------------------ 25902# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 25903# zyxel: file(1) magic for ZyXEL modems 25904# 25905# From <rob@pe1chl.ampr.org> 25906# These are the /etc/magic entries to decode datafiles as used for the 25907# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 25908# ZyXEL-defined standard) 25909 259100 string ZyXEL\002 ZyXEL voice data 25911>10 byte 0 - CELP encoding 25912>10 byte&0x0B 1 - ADPCM2 encoding 25913>10 byte&0x0B 2 - ADPCM3 encoding 25914>10 byte&0x0B 3 - ADPCM4 encoding 25915>10 byte&0x0B 8 - New ADPCM3 encoding 25916>10 byte&0x04 4 with resync 25917
