1# Magic data for file(1) command.
2# Format is described in magic(files), where:
3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4# Don't edit this file, edit /etc/magic or send your magic improvements
5# to the maintainers, at file@mx.gw.com
6
7#------------------------------------------------------------------------------
8# Localstuff:  file(1) magic for locally observed files
9#
10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
11# Add any locally observed files here.  Remember:
12# text if readable, executable if runnable binary, data if unreadable.
13
14#------------------------------------------------------------------------------
15# $File: acorn,v 1.5 2009/09/19 16:28:07 christos Exp $
16# acorn:  file(1) magic for files found on Acorn systems
17#
18
19# RISC OS Chunk File Format
20# From RISC OS Programmer's Reference Manual, Appendix D
21# We guess the file type from the type of the first chunk.
220	lelong		0xc3cbc6c5	RISC OS Chunk data
23>12	string		OBJ_		\b, AOF object
24>12	string		LIB_		\b, ALF library
25
26# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
2716	lelong		0xef000011	RISC OS AIF executable
28
29# RISC OS Draw files
30# From RISC OS Programmer's Reference Manual, Appendix E
310	string 		Draw		RISC OS Draw file data
32
33# RISC OS new format font files
34# From RISC OS Programmer's Reference Manual, Appendix E
350	string		FONT\0		RISC OS outline font data,
36>5	byte		x		version %d
370	string		FONT\1		RISC OS 1bpp font data,
38>5	byte		x		version %d
390	string		FONT\4		RISC OS 4bpp font data
40>5	byte		x		version %d
41
42# RISC OS Music files
43# From RISC OS Programmer's Reference Manual, Appendix E
440	string		Maestro\r	RISC OS music file
45>8	byte		x		version %d
46
47>8	byte		x		type %d
48
49# Digital Symphony data files
50# From: Bernard Jungen (bern8817@euphonynet.be)
510		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
52>8		byte	x	version %d,
53>9		pstring	x	named "%s",
54>(9.b+19)	byte	=0	8-bit logarithmic
55>(9.b+19)	byte	=1	LZW-compressed linear
56>(9.b+19)	byte	=2	8-bit linear signed
57>(9.b+19)	byte	=3	16-bit linear signed
58>(9.b+19)	byte	=4	SigmaDelta-compressed linear
59>(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
60>(9.b+19)	byte	>5	unknown format
61
620	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
63>8	byte	x	version %d,
64>9	byte	=1	1 voice,
65>9	byte	!1	%d voices,
66>10	leshort	=1	1 track,
67>10	leshort	!1	%d tracks,
68>12	leshort	=1	1 pattern
69>12	leshort	!1	%d patterns
70
710	string	\x02\x01\x13\x13\x10\x14\x12\x0e
72>9	byte	=0	Digital Symphony sequence (RISC OS),
73>>8	byte	x	version %d,
74>>10	byte	=1	1 line,
75>>10	byte	!1	%d lines,
76>>11	leshort	=1	1 position
77>>11	leshort	!1	%d positions
78>9	byte	=1	Digital Symphony pattern data (RISC OS),
79>>8	byte	x	version %d,
80>>10	leshort	=1	1 pattern
81>>10	leshort	!1	%d patterns
82
83#------------------------------------------------------------------------------
84# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
85# adi: file(1) magic for ADi's objects
86# From Gregory McGarry <g.mcgarry@ieee.org>
87#
880	leshort		0x521c		COFF DSP21k
89>18	lelong		&02		executable,
90>18	lelong		^02
91>>18	lelong		&01		static object,
92>>18	lelong		^01		relocatable object,
93>18	lelong		&010		stripped
94>18	lelong		^010		not stripped
95
96#------------------------------------------------------------------------------
97# $File: adventure,v 1.16 2017/03/17 21:35:28 christos Exp $
98# adventure: file(1) magic for Adventure game files
99#
100# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
101# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
102# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
103#
104# ALAN
105# I assume there are other, lower versions, but these are the only ones I
106# saw in the archive.
1070	beshort	0x0206	ALAN game data
108>2	byte	<10	version 2.6%d
109
110
111# Infocom (see z-machine)
112#------------------------------------------------------------------------------
113# Z-machine:  file(1) magic for Z-machine binaries.
114# Sanity checks by David Griffith <dave@661.org>
115# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
116#
117#http://www.gnelson.demon.co.uk/zspec/sect11.html
118#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
119#http://en.wikipedia.org/wiki/Z-machine
120# The first byte is the Z-machine revision; it is always between 1 and 8. We
121# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
122# well as an occasional MP3 file), so we sanity-check the version number.
123#
124# It might be possible to sanity-check the release number as well, as it seems
125# (at least in classic Infocom games) to always be a relatively small number,
126# always under 150 or so, but as this isn't rigorous, we'll wait on that until
127# it becomes clear that it's needed.
128#
1290	ubyte			>0
130>0	ubyte			<9
131>>16	belong&0xfe00f0f0	0x3030
132>>>0	ubyte			< 10
133>>>>2	ubeshort		< 10
134>>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
135>>>>>>0	ubyte			< 10	Infocom (Z-machine %d,
136>>>>>>>2	ubeshort	< 10 	Release %d /
137>>>>>>>>18	string		>\0	Serial %.6s)
138!:strength + 40
139!:mime	application/x-zmachine
140
141#------------------------------------------------------------------------------
142# Glulx:  file(1) magic for Glulx binaries.
143#
144# David Griffith <dave@661.org>
145# I haven't checked for false matches yet.
146#
1470	string			Glul	Glulx game data
148>4	beshort			x	(Version %d
149>>6	byte			x	\b.%d
150>>8	byte			x	\b.%d)
151>36	string			Info	Compiled by Inform
152!:mime	application/x-glulx
153
154
155# For Quetzal and blorb magic see iff
156
157
158# TADS (Text Adventure Development System) version 2
159#  All files are machine-independent (games compile to byte-code) and are tagged
160#  with a version string of the form "V2.<digit>.<digit>\0".
161#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
1620	string	TADS2\ bin	TADS
163>9	belong  !0x0A0D1A00	game data, CORRUPTED
164>9	belong	 0x0A0D1A00
165>>13	string	>\0		%s game data
166!:mime	application/x-tads
167#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
1680	string	TADS2\ rsc	TADS
169>9	belong  !0x0A0D1A00	resource data, CORRUPTED
170>9	belong	 0x0A0D1A00
171>>13	string	>\0		%s resource data
172!:mime	application/x-tads
173#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
174#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
175# "TADS2 save\n\r\032\0" and the interpreter version.
1760	string	TADS2\ save/g	TADS
177>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
178>12	belong	 0x0A0D1A00
179>>(16.s+32) string >\0		%s saved game data
180!:mime	application/x-tads
181#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
182#  version.
1830	string	TADS2\ save	TADS
184>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
185>10	belong	 0x0A0D1A00
186>>14	string	>\0		%s saved game data
187!:mime	application/x-tads
188
189# TADS (Text Adventure Development System) version 3
190#  Game files start with "T3-image\015\012\032"
1910	string	T3-image\015\012\032
192>11	leshort	x		TADS 3 game data (format version %d)
193#  Saved game files start with "T3-state-v####\015\012\032"
194#  where #### is a format version number
1950	string	T3-state-v
196>14	string	\015\012\032	TADS 3 saved game data (format version
197>>10	byte	x		%c
198>>11	byte	x		\b%c
199>>12	byte	x		\b%c
200>>13	byte	x		\b%c)
201!:mime	application/x-t3vm-image
202
203# edited by David Griffith <dave@661.org>
204# Danny Milosavljevic <danny.milo@gmx.net>
205# These are ADRIFT (adventure game standard) game files, extension .taf
206# Checked from source at (http://www.adrift.co/) and various taf files
207# found at the Interactive Fiction Archive (http://ifarchive.org/)
2080	belong  0x3C423FC9
209>4	belong  0x6A87C2CF	Adrift game file version
210>>8	belong  0x94453661	3.80
211>>8	belong  0x94453761	3.90
212>>8	belong  0x93453E61	4.0
213>>8	belong  0x92453E61	5.0
214>>8	default x		unknown
215!:mime	application/x-adrift
216
217#------------------------------------------------------------------------------
218# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $
219# algol68:  file(1) magic for Algol 68 source
220#
2210	search/8192	(input,			Algol 68 source text
222!:mime	text/x-Algol68
2230	regex		\^PROC			Algol 68 source text
224!:mime	text/x-Algol68
2250	regex           MODE[\t\ ]		Algol 68 source text
226!:mime	text/x-Algol68
2270	regex          	REF[\t\ ]		Algol 68 source text
228!:mime	text/x-Algol68
2290	regex          	FLEX[\t\ ]\*\\[		Algol 68 source text
230!:mime	text/x-Algol68
231#0	regex          	[\t\ ]OD		Algol 68 source text
232#!:mime	text/x-Algol68
233#0	regex          	[\t\ ]FI		Algol 68 source text
234#!:mime	text/x-Algol68
235
236#------------------------------------------------------------------------------
237# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
238# allegro:  file(1) magic for Allegro datafiles
239# Toby Deshane <hac@shoelace.digivill.net>
240#
2410 belong 0x736C6821   Allegro datafile (packed)
2420 belong 0x736C682E   Allegro datafile (not packed/autodetect)
2430 belong 0x736C682B   Allegro datafile (appended exe data)
244
245#------------------------------------------------------------------------------
246# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
247# alliant:  file(1) magic for Alliant FX series a.out files
248#
249# If the FX series is the one that had a processor with a 68K-derived
250# instruction set, the "short" should probably become "beshort" and the
251# "long" should probably become "belong".
252# If it's the i860-based one, they should probably become either the
253# big-endian or little-endian versions, depending on the mode they ran
254# the 860 in....
255#
2560	short		0420		0420 Alliant virtual executable
257>2	short		&0x0020		common library
258>16	long		>0		not stripped
2590	short		0421		0421 Alliant compact executable
260>2	short		&0x0020		common library
261>16	long		>0		not stripped
262
263#------------------------------------------------------------------------------
264# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
265# amanda:  file(1) magic for amanda file format
266#
2670	string	AMANDA:\ 		AMANDA
268>8	string	TAPESTART\ DATE		tape header file,
269>>23	string	X
270>>>25	string	>\ 			Unused %s
271>>23	string	>\ 			DATE %s
272>8	string	FILE\ 			dump file,
273>>13	string	>\ 			DATE %s
274
275#------------------------------------------------------------------------------
276# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $
277# amigaos:  file(1) magic for AmigaOS binary formats:
278
279#
280# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
281#
2820	belong		0x000003fa	AmigaOS shared library
2830	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
2840	belong		0x000003e7	AmigaOS object/library data
285#
2860	beshort		0xe310		Amiga Workbench
287>2	beshort		1
288>>48	byte		1		disk icon
289>>48	byte		2		drawer icon
290>>48	byte		3		tool icon
291>>48	byte		4		project icon
292>>48	byte		5		garbage icon
293>>48	byte		6		device icon
294>>48	byte		7		kickstart icon
295>>48	byte		8		workbench application icon
296>2	beshort		>1		icon, vers. %d
297#
298# various sound formats from the Amiga
299# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
300#
3010	string		FC14		Future Composer 1.4 Module sound file
3020	string		SMOD		Future Composer 1.3 Module sound file
3030	string		AON4artofnoise	Art Of Noise Module sound file
3041	string		MUGICIAN/SOFTEYES Mugician Module sound file
30558	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
3060	string		Synth4.0	Synthesis Module sound file
3070	string		ARP.		The Holy Noise Module sound file
3080	string		BeEp\0		JamCracker Module sound file
3090	string		COSO\0		Hippel-COSO Module sound file
310# Too simple (short, pure ASCII, deep), MPi
311#26	string		V.3		Brian Postma's Soundmon Module sound file v3
312#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
313#26	string		V.2		Brian Postma's Soundmon Module sound file v2
314
315# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
3160	beshort		0x0f00		AmigaOS bitmap font
3170	beshort		0x0f03		AmigaOS outline font
3180	belong		0x80001001	AmigaOS outline tag
3190	string		##\ version	catalog translation
3200	string		EMOD\0		Amiga E module
3218	string		ECXM\0		ECX module
3220	string/c	@database	AmigaGuide file
323
324# Amiga disk types
325#
3260	string		RDSK		Rigid Disk Block
327>160	string		x		on %.24s
3280	string		DOS\0		Amiga DOS disk
3290	string		DOS\1		Amiga FFS disk
3300	string		DOS\2		Amiga Inter DOS disk
3310	string		DOS\3		Amiga Inter FFS disk
3320	string		DOS\4		Amiga Fastdir DOS disk
3330	string		DOS\5		Amiga Fastdir FFS disk
3340	string		KICK		Kickstart disk
335
336# From: Alex Beregszaszi <alex@fsn.hu>
3370	string		LZX		LZX compressed archive (Amiga)
338
339# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
3400	string 		.KEY		AmigaDOS script
3410	string 		.key		AmigaDOS script
342
343#------------------------------------------------------------
344# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $
345# Various android related magic entries
346#------------------------------------------------------------
347
348# Dalvik .dex format. http://retrodev.com/android/dexformat.html
349# From <mkf@google.com> "Mike Fleming"
350# Fixed to avoid regexec 17 errors on some dex files
351# From <diff@lookout.com> "Tim Strazzere"
3520	string	dex\n
353>0	regex	dex\n[0-9]{2}\0	Dalvik dex file
354>4	string	>000			version %s
3550	string	dey\n
356>0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
357>4	string	>000			version %s
358
359# Android bootimg format
360# From https://android.googlesource.com/\
361# platform/system/core/+/master/mkbootimg/bootimg.h
3620		string	ANDROID!	Android bootimg
363>1024	string	LOKI\01		\b, LOKI'd
364>8		lelong	>0			\b, kernel
365>>12	lelong	>0			\b (0x%x)
366>16		lelong	>0			\b, ramdisk
367>>20	lelong	>0			\b (0x%x)
368>24		lelong	>0			\b, second stage
369>>28	lelong	>0			\b (0x%x)
370>36		lelong	>0			\b, page size: %d
371>38		string	>0			\b, name: %s
372>64		string	>0		 	\b, cmdline (%s)
373
374# Android Backup archive
375# From: Ariel Shkedi
376# File extension: .ab
377# No mime-type defined
378# URL: https://github.com/android/platform_frameworks_base/blob/\
379# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
380# android/server/BackupManagerService.java#L2367
381# After the header comes a tar file
382# If compressed, the entire tar file is compressed with JAVA deflate
383#
384# Include the version number hardcoded with the magic string to avoid
385# false positives
3860	string/b	ANDROID\ BACKUP\n1\n	Android Backup
387>17	string		0\n			\b, Not-Compressed
388>17	string		1\n			\b, Compressed
389# any string as long as it's not the word none (which is matched below)
390>>19    regex/1l	\^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).*	\b, Encrypted (%s)
391>>19	string		none\n			\b, Not-Encrypted
392# Commented out because they don't seem useful to print
393# (but they are part of the header - the tar file comes after them):
394#>>>&1		regex/1l .*	\b, Password salt: %s
395#>>>>&1		regex/1l .*	\b, Master salt: %s
396#>>>>>&1	regex/1l .*	\b, PBKDF2 rounds: %s
397#>>>>>>&1	regex/1l .*	\b, IV: %s
398#>>>>>>>&1	regex/1l .*	\b, Key: %s
399
400# *.pit files by Joerg Jenderek
401# http://forum.xda-developers.com/showthread.php?p=9122369
402# http://forum.xda-developers.com/showthread.php?t=816449
403# Partition Information Table for Samsung's smartphone with Android
404# used by flash software Odin
4050		ulelong			0x12349876
406# 1st pit entry marker
407>0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
408# minimal 13 and maximal 18 PIT entries found
409>>4		ulelong			<128	Partition Information Table for Samsung smartphone
410>>>4		ulelong			x	\b, %d entries
411# 1. pit entry
412>>>4		ulelong			>0	\b; #1
413>>>0x01C	use				PIT-entry
414>>>4		ulelong			>1	\b; #2
415>>>0x0A0	use				PIT-entry
416>>>4		ulelong			>2	\b; #3
417>>>0x124	use				PIT-entry
418>>>4		ulelong			>3	\b; #4
419>>>0x1A8	use				PIT-entry
420>>>4		ulelong			>4	\b; #5
421>>>0x22C	use				PIT-entry
422>>>4		ulelong			>5	\b; #6
423>>>0x2B0	use				PIT-entry
424>>>4		ulelong			>6	\b; #7
425>>>0x334	use				PIT-entry
426>>>4		ulelong			>7 	\b; #8
427>>>0x3B8	use				PIT-entry
428>>>4		ulelong			>8 	\b; #9
429>>>0x43C	use				PIT-entry
430>>>4		ulelong			>9	\b; #10
431>>>0x4C0	use				PIT-entry
432>>>4		ulelong			>10	\b; #11
433>>>0x544	use				PIT-entry
434>>>4		ulelong			>11	\b; #12
435>>>0x5C8	use				PIT-entry
436>>>4		ulelong			>12	\b; #13
437>>>>0x64C	use				PIT-entry
438# 14. pit entry
439>>>4		ulelong			>13	\b; #14
440>>>>0x6D0	use				PIT-entry
441>>>4		ulelong			>14	\b; #15
442>>>0x754	use				PIT-entry
443>>>4		ulelong			>15	\b; #16
444>>>0x7D8	use				PIT-entry
445>>>4		ulelong			>16	\b; #17
446>>>0x85C	use				PIT-entry
447# 18. pit entry
448>>>4		ulelong			>17	\b; #18
449>>>0x8E0	use				PIT-entry
450
4510	name			PIT-entry
452# garbage value implies end of pit entries
453>0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
454# skip empty partition name
455>>0x24		ubyte				!0
456# partition name
457>>>0x24		string				>\0			%-.32s
458# flags
459>>>0x0C		ulelong&0x00000002		2			\b+RW
460# partition ID:
461# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
462# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
463>>>0x08	ulelong		x			(0x%x)
464# filename
465>>>0x44		string				>\0			"%-.64s"
466#>>>0x18	ulelong				>0
467# blocksize in 512 byte units ?
468#>>>>0x18	ulelong				x			\b, %db
469# partition size in blocks ?
470#>>>>0x22	ulelong				x			\b*%d
471
472# Android sparse img format
473# From https://android.googlesource.com/\
474# platform/system/core/+/master/libsparse/sparse_format.h
4750		lelong	0xed26ff3a		Android sparse image
476>4		leshort	x			\b, version: %d
477>6		leshort	x			\b.%d
478>16		lelong	x			\b, Total of %d
479>12		lelong	x			\b %d-byte output blocks in
480>20		lelong	x			\b %d input chunks.
481
482# Android binary XML magic
483# In include/androidfw/ResourceTypes.h:
484# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
485# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
4860	lelong	0x00080003	Android binary XML
487
488#------------------------------------------------------------------------------
489# $File: animation,v 1.61 2017/04/01 18:26:03 christos Exp $
490# animation:  file(1) magic for animation/movie formats
491#
492# animation formats
493# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
494# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
495
496# SGI and Apple formats
4970	string		MOVI		Silicon Graphics movie file
498!:mime	video/x-sgi-movie
4994       string          moov            Apple QuickTime
500!:mime	video/quicktime
501>12     string          mvhd            \b movie (fast start)
502>12     string          mdra            \b URL
503>12     string          cmov            \b movie (fast start, compressed header)
504>12     string          rmra            \b multiple URLs
5054       string          mdat            Apple QuickTime movie (unoptimized)
506!:mime	video/quicktime
507#4       string          wide            Apple QuickTime movie (unoptimized)
508#!:mime	video/quicktime
509#4       string          skip            Apple QuickTime movie (modified)
510#!:mime	video/quicktime
511#4       string          free            Apple QuickTime movie (modified)
512#!:mime	video/quicktime
5134       string          idsc            Apple QuickTime image (fast start)
514!:mime	image/x-quicktime
515#4       string          idat            Apple QuickTime image (unoptimized)
516#!:mime	image/x-quicktime
5174       string          pckg            Apple QuickTime compressed archive
518!:mime	application/x-quicktime-player
5194	string/W	jP		JPEG 2000 image
520!:mime	image/jp2
521# http://www.ftyps.com/ with local additions
5224	string		ftyp		ISO Media
523# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
524>8	string		XAVC		\b, MPEG v4 system, Sony XAVC Codec
525>>96	string		x		\b, Audio "%.4s"
526>>118	beshort		x		at %dHz
527>>140	string		x		\b, Video "%.4s"
528>>168	beshort		x		%d
529>>170	beshort		x		\bx%d
530>8	string		3g2		\b, MPEG v4 system, 3GPP2
531!:mime	video/3gpp2
532>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
533>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
534>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
535>>11	byte		a		\b C.S0050-0 V1.0
536>>11	byte		b		\b C.S0050-0-A V1.0.0
537>>11	byte		c		\b C.S0050-0-B V1.0
538>8	string		3ge		\b, MPEG v4 system, 3GPP
539!:mime	video/3gpp
540>>11	byte		6		\b, Release 6 MBMS Extended Presentations
541>>11	byte		7		\b, Release 7 MBMS Extended Presentations
542>8	string		3gg		\b, MPEG v4 system, 3GPP
543>11	byte		6		\b, Release 6 General Profile
544!:mime	video/3gpp
545>8	string		3gp		\b, MPEG v4 system, 3GPP
546>11	byte		1		\b, Release %d (non existent)
547>11	byte		2		\b, Release %d (non existent)
548>11	byte		3		\b, Release %d (non existent)
549>11	byte		4		\b, Release %d
550>11	byte		5		\b, Release %d
551>11	byte		6		\b, Release %d
552>11	byte		7		\b, Release %d Streaming Servers
553!:mime	video/3gpp
554>8	string		3gs		\b, MPEG v4 system, 3GPP
555>11	byte		7		\b, Release %d Streaming Servers
556!:mime	video/3gpp
557>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
558!:mime	video/mp4
559>8	string/W	qt		\b, Apple QuickTime movie
560!:mime	video/quicktime
561>8	string		CAEP		\b, Canon Digital Camera
562>8	string		caqv		\b, Casio Digital Camera
563>8	string		CDes		\b, Convergent Design
564>8	string		da0a		\b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
565>8	string		da0b		\b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
566>8	string		da1a		\b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
567>8	string		da1b		\b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
568>8	string		da2a		\b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
569>8	string		da2b		\b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
570>8	string		da3a		\b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
571>8	string		da3b		\b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
572>8	string		dash		\b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
573!:mime	video/mp4
574>8	string		dmb1		\b, DMB MAF supporting all the components defined in the spec
575>8	string		dmpf		\b, Digital Media Project
576>8	string		drc1		\b, Dirac (wavelet compression), encap in ISO base media (MP4)
577>8	string		dv1a		\b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
578>8	string		dv1b		\b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
579>8	string		dv2a		\b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
580>8	string		dv2b		\b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
581>8	string		dv3a		\b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
582>8	string		dv3b		\b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
583>8	string		dvr1		\b, DVB (.DVB) over RTP
584!:mime	video/vnd.dvb.file
585>8	string		dvt1		\b, DVB (.DVB) over MPEG-2 Transport Stream
586!:mime	video/vnd.dvb.file
587>8	string		F4V		\b, Video for Adobe Flash Player 9+ (.F4V)
588!:mime	video/mp4
589>8	string		F4P		\b, Protected Video for Adobe Flash Player 9+ (.F4P)
590!:mime	video/mp4
591>8	string		F4A		\b, Audio for Adobe Flash Player 9+ (.F4A)
592!:mime	audio/mp4
593>8	string		F4B		\b, Audio Book for Adobe Flash Player 9+ (.F4B)
594!:mime	audio/mp4
595>8	string		isc2		\b, ISMACryp 2.0 Encrypted File
596#	?/enc-isoff-generic
597>8	string		iso2		\b, MP4 Base Media v2 [ISO 14496-12:2005]
598!:mime	video/mp4
599>8	string		isom		\b, MP4 Base Media v1 [IS0 14496-12:2003]
600!:mime	video/mp4
601>8	string/W	jp2		\b, JPEG 2000
602!:mime	image/jp2
603>8	string		JP2		\b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
604!:mime	image/jp2
605>8	string		JP20		\b, Unknown, from GPAC samples (prob non-existent)
606>8	string		jpm		\b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
607!:mime	image/jpm
608>8	string		jpx		\b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
609!:mime	image/jpx
610>8	string		KDDI		\b, 3GPP2 EZmovie for KDDI 3G cellphones
611!:mime	video/3gpp2
612>8	string		M4A 		\b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
613!:mime	audio/x-m4a
614>8	string		M4B 		\b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
615!:mime	audio/mp4
616>8	string		M4P 		\b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio
617!:mime	video/mp4
618>8	string		M4V 		\b, Apple iTunes Video (.M4V) Video
619!:mime	video/x-m4v
620>8	string		M4VH		\b, Apple TV (.M4V)
621!:mime	video/x-m4v
622>8	string		M4VP		\b, Apple iPhone (.M4V)
623!:mime	video/x-m4v
624>8	string		mj2s		\b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
625!:mime	video/mj2
626>8	string		mjp2		\b, Motion JPEG 2000 [ISO 15444-3] General Profile
627!:mime	video/mj2
628>8	string		mmp4		\b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
629!:mime	video/mp4
630>8	string		mobi		\b, MPEG-4, MOBI format
631!:mime	video/mp4
632>8	string		mp21		\b, MPEG-21 [ISO/IEC 21000-9]
633>8	string		mp41		\b, MP4 v1 [ISO 14496-1:ch13]
634!:mime	video/mp4
635>8	string		mp42		\b, MP4 v2 [ISO 14496-14]
636!:mime	video/mp4
637>8	string		mp71		\b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
638>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
639>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
640>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
641!:mime	video/mp4
642>8	string		MPPI		\b, Photo Player, MAF [ISO/IEC 23000-3]
643>8	string		mqt		\b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
644!:mime	video/quicktime
645>8	string		MSNV		\b, MPEG-4 (.MP4) for SonyPSP
646!:mime	audio/mp4
647>8	string		NDAS		\b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
648!:mime	audio/mp4
649>8	string		NDSC		\b, MPEG-4 (.MP4) Nero Cinema Profile
650!:mime	video/mp4
651>8	string		NDSH		\b, MPEG-4 (.MP4) Nero HDTV Profile
652!:mime	video/mp4
653>8	string		NDSM		\b, MPEG-4 (.MP4) Nero Mobile Profile
654!:mime	video/mp4
655>8	string		NDSP		\b, MPEG-4 (.MP4) Nero Portable Profile
656!:mime	video/mp4
657>8	string		NDSS		\b, MPEG-4 (.MP4) Nero Standard Profile
658!:mime	video/mp4
659>8	string		NDXC		\b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
660!:mime	video/mp4
661>8	string		NDXH		\b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
662!:mime	video/mp4
663>8	string		NDXM		\b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
664!:mime	video/mp4
665>8	string		NDXP		\b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
666!:mime	video/mp4
667>8	string		NDXS		\b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
668!:mime	video/mp4
669>8	string		odcf  		\b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
670>8	string		opf2 		\b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
671>8	string		opx2  		\b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
672>8	string		pana		\b, Panasonic Digital Camera
673>8	string		qt  		\b, Apple QuickTime (.MOV/QT)
674!:mime	video/quicktime
675>8	string		ROSS		\b, Ross Video
676>8	string		sdv		\b, SD Memory Card Video
677>8	string		ssc1		\b, Samsung stereo, single stream (patent pending)
678>8	string		ssc2		\b, Samsung stereo, dual stream (patent pending)
679
680# MPEG sequences
681# Scans for all common MPEG header start codes
6820	 belong		    0x00000001
683>4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
684>>5      byte               66             \b, baseline
685>>5      byte               77             \b, main
686>>5      byte               88             \b, extended
687>>7      byte               x              \b @ L %u
6880        belong&0xFFFFFF00  0x00000100
689>3       byte               0xBA           MPEG sequence
690!:mime  video/mpeg
691>>4      byte               &0x40          \b, v2, program multiplex
692>>4      byte               ^0x40          \b, v1, system multiplex
693>3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
694>3       byte&0x1F          0x07           MPEG sequence, H.264 video
695>>4      byte               66             \b, baseline
696>>4      byte               77             \b, main
697>>4      byte               88             \b, extended
698>>6      byte               x              \b @ L %u
699# GRR too general as it catches also FoxPro Memo example NG.FPT
700>3       byte               0xB0           MPEG sequence, v4
701# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
702#>>4      byte               !0             MPEG sequence, v4
703!:mime  video/mpeg4-generic
704>>5      belong             0x000001B5
705>>>9     byte               &0x80
706>>>>10   byte&0xF0          16             \b, video
707>>>>10   byte&0xF0          32             \b, still texture
708>>>>10   byte&0xF0          48             \b, mesh
709>>>>10   byte&0xF0          64             \b, face
710>>>9     byte&0xF8          8              \b, video
711>>>9     byte&0xF8          16             \b, still texture
712>>>9     byte&0xF8          24             \b, mesh
713>>>9     byte&0xF8          32             \b, face
714>>4      byte               1              \b, simple @ L1
715>>4      byte               2              \b, simple @ L2
716>>4      byte               3              \b, simple @ L3
717>>4      byte               4              \b, simple @ L0
718>>4      byte               17             \b, simple scalable @ L1
719>>4      byte               18             \b, simple scalable @ L2
720>>4      byte               33             \b, core @ L1
721>>4      byte               34             \b, core @ L2
722>>4      byte               50             \b, main @ L2
723>>4      byte               51             \b, main @ L3
724>>4      byte               53             \b, main @ L4
725>>4      byte               66             \b, n-bit @ L2
726>>4      byte               81             \b, scalable texture @ L1
727>>4      byte               97             \b, simple face animation @ L1
728>>4      byte               98             \b, simple face animation @ L2
729>>4      byte               99             \b, simple face basic animation @ L1
730>>4      byte               100            \b, simple face basic animation @ L2
731>>4      byte               113            \b, basic animation text @ L1
732>>4      byte               114            \b, basic animation text @ L2
733>>4      byte               129            \b, hybrid @ L1
734>>4      byte               130            \b, hybrid @ L2
735>>4      byte               145            \b, advanced RT simple @ L!
736>>4      byte               146            \b, advanced RT simple @ L2
737>>4      byte               147            \b, advanced RT simple @ L3
738>>4      byte               148            \b, advanced RT simple @ L4
739>>4      byte               161            \b, core scalable @ L1
740>>4      byte               162            \b, core scalable @ L2
741>>4      byte               163            \b, core scalable @ L3
742>>4      byte               177            \b, advanced coding efficiency @ L1
743>>4      byte               178            \b, advanced coding efficiency @ L2
744>>4      byte               179            \b, advanced coding efficiency @ L3
745>>4      byte               180            \b, advanced coding efficiency @ L4
746>>4      byte               193            \b, advanced core @ L1
747>>4      byte               194            \b, advanced core @ L2
748>>4      byte               209            \b, advanced scalable texture @ L1
749>>4      byte               210            \b, advanced scalable texture @ L2
750>>4      byte               211            \b, advanced scalable texture @ L3
751>>4      byte               225            \b, simple studio @ L1
752>>4      byte               226            \b, simple studio @ L2
753>>4      byte               227            \b, simple studio @ L3
754>>4      byte               228            \b, simple studio @ L4
755>>4      byte               229            \b, core studio @ L1
756>>4      byte               230            \b, core studio @ L2
757>>4      byte               231            \b, core studio @ L3
758>>4      byte               232            \b, core studio @ L4
759>>4      byte               240            \b, advanced simple @ L0
760>>4      byte               241            \b, advanced simple @ L1
761>>4      byte               242            \b, advanced simple @ L2
762>>4      byte               243            \b, advanced simple @ L3
763>>4      byte               244            \b, advanced simple @ L4
764>>4      byte               245            \b, advanced simple @ L5
765>>4      byte               247            \b, advanced simple @ L3b
766>>4      byte               248            \b, FGS @ L0
767>>4      byte               249            \b, FGS @ L1
768>>4      byte               250            \b, FGS @ L2
769>>4      byte               251            \b, FGS @ L3
770>>4      byte               252            \b, FGS @ L4
771>>4      byte               253            \b, FGS @ L5
772>3       byte               0xB5           MPEG sequence, v4
773!:mime  video/mpeg4-generic
774>>4      byte               &0x80
775>>>5     byte&0xF0          16             \b, video (missing profile header)
776>>>5     byte&0xF0          32             \b, still texture (missing profile header)
777>>>5     byte&0xF0          48             \b, mesh (missing profile header)
778>>>5     byte&0xF0          64             \b, face (missing profile header)
779>>4      byte&0xF8          8              \b, video (missing profile header)
780>>4      byte&0xF8          16             \b, still texture (missing profile header)
781>>4      byte&0xF8          24             \b, mesh (missing profile header)
782>>4      byte&0xF8          32             \b, face (missing profile header)
783>3       byte               0xB3           MPEG sequence
784!:mime  video/mpeg
785>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
786>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
787>>12     belong             0x000001B5     \b, v2,
788>>>16    byte&0x0F          1              \b HP
789>>>16    byte&0x0F          2              \b Spt
790>>>16    byte&0x0F          3              \b SNR
791>>>16    byte&0x0F          4              \b MP
792>>>16    byte&0x0F          5              \b SP
793>>>17    byte&0xF0          64             \b@HL
794>>>17    byte&0xF0          96             \b@H-14
795>>>17    byte&0xF0          128            \b@ML
796>>>17    byte&0xF0          160            \b@LL
797>>>17    byte               &0x08          \b progressive
798>>>17    byte               ^0x08          \b interlaced
799>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
800>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
801>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
802>>11     byte               &0x02
803>>>75    byte               &0x01
804>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
805>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
806>>>>140  belong             0x000001B5     \b, v2,
807>>>>>144 byte&0x0F          1              \b HP
808>>>>>144 byte&0x0F          2              \b Spt
809>>>>>144 byte&0x0F          3              \b SNR
810>>>>>144 byte&0x0F          4              \b MP
811>>>>>144 byte&0x0F          5              \b SP
812>>>>>145 byte&0xF0          64             \b@HL
813>>>>>145 byte&0xF0          96             \b@H-14
814>>>>>145 byte&0xF0          128            \b@ML
815>>>>>145 byte&0xF0          160            \b@LL
816>>>>>145 byte               &0x08          \b progressive
817>>>>>145 byte               ^0x08          \b interlaced
818>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
819>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
820>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
821>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
822>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
823>>76    belong             0x000001B5     \b, v2,
824>>>80   byte&0x0F          1              \b HP
825>>>80   byte&0x0F          2              \b Spt
826>>>80   byte&0x0F          3              \b SNR
827>>>80   byte&0x0F          4              \b MP
828>>>80   byte&0x0F          5              \b SP
829>>>81   byte&0xF0          64             \b@HL
830>>>81   byte&0xF0          96             \b@H-14
831>>>81   byte&0xF0          128            \b@ML
832>>>81   byte&0xF0          160            \b@LL
833>>>81   byte               &0x08          \b progressive
834>>>81   byte               ^0x08          \b interlaced
835>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
836>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
837>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
838>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
839>>>7     byte&0xF0          0x10           \b, 16:9
840>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
841>>>7     byte&0xF0          0x10           \b, 16:9
842>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
843>>>7     byte&0xF0          0x10           \b, 4:3
844>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
845>>>5     beshort&0x0FFF     0x01E0         \b NTSC
846>>>5     beshort&0x0FFF     0x0240         \b PAL
847>>>7     byte&0xF0          0x20           \b, 4:3
848>>>7     byte&0xF0          0x30           \b, 16:9
849>>>7     byte&0xF0          0x40           \b, 11:5
850>>>7     byte&0xF0          0x80           \b, PAL 4:3
851>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
852>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
853>>>7     byte&0xF0          0x10           \b, 4:3
854>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
855>>>7     byte&0xF0          0x10           \b, 4:3
856>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
857>>>7     byte&0xF0          0x10           \b, 4:3
858>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
859>>>7     byte&0xF0          0x10           \b, 4:3
860>>4      beshort&0xFFF0     0x1600         \b, CIF
861>>>5     beshort&0x0FFF     0x00F0         \b NTSC
862>>>5     beshort&0x0FFF     0x0120         \b PAL
863>>>7     byte&0xF0          0x20           \b, 4:3
864>>>7     byte&0xF0          0x30           \b, 16:9
865>>>7     byte&0xF0          0x40           \b, 11:5
866>>>7     byte&0xF0          0x80           \b, PAL 4:3
867>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
868>>>5     beshort&0x0FFF     0x0240         \b PAL 625
869>>>>7    byte&0xF0          0x20           \b, 4:3
870>>>>7    byte&0xF0          0x30           \b, 16:9
871>>>>7    byte&0xF0          0x40           \b, 11:5
872>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
873>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
874>>>5     beshort&0x0FFF     0x0240         \b PAL 625
875>>>7     byte&0xF0          0x20           \b, 4:3
876>>>7     byte&0xF0          0x30           \b, 16:9
877>>>7     byte&0xF0          0x40           \b, 11:5
878>>4      beshort&0xFFF0     0x1E00         \b, SVCD
879>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
880>>>5     beshort&0x0FFF     0x0240         \b PAL 625
881>>>7     byte&0xF0          0x20           \b, 4:3
882>>>7     byte&0xF0          0x30           \b, 16:9
883>>>7     byte&0xF0          0x40           \b, 11:5
884>>7      byte&0x0F          1              \b, 23.976 fps
885>>7      byte&0x0F          2              \b, 24 fps
886>>7      byte&0x0F          3              \b, 25 fps
887>>7      byte&0x0F          4              \b, 29.97 fps
888>>7      byte&0x0F          5              \b, 30 fps
889>>7      byte&0x0F          6              \b, 50 fps
890>>7      byte&0x0F          7              \b, 59.94 fps
891>>7      byte&0x0F          8              \b, 60 fps
892>>11     byte               &0x04          \b, Constrained
893
894# MPEG ADTS Audio (*.mpx/mxa/aac)
895# from dreesen@math.fu-berlin.de
896# modified to fully support MPEG ADTS
897
898# MP3, M1A
899# modified by Joerg Jenderek
900# GRR the original test are too common for many DOS files
901# so don't accept as MP3 until we've tested the rate
9020       beshort&0xFFFE  0xFFFA
903# rates
904>2      byte&0xF0       0x10           MPEG ADTS, layer III, v1,  32 kbps
905!:mime	audio/mpeg
906>2      byte&0xF0       0x20           MPEG ADTS, layer III, v1,  40 kbps
907!:mime	audio/mpeg
908>2      byte&0xF0       0x30           MPEG ADTS, layer III, v1,  48 kbps
909!:mime	audio/mpeg
910>2      byte&0xF0       0x40           MPEG ADTS, layer III, v1,  56 kbps
911!:mime	audio/mpeg
912>2      byte&0xF0       0x50           MPEG ADTS, layer III, v1,  64 kbps
913!:mime	audio/mpeg
914>2      byte&0xF0       0x60           MPEG ADTS, layer III, v1,  80 kbps
915!:mime	audio/mpeg
916>2      byte&0xF0       0x70           MPEG ADTS, layer III, v1,  96 kbps
917!:mime	audio/mpeg
918>2      byte&0xF0       0x80           MPEG ADTS, layer III, v1, 112 kbps
919!:mime	audio/mpeg
920>2      byte&0xF0       0x90           MPEG ADTS, layer III, v1, 128 kbps
921!:mime	audio/mpeg
922>2      byte&0xF0       0xA0           MPEG ADTS, layer III, v1, 160 kbps
923!:mime	audio/mpeg
924>2      byte&0xF0       0xB0           MPEG ADTS, layer III, v1, 192 kbps
925!:mime	audio/mpeg
926>2      byte&0xF0       0xC0           MPEG ADTS, layer III, v1, 224 kbps
927!:mime	audio/mpeg
928>2      byte&0xF0       0xD0           MPEG ADTS, layer III, v1, 256 kbps
929!:mime	audio/mpeg
930>2      byte&0xF0       0xE0           MPEG ADTS, layer III, v1, 320 kbps
931!:mime	audio/mpeg
932# timing
933>2      byte&0x0C       0x00           \b, 44.1 kHz
934>2      byte&0x0C       0x04           \b, 48 kHz
935>2      byte&0x0C       0x08           \b, 32 kHz
936# channels/options
937>3      byte&0xC0       0x00           \b, Stereo
938>3      byte&0xC0       0x40           \b, JntStereo
939>3      byte&0xC0       0x80           \b, 2x Monaural
940>3      byte&0xC0       0xC0           \b, Monaural
941#>1     byte            ^0x01          \b, Data Verify
942#>2     byte            &0x02          \b, Packet Pad
943#>2     byte            &0x01          \b, Custom Flag
944#>3     byte            &0x08          \b, Copyrighted
945#>3     byte            &0x04          \b, Original Source
946#>3     byte&0x03       1              \b, NR: 50/15 ms
947#>3     byte&0x03       3              \b, NR: CCIT J.17
948
949# MP2, M1A
9500       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
951!:mime	audio/mpeg
952# rates
953>2      byte&0xF0       0x10           \b,  32 kbps
954>2      byte&0xF0       0x20           \b,  48 kbps
955>2      byte&0xF0       0x30           \b,  56 kbps
956>2      byte&0xF0       0x40           \b,  64 kbps
957>2      byte&0xF0       0x50           \b,  80 kbps
958>2      byte&0xF0       0x60           \b,  96 kbps
959>2      byte&0xF0       0x70           \b, 112 kbps
960>2      byte&0xF0       0x80           \b, 128 kbps
961>2      byte&0xF0       0x90           \b, 160 kbps
962>2      byte&0xF0       0xA0           \b, 192 kbps
963>2      byte&0xF0       0xB0           \b, 224 kbps
964>2      byte&0xF0       0xC0           \b, 256 kbps
965>2      byte&0xF0       0xD0           \b, 320 kbps
966>2      byte&0xF0       0xE0           \b, 384 kbps
967# timing
968>2      byte&0x0C       0x00           \b, 44.1 kHz
969>2      byte&0x0C       0x04           \b, 48 kHz
970>2      byte&0x0C       0x08           \b, 32 kHz
971# channels/options
972>3      byte&0xC0       0x00           \b, Stereo
973>3      byte&0xC0       0x40           \b, JntStereo
974>3      byte&0xC0       0x80           \b, 2x Monaural
975>3      byte&0xC0       0xC0           \b, Monaural
976#>1     byte            ^0x01          \b, Data Verify
977#>2     byte            &0x02          \b, Packet Pad
978#>2     byte            &0x01          \b, Custom Flag
979#>3     byte            &0x08          \b, Copyrighted
980#>3     byte            &0x04          \b, Original Source
981#>3     byte&0x03       1              \b, NR: 50/15 ms
982#>3     byte&0x03       3              \b, NR: CCIT J.17
983
984# MPA, M1A
985# updated by Joerg Jenderek
986# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
987# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
988# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
989#0	beshort&0xFFFE		0xFFFE
990#>2	ubyte&0xF0	>0x0F
991#>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
992## rate
993#>>>2      byte&0xF0       0x10           \b,  32 kbps
994#>>>2      byte&0xF0       0x20           \b,  64 kbps
995#>>>2      byte&0xF0       0x30           \b,  96 kbps
996#>>>2      byte&0xF0       0x40           \b, 128 kbps
997#>>>2      byte&0xF0       0x50           \b, 160 kbps
998#>>>2      byte&0xF0       0x60           \b, 192 kbps
999#>>>2      byte&0xF0       0x70           \b, 224 kbps
1000#>>>2      byte&0xF0       0x80           \b, 256 kbps
1001#>>>2      byte&0xF0       0x90           \b, 288 kbps
1002#>>>2      byte&0xF0       0xA0           \b, 320 kbps
1003#>>>2      byte&0xF0       0xB0           \b, 352 kbps
1004#>>>2      byte&0xF0       0xC0           \b, 384 kbps
1005#>>>2      byte&0xF0       0xD0           \b, 416 kbps
1006#>>>2      byte&0xF0       0xE0           \b, 448 kbps
1007## timing
1008#>>>2      byte&0x0C       0x00           \b, 44.1 kHz
1009#>>>2      byte&0x0C       0x04           \b, 48 kHz
1010#>>>2      byte&0x0C       0x08           \b, 32 kHz
1011## channels/options
1012#>>>3      byte&0xC0       0x00           \b, Stereo
1013#>>>3      byte&0xC0       0x40           \b, JntStereo
1014#>>>3      byte&0xC0       0x80           \b, 2x Monaural
1015#>>>3      byte&0xC0       0xC0           \b, Monaural
1016##>1     byte            ^0x01          \b, Data Verify
1017##>2     byte            &0x02          \b, Packet Pad
1018##>2     byte            &0x01          \b, Custom Flag
1019##>3     byte            &0x08          \b, Copyrighted
1020##>3     byte            &0x04          \b, Original Source
1021##>3     byte&0x03       1              \b, NR: 50/15 ms
1022##>3     byte&0x03       3              \b, NR: CCIT J.17
1023
1024# MP3, M2A
10250       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
1026!:mime	audio/mpeg
1027# rate
1028>2      byte&0xF0       0x10           \b,   8 kbps
1029>2      byte&0xF0       0x20           \b,  16 kbps
1030>2      byte&0xF0       0x30           \b,  24 kbps
1031>2      byte&0xF0       0x40           \b,  32 kbps
1032>2      byte&0xF0       0x50           \b,  40 kbps
1033>2      byte&0xF0       0x60           \b,  48 kbps
1034>2      byte&0xF0       0x70           \b,  56 kbps
1035>2      byte&0xF0       0x80           \b,  64 kbps
1036>2      byte&0xF0       0x90           \b,  80 kbps
1037>2      byte&0xF0       0xA0           \b,  96 kbps
1038>2      byte&0xF0       0xB0           \b, 112 kbps
1039>2      byte&0xF0       0xC0           \b, 128 kbps
1040>2      byte&0xF0       0xD0           \b, 144 kbps
1041>2      byte&0xF0       0xE0           \b, 160 kbps
1042# timing
1043>2      byte&0x0C       0x00           \b, 22.05 kHz
1044>2      byte&0x0C       0x04           \b, 24 kHz
1045>2      byte&0x0C       0x08           \b, 16 kHz
1046# channels/options
1047>3      byte&0xC0       0x00           \b, Stereo
1048>3      byte&0xC0       0x40           \b, JntStereo
1049>3      byte&0xC0       0x80           \b, 2x Monaural
1050>3      byte&0xC0       0xC0           \b, Monaural
1051#>1     byte            ^0x01          \b, Data Verify
1052#>2     byte            &0x02          \b, Packet Pad
1053#>2     byte            &0x01          \b, Custom Flag
1054#>3     byte            &0x08          \b, Copyrighted
1055#>3     byte            &0x04          \b, Original Source
1056#>3     byte&0x03       1              \b, NR: 50/15 ms
1057#>3     byte&0x03       3              \b, NR: CCIT J.17
1058
1059# MP2, M2A
10600       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
1061!:mime	audio/mpeg
1062# rate
1063>2      byte&0xF0       0x10           \b,   8 kbps
1064>2      byte&0xF0       0x20           \b,  16 kbps
1065>2      byte&0xF0       0x30           \b,  24 kbps
1066>2      byte&0xF0       0x40           \b,  32 kbps
1067>2      byte&0xF0       0x50           \b,  40 kbps
1068>2      byte&0xF0       0x60           \b,  48 kbps
1069>2      byte&0xF0       0x70           \b,  56 kbps
1070>2      byte&0xF0       0x80           \b,  64 kbps
1071>2      byte&0xF0       0x90           \b,  80 kbps
1072>2      byte&0xF0       0xA0           \b,  96 kbps
1073>2      byte&0xF0       0xB0           \b, 112 kbps
1074>2      byte&0xF0       0xC0           \b, 128 kbps
1075>2      byte&0xF0       0xD0           \b, 144 kbps
1076>2      byte&0xF0       0xE0           \b, 160 kbps
1077# timing
1078>2      byte&0x0C       0x00           \b, 22.05 kHz
1079>2      byte&0x0C       0x04           \b, 24 kHz
1080>2      byte&0x0C       0x08           \b, 16 kHz
1081# channels/options
1082>3      byte&0xC0       0x00           \b, Stereo
1083>3      byte&0xC0       0x40           \b, JntStereo
1084>3      byte&0xC0       0x80           \b, 2x Monaural
1085>3      byte&0xC0       0xC0           \b, Monaural
1086#>1     byte            ^0x01          \b, Data Verify
1087#>2     byte            &0x02          \b, Packet Pad
1088#>2     byte            &0x01          \b, Custom Flag
1089#>3     byte            &0x08          \b, Copyrighted
1090#>3     byte            &0x04          \b, Original Source
1091#>3     byte&0x03       1              \b, NR: 50/15 ms
1092#>3     byte&0x03       3              \b, NR: CCIT J.17
1093
1094# MPA, M2A
10950       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
1096!:mime	audio/mpeg
1097# rate
1098>2      byte&0xF0       0x10           \b,  32 kbps
1099>2      byte&0xF0       0x20           \b,  48 kbps
1100>2      byte&0xF0       0x30           \b,  56 kbps
1101>2      byte&0xF0       0x40           \b,  64 kbps
1102>2      byte&0xF0       0x50           \b,  80 kbps
1103>2      byte&0xF0       0x60           \b,  96 kbps
1104>2      byte&0xF0       0x70           \b, 112 kbps
1105>2      byte&0xF0       0x80           \b, 128 kbps
1106>2      byte&0xF0       0x90           \b, 144 kbps
1107>2      byte&0xF0       0xA0           \b, 160 kbps
1108>2      byte&0xF0       0xB0           \b, 176 kbps
1109>2      byte&0xF0       0xC0           \b, 192 kbps
1110>2      byte&0xF0       0xD0           \b, 224 kbps
1111>2      byte&0xF0       0xE0           \b, 256 kbps
1112# timing
1113>2      byte&0x0C       0x00           \b, 22.05 kHz
1114>2      byte&0x0C       0x04           \b, 24 kHz
1115>2      byte&0x0C       0x08           \b, 16 kHz
1116# channels/options
1117>3      byte&0xC0       0x00           \b, Stereo
1118>3      byte&0xC0       0x40           \b, JntStereo
1119>3      byte&0xC0       0x80           \b, 2x Monaural
1120>3      byte&0xC0       0xC0           \b, Monaural
1121#>1     byte            ^0x01          \b, Data Verify
1122#>2     byte            &0x02          \b, Packet Pad
1123#>2     byte            &0x01          \b, Custom Flag
1124#>3     byte            &0x08          \b, Copyrighted
1125#>3     byte            &0x04          \b, Original Source
1126#>3     byte&0x03       1              \b, NR: 50/15 ms
1127#>3     byte&0x03       3              \b, NR: CCIT J.17
1128
1129# MP3, M25A
11300       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
1131!:mime	audio/mpeg
1132# rate
1133>2      byte&0xF0       0x10           \b,   8 kbps
1134>2      byte&0xF0       0x20           \b,  16 kbps
1135>2      byte&0xF0       0x30           \b,  24 kbps
1136>2      byte&0xF0       0x40           \b,  32 kbps
1137>2      byte&0xF0       0x50           \b,  40 kbps
1138>2      byte&0xF0       0x60           \b,  48 kbps
1139>2      byte&0xF0       0x70           \b,  56 kbps
1140>2      byte&0xF0       0x80           \b,  64 kbps
1141>2      byte&0xF0       0x90           \b,  80 kbps
1142>2      byte&0xF0       0xA0           \b,  96 kbps
1143>2      byte&0xF0       0xB0           \b, 112 kbps
1144>2      byte&0xF0       0xC0           \b, 128 kbps
1145>2      byte&0xF0       0xD0           \b, 144 kbps
1146>2      byte&0xF0       0xE0           \b, 160 kbps
1147# timing
1148>2      byte&0x0C       0x00           \b, 11.025 kHz
1149>2      byte&0x0C       0x04           \b, 12 kHz
1150>2      byte&0x0C       0x08           \b, 8 kHz
1151# channels/options
1152>3      byte&0xC0       0x00           \b, Stereo
1153>3      byte&0xC0       0x40           \b, JntStereo
1154>3      byte&0xC0       0x80           \b, 2x Monaural
1155>3      byte&0xC0       0xC0           \b, Monaural
1156#>1     byte            ^0x01          \b, Data Verify
1157#>2     byte            &0x02          \b, Packet Pad
1158#>2     byte            &0x01          \b, Custom Flag
1159#>3     byte            &0x08          \b, Copyrighted
1160#>3     byte            &0x04          \b, Original Source
1161#>3     byte&0x03       1              \b, NR: 50/15 ms
1162#>3     byte&0x03       3              \b, NR: CCIT J.17
1163
1164# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
1165
1166# Stored AAC streams (instead of the MP4 format)
11670       string          ADIF           MPEG ADIF, AAC
1168!:mime	audio/x-hx-aac-adif
1169>4      byte            &0x80
1170>>13    byte            &0x10          \b, VBR
1171>>13    byte            ^0x10          \b, CBR
1172>>16    byte&0x1E       0x02           \b, single stream
1173>>16    byte&0x1E       0x04           \b, 2 streams
1174>>16    byte&0x1E       0x06           \b, 3 streams
1175>>16    byte            &0x08          \b, 4 or more streams
1176>>16    byte            &0x10          \b, 8 or more streams
1177>>4    byte            &0x80          \b, Copyrighted
1178>>13   byte            &0x40          \b, Original Source
1179>>13   byte            &0x20          \b, Home Flag
1180>4      byte            ^0x80
1181>>4     byte            &0x10          \b, VBR
1182>>4     byte            ^0x10          \b, CBR
1183>>7     byte&0x1E       0x02           \b, single stream
1184>>7     byte&0x1E       0x04           \b, 2 streams
1185>>7     byte&0x1E       0x06           \b, 3 streams
1186>>7     byte            &0x08          \b, 4 or more streams
1187>>7     byte            &0x10          \b, 8 or more streams
1188>>4    byte            &0x40          \b, Original Stream(s)
1189>>4    byte            &0x20          \b, Home Source
1190
1191# Live or stored single AAC stream (used with MPEG-2 systems)
11920       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
1193!:mime	audio/x-hx-aac-adts
1194>1      byte            &0x08          \b, v2
1195>1      byte            ^0x08          \b, v4
1196# profile
1197>>2     byte            &0xC0          \b LTP
1198>2      byte&0xc0       0x00           \b Main
1199>2      byte&0xc0       0x40           \b LC
1200>2      byte&0xc0       0x80           \b SSR
1201# timing
1202>2      byte&0x3c       0x00           \b, 96 kHz
1203>2      byte&0x3c       0x04           \b, 88.2 kHz
1204>2      byte&0x3c       0x08           \b, 64 kHz
1205>2      byte&0x3c       0x0c           \b, 48 kHz
1206>2      byte&0x3c       0x10           \b, 44.1 kHz
1207>2      byte&0x3c       0x14           \b, 32 kHz
1208>2      byte&0x3c       0x18           \b, 24 kHz
1209>2      byte&0x3c       0x1c           \b, 22.05 kHz
1210>2      byte&0x3c       0x20           \b, 16 kHz
1211>2      byte&0x3c       0x24           \b, 12 kHz
1212>2      byte&0x3c       0x28           \b, 11.025 kHz
1213>2      byte&0x3c       0x2c           \b, 8 kHz
1214# channels
1215>2      beshort&0x01c0  0x0040         \b, monaural
1216>2      beshort&0x01c0  0x0080         \b, stereo
1217>2      beshort&0x01c0  0x00c0         \b, stereo + center
1218>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
1219>2      beshort&0x01c0  0x0140         \b, surround
1220>2      beshort&0x01c0  0x0180         \b, surround + LFE
1221>2      beshort         &0x01C0        \b, surround + side
1222#>1     byte            ^0x01           \b, Data Verify
1223#>2     byte            &0x02           \b, Custom Flag
1224#>3     byte            &0x20           \b, Original Stream
1225#>3     byte            &0x10           \b, Home Source
1226#>3     byte            &0x08           \b, Copyrighted
1227
1228# Live MPEG-4 audio streams (instead of RTP FlexMux)
12290       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
1230!:mime	audio/x-mp4a-latm
1231#>1     beshort&0x1FFF  x              \b, %hu byte packet
1232>3      byte&0xE0       0x40
1233>>4     byte&0x3C       0x04           \b, single stream
1234>>4     byte&0x3C       0x08           \b, 2 streams
1235>>4     byte&0x3C       0x0C           \b, 3 streams
1236>>4     byte            &0x08          \b, 4 or more streams
1237>>4     byte            &0x20          \b, 8 or more streams
1238>3      byte&0xC0       0
1239>>4     byte&0x78       0x08           \b, single stream
1240>>4     byte&0x78       0x10           \b, 2 streams
1241>>4     byte&0x78       0x18           \b, 3 streams
1242>>4     byte            &0x20          \b, 4 or more streams
1243>>4     byte            &0x40          \b, 8 or more streams
1244# This magic isn't strong enough (matches plausible ISO-8859-1 text)
1245#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
1246#!:mime	audio/x-mp4a-latm
1247
1248# Summary: FLI animation format
1249# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1250# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
12514	leshort		0xAF11
1252# standard FLI always has 320x200 resolution and 8 bit color
1253>8	leshort		320
1254>>10	leshort		200
1255>>>12	leshort		8			FLI animation, 320x200x8
1256!:mime	video/x-fli
1257>>>>6	leshort		x			\b, %d frames
1258# frame speed is multiple of 1/70s
1259>>>>16	leshort		x			\b, %d/70s per frame
1260
1261# Summary: FLC animation format
1262# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1263# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
12644	leshort		0xAF12
1265# standard FLC always use 8 bit color
1266>12	leshort		8			FLC animation
1267!:mime	video/x-flc
1268>>8	leshort		x			\b, %d
1269>>10	leshort		x			\bx%dx8
1270>>6	uleshort	x			\b, %d frames
1271>>16	uleshort	x			\b, %dms per frame
1272
1273# DL animation format
1274# XXX - collision with most `mips' magic
1275#
1276# I couldn't find a real magic number for these, however, this
1277# -appears- to work.  Note that it might catch other files, too, so be
1278# careful!
1279#
1280# Note that title and author appear in the two 20-byte chunks
1281# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
1282# 255 (hex FF)!  The DL format is really bad.
1283#
1284#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
1285#!:mime	video/x-unknown
1286#>42	byte	x	- %d screens,
1287#>43	byte	x	%d commands
1288#0	byte	2	DL version 2
1289#!:mime	video/x-unknown
1290#>1	byte	1	- large format (320x200,1 image/screen),
1291#>1	byte	2	- medium format (160x100,4 images/screen),
1292#>1	byte	>2	- unknown format,
1293#>42	byte	x	%d screens,
1294#>43	byte	x	%d commands
1295# Based on empirical evidence, DL version 3 have several nulls following the
1296# \003.  Most of them start with non-null values at hex offset 0x34 or so.
1297#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
1298
1299# iso 13818 transport stream
1300#
1301# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1302# syncbyte      8 bit	0x47
1303# error_ind     1 bit	-
1304# payload_start 1 bit	1
1305# priority      1 bit	-
1306# PID          13 bit	0x0000
1307# scrambling    2 bit	-
1308# adaptfld_ctrl 2 bit	1 or 3
1309# conti_count   4 bit	-
13100	belong&0xFF5FFF10	0x47400010
1311>188	byte			0x47		MPEG transport stream data
1312
1313# DIF digital video file format <mpruett@sgi.com>
13140	belong&0xffffff00	0x1f070000      DIF
1315>4	byte			&0x01		(DVCPRO) movie file
1316>4	byte			^0x01		(DV) movie file
1317>3	byte			&0x80		(PAL)
1318>3	byte			^0x80		(NTSC)
1319
1320# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
13210	belong			0x3026b275	Microsoft ASF
1322!:mime  video/x-ms-asf
1323
1324# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
13250	string			\x8aMNG		MNG video data,
1326!:mime	video/x-mng
1327>4	belong			!0x0d0a1a0a	CORRUPTED,
1328>4	belong			0x0d0a1a0a
1329>>16    belong	x				%d x
1330>>20    belong	x				%d
1331
1332# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
13330	string			\x8bJNG		JNG video data,
1334!:mime	video/x-jng
1335>4	belong			!0x0d0a1a0a	CORRUPTED,
1336>4	belong			0x0d0a1a0a
1337>>16    belong	x				%d x
1338>>20    belong	x				%d
1339
1340# Vivo video (Wolfram Kleff)
13413	string		\x0D\x0AVersion:Vivo	Vivo video data
1342
1343# VRML (Virtual Reality Modelling Language)
13440       string/w        #VRML\ V1.0\ ascii	VRML 1 file
1345!:mime	model/vrml
13460	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
1347!:mime	model/vrml
1348
1349# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
1350# From Michel Briand <michelbriand@free.fr>
1351# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
1352# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
13530	string/w	\<?xml\ version=
1354!:strength + 5
1355>20	search/1000/w	\<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
1356!:mime model/x3d+xml
1357
1358#---------------------------------------------------------------------------
1359# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1360# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1361#
13620	string		HVQM4		%s
1363>6	string		>\0		v%s
1364>0	byte		x		GameCube movie,
1365>0x34	ubeshort	x		%d x
1366>0x36	ubeshort	x		%d,
1367>0x26	ubeshort	x		%dus,
1368>0x42	ubeshort	0		no audio
1369>0x42	ubeshort	>0		%dHz audio
1370
1371# From: "Stefan A. Haubenthal" <polluks@web.de>
13720	string		DVDVIDEO-VTS	Video title set,
1373>0x21	byte		x		v%x
13740	string		DVDVIDEO-VMG	Video manager,
1375>0x21	byte		x		v%x
1376
1377# From: Behan Webster <behanw@websterwood.com>
1378# NuppelVideo used by Mythtv (*.nuv)
1379# Note: there are two identical stanzas here differing only in the
1380# initial string matched. It used to be done with a regex, but we're
1381# trying to get rid of those.
13820	string		NuppelVideo	MythTV NuppelVideo
1383>12	string		x		v%s
1384>20	lelong		x		(%d
1385>24	lelong		x		\bx%d),
1386>36	string		P		\bprogressive,
1387>36	string		I		\binterlaced,
1388>40	ledouble	x		\baspect:%.2f,
1389>48	ledouble	x		\bfps:%.2f
13900	string		MythTV		MythTV NuppelVideo
1391>12	string		x		v%s
1392>20	lelong		x		(%d
1393>24	lelong		x		\bx%d),
1394>36	string		P		\bprogressive,
1395>36	string		I		\binterlaced,
1396>40	ledouble	x		\baspect:%.2f,
1397>48	ledouble	x		\bfps:%.2f
1398
1399#						MPEG file
1400# MPEG sequences
1401# FIXME: This section is from the old magic.mime file and needs
1402# integrating with the rest
1403#0       belong             0x000001BA
1404#>4      byte               &0x40
1405#!:mime	video/mp2p
1406#>4      byte               ^0x40
1407#!:mime	video/mpeg
1408#0       belong             0x000001BB
1409#!:mime	video/mpeg
1410#0       belong             0x000001B0
1411#!:mime	video/mp4v-es
1412#0       belong             0x000001B5
1413#!:mime	video/mp4v-es
1414#0       belong             0x000001B3
1415#!:mime	video/mpv
1416#0       belong&0xFF5FFF10  0x47400010
1417#!:mime	video/mp2t
1418#0       belong             0x00000001
1419#>4      byte&0x1F	   0x07
1420#!:mime	video/h264
1421
1422# Type: Bink Video
1423# Extension: .bik
1424# URL:  http://wiki.multimedia.cx/index.php?title=Bink_Container
1425# From: <hoehle@users.sourceforge.net>  2008-07-18
14260	string		BIK	Bink Video
1427>3	regex		=[a-z]	rev.%s
1428#>4	ulelong		x	size %d
1429>20	ulelong		x	\b, %d
1430>24	ulelong		x	\bx%d
1431>8	ulelong		x	\b, %d frames
1432>32	ulelong		x	at rate %d/
1433>28	ulelong		>1	\b%d
1434>40	ulelong		=0	\b, no audio
1435>40	ulelong		!0	\b, %d audio track
1436>>40	ulelong		!1	\bs
1437# follow properties of the first audio track only
1438>>48	uleshort	x	%dHz
1439>>51	byte&0x20	0	mono
1440>>51	byte&0x20	!0	stereo
1441#>>51	byte&0x10	0	FFT
1442#>>51	byte&0x10	!0	DCT
1443
1444# Type:	NUT Container
1445# URL:	http://wiki.multimedia.cx/index.php?title=NUT
1446# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
14470	string	nut/multimedia\ container\0	NUT multimedia container
1448
1449# Type: Nullsoft Video (NSV)
1450# URL:  http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1451# From: Mike Melanson <mike@multimedia.cx>
14520	string	NSVf	Nullsoft Video
1453
1454# Type: REDCode Video
1455# URL:  http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
1456# From: Mike Melanson <mike@multimedia.cx>
14574	string	RED1	REDCode Video
1458
1459# Type: MTV Multimedia File
1460# URL:  http://wiki.multimedia.cx/index.php?title=MTV
1461# From: Mike Melanson <mike@multimedia.cx>
14620	string	AMVS	MTV Multimedia File
1463
1464# Type: ARMovie
1465# URL:  http://wiki.multimedia.cx/index.php?title=ARMovie
1466# From: Mike Melanson <mike@multimedia.cx>
14670	string	ARMovie\012	ARMovie
1468
1469# Type: Interplay MVE Movie
1470# URL:  http://wiki.multimedia.cx/index.php?title=Interplay_MVE
1471# From: Mike Melanson <mike@multimedia.cx>
14720	string	Interplay\040MVE\040File\032	Interplay MVE Movie
1473
1474# Type: Windows Television DVR File
1475# URL:  http://wiki.multimedia.cx/index.php?title=WTV
1476# From: Mike Melanson <mike@mutlimedia.cx>
1477# This takes the form of a Windows-style GUID
14780	bequad	0xB7D800203749DA11
1479>8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media
1480
1481# Type: Sega FILM/CPK Multimedia
1482# URL:  http://wiki.multimedia.cx/index.php?title=Sega_FILM
1483# From: Mike Melanson <mike@multimedia.cx>
14840	string	FILM	Sega FILM/CPK Multimedia,
1485>32	belong	x	%d x
1486>28	belong	x	%d
1487
1488# Type: Nintendo THP Multimedia
1489# URL:  http://wiki.multimedia.cx/index.php?title=THP
1490# From: Mike Melanson <mike@multimedia.cx>
14910	string	THP\0	Nintendo THP Multimedia
1492
1493# Type: BBC Dirac Video
1494# URL:  http://wiki.multimedia.cx/index.php?title=Dirac
1495# From: Mike Melanson <mike@multimedia.cx>
14960	string	BBCD	BBC Dirac Video
1497
1498# Type: RAD Game Tools Smacker Multimedia
1499# URL:  http://wiki.multimedia.cx/index.php?title=Smacker
1500# From: Mike Melanson <mike@multimedia.cx>
15010	string	SMK	RAD Game Tools Smacker Multimedia
1502>3	byte	x	version %c,
1503>4	lelong	x	%d x
1504>8	lelong	x	%d,
1505>12	lelong	x	%d frames
1506
1507# Material Exchange Format
1508# More information:
1509# https://en.wikipedia.org/wiki/Material_Exchange_Format
1510# http://www.freemxf.org/
15110	string	\x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02	Material exchange container format
1512!:ext	mxf
1513!:mime	application/mxf
1514
1515#------------------------------------------------------------------------------
1516# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
1517# aout:  file(1) magic for a.out executable/object/etc entries that
1518# handle executables on multiple platforms.
1519#
1520
1521#
1522# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1523# BSDI), netbsd, and vax (for UNIX/32V and BSD)
1524#
1525# XXX - is there anything we can look at to distinguish BSD/OS 386 from
1526# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
1527# works only for binaries using shared libraries.  Grabbing the entry
1528# point from the a.out header, using it to find the first code executed
1529# in the program, and looking at that might help.
1530#
15310	lelong		0407		a.out little-endian 32-bit executable
1532>16	lelong		>0		not stripped
1533>32	byte		0x6a		(uses BSD/OS shared libs)
1534
15350	lelong		0410		a.out little-endian 32-bit pure executable
1536>16	lelong		>0		not stripped
1537>32	byte		0x6a		(uses BSD/OS shared libs)
1538
15390	lelong		0413		a.out little-endian 32-bit demand paged pure executable
1540>16	lelong		>0		not stripped
1541>32	byte		0x6a		(uses BSD/OS shared libs)
1542
1543#
1544# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
1545# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
1546#
1547# XXX - is there anything we can look at to distinguish old SunOS 68010
1548# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
1549# the first instruction or instructions in the program.
1550#
15510	belong		0407		a.out big-endian 32-bit executable
1552>16	belong		>0		not stripped
1553
15540	belong		0410		a.out big-endian 32-bit pure executable
1555>16	belong		>0		not stripped
1556
15570	belong		0413		a.out big-endian 32-bit demand paged executable
1558>16	belong		>0		not stripped
1559
1560
1561#------------------------------------------------------------------------------
1562# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
1563# apache: file(1) magic for Apache Big Data formats
1564
1565# Avro files
15660	string		Obj		Apache Avro
1567>3	byte		x		version %d
1568
1569# ORC files
1570# Important information is in file footer, which we can't index to :(
15710	string		ORC		Apache ORC
1572
1573# Parquet files
15740	string		PAR1		Apache Parquet
1575
1576# Hive RC files
15770	string		RCF		Apache Hive RC file
1578>3	byte		x		version %d
1579
1580# Sequence files (and the careless first version of RC file)
1581
15820	string		SEQ
1583>3	byte		<6		Apache Hadoop Sequence file version %d
1584>3	byte		>6		Apache Hadoop Sequence file version %d
1585>3	byte		=6
1586>>5	string		org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer  Apache Hive RC file version 0
1587>>3	default		x		Apache Hadoop Sequence file version 6
1588
1589#------------------------------------------------------------------------------
1590# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
1591# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
1592#       workspaces)
1593#
15940	long		0100554		APL workspace (Ken's original?)
1595
1596#------------------------------------------------------------------------------
1597# $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $
1598# apple:  file(1) magic for Apple file formats
1599#
16000	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
16010	string		\x0aGL			Binary II (apple ][) data
16020	string		\x76\xff		Squeezed (apple ][) data
16030	string		NuFile			NuFile archive (apple ][) data
16040	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
16050	belong		0x00051600		AppleSingle encoded Macintosh file
16060	belong		0x00051607		AppleDouble encoded Macintosh file
1607
1608# Type: Apple Emulator 2IMG format
1609# From: Radek Vokal <rvokal@redhat.com>
16100	string		2IMG	Apple ][ 2IMG Disk Image
1611>4	string		XGS!	\b, XGS
1612>4	string		CTKG	\b, Catakig
1613>4	string		ShIm	\b, Sheppy's ImageMaker
1614>4	string		WOOF	\b, Sweet 16
1615>4	string		B2TR	\b, Bernie ][ the Rescue
1616>4	string		!nfc	\b, ASIMOV2
1617>4	string		x	\b, Unknown Format
1618>0xc	byte		00	\b, DOS 3.3 sector order
1619>>0x10	byte		00	\b, Volume 254
1620>>0x10	byte&0x7f	x	\b, Volume %u
1621>0xc	byte		01	\b, ProDOS sector order
1622>>0x14	short		x	\b, %u Blocks
1623>0xc	byte		02	\b, NIB data
1624
1625# magic for Newton PDA package formats
1626# from Ruda Moura <ruda@helllabs.org>
16270	string	package0	Newton package, NOS 1.x,
1628>12	belong	&0x80000000	AutoRemove,
1629>12	belong	&0x40000000	CopyProtect,
1630>12	belong	&0x10000000	NoCompression,
1631>12	belong	&0x04000000	Relocation,
1632>12	belong	&0x02000000	UseFasterCompression,
1633>16	belong	x		version %d
1634
16350	string	package1	Newton package, NOS 2.x,
1636>12	belong	&0x80000000	AutoRemove,
1637>12	belong	&0x40000000	CopyProtect,
1638>12	belong	&0x10000000	NoCompression,
1639>12	belong	&0x04000000	Relocation,
1640>12	belong	&0x02000000	UseFasterCompression,
1641>16	belong	x		version %d
1642
16430	string	package4	Newton package,
1644>8	byte	8		NOS 1.x,
1645>8	byte	9		NOS 2.x,
1646>12	belong	&0x80000000	AutoRemove,
1647>12	belong	&0x40000000	CopyProtect,
1648>12	belong	&0x10000000	NoCompression,
1649
1650# The following entries for the Apple II are for files that have
1651# been transferred as raw binary data from an Apple, without having
1652# been encapsulated by any of the above archivers.
1653#
1654# In general, Apple II formats are hard to identify because Apple DOS
1655# and especially Apple ProDOS have strong typing in the file system and
1656# therefore programmers never felt much need to include type information
1657# in the files themselves.
1658#
1659# Eric Fischer <enf@pobox.com>
1660
1661# AppleWorks word processor:
1662# URL: https://en.wikipedia.org/wiki/AppleWorks
1663# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
1664# Update: Joerg Jenderek
1665# NOTE:
1666# The "O" is really the magic number, but that's so common that it's
1667# necessary to check the tab stops that follow it to avoid false positives.
1668# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
1669# the newer AppleWorks is from claris with extension CWK
16704	string		O
1671# test for unused bits of zoom- , paginated-boolean bytes
1672>84	ubequad		^0x00Fe00000000Fe00
1673# look for tabstop definitions "=" no tab, "|" no tab
1674# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
1675# unofficial "!" other , "\x8a" other
1676# official only if SFMinVers is nonzero
1677>>5	regex/s	[=.<>|!^\x8a]{79}	AppleWorks Word Processor
1678# AppleWorks Word Processor File (Apple II)
1679# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
1680# application/x-appleworks is mime type for claris version with cwk extension
1681!:mime	application/x-appleworks3
1682# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
1683# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
1684# $70 $1A $F8 $FF is this the apple type ?
1685#:apple pdosp��
1686!:ext awp
1687# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
1688>>>183	ubyte		30	3.0
1689>>>183	ubyte		!30
1690>>>>183	ubyte		!0	0x%x
1691# usual tabstop start sequence "=====<"
1692>>>5	string		x	\b, tabstop ruler "%6.6s"
1693# tabstop ruler
1694#>>>5	string		>\0	\b, tabstops "%-79s"
1695# zoom switch
1696>>>85	  byte&0x01	>0	\b, zoomed
1697# whether paginated
1698>>>90	  byte&0x01	>0	\b, paginated
1699# contains any mail-merge commands
1700>>>92	  byte&0x01	>0	\b, with mail merge
1701# left margin in 1/10 inches ( normally 0 or 10 )
1702>>>91	ubyte		>0
1703>>>>91	ubyte		x	\b, %d/10 inch left margin
1704
1705# AppleWorks database:
1706#
1707# This isn't really a magic number, but it's the closest thing to one
1708# that I could find.  The 1 and 2 really mean "order in which you defined
1709# categories" and "left to right, top to bottom," respectively; the D and R
1710# mean that the cursor should move either down or right when you press Return.
1711
1712#30	string		\x01D	AppleWorks database data
1713#30	string		\x02D	AppleWorks database data
1714#30	string		\x01R	AppleWorks database data
1715#30	string		\x02R	AppleWorks database data
1716
1717# AppleWorks spreadsheet:
1718#
1719# Likewise, this isn't really meant as a magic number.  The R or C means
1720# row- or column-order recalculation; the A or M means automatic or manual
1721# recalculation.
1722
1723#131	string		RA	AppleWorks spreadsheet data
1724#131	string		RM	AppleWorks spreadsheet data
1725#131	string		CA	AppleWorks spreadsheet data
1726#131	string		CM	AppleWorks spreadsheet data
1727
1728# Applesoft BASIC:
1729#
1730# This is incredibly sloppy, but will be true if the program was
1731# written at its usual memory location of 2048 and its first line
1732# number is less than 256.  Yuck.
1733# update by Joerg Jenderek at Feb 2013
1734
1735# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
1736#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
17370	belong&0x00ff00ff	0x00080000
1738# assuming that line number must be positive
1739>2	leshort			>0		Applesoft BASIC program data, first line number %d
1740#>2     leshort         x       \b, first line number %d
1741
1742# ORCA/EZ assembler:
1743#
1744# This will not identify ORCA/M source files, since those have
1745# some sort of date code instead of the two zero bytes at 6 and 7
1746# XXX Conflicts with ELF
1747#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
1748#>5      byte                    x               \b, build number %d
1749
1750# Broderbund Fantavision
1751#
1752# I don't know what these values really mean, but they seem to recur.
1753# Will they cause too many conflicts?
1754
1755# Probably :-)
1756#2	belong&0xFF00FF		0x040008	Fantavision movie data
1757
1758# Some attempts at images.
1759#
1760# These are actually just bit-for-bit dumps of the frame buffer, so
1761# there's really no reasonably way to distinguish them except for their
1762# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1763# or, occasionally, 8184.
1764#
1765# Nevertheless this will manage to catch a lot of images that happen
1766# to have a solid-colored line at the bottom of the screen.
1767
1768# GRR: Magic too weak
1769#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
1770#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
1771#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
1772#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
1773#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
1774
1775# Beagle Bros. Apple Mechanic fonts
1776
17770	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
1778
1779# Apple Universal Disk Image Format (UDIF) - dmg files.
1780# From Johan Gade.
1781# These entries are disabled for now until we fix the following issues.
1782#
1783# Note there might be some problems with the "VAX COFF executable"
1784# entry. Note this entry should be placed before the mac filesystem section,
1785# particularly the "Apple Partition data" entry.
1786#
1787# The intended meaning of these tests is, that the file is only of the
1788# specified type if both of the lines are correct - i.e. if the first
1789# line matches and the second doesn't then it is not of that type.
1790#
1791#0	long	0x7801730d
1792#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
1793#
1794# Note that this entry is recognized correctly by the "Apple Partition
1795# data" entry - however since this entry is more specific - this
1796# information seems to be more useful.
1797#0	long	0x45520200
1798#>0x410	string	disk\ image	UDIF read/write image (UDRW)
1799
1800# From: Toby Peterson <toby@apple.com>
18010	string	bplist00	Apple binary property list
1802
1803# Apple binary property list (bplist)
1804#  Assumes version bytes are hex.
1805#  Provides content hints for version 0 files. Assumes that the root
1806#  object is the first object (true for CoreFoundation implementation).
1807# From: David Remahl <dremahl@apple.com>
18080		string	bplist
1809>6		byte	x	\bCoreFoundation binary property list data, version 0x%c
1810>>7		byte	x	\b%c
1811>6		string		00		\b
1812>>8		byte&0xF0	0x00	\b
1813>>>8	byte&0x0F	0x00	\b, root type: null
1814>>>8	byte&0x0F	0x08	\b, root type: false boolean
1815>>>8	byte&0x0F	0x09	\b, root type: true boolean
1816>>8		byte&0xF0	0x10	\b, root type: integer
1817>>8		byte&0xF0	0x20	\b, root type: real
1818>>8		byte&0xF0	0x30	\b, root type: date
1819>>8		byte&0xF0	0x40    \b, root type: data
1820>>8		byte&0xF0	0x50	\b, root type: ascii string
1821>>8		byte&0xF0	0x60	\b, root type: unicode string
1822>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
1823>>8		byte&0xF0	0xa0	\b, root type: array
1824>>8		byte&0xF0	0xd0	\b, root type: dictionary
1825
1826# Apple/NeXT typedstream data
1827#  Serialization format used by NeXT and Apple for various
1828#  purposes in YellowStep/Cocoa, including some nib files.
1829# From: David Remahl <dremahl@apple.com>
18302		string		typedstream	NeXT/Apple typedstream data, big endian
1831>0		byte		x		\b, version %d
1832>0		byte		<5		\b
1833>>13	byte		0x81	\b
1834>>>14	ubeshort	x		\b, system %d
18352		string		streamtyped NeXT/Apple typedstream data, little endian
1836>0		byte		x		\b, version %d
1837>0		byte		<5		\b
1838>>13	byte		0x81	\b
1839>>>14	uleshort	x		\b, system %d
1840
1841#------------------------------------------------------------------------------
1842# CAF: Apple CoreAudio File Format
1843#
1844# Container format for high-end audio purposes.
1845# From: David Remahl <dremahl@apple.com>
1846#
18470	string		caff		CoreAudio Format audio file
1848>4	beshort		<10		version %d
1849>6	beshort		x
1850
1851
1852#------------------------------------------------------------------------------
1853# Keychain database files
18540	string		kych		Mac OS X Keychain File
1855
1856#------------------------------------------------------------------------------
1857# Code Signing related file types
18580	belong		0xfade0c00	Mac OS X Code Requirement
1859>8	belong		1			(opExpr)
1860>4	belong		x			- %d bytes
1861
18620	belong		0xfade0c01	Mac OS X Code Requirement Set
1863>8	belong		>1			containing %d items
1864>4	belong		x			- %d bytes
1865
18660	belong		0xfade0c02	Mac OS X Code Directory
1867>8	belong		x			version %x
1868>12	belong		>0			flags 0x%x
1869>4	belong		x			- %d bytes
1870
18710	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
1872>4	belong		x			- %d bytes
1873
18740	belong		0xfade0cc1	Mac OS X Detached Code Signature
1875>8	belong		>1			(%d elements)
1876>4	belong		x			- %d bytes
1877
1878# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1879# .vdi
18804	string innotek\ VirtualBox\ Disk\ Image %s
1881
1882# Apple disk partition stuff
1883# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
1884# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
1885# Update: Joerg Jenderek
1886# "ER" is APPLE_DRVR_MAP_MAGIC signature
18870	beshort	0x4552
1888# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
1889#!:strength +0
1890# strengthen the magic by looking for used blocksizes 512 2048
1891>2	ubeshort&0xf1FF		0	Apple Driver Map
1892# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
1893#>>504	ubequad&0x0000FFffFFff0000	0
1894!:mime	application/x-apple-diskimage
1895!:apple	????devr
1896# https://en.wikipedia.org/wiki/Apple_Disk_Image
1897!:ext	dmg/iso
1898# sbBlkSize for driver descriptor map 512 2048
1899>>2	beshort	x			\b, blocksize %d
1900# sbBlkCount sometimes garbish like
1901# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
1902# 0xf2720100 for bunziped Firefox 48.0-2.dmg
1903# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
1904# 0x00009090 by syslinux-6.03/utils/isohybrid.c
1905>>4	ubelong	x			\b, blockcount %u
1906# following device/driver information not very useful
1907# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
1908>>8	ubeshort	x		\b, devtype %u
1909# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
1910>>10	ubeshort	x		\b, devid %u
1911# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
1912>>12	ubelong		>0
1913>>>12	ubelong		x		\b, driver data %u
1914# number of driver descriptors sbDrvrCount <= 61
1915# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
1916>>16	ubeshort	x		\b, driver count %u
1917# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
1918# >>18	use		apple-driver-map
1919# >>26	use		apple-driver-map
1920# # ...
1921# >>500	use		apple-driver-map
1922# number of partitions is always same in every partition (map block count)
1923#>>0x0204	ubelong		x	\b, %u partitions
1924>>0x0204	ubelong		>0	\b, contains[@0x200]:
1925>>>0x0200	use		apple-apm
1926>>0x0204	ubelong		>1	\b, contains[@0x400]:
1927>>>0x0400	use		apple-apm
1928>>0x0204	ubelong		>2	\b, contains[@0x600]:
1929>>>0x0600	use		apple-apm
1930>>0x0204	ubelong		>3	\b, contains[@0x800]:
1931>>>0x0800	use		apple-apm
1932>>0x0204	ubelong		>4	\b, contains[@0xA00]:
1933>>>0x0A00	use		apple-apm
1934>>0x0204	ubelong		>5	\b, contains[@0xC00]:
1935>>>0x0C00	use		apple-apm
1936>>0x0204	ubelong		>6	\b, contains[@0xE00]:
1937>>>0x0E00	use		apple-apm
1938>>0x0204	ubelong		>7	\b, contains[@0x1000]:
1939>>>0x1000	use		apple-apm
1940#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
19410	name				apple-driver-map
1942>0	ubequad		!0
1943# descBlock first block of driver
1944>>0	ubelong	x			\b, driver start block %u
1945# descSize driver size in blocks
1946>>4	ubeshort	x		\b, size %u
1947# descType driver system type 1 701h F8FFh FFFFh
1948>>6	ubeshort	x		\b, type 0x%x
1949
1950# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
1951# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
1952# Update: Joerg Jenderek
1953# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
1954# magic stronger.
1955# for apple partition map stored as a single file
19560	belong	0x504d0000
1957# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
1958#!:strength +0
1959>0	use		apple-apm
1960# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
1961# file: could not find any valid magic files!
1962#!:ext	bin
1963#	display apple partition map. Normally called after Apple driver map
19640	name				apple-apm
1965>0	belong	0x504d0000		Apple Partition Map
1966# number of partitions
1967>>4	ubelong	x			\b, map block count %u
1968# logical block (512 bytes) start of partition
1969>>8	ubelong	x			\b, start block %u
1970>>12	ubelong	x			\b, block count %u
1971>>16	string >0			\b, name %s
1972>>48	string >0			\b, type %s
1973# processor type dpme_process_id[16] e.g. "68000" "68020"
1974>>120	string >0			\b, processor %s
1975# A/UX boot arguments BootArgs[128]
1976>>136	string >0			\b, boot arguments %s
1977# status of partition dpme_flags
1978>>88	belong	& 1			\b, valid
1979>>88	belong	& 2			\b, allocated
1980>>88	belong	& 4			\b, in use
1981>>88	belong	& 8			\b, has boot info
1982>>88	belong	& 16			\b, readable
1983>>88	belong	& 32			\b, writable
1984>>88	belong	& 64			\b, pic boot code
1985>>88	belong	& 128			\b, chain compatible driver
1986>>88	belong	& 256			\b, real driver
1987>>88	belong	& 512			\b, chain driver
1988# mount automatically at startup APPLE_PS_AUTO_MOUNT
1989>>88	ubelong	&0x40000000		\b, mount at startup
1990# is the startup partition APPLE_PS_STARTUP
1991>>88	ubelong	&0x80000000		\b, is the startup partition
1992
1993#http://wiki.mozilla.org/DS_Store_File_Format
1994#http://en.wikipedia.org/wiki/.DS_Store
19950	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
1996
1997# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
1998# Usually not in separate files, but have either filename rsrc with
1999# no extension, or a filename corresponding to another file, with
2000# extensions rsr/rsrc
20010	string  \000\000\001\000
2002>4	leshort 0
2003>>16	lelong  0			Apple HFS/HFS+ resource fork
2004
2005#https://en.wikipedia.org/wiki/AppleScript
20060	string	FasdUAS			AppleScript compiled
2007
2008# AppleWorks/ClarisWorks
2009# https://github.com/joshenders/appleworks_format
2010# http://fileformats.archiveteam.org/wiki/AppleWorks
20110	name			appleworks
2012>0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
2013>0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
2014>0	default			x
2015>>0	belong			x		AppleWorks/ClarisWorks CWK Document
2016>0	byte			x		\b, version %d
2017>30	beshort			x		\b, %d
2018>32	beshort			x		\bx%d
2019!:ext cwk
2020
20214	string	BOBO
2022>0	byte	>4
2023>>12	belong	0
2024>>>26	belong	0
2025>>>>0	use	appleworks
2026>0	belong	0x0481ad00
2027>>0	use 	appleworks
2028
2029#------------------------------------------------------------------------------
2030# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
2031# application:  file(1) magic for applications on small devices
2032#
2033# Pebble Application
20340	string	PBLAPP\000\000	Pebble application
2035
2036#------------------------------------------------------------------------------
2037# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
2038# applix:  file(1) magic for Applixware
2039# From: Peter Soos <sp@osb.hu>
2040#
20410	string		*BEGIN		Applixware
2042>7	string		WORDS			Words Document
2043>7	string		GRAPHICS		Graphic
2044>7	string		RASTER			Bitmap
2045>7	string		SPREADSHEETS		Spreadsheet
2046>7	string		MACRO			Macro
2047>7	string		BUILDER			Builder Object
2048
2049#------------------------------------------------------------------------------
2050# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
2051# apt: file(1) magic for APT Cache files
2052# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html>
2053# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292>
2054
2055# before version 10 ("old format"), data was in arch-specific long/short
2056
2057# old format 64 bit
20580   	name		apt-cache-64bit-be
2059>12	beshort		1		\b, dirty
2060>40 	bequad		x		\b, %llu packages
2061>48 	bequad		x		\b, %llu versions
2062
2063# old format 32 bit
20640   	name    	apt-cache-32bit-be
2065>8  	beshort 	1		\b, dirty
2066>40 	belong  	x		\b, %u packages
2067>44 	belong  	x		\b, %u versions
2068
2069# new format
20700	name		apt-cache-be
2071>6	byte    	1		\b, dirty
2072>24	belong  	x		\b, %u packages
2073>28	belong		x		\b, %u versions
2074
20750	bequad		0x98FE76DC
2076>8	ubeshort	<10		APT cache data, version %u
2077>>10	beshort	    	x	  	\b.%u, 64 bit big-endian
2078>>0	use		apt-cache-64bit-be
2079
20800	lequad	    	0x98FE76DC
2081>8	uleshort    	<10		APT cache data, version %u
2082>>10	leshort		x		\b.%u, 64 bit little-endian
2083>>0	use		\^apt-cache-64bit-be
2084
20850	belong	    	0x98FE76DC
2086>4	ubeshort    	<10	 	APT cache data, version %u
2087>>6	ubeshort    	x		\b.%u, 32 bit big-endian
2088>>0	use  		apt-cache-32bit-be
2089>4	ubyte	    	>9		APT cache data, version %u
2090>>5	ubyte	    	x		\b.%u, big-endian
2091>>0	use 		apt-cache-be
2092
20930	lelong	    	0x98FE76DC
2094>4	uleshort    	<10		APT cache data, version %u
2095>>6	uleshort   	x		\b.%u, 32 bit little-endian
2096>>0	use 		\^apt-cache-32bit-be
2097>4	ubyte	    	>9		APT cache data, version %u
2098>>5	ubyte	    	x		\b.%u, little-endian
2099>>0	use		\^apt-cache-be
2100#------------------------------------------------------------------------------
2101# $File: archive,v 1.107 2017/03/20 19:51:15 christos Exp $
2102# archive:  file(1) magic for archive formats (see also "msdos" for self-
2103#           extracting compressed archives)
2104#
2105# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
2106# pre-POSIX "tar" archives are handled in the C code.
2107
2108# POSIX tar archives
2109257	string		ustar\0		POSIX tar archive
2110!:mime	application/x-tar # encoding: posix
2111257	string		ustar\040\040\0	GNU tar archive
2112!:mime	application/x-tar # encoding: gnu
2113
2114# Incremental snapshot gnu-tar format from:
2115# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
21160	string		GNU\ tar-	GNU tar incremental snapshot data
2117>&0	regex		[0-9]\.[0-9]+-[0-9]+	version %s
2118
2119# cpio archives
2120#
2121# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
2122# The idea is to indicate archives produced on machines with the same
2123# byte order as the machine running "file" with "cpio archive", and
2124# to indicate archives produced on machines with the opposite byte order
2125# from the machine running "file" with "byte-swapped cpio archive".
2126#
2127# The SVR4 "cpio(4)" hints that there are additional formats, but they
2128# are defined as "short"s; I think all the new formats are
2129# character-header formats and thus are strings, not numbers.
21300	short		070707		cpio archive
2131!:mime	application/x-cpio
21320	short		0143561		byte-swapped cpio archive
2133!:mime	application/x-cpio # encoding: swapped
21340	string		070707		ASCII cpio archive (pre-SVR4 or odc)
21350	string		070701		ASCII cpio archive (SVR4 with no CRC)
21360	string		070702		ASCII cpio archive (SVR4 with CRC)
2137
2138#
2139# Various archive formats used by various versions of the "ar"
2140# command.
2141#
2142
2143#
2144# Original UNIX archive formats.
2145# They were written with binary values in host byte order, and
2146# the magic number was a host "int", which might have been 16 bits
2147# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
2148# been ports to little-endian 16-bit-int or 32-bit-int platforms
2149# (x86?) using some of those formats; if none existed, feel free
2150# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
2151# 32-bit.  There might have been big-endian ports of that sort as
2152# well.
2153#
21540	leshort		0177555		very old 16-bit-int little-endian archive
21550	beshort		0177555		very old 16-bit-int big-endian archive
21560	lelong		0177555		very old 32-bit-int little-endian archive
21570	belong		0177555		very old 32-bit-int big-endian archive
2158
21590	leshort		0177545		old 16-bit-int little-endian archive
2160>2	string		__.SYMDEF	random library
21610	beshort		0177545		old 16-bit-int big-endian archive
2162>2	string		__.SYMDEF	random library
21630	lelong		0177545		old 32-bit-int little-endian archive
2164>4	string		__.SYMDEF	random library
21650	belong		0177545		old 32-bit-int big-endian archive
2166>4	string		__.SYMDEF	random library
2167
2168#
2169# From "pdp" (but why a 4-byte quantity?)
2170#
21710	lelong		0x39bed		PDP-11 old archive
21720	lelong		0x39bee		PDP-11 4.0 archive
2173
2174#
2175# XXX - what flavor of APL used this, and was it a variant of
2176# some ar archive format?  It's similar to, but not the same
2177# as, the APL workspace magic numbers in pdp.
2178#
21790	long		0100554		apl workspace
2180
2181#
2182# System V Release 1 portable(?) archive format.
2183#
21840	string		=<ar>		System V Release 1 ar archive
2185!:mime	application/x-archive
2186
2187#
2188# Debian package; it's in the portable archive format, and needs to go
2189# before the entry for regular portable archives, as it's recognized as
2190# a portable archive whose first member has a name beginning with
2191# "debian".
2192#
21930	string		=!<arch>\ndebian
2194>8	string		debian-split	part of multipart Debian package
2195!:mime	application/vnd.debian.binary-package
2196>8	string		debian-binary	Debian binary package
2197!:mime	application/vnd.debian.binary-package
2198>8	string		!debian
2199>68	string		>\0		(format %s)
2200# These next two lines do not work, because a bzip2 Debian archive
2201# still uses gzip for the control.tar (first in the archive).  Only
2202# data.tar varies, and the location of its filename varies too.
2203# file/libmagic does not current have support for ascii-string based
2204# (offsets) as of 2005-09-15.
2205#>81	string		bz2		\b, uses bzip2 compression
2206#>84	string		gz		\b, uses gzip compression
2207#>136	ledate		x		created: %s
2208
2209#
2210# MIPS archive; they're in the portable archive format, and need to go
2211# before the entry for regular portable archives, as it's recognized as
2212# a portable archive whose first member has a name beginning with
2213# "__________E".
2214#
22150	string	=!<arch>\n__________E	MIPS archive
2216!:mime	application/x-archive
2217>20	string	U			with MIPS Ucode members
2218>21	string	L			with MIPSEL members
2219>21	string	B			with MIPSEB members
2220>19	string	L			and an EL hash table
2221>19	string	B			and an EB hash table
2222>22	string	X			-- out of date
2223
22240	search/1	-h-		Software Tools format archive text
2225
2226#
2227# BSD/SVR2-and-later portable archive formats.
2228#
22290	string		=!<arch>		current ar archive
2230!:mime	application/x-archive
2231>8	string		__.SYMDEF	random library
2232>68	string		__.SYMDEF\ SORTED	random library
2233
2234#
2235# "Thin" archive, as can be produced by GNU ar.
2236#
22370	string		=!<thin>\n	thin archive with
2238>68	belong		0		no symbol entries
2239>68	belong		1		%d symbol entry
2240>68	belong		>1		%d symbol entries
2241
2242# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
2243#
2244# The first byte is the magic (0x1a), byte 2 is the compression type for
2245# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
2246# filename of the first file (null terminated).  Since some types collide
2247# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
2248# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
22490	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
2250!:mime	application/x-arc
22510	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
2252!:mime	application/x-arc
22530	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
2254!:mime	application/x-arc
22550	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
2256!:mime	application/x-arc
22570	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
2258!:mime	application/x-arc
22590	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
2260!:mime	application/x-arc
2261# [JW] stuff taken from idarc, obviously ARC successors:
22620	lelong&0x8080ffff	0x00000a1a	PAK archive data
2263!:mime	application/x-arc
22640	lelong&0x8080ffff	0x0000141a	ARC+ archive data
2265!:mime	application/x-arc
22660	lelong&0x8080ffff	0x0000481a	HYP archive data
2267!:mime	application/x-arc
2268
2269# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
2270# I can't create either SPARK or ArcFS archives so I have not tested this stuff
2271# [GRR:  the original entries collide with ARC, above; replaced with combined
2272#  version (not tested)]
2273#0	byte		0x1a		RISC OS archive (spark format)
22740	string		\032archive	RISC OS archive (ArcFS format)
22750       string          Archive\000     RISC OS archive (ArcFS format)
2276
2277# All these were taken from idarc, many could not be verified. Unfortunately,
2278# there were many low-quality sigs, i.e. easy to trigger false positives.
2279# Please notify me of any real-world fishy/ambiguous signatures and I'll try
2280# to get my hands on the actual archiver and see if I find something better. [JW]
2281# probably many can be enhanced by finding some 0-byte or control char near the start
2282
2283# idarc calls this Crush/Uncompressed... *shrug*
22840	string	CRUSH Crush archive data
2285# Squeeze It (.sqz)
22860	string	HLSQZ Squeeze It archive data
2287# SQWEZ
22880	string	SQWEZ SQWEZ archive data
2289# HPack (.hpk)
22900	string	HPAK HPack archive data
2291# HAP
22920	string	\x91\x33HF HAP archive data
2293# MD/MDCD
22940	string	MDmd MDCD archive data
2295# LIM
22960	string	LIM\x1a LIM archive data
2297# SAR
22983	string	LH5 SAR archive data
2299# BSArc/BS2
23000	string	\212\3SB\020\0	BSArc/BS2 archive data
2301# Bethesda Softworks Archive (Oblivion)
23020	string	BSA\0 		BSArc archive data
2303>4	lelong	x		version %d
2304# MAR
23052	string	=-ah MAR archive data
2306# ACB
2307#0	belong&0x00f800ff	0x00800000 ACB archive data
2308# CPZ
2309# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
2310# JRC
23110	string	JRchive JRC archive data
2312# Quantum
23130	string	DS\0 Quantum archive data
2314# ReSOF
23150	string	PK\3\6 ReSOF archive data
2316# QuArk
23170	string	7\4 QuArk archive data
2318# YAC
231914	string	YC YAC archive data
2320# X1
23210	string	X1 X1 archive data
23220	string	XhDr X1 archive data
2323# CDC Codec (.dqt)
23240	belong&0xffffe000	0x76ff2000 CDC Codec archive data
2325# AMGC
23260	string	\xad6" AMGC archive data
2327# NuLIB
23280	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
2329# PakLeo
23300	string	LEOLZW PAKLeo archive data
2331# ChArc
23320	string	SChF ChArc archive data
2333# PSA
23340	string	PSA PSA archive data
2335# CrossePAC
23360	string	DSIGDCC CrossePAC archive data
2337# Freeze
23380	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
2339# KBoom
23400	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
2341# NSQ, must go after CDC Codec
23420	string	\x76\xff NSQ archive data
2343# DPA
23440	string	Dirk\ Paehl DPA archive data
2345# BA
2346# TODO: idarc says "bytes 0-2 == bytes 3-5"
2347# TTComp
2348# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
2349# Update: Joerg Jenderek
2350# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
23510	string	\0\6
2352# look for first keyword of Panorama database *.pan
2353>12	search/261	DESIGN
2354# skip keyword with low entropy
2355>12	default		x	TTComp archive, binary, 4K dictionary
2356# (version 5.25) labeled the above entry as "TTComp archive data"
2357# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
23580	string	ESP ESP archive data
2359# ZPack
23600	string	\1ZPK\1 ZPack archive data
2361# Sky
23620	string	\xbc\x40 Sky archive data
2363# UFA
23640	string	UFA UFA archive data
2365# Dry
23660	string	=-H2O DRY archive data
2367# FoxSQZ
23680	string	FOXSQZ FoxSQZ archive data
2369# AR7
23700	string	,AR7 AR7 archive data
2371# PPMZ
23720	string	PPMZ PPMZ archive data
2373# MS Compress
23744	string	\x88\xf0\x27 MS Compress archive data
2375# updated by Joerg Jenderek
2376>9	string	\0
2377>>0	string	KWAJ
2378>>>7	string	\321\003	MS Compress archive data
2379>>>>14	ulong	>0		\b, original size: %d bytes
2380>>>>18		ubyte	>0x65
2381>>>>>18		string	x       \b, was %.8s
2382>>>>>(10.b-4)	string	x       \b.%.3s
2383# MP3 (archiver, not lossy audio compression)
23840	string	MP3\x1a MP3-Archiver archive data
2385# ZET
23860	string	OZ\xc3\x9d ZET archive data
2387# TSComp
23880	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
2389# ARQ
23900	string	gW\4\1 ARQ archive data
2391# Squash
23923	string	OctSqu Squash archive data
2393# Terse
23940	string	\5\1\1\0 Terse archive data
2395# PUCrunch
23960	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
2397# UHarc
23980	string	UHA UHarc archive data
2399# ABComp
24000	string	\2AB ABComp archive data
24010	string	\3AB2 ABComp archive data
2402# CMP
24030	string	CO\0 CMP archive data
2404# Splint
24050	string	\x93\xb9\x06 Splint archive data
2406# InstallShield
24070	string	\x13\x5d\x65\x8c InstallShield Z archive Data
2408# Gather
24091	string	GTH Gather archive data
2410# BOA
24110	string	BOA BOA archive data
2412# RAX
24130	string	ULEB\xa RAX archive data
2414# Xtreme
24150	string	ULEB\0 Xtreme archive data
2416# Pack Magic
24170	string	@\xc3\xa2\1\0 Pack Magic archive data
2418# BTS
24190	belong&0xfeffffff	0x1a034465 BTS archive data
2420# ELI 5750
24210	string	Ora\  ELI 5750 archive data
2422# QFC
24230	string	\x1aFC\x1a QFC archive data
24240	string	\x1aQF\x1a QFC archive data
2425# PRO-PACK
24260	string	RNC PRO-PACK archive data
2427# 777
24280	string	777 777 archive data
2429# LZS221
24300	string	sTaC LZS221 archive data
2431# HPA
24320	string	HPA HPA archive data
2433# Arhangel
24340	string	LG Arhangel archive data
2435# EXP1, uses bzip2
24360	string	0123456789012345BZh EXP1 archive data
2437# IMP
24380	string	IMP\xa IMP archive data
2439# NRV
24400	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
2441# Squish
24420	string	\x73\xb2\x90\xf4 Squish archive data
2443# Par
24440	string	PHILIPP Par archive data
24450	string	PAR Par archive data
2446# HIT
24470	string	UB HIT archive data
2448# SBX
24490	belong&0xfffff000	0x53423000 SBX archive data
2450# NaShrink
24510	string	NSK NaShrink archive data
2452# SAPCAR
24530	string	#\ CAR\ archive\ header SAPCAR archive data
24540	string	CAR\ 2.00RG SAPCAR archive data
2455# Disintegrator
24560	string	DST Disintegrator archive data
2457# ASD
24580	string	ASD ASD archive data
2459# InstallShield CAB
24600	string	ISc( InstallShield CAB
2461# TOP4
24620	string	T4\x1a TOP4 archive data
2463# BatComp left out: sig looks like COM executable
2464# so TODO: get real 4dos batcomp file and find sig
2465# BlakHole
24660	string	BH\5\7 BlakHole archive data
2467# BIX
24680	string	BIX0 BIX archive data
2469# ChiefLZA
24700	string	ChfLZ ChiefLZA archive data
2471# Blink
24720	string	Blink Blink archive data
2473# Logitech Compress
24740	string	\xda\xfa Logitech Compress archive data
2475# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
24761	string	(C)\ STEPANYUK ARS-Sfx archive data
2477# AKT/AKT32
24780	string	AKT32 AKT32 archive data
24790	string	AKT AKT archive data
2480# NPack
24810	string	MSTSM NPack archive data
2482# PFT
24830	string	\0\x50\0\x14 PFT archive data
2484# SemOne
24850	string	SEM SemOne archive data
2486# PPMD
24870	string	\x8f\xaf\xac\x84 PPMD archive data
2488# FIZ
24890	string	FIZ FIZ archive data
2490# MSXiE
24910	belong&0xfffff0f0	0x4d530000 MSXiE archive data
2492# DeepFreezer
24930	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
2494# DC
24950	string	=<DC- DC archive data
2496# TPac
24970	string	\4TPAC\3 TPac archive data
2498# Ai
24990	string	Ai\1\1\0 Ai archive data
25000	string	Ai\1\0\0 Ai archive data
2501# Ai32
25020	string	Ai\2\0 Ai32 archive data
25030	string	Ai\2\1 Ai32 archive data
2504# SBC
25050	string	SBC SBC archive data
2506# Ybs
25070	string	YBS Ybs archive data
2508# DitPack
25090	string	\x9e\0\0 DitPack archive data
2510# DMS
25110	string	DMS! DMS archive data
2512# EPC
25130	string	\x8f\xaf\xac\x8c EPC archive data
2514# VSARC
25150	string	VS\x1a VSARC archive data
2516# PDZ
25170	string	PDZ PDZ archive data
2518# ReDuq
25190	string	rdqx ReDuq archive data
2520# GCA
25210	string	GCAX GCA archive data
2522# PPMN
25230	string	pN PPMN archive data
2524# WinImage
25253	string	WINIMAGE WinImage archive data
2526# Compressia
25270	string	CMP0CMP Compressia archive data
2528# UHBC
25290	string	UHB UHBC archive data
2530# WinHKI
25310	string	\x61\x5C\x04\x05 WinHKI archive data
2532# WWPack data file
25330	string	WWP WWPack archive data
2534# BSN (BSA, PTS-DOS)
25350	string	\xffBSG BSN archive data
25361	string	\xffBSG BSN archive data
25373	string	\xffBSG BSN archive data
25381	string	\0\xae\2 BSN archive data
25391	string	\0\xae\3 BSN archive data
25401	string	\0\xae\7 BSN archive data
2541# AIN
25420	string	\x33\x18 AIN archive data
25430	string	\x33\x17 AIN archive data
2544# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
2545# SZip (TODO: doesn't catch all versions)
25460	string	SZ\x0a\4 SZip archive data
2547# XPack DiskImage
2548# *.XDI updated by Joerg Jenderek Sep 2015
2549# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
2550# GRR: this test is still too general as it catches also text files starting with jm
25510	string	jm
2552# only found examples with this additional characteristic 2 bytes
2553>2	string	\x2\x4	Xpack DiskImage archive data
2554#!:ext xdi
2555# XPack Data
2556# *.xpa updated by Joerg Jenderek Sep 2015
2557# ftp://ftp.elf.stuba.sk/pub/pc/pack/
25580	string	xpa	XPA
2559!:ext	xpa
2560# XPA32
2561# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
2562# created by XPA32.EXE version 1.0.2 for Windows
2563>0	string	xpa\0\1 \b32 archive data
2564# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
2565>3	ubeshort	!0x0001	\bck archive data
2566# XPack Single Data
2567# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
2568# letter 'I'+ acute accent is equivalent to \xcd
25690	string	\xcd\ jm	Xpack single archive data
2570#!:mime	application/x-xpa-compressed
2571!:ext xpa
2572
2573# TODO: missing due to unknown magic/magic at end of file:
2574#DWC
2575#ARG
2576#ZAR
2577#PC/3270
2578#InstallIt
2579#RKive
2580#RK
2581#XPack Diskimage
2582
2583# These were inspired by idarc, but actually verified
2584# Dzip archiver (.dz)
25850	string	DZ Dzip archive data
2586>2	byte	x \b, version %i
2587>3	byte	x \b.%i
2588# ZZip archiver (.zz)
25890	string	ZZ\ \0\0 ZZip archive data
25900	string	ZZ0 ZZip archive data
2591# PAQ archiver (.paq)
25920	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
25930	string	PAQ PAQ archive data
2594>3	byte&0xf0	0x30
2595>>3	byte	x (v%c)
2596# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
25970xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
25980	string	JARCS JAR (ARJ Software, Inc.) archive data
2599
2600# ARJ archiver (jason@jarthur.Claremont.EDU)
26010	leshort		0xea60		ARJ archive data
2602!:mime	application/x-arj
2603>5	byte		x		\b, v%d,
2604>8	byte		&0x04		multi-volume,
2605>8	byte		&0x10		slash-switched,
2606>8	byte		&0x20		backup,
2607>34	string		x		original name: %s,
2608>7	byte		0		os: MS-DOS
2609>7	byte		1		os: PRIMOS
2610>7	byte		2		os: Unix
2611>7	byte		3		os: Amiga
2612>7	byte		4		os: Macintosh
2613>7	byte		5		os: OS/2
2614>7	byte		6		os: Apple ][ GS
2615>7	byte		7		os: Atari ST
2616>7	byte		8		os: NeXT
2617>7	byte		9		os: VAX/VMS
2618>3	byte		>0		%d]
2619# [JW] idarc says this is also possible
26202	leshort		0xea60		ARJ archive data
2621
2622# HA archiver (Greg Roelofs, newt@uchicago.edu)
2623# This is a really bad format. A file containing HAWAII will match this...
2624#0	string		HA		HA archive data,
2625#>2	leshort		=1		1 file,
2626#>2	leshort		>1		%hu files,
2627#>4	byte&0x0f	=0		first is type CPY
2628#>4	byte&0x0f	=1		first is type ASC
2629#>4	byte&0x0f	=2		first is type HSC
2630#>4	byte&0x0f	=0x0e		first is type DIR
2631#>4	byte&0x0f	=0x0f		first is type SPECIAL
2632# suggestion: at least identify small archives (<1024 files)
26330  belong&0xffff00fc 0x48410000 HA archive data
2634>2	leshort		=1		1 file,
2635>2	leshort		>1		%u files,
2636>4	byte&0x0f	=0		first is type CPY
2637>4	byte&0x0f	=1		first is type ASC
2638>4	byte&0x0f	=2		first is type HSC
2639>4	byte&0x0f	=0x0e		first is type DIR
2640>4	byte&0x0f	=0x0f		first is type SPECIAL
2641
2642# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
26430	string		HPAK		HPACK archive data
2644
2645# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
26460	string		\351,\001JAM\ 		JAM archive,
2647>7	string		>\0			version %.4s
2648>0x26	byte		=0x27			-
2649>>0x2b	string          >\0			label %.11s,
2650>>0x27	lelong		x			serial %08x,
2651>>0x36	string		>\0			fstype %.8s
2652
2653# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2654# Update: Joerg Jenderek
2655# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
2656# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
2657#
2658#	check and display information of lharc (LHa,PMarc) file
26590	name				lharc-file
2660# check 1st character of method id like -lz4- -lh5- or -pm2-
2661>2	string		-
2662# check 5th character of method id
2663>>6	string		-
2664# check header level 0 1 2 3
2665>>>20	ubyte		<4
2666# check 2nd, 3th and 4th character of method id
2667>>>>3	regex		\^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1)		\b\040
2668!:mime	application/x-lzh-compressed
2669# creator type "LHA "
2670!:apple	????LHA
2671# display archive type name like "LHa/LZS archive data" or "LArc archive"
2672>>>>>2	string		-lz		\b\040
2673!:ext	lzs
2674# already known  -lzs- -lz4- -lz5- with old names
2675>>>>>>2	string	-lzs		LHa/LZS archive data
2676>>>>>>3	regex	\^lz[45]	LHarc 1.x archive data
2677# missing -lz?- with wikipedia names
2678>>>>>>3	regex	\^lz[2378]	LArc archive
2679# display archive type name like "LHa (2.x) archive data"
2680>>>>>2	string		-lh		\b
2681# already known -lh0- -lh1- -lh2- -lh3-  -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
2682>>>>>>3	regex		\^lh[01]	LHarc 1.x/ARX archive data
2683# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
2684# FOOBAR archiver use ".foo" as name extension instead usual one
2685# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
2686>>>>>>>2	string	-lh1		\b\040
2687!:ext lha/lzh/ice
2688>>>>>>3	regex		\^lh[23d]	LHa 2.x? archive data
2689>>>>>>3	regex		\^lh[7]		LHa (2.x)/LHark archive data
2690>>>>>>3	regex		\^lh[456]	LHa (2.x) archive data
2691>>>>>>>2	string	-lh5		\b\040
2692# https://en.wikipedia.org/wiki/BIOS
2693# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
2694# bios.rom , kd7_v14.bin, 1010.004, ...
2695!:ext lha/lzh/rom/bin
2696# missing -lh?- variants (Joe Jared)
2697>>>>>>3	regex		\^lh[89a-ce]	LHa (Joe Jared) archive
2698# UNLHA32 2.67a
2699>>>>>>2	string		-lhx		LHa (UNLHA32) archive
2700# lha archives with standard file name extensions ".lha" ".lzh"
2701>>>>>>3	regex		!\^(lh1|lh5)	\b\040
2702!:ext lha/lzh
2703# this should not happen if all -lh variants are described
2704>>>>>>2	default		x		LHa (unknown) archive
2705#!:ext	lha
2706# PMarc
2707>>>>>3	regex		\^pm[012]	PMarc archive data
2708!:ext pma
2709# append method id without leading and trailing minus character
2710>>>>>3	string		x		[%3.3s]
2711>>>>>>0	use	lharc-header
2712#
2713#	check and display information of lharc header
27140	name				lharc-header
2715# header size 0x4 , 0x1b-0x61
2716>0	ubyte		x
2717# compressed data size != compressed file size
2718#>7	ulelong		x		\b, data size %d
2719# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
2720#>19	ubyte		x		\b, 19_0x%x
2721# level identifier 0 1 2 3
2722#>20	ubyte		x		\b, level %d
2723# time stamp
2724#>15		ubelong	x		DATE 0x%8.8x
2725# OS ID for level 1
2726>20	ubyte		1
2727# 0x20 types find for *.rom files
2728>>(21.b+24)	ubyte	<0x21		\b, 0x%x OS
2729# ascii type like M for MSDOS
2730>>(21.b+24)	ubyte	>0x20		\b, '%c' OS
2731# OS ID for level 2
2732>20	ubyte		2
2733#>>23	ubyte		x		\b, OS ID 0x%x
2734>>23	ubyte		<0x21		\b, 0x%x OS
2735>>23	ubyte		>0x20		\b, '%c' OS
2736# filename only for level 0 and 1
2737>20	ubyte		<2
2738# length of filename
2739>>21		ubyte	>0		\b, with
2740# filename
2741>>>21		pstring	x		"%s"
2742#
2743#2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
2744#!:mime	application/x-lharc
27452	string		-lh0-
2746>0	use	lharc-file
2747#2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
2748#!:mime	application/x-lharc
27492	string		-lh1-
2750>0	use	lharc-file
2751# NEW -lz2- ... -lz8-
27522	string		-lz2-
2753>0	use	lharc-file
27542	string		-lz3-
2755>0	use	lharc-file
27562	string		-lz4-
2757>0	use	lharc-file
27582	string		-lz5-
2759>0	use	lharc-file
27602	string		-lz7-
2761>0	use	lharc-file
27622	string		-lz8-
2763>0	use	lharc-file
2764#	[never seen any but the last; -lh4- reported in comp.compression:]
2765#2	string		-lzs-		LHa/LZS archive data [lzs]
27662	string		-lzs-
2767>0	use	lharc-file
2768# According to wikipedia and others such a version does not exist
2769#2	string		-lh\40-		LHa 2.x? archive data [lh ]
2770#2	string		-lhd-		LHa 2.x? archive data [lhd]
27712	string		-lhd-
2772>0	use	lharc-file
2773#2	string		-lh2-		LHa 2.x? archive data [lh2]
27742	string		-lh2-
2775>0	use	lharc-file
2776#2	string		-lh3-		LHa 2.x? archive data [lh3]
27772	string		-lh3-
2778>0	use	lharc-file
2779#2	string		-lh4-		LHa (2.x) archive data [lh4]
27802	string		-lh4-
2781>0	use	lharc-file
2782#2	string		-lh5-		LHa (2.x) archive data [lh5]
27832	string		-lh5-
2784>0	use	lharc-file
2785#2	string		-lh6-		LHa (2.x) archive data [lh6]
27862	string		-lh6-
2787>0	use	lharc-file
2788#2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
27892	string		-lh7-
2790# !:mime	application/x-lha
2791# >20	byte		x		- header level %d
2792>0	use	lharc-file
2793# NEW -lh8- ... -lhe- , -lhx-
27942	string		-lh8-
2795>0	use	lharc-file
27962	string		-lh9-
2797>0	use	lharc-file
27982	string		-lha-
2799>0	use	lharc-file
28002	string		-lhb-
2801>0	use	lharc-file
28022	string		-lhc-
2803>0	use	lharc-file
28042	string		-lhe-
2805>0	use	lharc-file
28062	string		-lhx-
2807>0	use	lharc-file
2808# taken from idarc [JW]
28092   string      -lZ         PUT archive data
2810# already done by LHarc magics
2811# this should never happen if all sub types of LZS archive are identified
2812#2   string      -lz         LZS archive data
28132   string      -sw1-       Swag archive data
2814
28150	name		rar-file-header
2816>24	byte		15		\b, v1.5
2817>24	byte		20		\b, v2.0
2818>24	byte		29		\b, v4
2819>15	byte		0		\b, os: MS-DOS
2820>15	byte		1		\b, os: OS/2
2821>15	byte		2		\b, os: Win32
2822>15	byte		3		\b, os: Unix
2823>15	byte		4		\b, os: Mac OS
2824>15	byte		5		\b, os: BeOS
2825
28260	name		rar-archive-header
2827>3	leshort&0x1ff	>0		\b, flags:
2828>>3	leshort		&0x01		ArchiveVolume
2829>>3	leshort		&0x02		Commented
2830>>3	leshort		&0x04		Locked
2831>>3	leshort		&0x10		NewVolumeNaming
2832>>3	leshort		&0x08		Solid
2833>>3	leshort		&0x20		Authenticated
2834>>3	leshort		&0x40		RecoveryRecordPresent
2835>>3	leshort		&0x80		EncryptedBlockHeader
2836>>3	leshort		&0x100		FirstVolume
2837
2838# RAR (Roshal Archive) archive
28390	string		Rar!\x1a\7\0		RAR archive data
2840!:mime	application/x-rar
2841!:ext	rar/cbr
2842# file header
2843>(0xc.l+9)	byte	0x74
2844>>(0xc.l+7)	use	rar-file-header
2845# subblock seems to share information with file header
2846>(0xc.l+9)	byte	0x7a
2847>>(0xc.l+7)	use	rar-file-header
2848>9		byte	0x73
2849>>7		use	rar-archive-header
2850
28510	string		Rar!\x1a\7\1\0		RAR archive data, v5
2852!:mime	application/x-rar
2853!:ext	rar
2854
2855# Very old RAR archive
2856# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
28570	string		RE\x7e\x5e  RAR archive data (<v1.5)
2858!:mime	application/x-rar
2859!:ext	rar/cbr
2860
2861# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
28620	string		SQSH		squished archive data (Acorn RISCOS)
2863
2864# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
2865# [JW] see exe section for self-extracting version
28660	string		UC2\x1a		UC2 archive data
2867
2868# PKZIP multi-volume archive
28690	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
2870!:mime	application/zip
2871!:ext zip/cbz
2872
2873# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
28740	string		PK\005\006	Zip archive data (empty)
2875!:mime application/zip
2876!:ext zip/cbz
28770	string		PK\003\004
2878
2879# Specialised zip formats which start with a member named 'mimetype'
2880# (stored uncompressed, with no 'extra field') containing the file's MIME type.
2881# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
2882#  contents starting with "application/":
2883>26	string		\x8\0\0\0mimetypeapplication/
2884
2885#  KOffice / OpenOffice & StarOffice / OpenDocument formats
2886#    From: Abel Cheung <abel@oaka.org>
2887
2888#   KOffice (1.2 or above) formats
2889#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
2890>>50	string	vnd.kde.		KOffice (>=1.2)
2891>>>58	string	karbon			Karbon document
2892>>>58	string	kchart			KChart document
2893>>>58	string	kformula		KFormula document
2894>>>58	string	kivio			Kivio document
2895>>>58	string	kontour			Kontour document
2896>>>58	string	kpresenter		KPresenter document
2897>>>58	string	kspread			KSpread document
2898>>>58	string	kword			KWord document
2899
2900#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
2901#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
2902>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
2903>>>62	string	writer			Writer
2904>>>>68	byte	!0x2e			document
2905>>>>68	string	.template		template
2906>>>>68	string	.global			global document
2907>>>62	string	calc			Calc
2908>>>>66	byte	!0x2e			spreadsheet
2909>>>>66	string	.template		template
2910>>>62	string	draw			Draw
2911>>>>66	byte	!0x2e			document
2912>>>>66	string	.template		template
2913>>>62	string	impress			Impress
2914>>>>69	byte	!0x2e			presentation
2915>>>>69	string	.template		template
2916>>>62	string	math			Math document
2917>>>62	string	base			Database file
2918
2919#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
2920#    http://lists.oasis-open.org/archives/office/200505/msg00006.html
2921#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
2922>>50	string	vnd.oasis.opendocument.	OpenDocument
2923>>>73	string	text
2924>>>>77	byte	!0x2d			Text
2925!:mime	application/vnd.oasis.opendocument.text
2926>>>>77	string	-template		Text Template
2927!:mime	application/vnd.oasis.opendocument.text-template
2928>>>>77	string	-web			HTML Document Template
2929!:mime	application/vnd.oasis.opendocument.text-web
2930>>>>77	string	-master			Master Document
2931!:mime	application/vnd.oasis.opendocument.text-master
2932>>>73	string	graphics
2933>>>>81	byte	!0x2d			Drawing
2934!:mime	application/vnd.oasis.opendocument.graphics
2935>>>>81	string	-template		Template
2936!:mime	application/vnd.oasis.opendocument.graphics-template
2937>>>73	string	presentation
2938>>>>85	byte	!0x2d			Presentation
2939!:mime	application/vnd.oasis.opendocument.presentation
2940>>>>85	string	-template		Template
2941!:mime	application/vnd.oasis.opendocument.presentation-template
2942>>>73	string	spreadsheet
2943>>>>84	byte	!0x2d			Spreadsheet
2944!:mime	application/vnd.oasis.opendocument.spreadsheet
2945>>>>84	string	-template		Template
2946!:mime	application/vnd.oasis.opendocument.spreadsheet-template
2947>>>73	string	chart
2948>>>>78	byte	!0x2d			Chart
2949!:mime	application/vnd.oasis.opendocument.chart
2950>>>>78	string	-template		Template
2951!:mime	application/vnd.oasis.opendocument.chart-template
2952>>>73	string	formula
2953>>>>80	byte	!0x2d			Formula
2954!:mime	application/vnd.oasis.opendocument.formula
2955>>>>80	string	-template		Template
2956!:mime	application/vnd.oasis.opendocument.formula-template
2957>>>73	string	database		Database
2958!:mime	application/vnd.oasis.opendocument.database
2959>>>73	string	image
2960>>>>78	byte	!0x2d			Image
2961!:mime	application/vnd.oasis.opendocument.image
2962>>>>78	string	-template		Template
2963!:mime	application/vnd.oasis.opendocument.image-template
2964
2965#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
2966#    http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
2967#    From: Ralf Brown <ralf.brown@gmail.com>
2968>>50	string	epub+zip	EPUB document
2969!:mime application/epub+zip
2970
2971#  Catch other ZIP-with-mimetype formats
2972#	In a ZIP file, the bytes immediately after a member's contents are
2973#	always "PK". The 2 regex rules here print the "mimetype" member's
2974#	contents up to the first 'P'. Luckily, most MIME types don't contain
2975#	any capital 'P's. This is a kludge.
2976#    (mimetype contains "application/<OTHER>")
2977>>50		string	!epub+zip
2978>>>50		string	!vnd.oasis.opendocument.
2979>>>>50		string	!vnd.sun.xml.
2980>>>>>50		string	!vnd.kde.
2981>>>>>>38	regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
2982!:mime	application/zip
2983#    (mimetype contents other than "application/*")
2984>26		string	\x8\0\0\0mimetype
2985>>38		string	!application/
2986>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
2987!:mime	application/zip
2988
2989# Java Jar files
2990>(26.s+30)	leshort	0xcafe		Java archive data (JAR)
2991!:mime	application/java-archive
2992
2993# iOS App
2994>(26.s+30)	leshort	!0xcafe
2995>>26		string	!\x8\0\0\0mimetype
2996>>>30		string	Payload/
2997>>>>38		search/64       .app/   iOS App
2998!:mime application/x-ios-app
2999
3000
3001# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
3002#   Next line excludes specialized formats:
3003>(26.s+30)	leshort	!0xcafe
3004>>26    string          !\x8\0\0\0mimetype	Zip archive data
3005!:mime	application/zip
3006>>>4	byte		0x09		\b, at least v0.9 to extract
3007>>>4	byte		0x0a		\b, at least v1.0 to extract
3008>>>4	byte		0x0b		\b, at least v1.1 to extract
3009>>>4	byte		0x14		\b, at least v2.0 to extract
3010>>>4	byte		0x15		\b, at least v2.1 to extract
3011>>>4	byte		0x19		\b, at least v2.5 to extract
3012>>>4	byte		0x1b		\b, at least v2.7 to extract
3013>>>4	byte		0x2d		\b, at least v4.5 to extract
3014>>>4	byte		0x2e		\b, at least v4.6 to extract
3015>>>4	byte		0x32		\b, at least v5.0 to extract
3016>>>4	byte		0x33		\b, at least v5.1 to extract
3017>>>4	byte		0x34		\b, at least v5.2 to extract
3018>>>4	byte		0x3d		\b, at least v6.1 to extract
3019>>>4	byte		0x3e		\b, at least v6.2 to extract
3020>>>4	byte		0x3f		\b, at least v6.3 to extract
3021>>>0x161	string		WINZIP		\b, WinZIP self-extracting
3022
3023# StarView Metafile
3024# From Pierre Ducroquet <pinaraf@pinaraf.info>
30250	string	VCLMTF	StarView MetaFile
3026>6	beshort	x	\b, version %d
3027>8	belong	x	\b, size %d
3028
3029# Zoo archiver
303020	lelong		0xfdc4a7dc	Zoo archive data
3031!:mime	application/x-zoo
3032>4	byte		>48		\b, v%c.
3033>>6	byte		>47		\b%c
3034>>>7	byte		>47		\b%c
3035>32	byte		>0		\b, modify: v%d
3036>>33	byte		x		\b.%d+
3037>42	lelong		0xfdc4a7dc	\b,
3038>>70	byte		>0		extract: v%d
3039>>>71	byte		x		\b.%d+
3040
3041# Shell archives
304210	string		#\ This\ is\ a\ shell\ archive	shell archive text
3043!:mime	application/octet-stream
3044
3045#
3046# LBR. NB: May conflict with the questionable
3047#          "binary Computer Graphics Metafile" format.
3048#
30490       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
3050#
3051# PMA (CP/M derivative of LHA)
3052# Update: Joerg Jenderek
3053# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3054#
3055#2       string          -pm0-           PMarc archive data [pm0]
30562	string		-pm0-
3057>0	use	lharc-file
3058#2       string          -pm1-           PMarc archive data [pm1]
30592	string		-pm1-
3060>0	use	lharc-file
3061#2       string          -pm2-           PMarc archive data [pm2]
30622	string		-pm2-
3063>0	use	lharc-file
30642       string          -pms-           PMarc SFX archive (CP/M, DOS)
3065#!:mime	application/x-foobar-exec
3066!:ext com
30675       string          -pc1-           PopCom compressed executable (CP/M)
3068#!:mime	application/x-
3069#!:ext com
3070
3071# From Rafael Laboissiere <rafael@laboissiere.net>
3072# The Project Revision Control System (see
3073# http://prcs.sourceforge.net) generates a packaged project
3074# file which is recognized by the following entry:
30750	leshort		0xeb81	PRCS packaged project
3076
3077# Microsoft cabinets
3078# by David Necas (Yeti) <yeti@physics.muni.cz>
3079#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
3080#>25	byte	x		v%d
3081#>24	byte	x		\b.%d
3082# MPi: All CABs have version 1.3, so this is pointless.
3083# Better magic in debian-additions.
3084
3085# GTKtalog catalogs
3086# by David Necas (Yeti) <yeti@physics.muni.cz>
30874	string	gtktalog\ 	GTKtalog catalog data,
3088>13	string	3		version 3
3089>>14	beshort	0x677a		(gzipped)
3090>>14	beshort	!0x677a		(not gzipped)
3091>13	string	>3		version %s
3092
3093############################################################################
3094# Parity archive reconstruction file, the 'par' file format now used on Usenet.
30950       string          PAR\0	PARity archive data
3096>48	leshort		=0	- Index file
3097>48	leshort		>0	- file number %d
3098
3099# Felix von Leitner <felix-file@fefe.de>
31000	string	d8:announce	BitTorrent file
3101!:mime	application/x-bittorrent
3102# Durval Menezes, <jmgthbfile at durval dot com>
31030	string	d13:announce-list	BitTorrent file
3104!:mime	application/x-bittorrent
3105
3106# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
31070	beshort 0x0e0f		Atari MSA archive data
3108>2	beshort x		\b, %d sectors per track
3109>4	beshort 0		\b, 1 sided
3110>4	beshort 1		\b, 2 sided
3111>6	beshort x		\b, starting track: %d
3112>8	beshort x		\b, ending track: %d
3113
3114# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
31150	string	PK00PK\003\004	Zip archive data
3116
3117# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
3118# by Stefan `Sec` Zehl <sec@42.org>
31197	string		**ACE**		ACE archive data
3120>15	byte	>0		version %d
3121>16	byte	=0x00		\b, from MS-DOS
3122>16	byte	=0x01		\b, from OS/2
3123>16	byte	=0x02		\b, from Win/32
3124>16	byte	=0x03		\b, from Unix
3125>16	byte	=0x04		\b, from MacOS
3126>16	byte	=0x05		\b, from WinNT
3127>16	byte	=0x06		\b, from Primos
3128>16	byte	=0x07		\b, from AppleGS
3129>16	byte	=0x08		\b, from Atari
3130>16	byte	=0x09		\b, from Vax/VMS
3131>16	byte	=0x0A		\b, from Amiga
3132>16	byte	=0x0B		\b, from Next
3133>14	byte	x		\b, version %d to extract
3134>5	leshort &0x0080		\b, multiple volumes,
3135>>17	byte	x		\b (part %d),
3136>5	leshort &0x0002		\b, contains comment
3137>5	leshort	&0x0200		\b, sfx
3138>5	leshort	&0x0400		\b, small dictionary
3139>5	leshort	&0x0800		\b, multi-volume
3140>5	leshort	&0x1000		\b, contains AV-String
3141>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
3142>5	leshort &0x2000		\b, with recovery record
3143>5	leshort &0x4000		\b, locked
3144>5	leshort &0x8000		\b, solid
3145# Date in MS-DOS format (whatever that is)
3146#>18	lelong	x		Created on
3147
3148# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
3149# <doj@cubic.org>
31500x1A	string	sfArk		sfArk compressed Soundfont
3151>0x15	string	2
3152>>0x1	string	>\0		Version %s
3153>>0x2A	string	>\0		: %s
3154
3155# DR-DOS 7.03 Packed File *.??_
31560	string	Packed\ File\ 	Personal NetWare Packed File
3157>12	string	x		\b, was "%.12s"
3158
3159# EET archive
3160# From: Tilman Sauerbeck <tilman@code-monkey.de>
31610	belong	0x1ee7ff00	EET archive
3162!:mime	application/x-eet
3163
3164# rzip archives
31650	string	RZIP		rzip compressed data
3166>4	byte	x		- version %d
3167>5	byte	x		\b.%d
3168>6	belong	x		(%d bytes)
3169
3170# From: "Robert Dale" <robdale@gmail.com>
31710	belong	123		dar archive,
3172>4	belong	x		label "%.8x
3173>>8	belong	x		%.8x
3174>>>12	beshort	x		%.4x"
3175>14	byte	0x54		end slice
3176>14	beshort	0x4e4e		multi-part
3177>14	beshort	0x4e53		multi-part, with -S
3178
3179# Symbian installation files
3180#  http://www.thouky.co.uk/software/psifs/sis.html
3181#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
31828	lelong	0x10000419	Symbian installation file
3183!:mime	application/vnd.symbian.install
3184>4	lelong	0x1000006D	(EPOC release 3/4/5)
3185>4	lelong	0x10003A12	(EPOC release 6)
31860	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
3187!:mime	x-epoc/x-sisx-app
3188
3189# From "Nelson A. de Oliveira" <naoliv@gmail.com>
31900	string	MPQ\032		MoPaQ (MPQ) archive
3191
3192# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
3193# .kgb
31940	string KGB_arch		KGB Archiver file
3195>10	string x		with compression level %.1s
3196
3197# xar (eXtensible ARchiver) archive
3198# xar archive format: http://code.google.com/p/xar/
3199# From: "David Remahl" <dremahl@apple.com>
32000	string	xar!		xar archive
3201!:mime	application/x-xar
3202#>4	beshort	x		header size %d
3203>6	beshort	x		version %d,
3204#>8	quad	x		compressed TOC: %d,
3205#>16	quad	x		uncompressed TOC: %d,
3206>24	belong	0		no checksum
3207>24	belong	1		SHA-1 checksum
3208>24	belong	2		MD5 checksum
3209
3210# Type: Parity Archive
3211# From: Daniel van Eeden <daniel_e@dds.nl>
32120	string	PAR2		Parity Archive Volume Set
3213
3214# Bacula volume format. (Volumes always start with a block header.)
3215# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
3216# From: Adam Buchbinder <adam.buchbinder@gmail.com>
321712	string	BB02		Bacula volume
3218>20	bedate	x		\b, started %s
3219
3220# ePub is XHTML + XML inside a ZIP archive.  The first member of the
3221#   archive must be an uncompressed file called 'mimetype' with contents
3222#   'application/epub+zip'
3223
3224
3225# From: "Michael Gorny" <mgorny@gentoo.org>
3226# ZPAQ: http://mattmahoney.net/dc/zpaq.html
32270	string	zPQ	ZPAQ stream
3228>3	byte	x	\b, level %d
3229# From: Barry Carter <carter.barry@gmail.com>
3230# http://encode.ru/threads/456-zpaq-updates/page32
32310	string	7kSt	ZPAQ file
3232
3233# BBeB ebook, unencrypted (LRF format)
3234# URL: http://www.sven.de/librie/Librie/LrfFormat
3235# From: Adam Buchbinder <adam.buchbinder@gmail.com>
32360	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
3237>8	beshort	x		\b, version %d
3238>36	byte	1		\b, front-to-back
3239>36	byte	16		\b, back-to-front
3240>42	beshort	x		\b, (%dx,
3241>44	beshort	x		%d)
3242
3243# Symantec GHOST image by Joerg Jenderek at May 2014
3244# http://us.norton.com/ghost/
3245# http://www.garykessler.net/library/file_sigs.html
32460		ubelong&0xFFFFf7f0	0xFEEF0100	Norton GHost image
3247# *.GHO
3248>2		ubyte&0x08		0x00		\b, first file
3249# *.GHS or *.[0-9] with cns program option
3250>2		ubyte&0x08		0x08		\b, split file
3251# part of split index interesting for *.ghs
3252>>4		ubyte			x		id=0x%x
3253# compression tag minus one equals numeric compression command line switch z[1-9]
3254>3		ubyte			0		\b, no compression
3255>3		ubyte			2		\b, fast compression (Z1)
3256>3		ubyte			3		\b, medium compression (Z2)
3257>3		ubyte			>3
3258>>3		ubyte			<11		\b, compression (Z%d-1)
3259>2		ubyte&0x08		0x00
3260# ~ 30 byte password field only for *.gho
3261>>12		ubequad			!0		\b, password protected
3262>>44		ubyte			!1
3263# 1~Image All, sector-by-sector only for *.gho
3264>>>10		ubyte			1		\b, sector copy
3265# 1~Image Boot track only for *.gho
3266>>>43		ubyte			1		\b, boot track
3267# 1~Image Disc only for *.gho implies Image Boot track and sector copy
3268>>44		ubyte			1		\b, disc sector copy
3269# optional image description only *.gho
3270>>0xff		string			>\0		"%-.254s"
3271# look for DOS sector end sequence
3272>0xE08	search/7776		\x55\xAA
3273>>&-512	indirect		x		\b; contains
3274
3275# Google Chrome extensions
3276# https://developer.chrome.com/extensions/crx
3277# https://developer.chrome.com/extensions/hosting
32780	string	Cr24	Google Chrome extension
3279!:mime	application/x-chrome-extension
3280>4	ulong	x	\b, version %u
3281
3282# SeqBox - Sequenced container
3283# ext: sbx, seqbox
3284# Marco Pontello marcopon@gmail.com
3285# reference: https://github.com/MarcoPon/SeqBox
32860	string	SBx	SeqBox,
3287>3	byte	x	version %d
3288#------------------------------------------------------------------------------
3289# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
3290# make:  file(1) magic for assembler source
3291#
32920	regex	\^[\040\t]{0,50}\\.asciiz		assembler source text
3293!:mime	text/x-asm
32940	regex	\^[\040\t]{0,50}\\.byte		assembler source text
3295!:mime	text/x-asm
32960	regex	\^[\040\t]{0,50}\\.even		assembler source text
3297!:mime	text/x-asm
32980	regex	\^[\040\t]{0,50}\\.globl		assembler source text
3299!:mime	text/x-asm
33000	regex	\^[\040\t]{0,50}\\.text		assembler source text
3301!:mime	text/x-asm
33020	regex	\^[\040\t]{0,50}\\.file		assembler source text
3303!:mime	text/x-asm
33040	regex	\^[\040\t]{0,50}\\.type		assembler source text
3305!:mime	text/x-asm
3306
3307#------------------------------------------------------------------------------
3308# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
3309# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
3310# strings as "long" - we assume they're just strings:
3311# From: guy@netapp.com (Guy Harris)
3312#
33130	string		*STA		Aster*x
3314>7	string		WORD			Words Document
3315>7	string		GRAP			Graphic
3316>7	string		SPRE			Spreadsheet
3317>7	string		MACR			Macro
33180	string		2278		Aster*x Version 2
3319>29	byte		0x36			Words Document
3320>29	byte		0x35			Graphic
3321>29	byte		0x32			Spreadsheet
3322>29	byte		0x38			Macro
3323
3324
3325#------------------------------------------------------------------------------
3326# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
3327# att3b:  file(1) magic for AT&T 3B machines
3328#
3329# The `versions' should be un-commented if they work for you.
3330# (Was the problem just one of endianness?)
3331#
3332# 3B20
3333#
3334# The 3B20 conflicts with SCCS.
3335#0	beshort		0550		3b20 COFF executable
3336#>12	belong		>0		not stripped
3337#>22	beshort		>0		- version %d
3338#0	beshort		0551		3b20 COFF executable (TV)
3339#>12	belong		>0		not stripped
3340#>22	beshort		>0		- version %d
3341#
3342# WE32K
3343#
33440	beshort		0560		WE32000 COFF
3345>18	beshort		^00000020	object
3346>18	beshort		&00000020	executable
3347>12	belong		>0		not stripped
3348>18	beshort		^00010000	N/A on 3b2/300 w/paging
3349>18	beshort		&00020000	32100 required
3350>18	beshort		&00040000	and MAU hardware required
3351>20	beshort		0407		(impure)
3352>20	beshort		0410		(pure)
3353>20	beshort		0413		(demand paged)
3354>20	beshort		0443		(target shared library)
3355>22	beshort		>0		- version %d
33560	beshort		0561		WE32000 COFF executable (TV)
3357>12	belong		>0		not stripped
3358#>18	beshort		&00020000	- 32100 required
3359#>18	beshort		&00040000	and MAU hardware required
3360#>22	beshort		>0		- version %d
3361#
3362# core file for 3b2
33630	string		\000\004\036\212\200	3b2 core file
3364>364	string		>\0		of '%s'
3365
3366#------------------------------------------------------------------------------
3367# $File: audio,v 1.79 2017/03/17 22:20:22 christos Exp $
3368# audio:  file(1) magic for sound formats (see also "iff")
3369#
3370# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
3371# and others
3372#
3373
3374# Sun/NeXT audio data
33750	string		.snd		Sun/NeXT audio data:
3376>12	belong		1		8-bit ISDN mu-law,
3377!:mime	audio/basic
3378>12	belong		2		8-bit linear PCM [REF-PCM],
3379!:mime	audio/basic
3380>12	belong		3		16-bit linear PCM,
3381!:mime	audio/basic
3382>12	belong		4		24-bit linear PCM,
3383!:mime	audio/basic
3384>12	belong		5		32-bit linear PCM,
3385!:mime	audio/basic
3386>12	belong		6		32-bit IEEE floating point,
3387!:mime	audio/basic
3388>12	belong		7		64-bit IEEE floating point,
3389!:mime	audio/basic
3390>12	belong		8		Fragmented sample data,
3391>12	belong		10		DSP program,
3392>12	belong		11		8-bit fixed point,
3393>12	belong		12		16-bit fixed point,
3394>12	belong		13		24-bit fixed point,
3395>12	belong		14		32-bit fixed point,
3396>12	belong		18		16-bit linear with emphasis,
3397>12	belong		19		16-bit linear compressed,
3398>12	belong		20		16-bit linear with emphasis and compression,
3399>12	belong		21		Music kit DSP commands,
3400>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
3401!:mime  audio/x-adpcm
3402>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
3403>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
3404>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
3405>12	belong		27		8-bit A-law (CCITT G.711),
3406>20	belong		1		mono,
3407>20	belong		2		stereo,
3408>20	belong		4		quad,
3409>16	belong		>0		%d Hz
3410
3411# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
3412# that uses little-endian encoding and has a different magic number
34130	lelong		0x0064732E	DEC audio data:
3414>12	lelong		1		8-bit ISDN mu-law,
3415!:mime	audio/x-dec-basic
3416>12	lelong		2		8-bit linear PCM [REF-PCM],
3417!:mime	audio/x-dec-basic
3418>12	lelong		3		16-bit linear PCM,
3419!:mime	audio/x-dec-basic
3420>12	lelong		4		24-bit linear PCM,
3421!:mime	audio/x-dec-basic
3422>12	lelong		5		32-bit linear PCM,
3423!:mime	audio/x-dec-basic
3424>12	lelong		6		32-bit IEEE floating point,
3425!:mime	audio/x-dec-basic
3426>12	lelong		7		64-bit IEEE floating point,
3427!:mime	audio/x-dec-basic
3428>12	belong		8		Fragmented sample data,
3429>12	belong		10		DSP program,
3430>12	belong		11		8-bit fixed point,
3431>12	belong		12		16-bit fixed point,
3432>12	belong		13		24-bit fixed point,
3433>12	belong		14		32-bit fixed point,
3434>12	belong		18		16-bit linear with emphasis,
3435>12	belong		19		16-bit linear compressed,
3436>12	belong		20		16-bit linear with emphasis and compression,
3437>12	belong		21		Music kit DSP commands,
3438>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
3439!:mime	audio/x-dec-basic
3440>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
3441>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
3442>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
3443>12	belong		27		8-bit A-law (CCITT G.711),
3444>20	lelong		1		mono,
3445>20	lelong		2		stereo,
3446>20	lelong		4		quad,
3447>16	lelong		>0		%d Hz
3448
3449# Creative Labs AUDIO stuff
34500	string	MThd			Standard MIDI data
3451!:mime	audio/midi
3452>8 	beshort	x			(format %d)
3453>10	beshort	x			using %d track
3454>10	beshort		>1		\bs
3455>12	beshort&0x7fff	x		at 1/%d
3456>12	beshort&0x8000	>0		SMPTE
3457
34580	string	CTMF			Creative Music (CMF) data
3459!:mime	audio/x-unknown
34600	string	SBI			SoundBlaster instrument data
3461!:mime	audio/x-unknown
34620	string	Creative\ Voice\ File	Creative Labs voice data
3463!:mime	audio/x-unknown
3464# is this next line right?  it came this way...
3465>19	byte	0x1A
3466>23	byte	>0			- version %d
3467>22	byte	>0			\b.%d
3468
3469# first entry is also the string "NTRK"
34700	belong		0x4e54524b	MultiTrack sound data
3471>4	belong		x		- version %d
3472
3473# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
3474# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
34750	string		EMOD		Extended MOD sound data,
3476>4	byte&0xf0	x		version %d
3477>4	byte&0x0f	x		\b.%d,
3478>45	byte		x		%d instruments
3479>83	byte		0		(module)
3480>83	byte		1		(song)
3481
3482# Real Audio (Magic .ra\0375)
34830	belong		0x2e7261fd	RealAudio sound file
3484!:mime	audio/x-pn-realaudio
34850	string		.RMF\0\0\0	RealMedia file
3486!:mime	application/vnd.rn-realmedia
3487#video/x-pn-realvideo
3488#video/vnd.rn-realvideo
3489#application/vnd.rn-realmedia
3490#	sigh, there are many mimes for that but the above are the most common.
3491
3492# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
3493# Oct 31, 1995
3494# fixed by <doj@cubic.org> 2003-06-24
3495# Too short...
3496#0	string		MTM		MultiTracker Module sound file
3497#0	string		if		Composer 669 Module sound data
3498#0	string		JN		Composer 669 Module sound data (extended format)
34990	string		MAS_U		ULT(imate) Module sound data
3500
3501#0	string		FAR		Module sound data
3502#>4	string		>\15		Title: "%s"
3503
35040x2c	string		SCRM		ScreamTracker III Module sound data
3505>0	string		>\0		Title: "%s"
3506
3507# Gravis UltraSound patches
3508# From <ache@nagual.ru>
3509
35100	string		GF1PATCH110\0ID#000002\0	GUS patch
35110	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
3512
3513# mime types according to http://www.geocities.com/nevilo/mod.htm:
3514#	audio/it	.it
3515#	audio/x-zipped-it	.itz
3516#	audio/xm	fasttracker modules
3517#	audio/x-s3m	screamtracker modules
3518#	audio/s3m	screamtracker modules
3519#	audio/x-zipped-mod	mdz
3520#	audio/mod	mod
3521#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
3522
3523#
3524# Taken from loader code from mikmod version 2.14
3525# by Steve McIntyre (stevem@chiark.greenend.org.uk)
3526# <doj@cubic.org> added title printing on 2003-06-24
35270	string	MAS_UTrack_V00
3528>14	string	>/0		ultratracker V1.%.1s module sound data
3529!:mime	audio/x-mod
3530#audio/x-tracker-module
3531
35320	string	UN05		MikMod UNI format module sound data
3533
35340	string	Extended\ Module: Fasttracker II module sound data
3535!:mime	audio/x-mod
3536#audio/x-tracker-module
3537>17	string	>\0		Title: "%s"
3538
353921	string/c	=!SCREAM!	Screamtracker 2 module sound data
3540!:mime	audio/x-mod
3541#audio/x-screamtracker-module
354221	string	BMOD2STM	Screamtracker 2 module sound data
3543!:mime	audio/x-mod
3544#audio/x-screamtracker-module
35451080	string	M.K.		4-channel Protracker module sound data
3546!:mime	audio/x-mod
3547#audio/x-protracker-module
3548>0	string	>\0		Title: "%s"
35491080	string	M!K!		4-channel Protracker module sound data
3550!:mime	audio/x-mod
3551#audio/x-protracker-module
3552>0	string	>\0		Title: "%s"
35531080	string	FLT4		4-channel Startracker module sound data
3554!:mime	audio/x-mod
3555#audio/x-startracker-module
3556>0	string	>\0		Title: "%s"
35571080	string	FLT8		8-channel Startracker module sound data
3558!:mime	audio/x-mod
3559#audio/x-startracker-module
3560>0	string	>\0		Title: "%s"
35611080	string	4CHN		4-channel Fasttracker module sound data
3562!:mime	audio/x-mod
3563#audio/x-fasttracker-module
3564>0	string	>\0		Title: "%s"
35651080	string	6CHN		6-channel Fasttracker module sound data
3566!:mime	audio/x-mod
3567#audio/x-fasttracker-module
3568>0	string	>\0		Title: "%s"
35691080	string	8CHN		8-channel Fasttracker module sound data
3570!:mime	audio/x-mod
3571#audio/x-fasttracker-module
3572>0	string	>\0		Title: "%s"
35731080	string	CD81		8-channel Octalyser module sound data
3574!:mime	audio/x-mod
3575#audio/x-octalysertracker-module
3576>0	string	>\0		Title: "%s"
35771080	string	OKTA		8-channel Octalyzer module sound data
3578!:mime	audio/x-mod
3579#audio/x-octalysertracker-module
3580>0	string	>\0		Title: "%s"
3581# Not good enough.
3582#1082	string	CH
3583#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
35841080	string	16CN		16-channel Taketracker module sound data
3585!:mime	audio/x-mod
3586#audio/x-taketracker-module
3587>0	string	>\0		Title: "%s"
35881080	string	32CN		32-channel Taketracker module sound data
3589!:mime	audio/x-mod
3590#audio/x-taketracker-module
3591>0	string	>\0		Title: "%s"
3592
3593# TOC sound files -Trevor Johnson <trevor@jpj.net>
3594#
35950       string          TOC             TOC sound file
3596
3597# sidfiles <pooka@iki.fi>
3598# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
35990	string		SIDPLAY\ INFOFILE	Sidplay info file
3600
36010	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
3602>4	beshort		>0			w/ header v%d,
3603>14	beshort		=1			single song,
3604>14	beshort		>1			%d songs,
3605>16	beshort		>0			default song: %d
3606>0x16	string		>\0			name: "%s"
3607>0x36	string		>\0			author: "%s"
3608>0x56	string		>\0			copyright: "%s"
3609
36100	string		RSID			RSID sidtune PlaySID compatible
3611>4	beshort		>0			w/ header v%d,
3612>14	beshort		=1			single song,
3613>14	beshort		>1			%d songs,
3614>16	beshort		>0			default song: %d
3615>0x16	string		>\0			name: "%s"
3616>0x36	string		>\0			author: "%s"
3617>0x56	string		>\0			copyright: "%s"
3618
3619# IRCAM sound files - Michael Pruett <michael@68k.org>
3620# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
36210	belong		0x64a30100		IRCAM file (VAX little-endian)
36220	belong		0x0001a364		IRCAM file (VAX big-endian)
36230	belong		0x64a30200		IRCAM file (Sun big-endian)
36240	belong		0x0002a364		IRCAM file (Sun little-endian)
36250	belong		0x64a30300		IRCAM file (MIPS little-endian)
36260	belong		0x0003a364		IRCAM file (MIPS big-endian)
36270	belong		0x64a30400		IRCAM file (NeXT big-endian)
36280	belong		0x64a30400		IRCAM file (NeXT big-endian)
36290	belong		0x0004a364		IRCAM file (NeXT little-endian)
3630
3631# NIST SPHERE <mpruett@sgi.com>
36320	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
3633
3634# Sample Vision <mpruett@sgi.com>
36350	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
3636
3637# Audio Visual Research <tonigonenstein@users.sourceforge.net>
36380	string		2BIT			Audio Visual Research file,
3639>12	beshort		=0			mono,
3640>12	beshort		=-1			stereo,
3641>14	beshort		x			%d bits
3642>16	beshort		=0			unsigned,
3643>16	beshort		=-1			signed,
3644>22	belong&0x00ffffff	x		%d Hz,
3645>18	beshort		=0			no loop,
3646>18	beshort		=-1			loop,
3647>21	ubyte		<128			note %d,
3648>22	byte		=0			replay 5.485 KHz
3649>22	byte		=1			replay 8.084 KHz
3650>22	byte		=2			replay 10.971 KHz
3651>22	byte		=3			replay 16.168 KHz
3652>22	byte		=4			replay 21.942 KHz
3653>22	byte		=5			replay 32.336 KHz
3654>22	byte		=6			replay 43.885 KHz
3655>22	byte		=7			replay 47.261 KHz
3656
3657# SGI SoundTrack <mpruett@sgi.com>
36580	string		_SGI_SoundTrack		SGI SoundTrack project file
3659# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
36600	string		ID3	Audio file with ID3 version 2
3661>3	byte		x	\b.%d
3662>4	byte		x	\b.%d
3663>>5	byte		&0x80	\b, unsynchronized frames
3664>>5	byte		&0x40	\b, extended header
3665>>5	byte		&0x20	\b, experimental
3666>>5	byte		&0x10	\b, footer present
3667>(6.I+10)	indirect	x	\b, contains:
3668
3669# NSF (NES sound file) magic
36700	string		NESM\x1a	NES Sound File
3671>14	string		>\0		("%s" by
3672>46	string		>\0		%s, copyright
3673>78	string		>\0		%s),
3674>5	byte		x		version %d,
3675>6	byte		x		%d tracks,
3676>122	byte&0x2	=1		dual PAL/NTSC
3677>122	byte&0x1	=1		PAL
3678>122	byte&0x1	=0		NTSC
3679
3680# NSFE (Extended NES sound file) magic
3681# http://slickproductions.org/docs/NSF/nsfespec.txt
3682# From: David Pflug <david@pflug.email>
36830	string		NSFE		Extended NES Sound File
3684>48	search/0x1000	auth
3685>>&0	string		>\0		("%s"
3686>>>&1	string		>\0		by %s
3687>>>>&1	string		>\0		\b, copyright %s
3688>>>>>&1	string		>\0		\b, ripped by %s
3689>20	byte		x		\b), %d tracks,
3690>18	byte&0x2	=1		dual PAL/NTSC
3691>18     byte&0x2	=0
3692>>18	byte&0x1	=1		PAL
3693>>18	byte&0x1	=0		NTSC
3694
3695# Type: SNES SPC700 sound files
3696# From: Josh Triplett <josh@freedesktop.org>
36970	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
3698>&0	string	0.30					\b, version %s
3699>>0x23	byte	0x1B					\b, without ID666 tag
3700>>0x23	byte	0x1A					\b, with ID666 tag
3701>>>0x2E	string	>\0					\b, song "%.32s"
3702>>>0x4E	string	>\0					\b, game "%.32s"
3703
3704# Impulse tracker module (audio/x-it)
37050	string		IMPM		Impulse Tracker module sound data -
3706!:mime	audio/x-mod
3707>4	string		>\0		"%s"
3708>40	leshort		!0		compatible w/ITv%x
3709>42	leshort		!0		created w/ITv%x
3710
3711# Imago Orpheus module (audio/x-imf)
371260	string		IM10		Imago Orpheus module sound data -
3713>0	string		>\0		"%s"
3714
3715# From <collver1@attbi.com>
3716# These are the /etc/magic entries to decode modules, instruments, and
3717# samples in Impulse Tracker's native format.
3718
37190	string		IMPS		Impulse Tracker Sample
3720>18	byte		&2		16 bit
3721>18	byte		^2		8 bit
3722>18	byte		&4		stereo
3723>18	byte		^4		mono
37240	string		IMPI		Impulse Tracker Instrument
3725>28	leshort		!0		ITv%x
3726>30	byte		!0		%d samples
3727
3728# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
3729# From <collver1@attbi.com>
37300	string		LM8953		Yamaha TX Wave
3731>22	byte		0x49		looped
3732>22	byte		0xC9		non-looped
3733>23	byte		1		33kHz
3734>23	byte		2		50kHz
3735>23	byte		3		16kHz
3736
3737# scream tracker:  file(1) magic for Scream Tracker sample files
3738#
3739# From <collver1@attbi.com>
374076	string		SCRS		Scream Tracker Sample
3741>0	byte		1		sample
3742>0	byte		2		adlib melody
3743>0	byte		>2		adlib drum
3744>31	byte		&2		stereo
3745>31	byte		^2		mono
3746>31	byte		&4		16bit little endian
3747>31	byte		^4		8bit
3748>30	byte		0		unpacked
3749>30	byte		1		packed
3750
3751# audio
3752# From: Cory Dikkers <cdikkers@swbell.net>
37530	string		MMD0		MED music file, version 0
37540	string		MMD1		OctaMED Pro music file, version 1
37550	string		MMD3		OctaMED Soundstudio music file, version 3
37560	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
37570	string		MED		MED_Song
37580	string		SymM		Symphonie SymMOD music file
3759#
37600	string		THX		AHX version
3761>3	byte		=0		1 module data
3762>3	byte		=1		2 module data
3763#
37640	string		OKTASONG	Oktalyzer module data
3765#
37660	string		DIGI\ Booster\ module\0	%s
3767>20	byte		>0		%c
3768>>21	byte		>0		\b%c
3769>>>22	byte		>0		\b%c
3770>>>>23	byte		>0		\b%c
3771>610	string		>\0		\b, "%s"
3772#
37730	string		DBM0	   	DIGI Booster Pro Module
3774>4	byte		>0		V%X.
3775>>5	byte		x		\b%02X
3776>16	string		>\0		\b, "%s"
3777#
37780	string		FTMN		FaceTheMusic module
3779>16	string		>\0d		\b, "%s"
3780
3781# From: <doj@cubic.org> 2003-06-24
37820	string		AMShdr\32	Velvet Studio AMS Module v2.2
37830	string		Extreme		Extreme Tracker AMS Module v1.3
37840	string		DDMF		Xtracker DMF Module
3785>4	byte		x		v%i
3786>0xD	string		>\0		Title: "%s"
3787>0x2B	string		>\0		Composer: "%s"
37880	string		DSM\32		Dynamic Studio Module DSM
37890	string		SONG		DigiTrekker DTM Module
37900	string		DMDL		DigiTrakker MDL Module
37910	string		PSM\32		Protracker Studio PSM Module
379244	string		PTMF		Poly Tracker PTM Module
3793>0	string		>\32		Title: "%s"
37940	string		MT20		MadTracker 2.0 Module MT2
37950	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
37960	string		RTMM		RTM Module
37970x426	string		MaDoKaN96	XMS Adlib Module
3798>0	string		>\0		Composer: "%s"
37990	string		AMF		AMF Module
3800>4	string		>\0		Title: "%s"
38010	string		MODINFO1	Open Cubic Player Module Inforation MDZ
38020	string		Extended\40Instrument: Fast Tracker II Instrument
3803
3804# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
3805# NOA Nancy Codec file
38060	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
3807# Yamaha SMAF format
38080	string		MMMD		Yamaha SMAF file
3809# Sharp Jisaku Melody format for PDC
38100	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
3811>20	string		Ver01.00	Ver. 1.00
3812>>32	byte		x		, %d tracks
3813
3814# Free lossless audio codec <http://flac.sourceforge.net>
3815# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
38160	string			fLaC		FLAC audio bitstream data
3817!:mime	audio/x-flac
3818>4	byte&0x7f		>0		\b, unknown version
3819>4	byte&0x7f		0		\b
3820# some common bits/sample values
3821>>20	beshort&0x1f0		0x030		\b, 4 bit
3822>>20	beshort&0x1f0		0x050		\b, 6 bit
3823>>20	beshort&0x1f0		0x070		\b, 8 bit
3824>>20	beshort&0x1f0		0x0b0		\b, 12 bit
3825>>20	beshort&0x1f0		0x0f0		\b, 16 bit
3826>>20	beshort&0x1f0		0x170		\b, 24 bit
3827>>20	byte&0xe		0x0		\b, mono
3828>>20	byte&0xe		0x2		\b, stereo
3829>>20	byte&0xe		0x4		\b, 3 channels
3830>>20	byte&0xe		0x6		\b, 4 channels
3831>>20	byte&0xe		0x8		\b, 5 channels
3832>>20	byte&0xe		0xa		\b, 6 channels
3833>>20	byte&0xe		0xc		\b, 7 channels
3834>>20	byte&0xe		0xe		\b, 8 channels
3835# some common sample rates
3836>>17	belong&0xfffff0		0x2ee000	\b, 192 kHz
3837>>17	belong&0xfffff0		0x158880	\b, 88.2 kHz
3838>>17	belong&0xfffff0		0x0ac440	\b, 44.1 kHz
3839>>17	belong&0xfffff0		0x0bb800	\b, 48 kHz
3840>>17	belong&0xfffff0		0x07d000	\b, 32 kHz
3841>>17	belong&0xfffff0		0x056220	\b, 22.05 kHz
3842>>17	belong&0xfffff0		0x05dc00	\b, 24 kHz
3843>>17	belong&0xfffff0		0x03e800	\b, 16 kHz
3844>>17	belong&0xfffff0		0x02b110	\b, 11.025 kHz
3845>>17	belong&0xfffff0		0x02ee00	\b, 12 kHz
3846>>17	belong&0xfffff0		0x01f400	\b, 8 kHz
3847>>17	belong&0xfffff0		0x177000	\b, 96 kHz
3848>>17	belong&0xfffff0		0x0fa000	\b, 64 kHz
3849>>21	byte&0xf		>0		\b, >4G samples
3850>>21	byte&0xf		0		\b
3851>>>22	belong			>0		\b, %u samples
3852>>>22	belong			0		\b, length unknown
3853
3854# (ISDN) VBOX voice message file (Wolfram Kleff)
38550       string          VBOX            VBOX voice message data
3856
3857# ReBorn Song Files (.rbs)
3858# David J. Singer <doc@deadvirgins.org.uk>
38598       string          RB40             RBS Song file
3860>29     string          ReBorn           created by ReBorn
3861>37     string          Propellerhead    created by ReBirth
3862
3863# Synthesizer Generator and Kimwitu share their file format
38640	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
3865# Kimwitu++ uses a slightly different magic
38660	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
3867
3868# From "Simon Hosie
38690       string  TFMX-SONG       TFMX module sound data
3870
3871# Monkey's Audio compressed audio format (.ape)
3872# From danny.milo@gmx.net (Danny Milosavljevic)
3873# New version from Abel Cheung <abel (@) oaka.org>
38740		string		MAC\040		Monkey's Audio compressed format
3875!:mime audio/x-ape
3876>4		uleshort	>0x0F8B		version %d
3877>>(0x08.l)	uleshort	=1000		with fast compression
3878>>(0x08.l)	uleshort	=2000		with normal compression
3879>>(0x08.l)	uleshort	=3000		with high compression
3880>>(0x08.l)	uleshort	=4000		with extra high compression
3881>>(0x08.l)	uleshort	=5000		with insane compression
3882>>(0x08.l+18)	uleshort	=1		\b, mono
3883>>(0x08.l+18)	uleshort	=2		\b, stereo
3884>>(0x08.l+20)	ulelong		x		\b, sample rate %d
3885>4		uleshort	<0x0F8C		version %d
3886>>6		uleshort	=1000		with fast compression
3887>>6		uleshort	=2000		with normal compression
3888>>6		uleshort	=3000		with high compression
3889>>6		uleshort	=4000		with extra high compression
3890>>6		uleshort	=5000		with insane compression
3891>>10		uleshort	=1		\b, mono
3892>>10		uleshort	=2		\b, stereo
3893>>12		ulelong		x		\b, sample rate %d
3894
3895# adlib sound files
3896# From Gurkan Sengun <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
38970    	string		RAWADATA	RdosPlay RAW
3898
38991068	string		RoR		AMUSIC Adlib Tracker
3900
39010	string		JCH		EdLib
3902
39030	string		mpu401tr	MPU-401 Trakker
3904
39050	string		SAdT		Surprise! Adlib Tracker
3906>4	byte		x		Version %d
3907
39080	string		XAD!		eXotic ADlib
3909
39100	string		ofTAZ!		eXtra Simple Music
3911
3912# Spectrum 128 tunes (.ay files).
3913# From: Emanuel Haupt <ehaupt@critical.ch>
39140	string		ZXAYEMUL	Spectrum 128 tune
3915
39160	string		\0BONK		BONK,
3917#>5	byte		x		version %d
3918>14	byte		x		%d channel(s),
3919>15	byte		=1		lossless,
3920>15	byte		=0		lossy,
3921>16	byte		x		mid-side
3922
3923384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
3924
3925# format VQF (proprietary codec for sound)
3926# some infos on the header file available at :
3927# http://www.twinvq.org/english/technology_format.html
39280	string		TWIN97012000	VQF data
3929>27	short		0		\b, Mono
3930>27	short		1		\b, Stereo
3931>31	short 		>0		\b, %d kbit/s
3932>35	short 		>0		\b, %d kHz
3933
3934# Nelson A. de Oliveira (naoliv@gmail.com)
3935# .eqf
39360	string	Winamp\ EQ\ library\ file	%s
3937# it will match only versions like v<digit>.<digit>
3938# Since I saw only eqf files with version v1.1 I think that it's OK
3939>23	string	x	\b%.4s
3940# .preset
39410	string	[Equalizer\ preset]	XMMS equalizer preset
3942# .m3u
39430	search/1	#EXTM3U 	M3U playlist text
3944# .pls
39450	search/1	[playlist]	PLS playlist text
3946# licq.conf
39471	string	[licq]			LICQ configuration file
3948
3949# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
39500	string		ICE!		SNDH Atari ST music
39510	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music
3952
3953# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
39540       string          MP+     Musepack audio (MP+)
3955!:mime	audio/x-musepack
3956>3      byte            255     \b, SV pre8
3957>3      byte&0xF        0x6     \b, SV 6
3958>3      byte&0xF        0x8     \b, SV 8
3959>3      byte&0xF        0x7     \b, SV 7
3960>>3     byte&0xF0       0x0     \b.0
3961>>3     byte&0xF0       0x10    \b.1
3962>>3     byte&0xF0       240     \b.15
3963>>10    byte&0xF0       0x0     \b, no profile
3964>>10    byte&0xF0       0x10    \b, profile 'Unstable/Experimental'
3965>>10    byte&0xF0       0x50    \b, quality 0
3966>>10    byte&0xF0       0x60    \b, quality 1
3967>>10    byte&0xF0       0x70    \b, quality 2 (Telephone)
3968>>10    byte&0xF0       0x80    \b, quality 3 (Thumb)
3969>>10    byte&0xF0       0x90    \b, quality 4 (Radio)
3970>>10    byte&0xF0       0xA0    \b, quality 5 (Standard)
3971>>10    byte&0xF0       0xB0    \b, quality 6 (Xtreme)
3972>>10    byte&0xF0       0xC0    \b, quality 7 (Insane)
3973>>10    byte&0xF0       0xD0    \b, quality 8 (BrainDead)
3974>>10    byte&0xF0       0xE0    \b, quality 9
3975>>10    byte&0xF0       0xF0    \b, quality 10
3976>>27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
3977>>27    byte            102     \b, Beta 1.02
3978>>27    byte            104     \b, Beta 1.04
3979>>27    byte            105     \b, Alpha 1.05
3980>>27    byte            106     \b, Beta 1.06
3981>>27    byte            110     \b, Release 1.1
3982>>27    byte            111     \b, Alpha 1.11
3983>>27    byte            112     \b, Beta 1.12
3984>>27    byte            113     \b, Alpha 1.13
3985>>27    byte            114     \b, Beta 1.14
3986>>27    byte            115     \b, Alpha 1.15
3987
39880       string          MPCK    Musepack audio (MPCK)
3989!:mime	audio/x-musepack
3990
3991# IMY
3992# from http://filext.com/detaillist.php?extdetail=IMY
3993# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
3994# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
3995# http://www.wx800.com/msg/download/irda/iMelody.pdf
39960	string	BEGIN:IMELODY	iMelody Ringtone Format
3997
3998# From: "Mateus Caruccio" <mateus@caruccio.com>
3999# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
40000	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature
4001
4002# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
400360	string	SONG		SoundFX Module sound file
4004
4005# Type: Adaptive Multi-Rate Codec
4006# URL:  http://filext.com/detaillist.php?extdetail=AMR
4007# From: Russell Coker <russell@coker.com.au>
40080	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
4009
4010# Type: SuperCollider 3 Synth Definition File Format
4011# From: Mario Lang <mlang@debian.org>
40120	string	SCgf	SuperCollider3 Synth Definition file,
4013>4	belong	x	version %d
4014
4015# Type: True Audio Lossless Audio
4016# URL:  http://wiki.multimedia.cx/index.php?title=True_Audio
4017# From: Mike Melanson <mike@multimedia.cx>
40180	string	TTA1	True Audio Lossless Audio
4019
4020# Type: WavPack Lossless Audio
4021# URL:  http://wiki.multimedia.cx/index.php?title=WavPack
4022# From: Mike Melanson <mike@multimedia.cx>
40230	string	wvpk	WavPack Lossless Audio
4024
4025# From Fabio R. Schmidlin <frs@pop.com.br>
4026# VGM music file
40270	string		Vgm\040
4028>9	ubyte		>0	VGM Video Game Music dump v
4029>>9	ubyte/16	>0	\b%d
4030>>9	ubyte&0x0F	x	\b%d
4031>>8	ubyte/16	x	\b.%d
4032>>8	ubyte&0x0F	>0	\b%d
4033#Get soundchips
4034>>8	ubyte		x	\b, soundchip(s)=
4035>>0x0C	ulelong		>0	SN76489,
4036>>0x10	ulelong		>0	YM2413,
4037>>0x2C	ulelong		>0	YM2612,
4038>>0x30	ulelong		>0	YM2151,
4039>>0x38	ulelong		>0	Sega PCM,
4040>>0x34	ulelong		>0xC
4041>>>0x40	ulelong		>0	RF5C68,
4042>>0x34	ulelong		>0x10
4043>>>0x44	ulelong		>0	YM2203,
4044>>0x34	ulelong		>0x14
4045>>>0x48	ulelong		>0	YM2608,
4046>>0x34	ulelong		>0x18
4047>>>0x4C	lelong		>0	YM2610,
4048>>>0x4C	lelong		<0	YM2610B,
4049>>0x34	ulelong		>0x1C
4050>>>0x50	ulelong		>0	YM3812,
4051>>0x34	ulelong		>0x20
4052>>>0x54	ulelong		>0	YM3526,
4053>>0x34	ulelong		>0x24
4054>>>0x58	ulelong		>0	Y8950,
4055>>0x34	ulelong		>0x28
4056>>>0x5C	ulelong		>0	YMF262,
4057>>0x34	ulelong		>0x2C
4058>>>0x60	ulelong		>0	YMF278B,
4059>>0x34	ulelong		>0x30
4060>>>0x64	ulelong		>0	YMF271,
4061>>0x34	ulelong		>0x34
4062>>>0x68	ulelong		>0	YMZ280B,
4063>>0x34	ulelong		>0x38
4064>>>0x6C	ulelong		>0	RF5C164,
4065>>0x34	ulelong		>0x3C
4066>>>0x70	ulelong		>0	PWM,
4067>>0x34	ulelong		>0x40
4068>>>0x74	ulelong		>0
4069>>>>0x78 ubyte		0x00	AY-3-8910,
4070>>>>0x78 ubyte		0x01	AY-3-8912,
4071>>>>0x78 ubyte		0x02	AY-3-8913,
4072>>>>0x78 ubyte		0x03	AY-3-8930,
4073>>>>0x78 ubyte		0x10	YM2149,
4074>>>>0x78 ubyte		0x11	YM3439,
4075
4076# GVOX Encore file format
4077# Since this is a proprietary file format and there is no publicly available
4078# format specification, this is just based on induction
4079#
40800	string	SCOW
4081>4	byte	0xc4	GVOX Encore music, version 5.0 or above
4082>4	byte	0xc2	GVOX Encore music, version < 5.0
4083
40840	string	ZBOT
4085>4	byte	0xc5	GVOX Encore music, version < 5.0
4086
4087# Summary:	Garmin Voice Processing Module (WAVE audios)
4088# From:		Joerg Jenderek
4089# URL:		http://www.garmin.com/
4090# Reference:	http://turboccc.wikispaces.com/share/view/28622555
4091# NOTE:		there exist 2 other Garmin VPM formats
40920		string	AUDIMG
4093# skip text files starting with string "AUDIMG"
4094>13		ubyte		<13	Garmin Voice Processing Module
4095!:mime	audio/x-vpm-wav-garmin
4096!:ext	vpm
4097# 3 bytes indicating the voice version (200,220)
4098>>6		string		x	\b, version %3.3s
4099# day of release (01-31)
4100>>12		ubyte		x	\b, %.2d
4101# month of release (01-12)
4102>>13		ubyte		x	\b.%.2d
4103# year of release (like 2006, 2007, 2008)
4104>>14		uleshort	x	\b.%.4d
4105# hour of release (0-23)
4106>>11		ubyte		x	%.2d
4107# minute of release (0-59)
4108>>10		ubyte		x	\b:%.2d
4109# second of release (0-59)
4110>>9		ubyte		x	\b:%.2d
4111# if you select a language like german on your garmin device
4112# you can only select voice modules with correponding language byte ID like 1
4113>>18		ubyte		x	\b, language ID %d
4114# pointer to 1st audio WAV sample
4115>>16		uleshort	>0
4116>>>(16.s)	ulelong		>0	\b, at offset 0x%x
4117# WAV length
4118>>>>(16.s+4)	ulelong		>0	%d Bytes
4119# look for magic
4120>>>>>(&-8.l)	string		RIFF
4121# determine type by ./riff
4122>>>>>>&-4	indirect	x	\b
4123# 2 - ~ 131 WAV samples following same way
4124
4125# From Martin Mueller Skarbiniks Pedersen
41260		string		GDM
4127>0x3		byte		0xFE	General Digital Music.
4128>0x4		string		>\0	title: "%s"
4129>0x24		string		>\0	musician: "%s"
4130>>0x44		beshort		0x0D0A
4131>>>0x46		byte		0x1A
4132>>>>0x47	string		GMFS	Version
4133>>>>0x4B	byte		x	%d.
4134>>>>0x4C	byte		x	\b%02d
4135>>>>0x4D	beshort		0x000	(2GDM v
4136>>>>0x4F	byte		x	\b%d.
4137>>>>>0x50	byte		x	\b%d)
4138
41390		string		MTM	Multitracker
4140>0x3		byte/16		x	Version %d.
4141>0x3		byte&0x0F	x	\b%02d
4142>>0x4		string		>\0	title: "%s"
4143
41440		string		HVL
4145>3		byte		<2	Hively Tracker Song
4146>3		byte		0	1 module data
4147>3		byte		1	2 module data
4148
41490		string		MO3
4150>3		ubyte		<6	MOdule with MP3
4151>>3		byte		0	Version	0	(With MP3 and lossless)
4152>>3		byte		1	Version	1	(With ogg and lossless)
4153>>3		byte		3	Version 2.2
4154>>3		byte		4	(With no LAME header)
4155>>3		byte		5	Version 2.4
4156
41570		string		ADRVPACK	AProSys	module
4158
4159# ftp://ftp.modland.com/pub/documents/format_documentation/\
4160# Art%20Of%20Noise%20(.aon).txt
41610		string		AON
4162>4		string		"ArtOfNoise by Bastian Spiegel(twice/lego)"
4163>0x2e		string		NAME	Art of Noise Tracker Song
4164>3		string		<9
4165>3		string		4	(4 voices)
4166>3		string		8	(8 voices)
4167>>0x36		string		>\0	Title: "%s"
4168
41690		string		FAR
4170>0x2c		byte		0x0d
4171>0x2d		byte		0x0a
4172>0x2e		byte		0x1a
4173>>0x3		byte		0xFE	Farandole Tracker Song
4174>>>0x31		byte/16		x	Version %d.
4175>>>0x31		byte&0x0F	x	\b%02d
4176>>>>0x4		string		>\0	\b, title: "%s"
4177
4178#----------------------------------------------------------------
4179# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
4180# basis: file(1) magic for BBx/Pro5-files
4181#      Oliver Dammer <dammer@olida.de>	 2005/11/07
4182# http://www.basis.com business-basic-files.
4183#
41840	string		\074\074bbx\076\076	BBx
4185>7	string		\000			indexed file
4186>7	string		\001			serial file
4187>7	string		\002			keyed file
4188>>13	short		0			(sort)
4189>7	string		\004			program
4190>>18	byte		x			(LEVEL %d)
4191>>>23	string		>\000			psaved
4192>7	string		\006			mkeyed file
4193>>13	short		0			(sort)
4194>>8	string		\000			(mkey)
4195
4196#------------------------------------------------------------------------------
4197# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $
4198# ber:  file(1) magic for several BER formats used in the mobile
4199# telecommunications industry (Georg Sauthoff)
4200
4201# The file formats are standardized by the GSMA (GSM association).
4202# They are specified via ASN.1 schemas and some prose. Basic encoding
4203# rules (BER) is the used encoding. The formats are used for exchanging
4204# call data records (CDRs) between mobile operators and associated
4205# parties for roaming clearing purposes and fraud detection.
4206
4207# The magic file covers:
4208
4209# - TAP files (TD.57) - CDR batches and notifications
4210# - RAP files (TD.32) - return batches and acknowledgements
4211# - NRT files (TD.35) - CDR batches for 'near real time' processing
4212
4213#
4214# TAP 3 Files
4215# TAP -> Transferred Account Procedure
4216# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
4217# TransferBatch short tag
42180	byte	0x61
4219# BatchControlInfo short tag
4220>&1	search/b5	\x64
4221# Sender long tag #TAP 3.x (BER encoded)
4222>>&1	search/b8	\x5f\x81\x44
4223# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
4224>>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
4225>>>>&0	byte	x	TAP 3.%d Batch (TD.57, Transferred Account)
4226
4227# Notification short tag
42280	byte	0x62
4229# Sender long tag
4230>2	search/b8	\x5f\x81\x44
4231# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
4232>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
4233>>>&0	byte	x	TAP 3.%d Notification (TD.57, Transferred Account)
4234
4235
4236# NRT Files
4237# NRT a.k.a. NRTRDE
42380	byte	0x61
4239# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
4240>&1	search/b8 \x5f\x29\x01\x02\x5f\x25\x01
4241>>&0	byte	x	NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
4242
4243# RAP Files
4244# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
4245# Long ReturnBatch tag
42460	string	\x7f\x84\x16
4247# Long RapBatchControlInfo tag
4248>&1	search/b8	\x7f\x84\x19
4249# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
4250>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
4251# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block
4252>>>&1	string/b	\x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
4253>>>>&0	byte	x	RAP 1.%d Batch (TD.32, Returned Account Procedure),
4254>>>&0	byte	x	TAP 3.%d
4255
4256# Long Acknowledgement tag
42570	string \x7f\x84\x17
4258# Long Sender tag
4259>&1	search/b5	\x5f\x81\x44	RAP Acknowledgement (TD.32, Returned Account Procedure)
4260
4261#------------------------------------------------------------------------------
4262# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
4263# bFLT: file(1) magic for BFLT uclinux binary files
4264#
4265# From Philippe De Muyter <phdm@macqel.be>
4266#
42670	string		bFLT		BFLT executable
4268>4	belong		x		- version %d
4269>4	belong		4
4270>>36	belong&0x1	0x1		ram
4271>>36	belong&0x2	0x2		gotpic
4272>>36	belong&0x4	0x4		gzip
4273>>36	belong&0x8	0x8		gzdata
4274
4275#------------------------------------------------------------------------------
4276# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $
4277# bioinfomatics:  file(1) magic for Bioinfomatics file formats
4278
4279###############################################################################
4280# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
4281# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
4282###############################################################################
42830	string		\037\213
4284>3	byte		&0x04
4285>>12	string		BC
4286>>>14	leshort		&0x02	Blocked GNU Zip Format (BGZF; gzip compatible)
4287>>>>16	leshort		x	\b, block length %d
4288!:mime	application/x-gzip
4289
4290
4291###############################################################################
4292# Tabix index file
4293# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
4294###############################################################################
42950	string	TBI\1		SAMtools TBI (Tabix index format)
4296>0x04	lelong	=1		\b, with %d reference sequence
4297>0x04	lelong	>1		\b, with %d reference sequences
4298>0x08	lelong	&0x10000	\b, using half-closed-half-open coordinates (BED style)
4299>0x08	lelong	^0x10000
4300>>0x08	lelong	=0		\b, using closed and one based coordinates (GFF style)
4301>>0x08	lelong	=1		\b, using SAM format
4302>>0x08	lelong	=2		\b, using VCF format
4303>0x0c	lelong	x		\b, sequence name column: %d
4304>0x10	lelong	x		\b, region start column: %d
4305>0x08	lelong	=0
4306>>0x14	lelong	x		\b, region end column: %d
4307>0x18	byte	x		\b, comment character: %c
4308>0x1c	lelong	x		\b, skip line count: %d
4309
4310
4311###############################################################################
4312# BAM (Binary Sequence Alignment/Map format)
4313# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
4314# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
4315###############################################################################
43160	string	BAM\1	SAMtools BAM (Binary Sequence Alignment/Map)
4317>0x04	lelong	>0
4318>>&0x00 regex	=^[@]HD\t.*VN:		\b, with SAM header
4319>>>&0	regex	=[0-9.]+		\b version %s
4320>>&(0x04)	lelong	>0	\b, with %d reference sequences
4321
4322
4323###############################################################################
4324# BAI (BAM indexing format)
4325# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
4326###############################################################################
43270		string	BAI\1	SAMtools BAI (BAM indexing format)
4328>0x04		lelong	>0	\b, with %d reference sequences
4329
4330
4331###############################################################################
4332# CRAM (Binary Sequence Alignment/Map format)
4333###############################################################################
43340	string	CRAM	CRAM
4335>0x04	byte	>-1	version %d.
4336>0x05	byte	>-1	\b%d
4337>0x06	string	>\0	(identified as %s)
4338
4339
4340###############################################################################
4341# BCF (Binary Call Format), version 1
4342# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
4343# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
4344###############################################################################
43450		string	   BCF\4
4346# length of seqnm data in bytes is positive
4347>&0x00		lelong	  >0
4348# length of smpl data in bytes is positive
4349>>&(&-0x04)	lelong	  >0			SAMtools BCF (Binary Call Format)
4350# length of meta in bytes
4351>>>&(&-0x04)	lelong	  >0
4352# have meta text string
4353>>>>&0x00	search	  ##samtoolsVersion=
4354>>>>>&0x00	string	  x			\b, generated by SAMtools version %s
4355
4356
4357###############################################################################
4358# BCF (Binary Call Format), version 2.1
4359# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
4360# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
4361###############################################################################
43620		string	   BCF\2\1    Binary Call Format (BCF) version 2.1
4363# length of header text
4364>&0x00		lelong	  >0
4365# have header string
4366>>&0x00 search	  ##samtoolsVersion=
4367>>>&0x00	string	  x			\b, generated by SAMtools version %s
4368
4369
4370###############################################################################
4371# BCF (Binary Call Format), version 2.2
4372# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
4373# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
4374###############################################################################
43750		string	   BCF\2\2    Binary Call Format (BCF) version 2.2
4376# length of header text
4377>&0x00		lelong	  >0
4378# have header string
4379>>&0x00 search	  ##samtoolsVersion=
4380>>>&0x00	string	  x			\b, generated by SAMtools version %s
4381
4382###############################################################################
4383# VCF (Variant Call Format)
4384# used by VCFtools (http://vcftools.sourceforge.net/)
4385###############################################################################
43860      search	   ##fileformat=VCFv	Variant Call Format (VCF)
4387>&0    string	   x			\b version %s
4388
4389###############################################################################
4390# FASTQ
4391# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
4392###############################################################################
4393# XXX Broken?
4394# @<seqname>
4395#0	regex	=^@[A-Za-z0-9_.:-]+\?\n
4396# <seq>
4397#>&1	regex	=^[A-Za-z\n.~]++
4398# +[<seqname>]
4399#>>&1	regex	=^[A-Za-z0-9_.:-]*\?\n
4400# <qual>
4401#>>>&1	regex	=^[!-~\n]+\n		FASTQ
4402
4403###############################################################################
4404# FASTA
4405# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
4406###############################################################################
4407#0	byte	0x3e
4408# q>0	regex	=^[>][!-~\t\ ]+$
4409# Amino Acid codes: [A-IK-Z*-]+
4410#>>1	regex	!=[!-'Jj;:=?@^`|~\\]		FASTA
4411# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
4412# not in IUPAC codes/gaps: [EFIJLOPQZ]
4413#>>>1	regex	!=[EFIJLOPQZefijlopqz]		\b, with IUPAC nucleotide codes
4414#>>>1	regex	=^[EFIJLOPQZefijlopqz]+$	\b, with Amino Acid codes
4415
4416###############################################################################
4417# SAM (Sequence Alignment/Map format)
4418# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
4419###############################################################################
4420# Short-cut version to recognise SAM files with (optional) header at beginning
4421###############################################################################
44220      string	   @HD\t
4423>4     search	   VN:		Sequence Alignment/Map (SAM), with header
4424>>&0   regex	   [0-9.]+	\b version %s
4425###############################################################################
4426# Longer version to recognise SAM alignment lines using (many) regexes
4427###############################################################################
4428# SAM Alignment QNAME
44290		regex	=^[!-?A-~]{1,255}(\t[^\t]+){11}
4430# SAM Alignment FLAG
4431>0		regex	=^([^\t]+\t){1}[0-9]{1,5}\t
4432# SAM Alignment RNAME
4433>>0		regex	=^([^\t]+\t){2}\\*|[^*=]*\t
4434# SAM Alignment POS
4435>>>0		regex	=^([^\t]+\t){3}[0-9]{1,9}\t
4436# SAM Alignment MAPQ
4437>>>>0		regex	=^([^\t]+\t){4}[0-9]{1,3}\t
4438# SAM Alignment CIGAR
4439>>>>>0		regex	=\t(\\*|([0-9]+[MIDNSHPX=])+)\t
4440# SAM Alignment RNEXT
4441>>>>>>0		regex	=\t(\\*|=|[!-()+->?-~][!-~]*)\t
4442# SAM Alignment PNEXT
4443>>>>>>>0	regex	=^([^\t]+\t){7}[0-9]{1,9}\t
4444# SAM Alignment TLEN
4445>>>>>>>>0	regex	=\t[+-]{0,1}[0-9]{1,9}\t.*\t
4446# SAM Alignment SEQ
4447>>>>>>>>>0	regex	=^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
4448# SAM Alignment QUAL
4449>>>>>>>>>>0	regex	=^([^\t]+\t){10}[!-~]+	Sequence Alignment/Map (SAM)
4450>>>>>>>>>>>0	regex	=^[@]HD\t.*VN:		\b, with header
4451>>>>>>>>>>>>&0	regex	=[0-9.]+		\b version %s
4452
4453#------------------------------------------------------------------------------
4454# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
4455# blackberry:  file(1) magic for BlackBerry file formats
4456#
44575	belong	0
4458>8	belong  010010010	BlackBerry RIM ETP file
4459>>22	string	x		\b for %s
4460# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
4461# http://ftg.lbl.gov/checkpoint
44620	string	C\0\0\0R\0\0\0	BLCR
4463>16	lelong	1	x86
4464>16	lelong	3	alpha
4465>16	lelong	5	x86-64
4466>16	lelong	7	ARM
4467>8	lelong	x	context data (little endian, version %d)
4468# Uncomment the following only of your "file" program supports "search"
4469#>0	search/1024	VMA\06	for kernel
4470#>>&1	byte	x	%d.
4471#>>&2	byte	x	%d.
4472#>>&3	byte	x	%d
44730	string	\0\0\0C\0\0\0R	BLCR
4474>16	belong	2	SPARC
4475>16	belong	4	ppc
4476>16	belong	6	ppc64
4477>16	belong	7	ARMEB
4478>16	belong	8	SPARC64
4479>8	belong	x	context data (big endian, version %d)
4480# Uncomment the following only of your "file" program supports "search"
4481#>0	search/1024	VMA\06	for kernel
4482#>>&1	byte	x	%d.
4483#>>&2	byte	x	\b%d.
4484#>>&3	byte	x	\b%d
4485
4486#------------------------------------------------------------------------------
4487# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $
4488# blender: file(1) magic for Blender 3D related files
4489#
4490# Native format rule v1.2. For questions use the developers list
4491# http://lists.blender.org/mailman/listinfo/bf-committers
4492# GLOB chunk was moved near start and provides subversion info since 2.42
4493
44940		string	=BLENDER	Blender3D,
4495>7		string	=_		saved as 32-bits
4496>>8		string	=v		little endian
4497>>>9		byte	x		with version %c.
4498>>>10		byte	x		\b%c
4499>>>11		byte	x		\b%c
4500>>>0x40		string	=GLOB		\b.
4501>>>>0x58	leshort	x		\b%.4d
4502>>8		string	=V		big endian
4503>>>9		byte	x		with version %c.
4504>>>10		byte	x		\b%c
4505>>>11		byte	x		\b%c
4506>>>0x40		string	=GLOB		\b.
4507>>>>0x58	beshort	x		\b%.4d
4508>7		string	=-		saved as 64-bits
4509>>8		string	=v		little endian
4510>>9		byte	x		with version %c.
4511>>10		byte	x		\b%c
4512>>11		byte	x		\b%c
4513>>0x44		string	=GLOB		\b.
4514>>>0x60		leshort	x		\b%.4d
4515>>8		string	=V		big endian
4516>>>9		byte	x		with version %c.
4517>>>10		byte	x		\b%c
4518>>>11		byte	x		\b%c
4519>>>0x44		string	=GLOB		\b.
4520>>>>0x60	beshort	x		\b%.4d
4521
4522# Scripts that run in the embedded Python interpreter
45230		string	#!BPY		Blender3D BPython script
4524
4525#------------------------------------------------------------------------------
4526# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
4527# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
4528#
4529# Note that this 0407 conflicts with several other a.out formats...
4530#
4531# XXX - should this be redone with "be" and "le", so that it works on
4532# little-endian machines as well?  If so, what's the deal with
4533# "VAX-order" and "VAX-order2"?
4534#
4535#0	long		0407		68K Blit (standalone) executable
4536#0	short		0407		VAX-order2 68K Blit (standalone) executable
45370	short		03401		VAX-order 68K Blit (standalone) executable
45380	long		0406		68k Blit mpx/mux executable
45390	short		0406		VAX-order2 68k Blit mpx/mux executable
45400	short		03001		VAX-order 68k Blit mpx/mux executable
4541# Need more values for WE32 DMD executables.
4542# Note that 0520 is the same as COFF
4543#0	short		0520		tty630 layers executable
4544
4545#------------------------------------------------------------------------------
4546# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
4547# i80960 b.out objects and archives
4548#
45490	long		0x10d		i960 b.out relocatable object
4550>16	long		>0		not stripped
4551#
4552# b.out archive (hp-rt on i960)
45530	string		=!<bout>	b.out archive
4554>8	string		__.SYMDEF	random library
4555
4556#------------------------------------------------------------------------------
4557# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
4558# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
4559# Some object/executable formats use the same magic numbers as are used
4560# in other OSes; those are handled by entries in aout.
4561#
4562
45630	lelong		0314		386 compact demand paged pure executable
4564>16	lelong		>0		not stripped
4565>32	byte		0x6a		(uses shared libs)
4566
4567# same as in SunOS 4.x, except for static shared libraries
45680	belong&077777777	0600413		SPARC demand paged
4569>0	byte		&0x80
4570>>20	belong		<4096		shared library
4571>>20	belong		=4096		dynamically linked executable
4572>>20	belong		>4096		dynamically linked executable
4573>0	byte		^0x80		executable
4574>16	belong		>0		not stripped
4575>36	belong		0xb4100001	(uses shared libs)
4576
45770	belong&077777777	0600410		SPARC pure
4578>0	byte		&0x80		dynamically linked executable
4579>0	byte		^0x80		executable
4580>16	belong		>0		not stripped
4581>36	belong		0xb4100001	(uses shared libs)
4582
45830	belong&077777777	0600407		SPARC
4584>0	byte		&0x80		dynamically linked executable
4585>0	byte		^0x80		executable
4586>16	belong		>0		not stripped
4587>36	belong		0xb4100001	(uses shared libs)
4588# Chiasmus is a encryption standard developed by the German Federal
4589# Office for Information Security (Bundesamt fuer Sicherheit in der
4590# Informationstechnik).
4591
4592# Extension: .xia
45930	string	XIA1	Chiasmus encrypted data
4594
4595# Extension: .xis
45960	string	XIS	Chiasmus key
4597
4598#------------------------------------------------------------------------------
4599# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
4600# BTSnoop:  file(1) magic for BTSnoop files
4601#
4602# From <marcel@holtmann.org>
46030	string		btsnoop\0		BTSnoop
4604>8	belong		x			version %d,
4605>12	belong		1001			Unencapsulated HCI
4606>12	belong		1002			HCI UART (H4)
4607>12	belong		1003			HCI BCSP
4608>12	belong		1004			HCI Serial (H5)
4609>>12	belong		x			type %d
4610
4611#------------------------------------------------------------------------------
4612# $File: c64,v 1.6 2015/08/24 05:17:42 christos Exp $
4613# c64:  file(1) magic for various commodore 64 related files
4614#
4615# From: Dirk Jagdmann <doj@cubic.org>
4616
46170x16500	belong		0x12014100	D64 Image
46180x16500	belong		0x12014180	D71 Image
46190x61800 belong		0x28034400	D81 Image
46200	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
46210	belong		0x43154164	X64 Image
4622
46230	string		GCR-1541	GCR Image
4624>8	byte		x		version: %i
4625>9	byte		x		tracks: %i
4626
46279	string		PSUR		ARC archive (c64)
46282	string		-LH1-		LHA archive (c64)
4629
46300	string		C64File		PC64 Emulator file
4631>8	string		>\0		"%s"
46320	string		C64Image	PC64 Freezer Image
4633
46340	beshort		0x38CD		C64 PCLink Image
46350	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
4636
46370	belong		0xFF424CFF	WRAptor packer (c64)
4638
46390	string		C64S\x20tape\x20file	T64 tape Image
4640>32	leshort		x		Version:0x%x
4641>36	leshort		!0		Entries:%i
4642>40	string		x		Name:%.24s
4643
46440	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
4645>32	leshort		x		Version:0x%x
4646>36	leshort		!0		Entries:%i
4647>40	string		x		Name:%.24s
4648
46490	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
4650>32	leshort		x		Version:0x%x
4651>36	leshort		!0		Entries:%i
4652>40	string		x		Name:%.24s
4653
4654# Raw tape file format (.tap files)
4655# Esa Hyyti <esa@netlab.tkk.fi>
46560	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
4657>0x0c	byte		x		Version:%u,
4658>0x10   lelong		x		Length:%u cycles
4659
4660#------------------------------------------------------------------------------
4661# $File: cad,v 1.14 2017/03/17 21:35:28 christos Exp $
4662# autocad:  file(1) magic for cad files
4663#
4664
4665# Microstation DGN/CIT Files (www.bentley.com)
4666# Last updated July 29, 2005 by Lester Hightower
4667# DGN is the default file extension of Microstation/Intergraph CAD files.
4668# CIT is the proprietary raster format (similar to TIFF) used to attach
4669# raster underlays to Microstation DGN (vector) drawings.
4670#
4671# http://www.wotsit.org/search.asp
4672# http://filext.com/detaillist.php?extdetail=DGN
4673# http://filext.com/detaillist.php?extdetail=CIT
4674#
4675# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
4676# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
4677# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
4678# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
46790	string	\010\011\376			Microstation
4680>3	string	\002
4681>>30	string	\026\105			DGNFile
4682>>30	string	\034\105			DGNFile
4683>>30	string	\073\107			DGNFile
4684>>30	string	\073\110			DGNFile
4685>>30	string	\106\107			DGNFile
4686>>30	string	\110\103			DGNFile
4687>>30	string	\120\104			DGNFile
4688>>30	string	\172\104			DGNFile
4689>>30	string	\172\105			DGNFile
4690>>30	string	\172\106			DGNFile
4691>>30	string	\234\106			DGNFile
4692>>30	string	\273\105			DGNFile
4693>>30	string	\306\106			DGNFile
4694>>30	string	\310\104			DGNFile
4695>>30	string	\341\104			DGNFile
4696>>30	string	\372\103			DGNFile
4697>>30	string	\372\104			DGNFile
4698>>30	string	\372\106			DGNFile
4699>>30	string	\376\103			DGNFile
4700>4	string	\030\000\000			CITFile
4701>4	string	\030\000\003			CITFile
4702
4703# AutoCAD
4704# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
4705# and http://www.iana.org/assignments/media-types/image/vnd.dwg
47060	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
4707!:mime image/vnd.dwg
47080	string	AC1.2	DWG AutoDesk AutoCAD Release 1.2
4709!:mime image/vnd.dwg
47100	string	AC1.3	DWG AutoDesk AutoCAD Release 1.3
4711!:mime image/vnd.dwg
47120	string	AC1.40	DWG AutoDesk AutoCAD Release 1.40
4713!:mime image/vnd.dwg
47140	string	AC1.50	DWG AutoDesk AutoCAD Release 2.05
4715!:mime image/vnd.dwg
47160	string	AC2.10	DWG AutoDesk AutoCAD Release 2.10
4717!:mime image/vnd.dwg
47180	string	AC2.21	DWG AutoDesk AutoCAD Release 2.21
4719!:mime image/vnd.dwg
47200	string	AC2.22	DWG AutoDesk AutoCAD Release 2.22
4721!:mime image/vnd.dwg
47220	string	AC1001	DWG AutoDesk AutoCAD Release 2.22
4723!:mime image/vnd.dwg
47240	string	AC1002	DWG AutoDesk AutoCAD Release 2.50
4725!:mime image/vnd.dwg
47260	string	AC1003	DWG AutoDesk AutoCAD Release 2.60
4727!:mime image/vnd.dwg
47280	string	AC1004	DWG AutoDesk AutoCAD Release 9
4729!:mime image/vnd.dwg
47300	string	AC1006	DWG AutoDesk AutoCAD Release 10
4731!:mime image/vnd.dwg
47320	string	AC1009	DWG AutoDesk AutoCAD Release 11/12
4733!:mime image/vnd.dwg
4734# AutoCAD DWG versions R13/R14 (www.autodesk.com)
4735# Written December 01, 2003 by Lester Hightower
4736# Based on the DWG File Format Specifications at http://www.opendwg.org/
4737# AutoCad, from Nahuel Greco
4738# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
47390	string	AC1012	DWG AutoDesk AutoCAD Release 13
4740!:mime image/vnd.dwg
47410	string	AC1014	DWG AutoDesk AutoCAD Release 14
4742!:mime image/vnd.dwg
47430	string	AC1015	DWG AutoDesk AutoCAD 2000/2002
4744!:mime image/vnd.dwg
4745
4746# A new version of AutoCAD DWG
4747# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
4748# ICQ 358572321)
4749# From various sources like:
4750# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
47510	string	AC1018	DWG AutoDesk AutoCAD 2004/2005/2006
4752!:mime image/vnd.dwg
47530	string	AC1021	DWG AutoDesk AutoCAD 2007/2008/2009
4754!:mime image/vnd.dwg
47550	string	AC1024	DWG AutoDesk AutoCAD 2010/2011/2012
4756!:mime image/vnd.dwg
47570	string	AC1027	DWG AutoDesk AutoCAD 2013/2014
4758!:mime image/vnd.dwg
4759
4760# KOMPAS 2D drawing from ASCON
4761# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
4762# gathered nor specification
4763# ASCON http://ascon.net/main/ in English,
4764#	http://ascon.ru/ main site in Russian
4765# Extension is CDW for drawing and FRW for fragment of drawing
4766# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
4767# ICQ 358572321, http://vkontakte.ru/id16076543)
4768# From:
4769# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
4770# (in russian) and my experiments
47710	string	KF
4772>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
4773>2	belong	0x4D00000C	Kompas drawing 12.0
4774>2	belong	0x3200000B	Kompas drawing 11.0 SP1
4775>2	belong	0x3100000B	Kompas drawing 11.0
4776>2	belong	0x2310000A	Kompas drawing 10.0 SP1
4777>2	belong	0x2110000A	Kompas drawing 10.0
4778>2	belong	0x08000009	Kompas drawing 9.0 SP1
4779>2	belong	0x05000009	Kompas drawing 9.0
4780>2	belong	0x33010008	Kompas drawing 8+
4781>2	belong	0x1A000008	Kompas drawing 8.0
4782>2	belong	0x2C010107	Kompas drawing 7+
4783>2	belong	0x05000007	Kompas drawing 7.0
4784>2	belong	0x32000006	Kompas drawing 6+
4785>2	belong	0x09000006	Kompas drawing 6.0
4786>2	belong	0x5C009005	Kompas drawing 5.11R03
4787>2	belong	0x54009005	Kompas drawing 5.11R02
4788>2	belong	0x51009005	Kompas drawing 5.11R01
4789>2	belong	0x22009005	Kompas drawing 5.10R03
4790>2	belong	0x22009005	Kompas drawing 5.10R02 mar
4791>2	belong	0x21009005	Kompas drawing 5.10R02 febr
4792>2	belong	0x19009005	Kompas drawing 5.10R01
4793>2	belong	0xF4008005	Kompas drawing 5.9R01.003
4794>2	belong	0x1C008005	Kompas drawing 5.9R01.002
4795>2	belong	0x11008005	Kompas drawing 5.8R01.003
4796
4797# CAD: file(1) magic for computer aided design files
4798# Phillip Griffith <phillip dot griffith at gmail dot com>
4799# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
4800#
48010	belong	0x08051700	Bentley/Intergraph MicroStation DGN cell library
48020	belong	0x0809fe02	Bentley/Intergraph MicroStation DGN vector CAD
48030	belong	0xc809fe02	Bentley/Intergraph MicroStation DGN vector CAD
48040	beshort	0x0809		Bentley/Intergraph MicroStation
4805>0x02	byte	0xfe
4806>>0x04	beshort	0x1800		CIT raster CAD
4807
4808# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
4809#16	beshort		0x3d3d		image/x-3ds
4810
4811# MegaCAD 2D/3D drawing (.prt)
4812# http://megacad.de/
4813# From: Markus Heidelberg <markus.heidelberg@web.de>
48140	string	MegaCad23\0	MegaCAD 2D/3D drawing
4815
4816#------------------------------------------------------------------------------
4817# $File: cafebabe,v 1.22 2017/03/17 21:35:28 christos Exp $
4818# Cafe Babes unite!
4819#
4820# Since Java bytecode and Mach-O universal binaries have the same magic number,
4821# the test must be performed in the same "magic" sequence to get both right.
4822# The long at offset 4 in a Mach-O universal binary tells the number of
4823# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
4824# version and the short at offset 6 is the JVM major version.  Since there are only
4825# only 18 labeled Mach-O architectures at current, and the first released
4826# Java class format was version 43.0, we can safely choose any number
4827# between 18 and 39 to test the number of architectures against
4828# (and use as a hack). Let's not use 18, because the Mach-O people
4829# might add another one or two as time goes by...
4830#
4831### JAVA START ###
48320	belong		0xcafebabe
4833>4	belong		>30		compiled Java class data,
4834!:mime	application/x-java-applet
4835>>6	beshort		x	        version %d.
4836>>4	beshort		x       	\b%d
4837# Which is which?
4838#>>4	belong		0x032d		(Java 1.0)
4839#>>4	belong		0x032d		(Java 1.1)
4840>>4	belong		0x002e		(Java 1.2)
4841>>4	belong		0x002f		(Java 1.3)
4842>>4	belong		0x0030		(Java 1.4)
4843>>4	belong		0x0031		(Java 1.5)
4844>>4	belong		0x0032		(Java 1.6)
4845>>4	belong		0x0033		(Java 1.7)
4846>>4	belong		0x0034		(Java 1.8)
4847
48480	belong		0xcafed00d	JAR compressed with pack200,
4849>5	byte		x		version %d.
4850>4	byte		x		\b%d
4851!:mime	application/x-java-pack200
4852
4853
48540	belong		0xcafed00d	JAR compressed with pack200,
4855>5	byte		x		version %d.
4856>4	byte		x		\b%d
4857!:mime	application/x-java-pack200
4858
4859### JAVA END ###
4860### MACH-O START ###
4861
48620	name		mach-o		\b [
4863>0	use		mach-o-cpu	\b
4864>(8.L)	indirect			\b:
4865>0	belong		x		\b]
4866
48670	belong		0xcafebabe
4868>4	belong		1		Mach-O universal binary with 1 architecture:
4869!:mime application/x-mach-binary
4870>>8	use		mach-o		\b
4871>4	belong		>1
4872>>4	belong		<20		Mach-O universal binary with %d architectures:
4873!:mime application/x-mach-binary
4874>>>8	use		mach-o		\b
4875>>4	belong		2
4876>>>28	use		mach-o		\b
4877>>4	belong		3
4878>>>48	use		mach-o		\b
4879>>4	belong		4
4880>>>68	use		mach-o		\b
4881>>4	belong		5
4882>>>88	use		mach-o		\b
4883>>4	belong		6
4884>>>108	use		mach-o		\b
4885
4886### MACH-O END ###
4887
4888#------------------------------------------------------------------------------
4889# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
4890# cbor:  file(1) magic for CBOR files as defined in RFC 7049
4891
48920	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
4893!:mime	application/cbor
4894>3	ubyte	<0x20	(positive integer)
4895>3	ubyte	<0x40
4896>>3	ubyte	>0x1f	(negative integer)
4897>3	ubyte	<0x60
4898>>3	ubyte	>0x3f	(byte string)
4899>3	ubyte	<0x80
4900>>3	ubyte	>0x5f	(text string)
4901>3	ubyte	<0xa0
4902>3	ubyte	>0x7f	(array)
4903>3	ubyte	<0xc0
4904>>3	ubyte	>0x9f	(map)
4905>3	ubyte	<0xe0
4906>>3	ubyte	>0xbf	(tagged)
4907>3	ubyte	>0xdf	(other)
4908
4909#------------------------------------------------------------------------------
4910# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
4911# CDDB: file(1) magic for CDDB(tm) format CD text data files
4912#
4913# From <steve@gracenote.com>
4914#
4915# This is the /etc/magic entry to decode datafiles as used by
4916# CDDB-enabled CD player applications.
4917#
4918
49190	search/1/w	#\040xmcd	CDDB(tm) format CD text data
4920
4921#------------------------------------------------------------------------------
4922# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
4923# chord: file(1) magic for Chord music sheet typesetting utility input files
4924#
4925# From Philippe De Muyter <phdm@macqel.be>
4926# File format is actually free, but many distributed files begin with `{title'
4927#
49280	string		{title		Chord text file
4929
4930# Type:	PowerTab file format
4931# URL:	http://www.power-tab.net/
4932# From:	Jelmer Vernooij <jelmer@samba.org>
49330	string		ptab\003\000	Power-Tab v3 Tablature File
49340	string		ptab\004\000	Power-Tab v4 Tablature File
4935
4936#------------------------------------------------------------------------------
4937# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
4938# cisco:  file(1) magic for cisco Systems routers
4939#
4940# Most cisco file-formats are covered by the generic elf code
4941#
4942# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
49430	belong&0xffffff00	0x85011400  cisco IOS microcode
4944>7	string		>\0		    for '%s'
49450	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
4946>7	string		>\0		    for '%s'
4947
4948#------------------------------------------------------------------------------
4949# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
4950# citrus locale declaration
4951#
4952
49530	string		RuneCT		Citrus locale declaration for LC_CTYPE
4954
4955#------------------------------------------------------------------------------
4956# $File: c-lang,v 1.25 2017/03/17 21:35:28 christos Exp $
4957# c-lang:  file(1) magic for C and related languages programs
4958#
4959# The strength is to beat standard HTML
4960
4961# BCPL
49620	search/8192	"libhdr"	BCPL source text
4963!:mime	text/x-bcpl
49640	search/8192	"LIBHDR"	BCPL source text
4965!:mime	text/x-bcpl
4966
4967# C
49680	regex	\^#include	C source text
4969!:strength +25
4970!:mime	text/x-c
49710	regex	\^char[\ \t\n]+	C source text
4972!:mime	text/x-c
49730	regex	\^double[\ \t\n]+		C source text
4974!:mime	text/x-c
49750	regex	\^extern[\ \t\n]+		C source text
4976!:mime	text/x-c
49770	regex	\^float[\ \t\n]+		C source text
4978!:mime	text/x-c
49790	regex	\^struct[\ \t\n]+		C source text
4980!:mime	text/x-c
49810	regex	\^union[\ \t\n]+		C source text
4982!:mime	text/x-c
49830	search/8192	main(		C source text
4984!:mime	text/x-c
4985
4986# C++
4987# The strength of these rules is increased so they beat the C rules above
49880	regex	\^template[\ \t]+<.*>[\ \t\n]+	C++ source text
4989!:strength + 30
4990!:mime	text/x-c++
49910	regex	\^virtual[\ \t\n]+		C++ source text
4992!:strength + 30
4993!:mime	text/x-c++
49940	regex	\^class[\ \t\n]+		C++ source text
4995# But class is reduced to avoid beating php (Jens Schleusener)
4996!:strength + 13
4997!:mime	text/x-c++
49980	regex	\^public:		C++ source text
4999!:strength + 30
5000!:mime	text/x-c++
50010	regex	\^private:		C++ source text
5002!:strength + 30
5003!:mime	text/x-c++
5004
5005# Objective-C
50060	regex	\^#import	Objective-C source text
5007!:strength +25
5008!:mime	text/x-objective-c
5009
5010# From: Mikhail Teterin <mi@aldan.algebra.com>
50110	string		cscope		cscope reference data
5012>7	string		x		version %.2s
5013# We skip the path here, because it is often long (so file will
5014# truncate it) and mostly redundant.
5015# The inverted index functionality was added some time between
5016# versions 11 and 15, so look for -q if version is above 14:
5017>7	string		>14
5018>>10	search/100	\ -q\ 		with inverted index
5019>10	search/100	\ -c\ 		text (non-compressed)
5020
5021#------------------------------------------------------------------------------
5022# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
5023# clarion:  file(1) magic for # Clarion Personal/Professional Developer
5024# (v2 and above)
5025# From: Julien Blache <jb@jblache.org>
5026
5027# Database files
5028# signature
50290	leshort	0x3343	Clarion Developer (v2 and above) data file
5030# attributes
5031>2	leshort	&0x0001	\b, locked
5032>2	leshort	&0x0004	\b, encrypted
5033>2	leshort	&0x0008	\b, memo file exists
5034>2	leshort	&0x0010	\b, compressed
5035>2	leshort	&0x0040	\b, read only
5036# number of records
5037>5	lelong	x	\b, %d records
5038
5039# Memo files
50400	leshort	0x334d	Clarion Developer (v2 and above) memo data
5041
5042# Key/Index files
5043# No magic? :(
5044
5045# Help files
50460	leshort	0x49e0	Clarion Developer (v2 and above) help data
5047
5048#------------------------------------------------------------------------------
5049# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
5050# claris:  file(1) magic for claris
5051# "H. Nanosecond" <aldomel@ix.netcom.com>
5052# Claris Works a word processor, etc.
5053# Version 3.0
5054
5055# .pct claris works clip art files
5056#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
5057#*
5058#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
5059#null to byte 1000 octal
5060514	string	\377\377\377\377\000
5061>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
5062514	string	\377\377\377\377\001
5063>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
5064
5065# Claris works files
5066# .cwk
5067# Moved to Apple AppleWorks document
5068#0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
5069# .plt
50700	string	\020\341\000\000\010\010	Claris Works palette files .plt
5071
5072# .msp a dictionary file I am not sure about this I have only one .msp file
50730	string	\002\271\262\000\040\002\000\164	Claris works dictionary
5074
5075# .usp are user dictionary bits
5076# I am not sure about a magic header:
5077#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
5078#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
5079#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
5080#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
5081
5082# .mth Thesaurus
5083# starts with \0 but no magic header
5084
5085# .chy Hyphenation file
5086# I am not sure: 000 210 034 000 000
5087
5088# other claris files
5089#./windows/claris/useng.ndx: data
5090#./windows/claris/xtndtran.l32: data
5091#./windows/claris/xtndtran.lst: data
5092#./windows/claris/clworks.lbl: data
5093#./windows/claris/clworks.prf: data
5094#./windows/claris/userd.spl: data
5095
5096#------------------------------------------------------------------------------
5097# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
5098# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
5099#
5100# XXX - what byte order does the Clipper use?
5101#
5102# XXX - what's the "!" stuff:
5103#
5104# >18	short		!074000,000000	C1 R1
5105# >18	short		!074000,004000	C2 R1
5106# >18	short		!074000,010000	C3 R1
5107# >18	short		!074000,074000	TEST
5108#
5109# I shall assume it's ANDing the field with the first value and
5110# comparing it with the second, and rewrite it as:
5111#
5112# >18	short&074000	000000		C1 R1
5113# >18	short&074000	004000		C2 R1
5114# >18	short&074000	010000		C3 R1
5115# >18	short&074000	074000		TEST
5116#
5117# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
5118# sort, nor does SunOS 4.x, so either it's something Intergraph added
5119# in CLIX, or something AT&T added in SVR3.2 or later, or something
5120# somebody else thought was a good idea; it's not documented in the
5121# man page for this version of "magic", nor does it appear to be
5122# implemented (at least not after I blew off the bogus code to turn
5123# old-style "&"s into new-style "&"s, which just didn't work at all).
5124#
51250	short		0575		CLIPPER COFF executable (VAX #)
5126>20	short		0407		(impure)
5127>20	short		0410		(5.2 compatible)
5128>20	short		0411		(pure)
5129>20	short		0413		(demand paged)
5130>20	short		0443		(target shared library)
5131>12	long		>0		not stripped
5132>22	short		>0		- version %d
51330	short		0577		CLIPPER COFF executable
5134>18	short&074000	000000		C1 R1
5135>18	short&074000	004000		C2 R1
5136>18	short&074000	010000		C3 R1
5137>18	short&074000	074000		TEST
5138>20	short		0407		(impure)
5139>20	short		0410		(pure)
5140>20	short		0411		(separate I&D)
5141>20	short		0413		(paged)
5142>20	short		0443		(target shared library)
5143>12	long		>0		not stripped
5144>22	short		>0		- version %d
5145>48	long&01		01		alignment trap enabled
5146>52	byte		1		-Ctnc
5147>52	byte		2		-Ctsw
5148>52	byte		3		-Ctpw
5149>52	byte		4		-Ctcb
5150>53	byte		1		-Cdnc
5151>53	byte		2		-Cdsw
5152>53	byte		3		-Cdpw
5153>53	byte		4		-Cdcb
5154>54	byte		1		-Csnc
5155>54	byte		2		-Cssw
5156>54	byte		3		-Cspw
5157>54	byte		4		-Cscb
51584	string		pipe		CLIPPER instruction trace
51594	string		prof		CLIPPER instruction profile
5160
5161#------------------------------------------------------------------------------
5162# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $
5163# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
5164#
5165# COFF
5166#
5167# by Joerg Jenderek at Oct 2015
5168# https://en.wikipedia.org/wiki/COFF
5169# https://de.wikipedia.org/wiki/Common_Object_File_Format
5170# http://www.delorie.com/djgpp/doc/coff/filhdr.html
5171
5172# display name+variables+flags of Common Object Files Format (32bit)
5173# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
5174# mips,motorola,msdos,osf1,sharc,varied.out,vax
51750	name				display-coff
5176# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
5177>18	uleshort&0x8E80	0
5178>>0	clear		x
5179# f_magic - magic number
5180# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
5181>>0	uleshort	0x014C		Intel 80386
5182# Hitachi SH big-endian COFF (./hitachi-sh)
5183>>0	uleshort	0x0500		Hitachi SH big-endian
5184# Hitachi SH little-endian COFF (./hitachi-sh)
5185>>0	uleshort	0x0550		Hitachi SH little-endian
5186# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
5187#>>0	uleshort	0x01DF
5188# TODO for other COFFs
5189#>>0	uleshort	0xABCD		COFF_TEMPLATE
5190>>0	default		x
5191>>>0	uleshort	x		type 0x%04x
5192>>0	uleshort	x		COFF
5193# F_EXEC flag bit
5194>>18	leshort		^0x0002		object file
5195#!:mime	application/x-coff
5196#!:ext cof/o/obj/lib
5197>>18	leshort		&0x0002		executable
5198#!:mime	application/x-coffexec
5199# F_RELFLG flag bit,static object
5200>>18	leshort		&0x0001		\b, no relocation info
5201# F_LNNO flag bit
5202>>18	leshort		&0x0004		\b, no line number info
5203# F_LSYMS flag bit
5204>>18	leshort		&0x0008		\b, stripped
5205>>18	leshort		^0x0008		\b, not stripped
5206# flags in other COFF versions
5207#0x0010    F_FDPR_PROF
5208#0x0020    F_FDPR_OPTI
5209#0x0040    F_DSA
5210# F_AR32WR flag bit
5211#>>>18	leshort		&0x0100		\b, 32 bit little endian
5212#0x1000    F_DYNLOAD
5213#0x2000    F_SHROBJ
5214#0x4000    F_LOADONLY
5215# f_nscns - number of sections
5216>>2	uleshort	<2		\b, %d section
5217>>2	uleshort	>1		\b, %d sections
5218# f_timdat - file time & date stamp only for little endian
5219#>>4	date		x		\b, %s
5220# f_symptr - symbol table pointer, only for not stripped
5221>>8	ulelong		>0		\b, symbol offset=0x%x
5222# f_nsyms - number of symbols, only for not stripped
5223>>12	ulelong		>0		\b, %d symbols
5224# f_opthdr - optional header size
5225>>16	uleshort	>0		\b, optional header size %d
5226# at offset 20 can be optional header, extra bytes FILHSZ-20 because
5227# do not rely on sizeof(FILHDR) to give the correct size for header.
5228# or first section header
5229# additional variables for other COFF files
5230# >20	beshort		0407		(impure)
5231# >20	beshort		0410		(pure)
5232# >20	beshort		0413		(demand paged)
5233# >20	beshort		0421		(standalone)
5234# >22	leshort		>0		- version %d
5235# >168	string		.lowmem		Apple toolbox
5236
5237
5238#------------------------------------------------------------------------------
5239# $File: commands,v 1.57 2017/04/04 20:34:24 christos Exp $
5240# commands:  file(1) magic for various shells and interpreters
5241#
5242#0	string/w	:			shell archive or script for antique kernel text
52430	string/wt	#!\ /bin/sh		POSIX shell script text executable
5244!:mime	text/x-shellscript
52450	string/wb	#!\ /bin/sh		POSIX shell script executable (binary data)
5246!:mime	text/x-shellscript
5247
52480	string/wt	#!\ /bin/csh		C shell script text executable
5249!:mime	text/x-shellscript
5250
5251# korn shell magic, sent by George Wu, gwu@clyde.att.com
52520	string/wt	#!\ /bin/ksh		Korn shell script text executable
5253!:mime	text/x-shellscript
52540	string/wb	#!\ /bin/ksh		Korn shell script executable (binary data)
5255!:mime	text/x-shellscript
5256
52570	string/wt 	#!\ /bin/tcsh		Tenex C shell script text executable
5258!:mime	text/x-shellscript
52590	string/wt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
5260!:mime	text/x-shellscript
52610	string/wt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
5262!:mime	text/x-shellscript
52630	string/wt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
5264!:mime	text/x-shellscript
5265
5266#
5267# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
52680	string/wt	#!\ /bin/zsh		Paul Falstad's zsh script text executable
5269!:mime	text/x-shellscript
52700	string/wt	#!\ /usr/bin/zsh	Paul Falstad's zsh script text executable
5271!:mime	text/x-shellscript
52720	string/wt	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
5273!:mime	text/x-shellscript
52740	string/wt	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
5275!:mime	text/x-shellscript
52760	string/wt	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
5277!:mime	text/x-shellscript
52780	string/wt	#!\ /bin/nawk		new awk script text executable
5279!:mime	text/x-nawk
52800	string/wt	#!\ /usr/bin/nawk	new awk script text executable
5281!:mime	text/x-nawk
52820	string/wt	#!\ /usr/local/bin/nawk	new awk script text executable
5283!:mime	text/x-nawk
52840	string/wt	#!\ /bin/gawk		GNU awk script text executable
5285!:mime	text/x-gawk
52860	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
5287!:mime	text/x-gawk
52880	string/wt	#!\ /usr/local/bin/gawk	GNU awk script text executable
5289!:mime	text/x-gawk
5290#
52910	string/wt	#!\ /bin/awk		awk script text executable
5292!:mime	text/x-awk
52930	string/wt	#!\ /usr/bin/awk	awk script text executable
5294!:mime	text/x-awk
52950	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text
5296
5297# AT&T Bell Labs' Plan 9 shell
52980	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
5299
5300# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
53010	string/wt	#!\ /bin/bash	Bourne-Again shell script text executable
5302!:mime	text/x-shellscript
53030	string/wb	#!\ /bin/bash	Bourne-Again shell script executable (binary data)
5304!:mime	text/x-shellscript
53050	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
5306!:mime	text/x-shellscript
53070	string/wb	#!\ /usr/bin/bash	Bourne-Again shell script executable (binary data)
5308!:mime	text/x-shellscript
53090	string/wt	#!\ /usr/local/bash	Bourne-Again shell script text executable
5310!:mime	text/x-shellscript
53110	string/wb	#!\ /usr/local/bash	Bourne-Again shell script executable (binary data)
5312!:mime	text/x-shellscript
53130	string/wt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
5314!:mime	text/x-shellscript
53150	string/wb	#!\ /usr/local/bin/bash	Bourne-Again shell script executable (binary data)
5316!:mime	text/x-shellscript
53170	string/wt	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
5318!:mime	text/x-shellscript
5319
5320# PHP scripts
5321# Ulf Harnhammar <ulfh@update.uu.se>
53220	search/1/c	=<?php			PHP script text
5323!:strength + 10
5324!:mime	text/x-php
53250	search/1	=<?\n			PHP script text
5326!:mime	text/x-php
53270	search/1	=<?\r			PHP script text
5328!:mime	text/x-php
53290	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
5330!:strength + 10
5331!:mime	text/x-php
53320	search/1/w	#!\ /usr/bin/php	PHP script text executable
5333!:strength + 10
5334!:mime	text/x-php
5335# Smarty compiled template, http://www.smarty.net/
5336# Elan Ruusamae <glen@delfi.ee>
53370	string	=<?php
5338>5	regex	[\ \n]
5339>>6	string	/*\ Smarty\ version		Smarty compiled template
5340>>>24	regex	[0-9.]+				\b, version %s
5341!:mime	text/x-php
5342
53430	string		Zend\x00		PHP script Zend Optimizer data
5344
53450	string/t	$!			DCL command file
5346
5347# Type: Pdmenu
5348# URL:  http://packages.debian.org/pdmenu
5349# From: Edward Betts <edward@debian.org>
53500	string		#!/usr/bin/pdmenu	Pdmenu configuration file text
5351
5352# From Danny Weldon
53530	string	\x0b\x13\x08\x00
5354>0x04   uleshort	<4      ksh byte-code version %d
5355
5356#----------------------------------------------------------------------------
5357# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
5358# communication
5359
5360# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
5361# It is used for conformance testing of communication protocols.
5362# Added by W. Borgert <debacle@debian.org>.
53630	string		$Suite			TTCN Abstract Test Suite
5364>&1	string		$SuiteId
5365>>&1	string		>\n			%s
5366>&2	string		$SuiteId
5367>>&1	string		>\n			%s
5368>&3	string		$SuiteId
5369>>&1	string		>\n			%s
5370
5371# MSC (message sequence charts) are a formal description technique,
5372# described in ITU-T Z.120, mainly used for communication protocols.
5373# Added by W. Borgert <debacle@debian.org>.
53740	string		mscdocument	Message Sequence Chart (document)
53750	string		msc		Message Sequence Chart (chart)
53760	string		submsc		Message Sequence Chart (subchart)
5377#------------------------------------------------------------------------------
5378# $File: compress,v 1.67 2017/03/17 21:35:28 christos Exp $
5379# compress:  file(1) magic for pure-compression formats (no archives)
5380#
5381# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
5382#
5383# Formats for various forms of compressed data
5384# Formats for "compress" proper have been moved into "compress.c",
5385# because it tries to uncompress it to figure out what's inside.
5386
5387# standard unix compress
53880	string		\037\235	compress'd data
5389!:mime	application/x-compress
5390!:apple	LZIVZIVU
5391>2	byte&0x80	>0		block compressed
5392>2	byte&0x1f	x		%d bits
5393
5394# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
5395#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
5396#	* Original filename is only at offset 10 if "extra field" absent
5397#	* Produce shorter output - notably, only report compression methods
5398#         other than 8 ("deflate", the only method defined in RFC 1952).
53990       string          \037\213        gzip compressed data
5400!:mime	application/x-gzip
5401!:strength * 2
5402>2	byte		<8		\b, reserved method
5403>2	byte		>8		\b, unknown method
5404>3	byte		&0x01		\b, ASCII
5405>3	byte		&0x02		\b, has CRC
5406>3	byte		&0x04		\b, extra field
5407>3	byte&0xC	=0x08
5408>>10	string		x		\b, was "%s"
5409>3	byte		&0x10		\b, has comment
5410>3	byte		&0x20		\b, encrypted
5411>4	ledate		>0		\b, last modified: %s
5412>8	byte		2		\b, max compression
5413>8	byte		4		\b, max speed
5414>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
5415>9	byte		=0x01		\b, from Amiga
5416>9	byte		=0x02		\b, from VMS
5417>9	byte		=0x03		\b, from Unix
5418>9	byte		=0x04		\b, from VM/CMS
5419>9	byte		=0x05		\b, from Atari
5420>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
5421>9	byte		=0x07		\b, from MacOS
5422>9	byte		=0x08		\b, from Z-System
5423>9	byte		=0x09		\b, from CP/M
5424>9	byte		=0x0A		\b, from TOPS/20
5425>9	byte		=0x0B		\b, from NTFS filesystem (NT)
5426>9	byte		=0x0C		\b, from QDOS
5427>9	byte		=0x0D		\b, from Acorn RISCOS
5428
5429# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
54300	string		\037\036	packed data
5431!:mime	application/octet-stream
5432>2	belong		>1		\b, %d characters originally
5433>2	belong		=1		\b, %d character originally
5434#
5435# This magic number is byte-order-independent.
54360	short		0x1f1f		old packed data
5437!:mime	application/octet-stream
5438
5439# XXX - why *two* entries for "compacted data", one of which is
5440# byte-order independent, and one of which is byte-order dependent?
5441#
54420	short		0x1fff		compacted data
5443!:mime	application/octet-stream
5444# This string is valid for SunOS (BE) and a matching "short" is listed
5445# in the Ultrix (LE) magic file.
54460	string		\377\037	compacted data
5447!:mime	application/octet-stream
54480	short		0145405		huf output
5449!:mime	application/octet-stream
5450
5451# bzip2
54520	string		BZh		bzip2 compressed data
5453!:mime	application/x-bzip2
5454>3	byte		>47		\b, block size = %c00k
5455
5456# lzip
54570	string		LZIP		lzip compressed data
5458!:mime application/x-lzip
5459>4	byte		x		\b, version: %d
5460
5461# squeeze and crunch
5462# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
54630	beshort		0x76FF		squeezed data,
5464>4	string		x		original name %s
54650	beshort		0x76FE		crunched data,
5466>2	string		x		original name %s
54670	beshort		0x76FD		LZH compressed data,
5468>2	string		x		original name %s
5469
5470# Freeze
54710	string		\037\237	frozen file 2.1
54720	string		\037\236	frozen file 1.0 (or gzip 0.5)
5473
5474# SCO compress -H (LZH)
54750	string		\037\240	SCO compress -H (LZH) data
5476
5477# European GSM 06.10 is a provisional standard for full-rate speech
5478# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
5479# excitation/long term prediction) coding at 13 kbit/s.
5480#
5481# There's only a magic nibble (4 bits); that nibble repeats every 33
5482# bytes.  This isn't suited for use, but maybe we can use it someday.
5483#
5484# This will cause very short GSM files to be declared as data and
5485# mismatches to be declared as data too!
5486#0	byte&0xF0	0xd0		data
5487#>33	byte&0xF0	0xd0
5488#>66	byte&0xF0	0xd0
5489#>99	byte&0xF0	0xd0
5490#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
5491
5492# bzip	a block-sorting file compressor
5493#	by Julian Seward <sewardj@cs.man.ac.uk> and others
5494#
5495#0	string		BZ		bzip compressed data
5496#>2	byte		x		\b, version: %c
5497#>3	string		=1		\b, compression block size 100k
5498#>3	string		=2		\b, compression block size 200k
5499#>3	string		=3		\b, compression block size 300k
5500#>3	string		=4		\b, compression block size 400k
5501#>3	string		=5		\b, compression block size 500k
5502#>3	string		=6		\b, compression block size 600k
5503#>3	string		=7		\b, compression block size 700k
5504#>3	string		=8		\b, compression block size 800k
5505#>3	string		=9		\b, compression block size 900k
5506
5507# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
55080	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
5509>9	beshort		<0x0940
5510>>9	byte&0xf0	=0x00		- version 0.
5511>>9	beshort&0x0fff	x		\b%03x,
5512>>13	byte		1		LZO1X-1,
5513>>13	byte		2		LZO1X-1(15),
5514>>13	byte		3		LZO1X-999,
5515## >>22	bedate		>0		last modified: %s,
5516>>14	byte		=0x00		os: MS-DOS
5517>>14	byte		=0x01		os: Amiga
5518>>14	byte		=0x02		os: VMS
5519>>14	byte		=0x03		os: Unix
5520>>14	byte		=0x05		os: Atari
5521>>14	byte		=0x06		os: OS/2
5522>>14	byte		=0x07		os: MacOS
5523>>14	byte		=0x0A		os: Tops/20
5524>>14	byte		=0x0B		os: WinNT
5525>>14	byte		=0x0E		os: Win32
5526>9	beshort		>0x0939
5527>>9	byte&0xf0	=0x00		- version 0.
5528>>9	byte&0xf0	=0x10		- version 1.
5529>>9	byte&0xf0	=0x20		- version 2.
5530>>9	beshort&0x0fff	x		\b%03x,
5531>>15	byte		1		LZO1X-1,
5532>>15	byte		2		LZO1X-1(15),
5533>>15	byte		3		LZO1X-999,
5534## >>25	bedate		>0		last modified: %s,
5535>>17	byte		=0x00		os: MS-DOS
5536>>17	byte		=0x01		os: Amiga
5537>>17	byte		=0x02		os: VMS
5538>>17	byte		=0x03		os: Unix
5539>>17	byte		=0x05		os: Atari
5540>>17	byte		=0x06		os: OS/2
5541>>17	byte		=0x07		os: MacOS
5542>>17	byte		=0x0A		os: Tops/20
5543>>17	byte		=0x0B		os: WinNT
5544>>17	byte		=0x0E		os: Win32
5545
5546# 4.3BSD-Quasijarus Strong Compression
5547# http://minnie.tuhs.org/Quasijarus/compress.html
55480	string		\037\241	Quasijarus strong compressed data
5549
5550# From: Cory Dikkers <cdikkers@swbell.net>
55510	string		XPKF		Amiga xpkf.library compressed data
55520	string		PP11		Power Packer 1.1 compressed data
55530	string		PP20		Power Packer 2.0 compressed data,
5554>4	belong		0x09090909	fast compression
5555>4	belong		0x090A0A0A	mediocre compression
5556>4	belong		0x090A0B0B	good compression
5557>4	belong		0x090A0C0C	very good compression
5558>4	belong		0x090A0C0D	best compression
5559
5560# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
5561# http://www.7-zip.org or DOC/7zFormat.txt
5562#
55630	string		7z\274\257\047\034	7-zip archive data,
5564>6	byte		x			version %d
5565>7	byte		x			\b.%d
5566!:mime	application/x-7z-compressed
5567!:ext 7z/cb7
5568
5569# Type: LZMA
55700	lelong&0xffffff	=0x5d
5571>12	leshort		0xff			LZMA compressed data,
5572!:mime	application/x-lzma
5573>>5	lequad		=0xffffffffffffffff	streamed
5574>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
5575>12	leshort		0			LZMA compressed data,
5576>>5	lequad		=0xffffffffffffffff	streamed
5577>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
5578
5579# http://tukaani.org/xz/xz-file-format.txt
55800	ustring		\xFD7zXZ\x00		XZ compressed data
5581!:strength * 2
5582!:mime	application/x-xz
5583
5584# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
55850	string		LRZI			LRZIP compressed data
5586>4	byte		x			- version %d
5587>5	byte		x			\b.%d
5588!:mime	application/x-lrzip
5589
5590# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
55910	lelong		0x184d2204	LZ4 compressed data (v1.4+)
5592!:mime	application/x-lz4
5593# Added by osm0sis@xda-developers.com
55940 	lelong		0x184c2103	LZ4 compressed data (v1.0-v1.3)
5595!:mime	application/x-lz4
55960	lelong		0x184c2102	LZ4 compressed data (v0.1-v0.9)
5597!:mime	application/x-lz4
5598
5599# Zstandard/LZ4 skippable frames
5600# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
56010         lelong&0xFFFFFFF0  0x184D2A50
5602>(4.l+8)  indirect
5603
5604# Zstandard Dictionary ID subroutine
56050     name        zstd-dictionary-id
5606# Single Segment = True
5607>0    byte        &0x20   \b, Dictionary ID:
5608>>0   byte&0x03   0       None
5609>>0   byte&0x03   1
5610>>>1  byte        x       %u
5611>>0   byte&0x03   2
5612>>>1  leshort     x       %u
5613>>0   byte&0x03   3
5614>>>1  lelong      x       %u
5615# Single Segment = False
5616>0    byte        ^0x20   \b, Dictionary ID:
5617>>0   byte&0x03   0       None
5618>>0   byte&0x03   1
5619>>>2  byte        x       %u
5620>>0   byte&0x03   2
5621>>>2  leshort     x       %u
5622>>0   byte&0x03   3
5623>>>2  lelong      x       %u
5624
5625# Zstandard compressed data
5626# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
56270     lelong       0xFD2FB522  Zstandard compressed data (v0.2)
5628!:mime  application/x-zstd
56290     lelong       0xFD2FB523  Zstandard compressed data (v0.3)
5630!:mime  application/x-zstd
56310     lelong       0xFD2FB524  Zstandard compressed data (v0.4)
5632!:mime  application/x-zstd
56330     lelong       0xFD2FB525  Zstandard compressed data (v0.5)
5634!:mime  application/x-zstd
56350     lelong       0xFD2FB526  Zstandard compressed data (v0.6)
5636!:mime  application/x-zstd
56370     lelong       0xFD2FB527  Zstandard compressed data (v0.7)
5638!:mime  application/x-zstd
5639>4    use          zstd-dictionary-id
56400     lelong       0xFD2FB528  Zstandard compressed data (v0.8+)
5641!:mime  application/x-zstd
5642>4    use          zstd-dictionary-id
5643
5644# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
56450  lelong    0xEC30A437  Zstandard dictionary
5646!:mime  application/x-zstd-dictionary
5647>4 lelong    x           (ID %u)
5648
5649# AFX compressed files (Wolfram Kleff)
56502	string		-afx-		AFX compressed file data
5651
5652# Supplementary magic data for the file(1) command to support
5653# rzip(1).  The format is described in magic(5).
5654#
5655# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
5656# this file.
5657#
56580	string		RZIP		rzip compressed data
5659>4	byte		x		- version %d
5660>5	byte		x		\b.%d
5661>6	belong		x		(%d bytes)
5662
56630	string		ArC\x01		FreeArc archive <http://freearc.org>
5664
5665# Type:	DACT compressed files
56660	long	0x444354C3	DACT compressed data
5667>4	byte	>-1		(version %i.
5668>5	byte	>-1		%i.
5669>6	byte	>-1		%i)
5670>7	long	>0		, original size: %i bytes
5671>15	long	>30		, block size: %i bytes
5672
5673# Valve Pack (VPK) files
56740	lelong	0x55aa1234	Valve Pak file
5675>0x4	lelong	x		\b, version %u
5676>0x8	lelong	x		\b, %u entries
5677
5678# Snappy framing format
5679# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
56800	string	\377\006\0\0sNaPpY	snappy framed data
5681!:mime	application/x-snappy-framed
5682
5683# qpress, http://www.quicklz.com/
56840	string	qpress10	qpress compressed data
5685!:mime	application/x-qpress
5686
5687# Zlib https://www.ietf.org/rfc/rfc6713.txt
56880	string/b	x
5689>0	beshort%31	=0
5690>>0	byte&0xf	=8
5691>>>0	byte&0x80 	=0	zlib compressed data
5692!:mime	application/zlib
5693
5694#------------------------------------------------------------------------------
5695# $File: console,v 1.30 2017/03/17 21:35:28 christos Exp $
5696# Console game magic
5697# Toby Deshane <hac@shoelace.digivill.net>
5698
5699# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format
5700# Updated by David Korth <gerbilsoft@gerbilsoft.com>
5701# References:
5702# - http://wiki.nesdev.com/w/index.php/INES
5703# - http://wiki.nesdev.com/w/index.php/NES_2.0
5704
5705# Common header for iNES, NES 2.0, and Wii U iNES.
57060	name		nes-rom-image-ines
5707>7	byte&0x0C	=0x8		(NES 2.0)
5708>4	byte		x		\b: %ux16k PRG
5709>5	byte		x		\b, %ux8k CHR
5710>6	byte&0x08	=0x8		[4-Scr]
5711>6	byte&0x09	=0x0		[H-mirror]
5712>6	byte&0x09	=0x1		[V-mirror]
5713>6	byte&0x02	=0x2		[SRAM]
5714>6	byte&0x04	=0x4		[Trainer]
5715>7	byte&0x03	=0x2		[PC10]
5716>7	byte&0x03	=0x1		[VS]
5717>>7	byte&0x0C	=0x8
5718# NES 2.0: VS PPU
5719>>>13	byte&0x0F	=0x0		\b, RP2C03B
5720>>>13	byte&0x0F	=0x1		\b, RP2C03G
5721>>>13	byte&0x0F	=0x2		\b, RP2C04-0001
5722>>>13	byte&0x0F	=0x3		\b, RP2C04-0002
5723>>>13	byte&0x0F	=0x4		\b, RP2C04-0003
5724>>>13	byte&0x0F	=0x5		\b, RP2C04-0004
5725>>>13	byte&0x0F	=0x6		\b, RP2C03B
5726>>>13	byte&0x0F	=0x7		\b, RP2C03C
5727>>>13	byte&0x0F	=0x8		\b, RP2C05-01
5728>>>13	byte&0x0F	=0x9		\b, RP2C05-02
5729>>>13	byte&0x0F	=0xA		\b, RP2C05-03
5730>>>13	byte&0x0F	=0xB		\b, RP2C05-04
5731>>>13	byte&0x0F	=0xC		\b, RP2C05-05
5732# TODO: VS protection hardware?
5733>>7	byte		x		\b]
5734# NES 2.0-specific flags.
5735>7	byte&0x0C	=0x8
5736>>12	byte&0x03	=0x0		[NTSC]
5737>>12	byte&0x03	=0x1		[PAL]
5738>>12	byte&0x02	=0x2		[NTSC+PAL]
5739
5740# Standard iNES ROM header.
57410	string		NES\x1A		NES ROM image (iNES)
5742>0	use		nes-rom-image-ines
5743
5744# Wii U Virtual Console iNES ROM header.
57450	belong		0x4E455300	NES ROM image (Wii U Virtual Console)
5746>0	use		nes-rom-image-ines
5747
5748#------------------------------------------------------------------------------
5749# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
5750# Reference: http://wiki.nesdev.com/w/index.php/UNIF
5751# From: David Korth <gerbilsoft@gerbilsoft.com>
5752#
5753# NOTE: The UNIF format uses chunks instead of a fixed header,
5754# so most of the data isn't easily parseable.
5755#
57560	string	UNIF
5757>4	lelong	<16	NES ROM image (UNIF v%d format)
5758
5759#------------------------------------------------------------------------------
5760# fds: file(1) magic for Famciom Disk System disk images
5761# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
5762# From: David Korth <gerbilsoft@gerbilsoft.com>
5763# TODO: Check "Disk info block" and get info from that in addition to the optional header.
5764
5765# Disk info block. (block 1)
57660	name	nintendo-fds-disk-info-block
5767>23	byte	!1		FMC-
5768>23	byte	1		FSC-
5769>16	string	x		\b%.3s
5770>15	byte	x		\b, mfr %02X
5771>20	byte	x		(Rev.%02u)
5772
5773# Headered version.
57740	string	FDS\x1A
5775>0x11	string	*NINTENDO-HVC*	Famicom Disk System disk image:
5776>>0x10	use	nintendo-fds-disk-info-block
5777>4	byte	1	(%u side)
5778>4	byte	!1	(%u sides)
5779
5780# Unheadered version.
57811	string	*NINTENDO-HVC*	Famicom Disk System disk image:
5782>0	use	nintendo-fds-disk-info-block
5783
5784#------------------------------------------------------------------------------
5785# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
5786# Used by Nintendo 3DS NES Virtual Console games.
5787# From: David Korth <gerbilsoft@gerbilsoft.com>
5788#
57890		string	TNES	NES ROM image (Nintendo 3DS Virtual Console)
5790>4		byte	100	\b: FDS,
5791>>0x2010	use	nintendo-fds-disk-info-block
5792>4		byte	!100	\b: TNES mapper %u
5793>>5	byte		x		\b, %ux8k PRG
5794>>6	byte		x		\b, %ux8k CHR
5795>>7	byte&0x08	=1		[WRAM]
5796>>8	byte&0x09	=1		[H-mirror]
5797>>8	byte&0x09	=2		[V-mirror]
5798>>8	byte&0x02	=3		[VRAM]
5799
5800#------------------------------------------------------------------------------
5801# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
5802# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
5803#
58040x104		bequad		0xCEED6666CC0D000B	Game Boy ROM image
5805>0x143		byte&0x80	0x80
5806>>0x134		string		>\0			\b: "%.15s"
5807>0x143		byte&0x80	!0x80
5808>>0x134		string		>\0			\b: "%.16s"
5809>0x14c		byte		x			(Rev.%02u)
5810
5811# Machine type. (SGB, CGB, SGB+CGB)
5812>0x14b		byte		0x33
5813>>0x146		byte		0x03
5814>>>0x143	byte&0x80	0x80	[SGB+CGB]
5815>>>0x143	byte&0x80	!0x80	[SGB]
5816>>0x146		byte		!0x03
5817>>>0x143	byte&0xC0	0x80	[CGB]
5818>>>0x143	byte&0xC0	0xC0	[CGB ONLY]
5819
5820# Mapper.
5821>0x147 byte 0x00  [ROM ONLY]
5822>0x147 byte 0x01  [MBC1]
5823>0x147 byte 0x02  [MBC1+RAM]
5824>0x147 byte 0x03  [MBC1+RAM+BATT]
5825>0x147 byte 0x05  [MBC2]
5826>0x147 byte 0x06  [MBC2+BATTERY]
5827>0x147 byte 0x08  [ROM+RAM]
5828>0x147 byte 0x09  [ROM+RAM+BATTERY]
5829>0x147 byte 0x0B  [MMM01]
5830>0x147 byte 0x0C  [MMM01+SRAM]
5831>0x147 byte 0x0D  [MMM01+SRAM+BATT]
5832>0x147 byte 0x0F  [MBC3+TIMER+BATT]
5833>0x147 byte 0x10  [MBC3+TIMER+RAM+BATT]
5834>0x147 byte 0x11  [MBC3]
5835>0x147 byte 0x12  [MBC3+RAM]
5836>0x147 byte 0x13  [MBC3+RAM+BATT]
5837>0x147 byte 0x19  [MBC5]
5838>0x147 byte 0x1A  [MBC5+RAM]
5839>0x147 byte 0x1B  [MBC5+RAM+BATT]
5840>0x147 byte 0x1C  [MBC5+RUMBLE]
5841>0x147 byte 0x1D  [MBC5+RUMBLE+SRAM]
5842>0x147 byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
5843>0x147 byte 0xFC  [Pocket Camera]
5844>0x147 byte 0xFD  [Bandai TAMA5]
5845>0x147 byte 0xFE  [Hudson HuC-3]
5846>0x147 byte 0xFF  [Hudson HuC-1]
5847
5848# ROM size.
5849>0x148 byte 0     \b, ROM: 256Kbit
5850>0x148 byte 1     \b, ROM: 512Kbit
5851>0x148 byte 2     \b, ROM: 1Mbit
5852>0x148 byte 3     \b, ROM: 2Mbit
5853>0x148 byte 4     \b, ROM: 4Mbit
5854>0x148 byte 5     \b, ROM: 8Mbit
5855>0x148 byte 6     \b, ROM: 16Mbit
5856>0x148 byte 7     \b, ROM: 32Mbit
5857>0x148 byte 0x52  \b, ROM: 9Mbit
5858>0x148 byte 0x53  \b, ROM: 10Mbit
5859>0x148 byte 0x54  \b, ROM: 12Mbit
5860
5861# RAM size.
5862>0x149 byte 1     \b, RAM: 16Kbit
5863>0x149 byte 2     \b, RAM: 64Kbit
5864>0x149 byte 3     \b, RAM: 128Kbit
5865>0x149 byte 4     \b, RAM: 1Mbit
5866>0x149 byte 5     \b, RAM: 512Kbit
5867
5868#------------------------------------------------------------------------------
5869# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
5870# Updated by David Korth <gerbilsoft@gerbilsoft.com>
5871# References:
5872# - http://www.retrodev.com/segacd.html
5873# - http://devster.monkeeh.com/sega/32xguide1.txt
5874#
5875
5876# Common Sega Mega Drive header format.
5877# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s.
58780		name	sega-mega-drive-header
5879# ROM title. (Use domestic if present; if not, use international.)
5880>0x120		byte	>0x20
5881>>0x120		string	>\0	\b: "%.16s"
5882>0x120		byte	<0x21
5883>>0x150		string	>\0	\b: "%.16s"
5884# Other information.
5885>0x180		string	>\0	(%.14s
5886>>0x110		string  >\0	\b, %.16s
5887>0x180		byte	0
5888>>0x110		string  >\0	(%.16s
5889>0		byte	x	\b)
5890
5891# TODO: Check for 32X CD?
5892# Sega Mega CD disc images: 2048-byte sectors.
58930	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
5894>0	use	sega-mega-drive-header
5895>0	byte	x			\b, 2048-byte sectors
58960	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
5897>0	use	sega-mega-drive-header
5898>0	byte	x			\b, 2048-byte sectors
5899# Sega Mega CD disc images: 2352-byte sectors.
59000x10	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
5901>0x10	use	sega-mega-drive-header
5902>0	byte	x			\b, 2352-byte sectors
59030x10	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
5904>0x10	use	sega-mega-drive-header
5905>0	byte	x			\b, 2352-byte sectors
5906
5907# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images.
59080x100		string	SEGA
5909>0x3C0		bequad	0x4D41525320434845	Sega 32X ROM image
5910>>0		use	sega-mega-drive-header
5911>0x3C0		bequad	!0x4D41525320434845
5912>>0x105		belong	0x5049434F	Sega Pico ROM image
5913>>>0		use	sega-mega-drive-header
5914>>0x105		belong	!0x5049434F
5915>>>0x180	beshort	0x4252		Sega Mega CD Boot ROM image
5916>>>0x180	beshort	!0x4252		Sega Mega Drive / Genesis ROM image
5917>>>0		use	sega-mega-drive-header
5918
5919#------------------------------------------------------------------------------
5920# genesis: file(1) magic for the Super MegaDrive ROM dump format
5921#
5922
5923# NOTE: Due to interleaving, we can't display anything
5924# other than the copier header information.
59250      name    sega-genesis-smd-header
5926>0     byte    x       %dx16k blocks
5927>2     byte    0       \b, last in series or standalone
5928>2     byte    >0      \b, split ROM
5929
5930# "Sega Genesis" header.
59310x280	string EAGN
5932>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
5933>>0	use     sega-genesis-smd-header
5934
5935# "Sega Mega Drive" header.
59360x280	string EAMG
5937>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
5938>>0	use     sega-genesis-smd-header
5939
5940#------------------------------------------------------------------------------
5941# smsgg:  file(1) magic for Sega Master System and Game Gear ROM images
5942# Detects all Game Gear and export Sega Master System ROM images,
5943# and some Japanese Sega Master System ROM images.
5944# From: David Korth <gerbilsoft@gerbilsoft.com>
5945# Reference: http://www.smspower.org/Development/ROMHeader
5946#
5947
5948# General SMS header rule.
5949# The SMS boot ROM checks the header at three locations.
59500	name	sega-master-system-rom-header
5951# Machine type.
5952>0x0F	byte&0xF0	0x30	Sega Master System
5953>0x0F	byte&0xF0	0x40	Sega Master System
5954>0x0F	byte&0xF0	0x50	Sega Game Gear
5955>0x0F	byte&0xF0	0x60	Sega Game Gear
5956>0x0F	byte&0xF0	0x70	Sega Game Gear
5957>0x0F	byte&0xF0	<0x30	Sega Master System / Game Gear
5958>0x0F	byte&0xF0	>0x70	Sega Master System / Game Gear
5959>0	byte		x	ROM image:
5960# Product code.
5961>0x0E	byte&0xF0	0x10	1
5962>0x0E	byte&0xF0	0x20	2
5963>0x0E	byte&0xF0	0x30	3
5964>0x0E	byte&0xF0	0x40	4
5965>0x0E	byte&0xF0	0x50	5
5966>0x0E	byte&0xF0	0x60	6
5967>0x0E	byte&0xF0	0x70	7
5968>0x0E	byte&0xF0	0x80	8
5969>0x0E	byte&0xF0	0x90	9
5970>0x0E	byte&0xF0	0xA0	10
5971>0x0E	byte&0xF0	0xB0	11
5972>0x0E	byte&0xF0	0xC0	12
5973>0x0E	byte&0xF0	0xD0	13
5974>0x0E	byte&0xF0	0xE0	14
5975>0x0E	byte&0xF0	0xF0	15
5976# If the product code is 5 digits, we'll need to backspace here.
5977>0x0E	byte&0xF0	!0
5978>>0x0C	leshort		x	\b%04x
5979>0x0E	byte&0xF0	0
5980>>0x0C	leshort		x	%04x
5981# Revision.
5982>0x0E	byte&0x0F	x	(Rev.%02d)
5983# ROM size. (Used for the boot ROM checksum routine.)
5984>0x0F	byte&0x0F	0x0A	(8 KB)
5985>0x0F	byte&0x0F	0x0B	(16 KB)
5986>0x0F	byte&0x0F	0x0C	(32 KB)
5987>0x0F	byte&0x0F	0x0D	(48 KB)
5988>0x0F	byte&0x0F	0x0E	(64 KB)
5989>0x0F	byte&0x0F	0x0F	(128 KB)
5990>0x0F	byte&0x0F	0x00	(256 KB)
5991>0x0F	byte&0x0F	0x01	(512 KB)
5992>0x0F	byte&0x0F	0x02	(1 MB)
5993
5994# SMS/GG header locations.
59950x7FF0	string	TMR\ SEGA
5996>0x7FF0	use	sega-master-system-rom-header
59970x3FF0	string	TMR\ SEGA
5998>0x3FF0	use	sega-master-system-rom-header
59990x1FF0	string	TMR\ SEGA
6000>0x1FF0	use	sega-master-system-rom-header
6001
6002#------------------------------------------------------------------------------
6003# saturn: file(1) magic for the Sega Saturn disc image format.
6004# From: David Korth <gerbilsoft@gerbilsoft.com>
6005#
6006
6007# Common Sega Saturn disc header format.
6008# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding.
6009# TODO: Release date, device information, region code, others?
60100	name	sega-saturn-disc-header
6011>0x60	string	>\0	\b: "%.32s"
6012>0x20	string	>\0	(%.10s
6013>>0x2A	string	>\0	\b, %.6s)
6014>>0x2A	byte	0	\b)
6015
6016# 2048-byte sector version.
60170	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
6018>0	use	sega-saturn-disc-header
6019>0	byte	x			(2048-byte sectors)
6020# 2352-byte sector version.
60210x10	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
6022>0x10	use	sega-saturn-disc-header
6023>0	byte	x			(2352-byte sectors)
6024
6025#------------------------------------------------------------------------------
6026# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
6027# From: David Korth <gerbilsoft@gerbilsoft.com>
6028# Reference: http://mc.pp.se/dc/ip0000.bin.html
6029#
6030
6031# Common Sega Dreamcast disc header format.
6032# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding.
6033# TODO: Release date, device information, region code, others?
60340	name	sega-dreamcast-disc-header
6035>0x80	string	>\0	\b: "%.32s"
6036>0x40	string	>\0	(%.10s
6037>>0x4A	string	>\0	\b, %.6s)
6038>>0x4A	byte	0	\b)
6039
6040# 2048-byte sector version.
60410	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
6042>0	use	sega-dreamcast-disc-header
6043>0	byte	x			(2048-byte sectors)
6044# 2352-byte sector version.
60450x10	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
6046>0x10	use	sega-dreamcast-disc-header
6047>0	byte	x			(2352-byte sectors)
6048
6049#------------------------------------------------------------------------------
6050# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
6051#
60520 belong 0x21068028   Sega Dreamcast VMU game image
60530 string LCDi         Dream Animator file
6054
6055#------------------------------------------------------------------------------
6056# z64: file(1) magic for the Z64 format N64 ROM dumps
6057# Reference: http://forum.pj64-emu.com/showthread.php?t=2239
6058# From: David Korth <gerbilsoft@gerbilsoft.com>
6059#
60600	bequad	0x803712400000000F	Nintendo 64 ROM image
6061>0x20	string	>\0	\b: "%.20s"
6062>0x3B	string	x	(%.4s
6063>0x3F	byte	x	\b, Rev.%02u)
6064
6065#------------------------------------------------------------------------------
6066# v64: file(1) magic for the V64 format N64 ROM dumps
6067# Same as z64 format, but with 16-bit byteswapping.
6068#
60690	bequad	0x3780401200000F00	Nintendo 64 ROM image (V64)
6070
6071#------------------------------------------------------------------------------
6072# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps
6073# Same as z64 format, but with swapped 16-bit words.
6074#
60750	bequad	0x12408037000F0000	Nintendo 64 ROM image (wordswapped)
6076
6077#------------------------------------------------------------------------------
6078# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps
6079# Same as z64 format, but with 32-bit byteswapping.
6080#
60810	bequad	0x401237800F000000	Nintendo 64 ROM image (32-bit byteswapped)
6082
6083#------------------------------------------------------------------------------
6084# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
6085# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader
6086#
6087# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
6088# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
6089#
60904	bequad	0x24FFAE51699AA221	Game Boy Advance ROM image
6091>0xA0	string	>\0	\b: "%.12s"
6092>0xAC	string	x	(%.6s
6093>0xBC	byte	x	\b, Rev.%02u)
6094
6095#------------------------------------------------------------------------------
6096# nds: file(1) magic for the Nintendo DS(i) raw ROM format
6097# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader
6098#
6099# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
6100# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
6101#
61020xC0	bequad	0x24FFAE51699AA221	Nintendo DS ROM image
6103>0x00	string	>\0		\b: "%.12s"
6104>0x0C	string	x		(%.6s
6105>0x1E	byte	x		\b, Rev.%02u)
6106>0x12	byte	2		(DSi enhanced)
6107>0x12	byte	3		(DSi only)
6108
6109#------------------------------------------------------------------------------
6110# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
6111# This is also used for loading .nds files using the MSET exploit on 3DS.
6112# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp
61130xC0	bequad	0xC8604FE201708FE2	Nintendo DS Slot-2 ROM image (PassMe)
6114
6115#------------------------------------------------------------------------------
6116# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format.
6117# From: David Korth <gerbilsoft@gerbilsoft.com>
6118# References:
6119# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
6120# - http://www.devrs.com/ngp/files/ngpctech.txt
6121#
61220x0A	string	BY\ SNK\ CORPORATION	Neo Geo Pocket
6123>0x23	byte	0x10			Color
6124>0	byte	x			ROM image
6125>0x24	string	>\0			\b: "%.12s"
6126>0x1F	byte	0xFF			(debug mode enabled)
6127
6128#------------------------------------------------------------------------------
6129# msx: file(1) magic for MSX game cartridge dumps
6130# Too simple - MPi
6131#0 beshort 0x4142 MSX game cartridge dump
6132
6133#------------------------------------------------------------------------------
6134# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
61350	string	PS-X\ EXE	Sony Playstation executable
6136>16	lelong	x		PC=0x%08x,
6137>20	lelong	!0		GP=0x%08x,
6138>24	lelong	!0		.text=[0x%08x,
6139>>28	lelong	x		\b0x%x],
6140>32	lelong	!0		.data=[0x%08x,
6141>>36	lelong	x		\b0x%x],
6142>40	lelong	!0		.bss=[0x%08x,
6143>>44	lelong	x		\b0x%x],
6144>48	lelong	!0		Stack=0x%08x,
6145>48	lelong	=0		No Stack!,
6146>52	lelong	!0		StackSize=0x%x,
6147#>76	string	>\0		(%s)
6148#  Area:
6149>113	string	x		(%s)
6150
6151# CPE executables
61520	string	CPE		CPE executable
6153>3	byte	x		(version %d)
6154
6155#------------------------------------------------------------------------------
6156# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
61570       string          XBEH            XBE, Microsoft Xbox executable
6158# probabilistic checks whether signed or not
6159>0x0004 ulelong =0x0
6160>>&2    ulelong =0x0
6161>>>&2   ulelong =0x0  \b, not signed
6162>0x0004 ulelong >0
6163>>&2    ulelong >0
6164>>>&2   ulelong >0    \b, signed
6165# expect base address of 0x10000
6166>0x0104               ulelong =0x10000
6167>>(0x0118-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
6168>>(0x0118-0x0FF60)    ulelong&0x80000007  !0x80000007
6169>>>(0x0118-0x0FF60)   ulelong >0           (regions:
6170>>>>(0x0118-0x0FF60)  ulelong &0x00000001  NA
6171>>>>(0x0118-0x0FF60)  ulelong &0x00000002  Japan
6172>>>>(0x0118-0x0FF60)  ulelong &0x00000004  Rest_of_World
6173>>>>(0x0118-0x0FF60)  ulelong &0x80000000  Manufacturer
6174>>>(0x0118-0x0FF60)   ulelong >0           \b)
6175
6176# --------------------------------
6177# Microsoft Xbox data file formats
61780       string          XIP0            XIP, Microsoft Xbox data
61790       string          XTF0            XTF, Microsoft Xbox data
6180
6181# Atari Lynx cartridge dump (EXE/BLL header)
6182# From: "Stefan A. Haubenthal" <polluks@web.de>
6183
6184# Double-check that the image type matches too, 0x8008 conflicts with
6185# 8 character OMF-86 object file headers.
61860	beshort		0x8008
6187>6	string		BS93		Lynx homebrew cartridge
6188>>2	beshort		x		\b, RAM start $%04x
6189>6	string		LYNX		Lynx cartridge
6190>>2	beshort		x		\b, RAM start $%04x
6191
6192# Opera file system that is used on the 3DO console
6193# From: Serge van den Boom <svdb@stack.nl>
61940	string		\x01ZZZZZ\x01	3DO "Opera" file system
6195
6196# From: Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
6197# From: David Pflug <david@pflug.email>
6198# is the offset 12 or the offset 16 correct?
6199# GBS (Game Boy Sound) magic
6200# ftp://ftp.modland.com/pub/documents/format_documentation/\
6201# Gameboy%20Sound%20System%20(.gbs).txt
62020	string		GBS		Nintendo Gameboy Music/Audio Data
6203#12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
6204>16	string		>\0	("%s" by
6205>48	string		>\0	%s, copyright
6206>80	string		>\0	%s),
6207>3	byte		x	version %d,
6208>4	byte		x	%d tracks
6209
6210# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
6211# see http://zerosoft.zophar.net/ips.php
62120	string	PATCH			IPS patch file
6213
6214# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
62150	string	PPF30			Playstation Patch File version 3.0
6216>5	byte	0			\b, PPF 1.0 patch
6217>5	byte	1			\b, PPF 2.0 patch
6218>5	byte	2			\b, PPF 3.0 patch
6219>>56	byte	0			\b, Imagetype BIN (any)
6220>>56	byte	1			\b, Imagetype GI (PrimoDVD)
6221>>57	byte	0			\b, Blockcheck disabled
6222>>57	byte	1			\b, Blockcheck enabled
6223>>58	byte	0			\b, Undo data not available
6224>>58	byte	1			\b, Undo data available
6225>6	string	x			\b, description: %s
6226
62270	string	PPF20			Playstation Patch File version 2.0
6228>5	byte	0			\b, PPF 1.0 patch
6229>5	byte	1			\b, PPF 2.0 patch
6230>>56	lelong	>0			\b, size of file to patch %d
6231>6	string	x			\b, description: %s
6232
62330	string	PPF10			Playstation Patch File version 1.0
6234>5	byte	0			\b, Simple Encoding
6235>6	string	x			\b, description: %s
6236
6237# From: Daniel Dawson <ddawson@icehouse.net>
6238# SNES9x .smv "movie" file format.
62390		string		SMV\x1A	SNES9x input recording
6240>0x4		lelong		x	\b, version %d
6241# version 4 is latest so far
6242>0x4		lelong		<5
6243>>0x8		ledate		x	\b, recorded at %s
6244>>0xc		lelong		>0	\b, rerecorded %d times
6245>>0x10		lelong		x	\b, %d frames long
6246>>0x14		byte		>0	\b, data for controller(s):
6247>>>0x14		byte		&0x1	#1
6248>>>0x14		byte		&0x2	#2
6249>>>0x14		byte		&0x4	#3
6250>>>0x14		byte		&0x8	#4
6251>>>0x14		byte		&0x10	#5
6252>>0x15		byte		^0x1	\b, begins from snapshot
6253>>0x15		byte		&0x1	\b, begins from reset
6254>>0x15		byte		^0x2	\b, NTSC standard
6255>>0x15		byte		&0x2	\b, PAL standard
6256>>0x17		byte		&0x1    \b, settings:
6257# WIP1Timing not used as of version 4
6258>>>0x4		lelong		<4
6259>>>>0x17	byte		&0x2	WIP1Timing
6260>>>0x17		byte		&0x4	Left+Right
6261>>>0x17		byte		&0x8	VolumeEnvX
6262>>>0x17		byte		&0x10	FakeMute
6263>>>0x17		byte		&0x20	SyncSound
6264# New flag as of version 4
6265>>>0x4		lelong		>3
6266>>>>0x17	byte		&0x80	NoCPUShutdown
6267>>0x4		lelong		<4
6268>>>0x18		lelong		>0x23
6269>>>>0x20	leshort		!0
6270>>>>>0x20	lestring16	x	\b, metadata: "%s"
6271>>0x4		lelong		>3
6272>>>0x24		byte		>0	\b, port 1:
6273>>>>0x24	byte		1	joypad
6274>>>>0x24	byte		2	mouse
6275>>>>0x24	byte		3	SuperScope
6276>>>>0x24	byte		4	Justifier
6277>>>>0x24	byte		5	multitap
6278>>>0x24		byte		>0	\b, port 2:
6279>>>>0x25	byte		1	joypad
6280>>>>0x25	byte		2	mouse
6281>>>>0x25	byte		3	SuperScope
6282>>>>0x25	byte		4	Justifier
6283>>>>0x25	byte		5	multitap
6284>>>0x18		lelong		>0x43
6285>>>>0x40	leshort		!0
6286>>>>>0x40	lestring16	x	\b, metadata: "%s"
6287>>0x17		byte		&0x40   \b, ROM:
6288>>>(0x18.l-26)	lelong		x	CRC32 0x%08x
6289>>>(0x18.l-23)	string		x	"%s"
6290
6291# Type: scummVM savegame files
6292# From: Sven Hartge <debian@ds9.argh.org>
62930	string	SCVM	ScummVM savegame
6294>12	string	>\0	"%s"
6295
6296#------------------------------------------------------------------------------
6297# Nintendo GameCube / Wii file formats.
6298#
6299
6300# Type: Nintendo GameCube/Wii common disc header data.
6301# From: David Korth <gerbilsoft@gerbilsoft.com>
6302# Reference: http://wiibrew.org/wiki/Wii_Disc
63030	name	nintendo-gcn-disc-common
6304>0x20	string	x	"%.64s"
6305>0x00	string	x	(%.6s
6306>0x06	byte	>0
6307>>0x06	byte	1	\b, Disc 2
6308>>0x06	byte	2	\b, Disc 3
6309>>0x06	byte	3	\b, Disc 4
6310>0x07	byte	x	\b, Rev.%02u)
6311
6312# Type: Nintendo GameCube disc image
6313# From: David Korth <gerbilsoft@gerbilsoft.com>
6314# Reference: http://wiibrew.org/wiki/Wii_Disc
63150x1C	belong	0xC2339F3D	Nintendo GameCube disc image:
6316>0	use	nintendo-gcn-disc-common
6317
6318# Type: Nintendo GameCube embedded disc image
6319# Commonly found on demo discs.
6320# From: David Korth <gerbilsoft@gerbilsoft.com>
6321# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8
63220		belong	0xAE0F38A2
6323>0x0C		belong	0x00100000
6324>>(8.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube embedded disc image:
6325>>>(8.L)	use	nintendo-gcn-disc-common
6326
6327# Type: Nintendo Wii disc image
6328# From: David Korth <gerbilsoft@gerbilsoft.com>
6329# Reference: http://wiibrew.org/wiki/Wii_Disc
63300x18	belong	0x5D1C9EA3	Nintendo Wii disc image:
6331>0	use	nintendo-gcn-disc-common
6332
6333# Type: Nintendo Wii disc image (WBFS format)
6334# From: David Korth <gerbilsoft@gerbilsoft.com>
6335# Reference: http://wiibrew.org/wiki/Wii_Disc
63360	string	WBFS
6337>0x218	belong	0x5D1C9EA3	Nintendo Wii disc image (WBFS format):
6338>>0x200	use	nintendo-gcn-disc-common
6339
6340# Type: Nintendo GameCube/Wii disc image (CISO format)
6341# NOTE: This is NOT the same as Compact ISO or PSP CISO,
6342# though it has the same magic number.
63430		string	CISO
6344# Other fields are used to determine what type of CISO this is:
6345# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
6346# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
6347# - None of the above: Compact ISO.
6348>4		lelong	0x200000
6349>>8		byte	1
6350>>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
6351>>>>0x8000	use	nintendo-gcn-disc-common
6352>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
6353>>>>0x8000	use	nintendo-gcn-disc-common
6354
6355# Type: Nintendo GameCube/Wii disc image (GCZ format)
6356# Due to zlib compression, we can't get the actual disc information.
63570	lelong	0xB10BC001
6358>4	lelong	0		Nintendo GameCube disc image (GCZ format)
6359>4	lelong	1		Nintendo Wii disc image (GCZ format)
6360>4	lelong	>1		Nintendo GameCube/Wii disc image (GCZ format)
6361
6362# Type: Nintendo GameCube/Wii disc image (WDF format)
63630		string	WII\001DISC
6364>8		belong	1
6365# WDFv1
6366>>0x54		belong	0xC2339F3D	Nintendo GameCube disc image (WDFv1 format):
6367>>>0x38		use	nintendo-gcn-disc-common
6368>>0x58		belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv1 format):
6369>>>0x38		use	nintendo-gcn-disc-common
6370>8		belong	2
6371# WDFv2
6372>>(12.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube disc image (WDFv2 format):
6373>>>(12.L)	use	nintendo-gcn-disc-common
6374>>(12.L+0x18)	belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv2 format):
6375>>>(12.L)	use	nintendo-gcn-disc-common
6376
6377# Type: Nintendo GameCube/Wii disc image (WIA format)
63780	string	WIA\001	Nintendo
6379>0x48	belong	0	GameCube/Wii
6380>0x48	belong	1	GameCube
6381>0x48	belong	2	Wii
6382>0x48	belong	>2	GameCube/Wii
6383>0x48	belong	x	disc image (WIA format):
6384>>0x58	use	nintendo-gcn-disc-common
6385
6386#------------------------------------------------------------------------------
6387# Nintendo 3DS file formats.
6388#
6389
6390# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC)
6391# From: David Korth <gerbilsoft@gerbilsoft.com>
6392# Reference: https://www.3dbrew.org/wiki/NCSD
63930x100		string		NCSD
6394>0x118		lequad		0		Nintendo 3DS Game Card image
6395# NCCH header for partition 0. (game data)
6396>>0x1150	string		>\0	\b: "%.16s"
6397>>0x312		byte		x	(Rev.%02u)
6398>>0x118C	byte		2	(New3DS only)
6399>>0x18D		byte		0		(inner device)
6400>>0x18D		byte		1		(Card1)
6401>>0x18D		byte		2		(Card2)
6402>>0x18D		byte		3		(extended device)
6403>0x118		bequad		0x0102020202000000	Nintendo 3DS eMMC dump (Old3DS)
6404>0x118		bequad		0x0102020203000000	Nintendo 3DS eMMC dump (New3DS)
6405
6406# Nintendo 3DS version code.
6407# Reference: https://www.3dbrew.org/wiki/Titles
6408# Format: leshort containing three fields:
6409# - 6-bit: Major
6410# - 6-bit: Minor
6411# - 4-bit: Revision
6412# NOTE: Only supporting major/minor versions from 0-15 right now.
6413# NOTE: Should be prefixed with "v".
64140	name	nintendo-3ds-version-code
6415# Raw version.
6416>0	leshort	x	\b%u,
6417# Major version.
6418>0	leshort&0xFC00	0x0000	0
6419>0	leshort&0xFC00	0x0400	1
6420>0	leshort&0xFC00	0x0800	2
6421>0	leshort&0xFC00	0x0C00	3
6422>0	leshort&0xFC00	0x1000	4
6423>0	leshort&0xFC00	0x1400	5
6424>0	leshort&0xFC00	0x1800	6
6425>0	leshort&0xFC00	0x1C00	7
6426>0	leshort&0xFC00	0x2000	8
6427>0	leshort&0xFC00	0x2400	9
6428>0	leshort&0xFC00	0x2800	10
6429>0	leshort&0xFC00	0x2C00	11
6430>0	leshort&0xFC00	0x3000	12
6431>0	leshort&0xFC00	0x3400	13
6432>0	leshort&0xFC00	0x3800	14
6433>0	leshort&0xFC00	0x3C00	15
6434# Minor version.
6435>0	leshort&0x03F0	0x0000	\b.0
6436>0	leshort&0x03F0	0x0010	\b.1
6437>0	leshort&0x03F0	0x0020	\b.2
6438>0	leshort&0x03F0	0x0030	\b.3
6439>0	leshort&0x03F0	0x0040	\b.4
6440>0	leshort&0x03F0	0x0050	\b.5
6441>0	leshort&0x03F0	0x0060	\b.6
6442>0	leshort&0x03F0	0x0070	\b.7
6443>0	leshort&0x03F0	0x0080	\b.8
6444>0	leshort&0x03F0	0x0090	\b.9
6445>0	leshort&0x03F0	0x00A0	\b.10
6446>0	leshort&0x03F0	0x00B0	\b.11
6447>0	leshort&0x03F0	0x00C0	\b.12
6448>0	leshort&0x03F0	0x00D0	\b.13
6449>0	leshort&0x03F0	0x00E0	\b.14
6450>0	leshort&0x03F0	0x00F0	\b.15
6451# Revision.
6452>0	leshort&0x000F	x	\b.%u
6453
6454# Type: Nintendo 3DS "NCCH" container.
6455# https://www.3dbrew.org/wiki/NCCH
64560x100		string	NCCH	Nintendo 3DS
6457>0x18D		byte&2	0	File Archive (CFA)
6458>0x18D		byte&2	2	Executable Image (CXI)
6459>0x150		string	>\0	\b: "%.16s"
6460>0x18D		byte	0x05
6461>>0x10E		leshort	x	(Old3DS System Update v
6462>>0x10E		use	nintendo-3ds-version-code
6463>>0x10E		leshort	x	\b)
6464>0x18D		byte	0x15
6465>>0x10E		leshort	x	(New3DS System Update v
6466>>0x10E		use	nintendo-3ds-version-code
6467>>0x10E		leshort	x	\b)
6468>0x18D		byte	!0x05
6469>>0x18D		byte	!0x15
6470>>>0x112	byte	x	(v
6471>>>0x112	use	nintendo-3ds-version-code
6472>>>0x112	byte	x	\b)
6473>0x18C		byte	2	(New3DS only)
6474
6475# Type: Nintendo 3DS "SMDH" file. (application description)
6476# From: David Korth <gerbilsoft@gerbilsoft.com>
6477# Reference: https://3dbrew.org/wiki/SMDH
64780		string		SMDH		Nintendo 3DS SMDH file
6479>0x208		leshort		!0
6480>>0x208		lestring16	x		\b: "%.128s"
6481>>0x388		leshort		!0
6482>>>0x388	lestring16	x		by %.128s
6483>0x208		leshort		0
6484>>0x008		leshort		!0
6485>>>0x008	lestring16	x		\b: "%.128s"
6486>>>0x188	leshort		!0
6487>>>>0x188	lestring16	x		by %.128s
6488
6489# Type: Nintendo 3DS Homebrew Application.
6490# From: David Korth <gerbilsoft@gerbilsoft.com>
6491# Refernece: https://3dbrew.org/wiki/3DSX_Format
64920	string	3DSX	Nintendo 3DS Homebrew Application (3DSX)
6493
6494#------------------------------------------------------------------------------
6495# a7800: file(1) magic for the Atari 7800 raw ROM format.
6496# From: David Korth <gerbilsoft@gerbilsoft.com>
6497# Reference: https://sites.google.com/site/atari7800wiki/a78-header
6498
64990	byte	>0
6500>0	byte	<3
6501>>1	string	ATARI7800	Atari 7800 ROM image
6502>>>0x11	string	>\0	\b: "%.32s"
6503# Display type.
6504>>>0x39	byte	0	(NTSC)
6505>>>0x39	byte	1	(PAL)
6506>>>0x36	byte&1	1	(POKEY)
6507
6508#------------------------------------------------------------------------------
6509# vectrex: file(1) magic for the GCE Vectrex raw ROM format.
6510# From: David Korth <gerbilsoft@gerbilsoft.com>
6511# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm
6512#
6513# NOTE: Title is terminated with 0x80, not 0.
6514# The header is terminated with a 0, so that will
6515# terminate the title as well.
6516#
65170	string	g\ GCE	Vectrex ROM image
6518>0x11	string	>\0	\b: "%.16s"
6519
6520#------------------------------------------------------------------------------
6521# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
6522# From: David Korth <gerbilsoft@gerbilsoft.com>
6523# Reference: https://www.3dbrew.org/wiki/Amiibo
65240x00		byte	0x04
6525>0x0A		beshort	0x0FE0
6526>>0x0C		belong	0xF110FFEE
6527>>>0x208	beshort	0x0100
6528>>>>0x020A	byte	0x0F
6529>>>>>0x020C	bequad	0x000000045F000000
6530>>>>>>0x5B	byte	0x02
6531>>>>>>>0x54	belong	x	Nintendo amiibo NFC dump - amiibo ID: %08X-
6532>>>>>>>0x58	belong	x	\b%08X
6533
6534#------------------------------------------------------------------------------
6535# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
6536# convex:  file(1) magic for Convex boxes
6537#
6538# Convexes are big-endian.
6539#
6540# /*\
6541#  * Below are the magic numbers and tests added for Convex.
6542#  * Added at beginning, because they are expected to be used most.
6543# \*/
65440	belong	0507	Convex old-style object
6545>16	belong	>0	not stripped
65460	belong	0513	Convex old-style demand paged executable
6547>16	belong	>0	not stripped
65480	belong	0515	Convex old-style pre-paged executable
6549>16	belong	>0	not stripped
65500	belong	0517	Convex old-style pre-paged, non-swapped executable
6551>16	belong	>0	not stripped
65520	belong	0x011257	Core file
6553#
6554# The following are a series of dump format magic numbers.  Each one
6555# corresponds to a drastically different dump format.  The first on is
6556# the original dump format on a 4.1 BSD or earlier file system.  The
6557# second marks the change between the 4.1 file system and the 4.2 file
6558# system.  The Third marks the changing of the block size from 1K
6559# to 2K to be compatible with an IDC file system.  The fourth indicates
6560# a dump that is dependent on Convex Storage Manager, because data in
6561# secondary storage is not physically contained within the dump.
6562# The restore program uses these number to determine how the data is
6563# to be extracted.
6564#
656524	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
656624	belong	=60014	dump format, Convex Storage Manager by-reference dump
6567#
6568# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
6569# If there is no `=' sign, assume just checking for whether the bit is set?
6570#
65710	belong	0601		Convex SOFF
6572>88	belong&0x000f0000	=0x00000000	c1
6573>88	belong			&0x00010000	c2
6574>88	belong			&0x00020000	c2mp
6575>88	belong			&0x00040000	parallel
6576>88	belong			&0x00080000	intrinsic
6577>88	belong			&0x00000001	demand paged
6578>88	belong			&0x00000002	pre-paged
6579>88	belong			&0x00000004	non-swapped
6580>88	belong			&0x00000008	POSIX
6581#
6582>84	belong			&0x80000000	executable
6583>84	belong			&0x40000000	object
6584>84	belong&0x20000000	=0		not stripped
6585>84	belong&0x18000000	=0x00000000	native fpmode
6586>84	belong&0x18000000	=0x10000000	ieee fpmode
6587>84	belong&0x18000000	=0x18000000	undefined fpmode
6588#
65890	belong			0605		Convex SOFF core
6590#
65910	belong			0607		Convex SOFF checkpoint
6592>88	belong&0x000f0000	=0x00000000	c1
6593>88	belong			&0x00010000	c2
6594>88	belong			&0x00020000	c2mp
6595>88	belong			&0x00040000	parallel
6596>88	belong			&0x00080000	intrinsic
6597>88	belong			&0x00000008	POSIX
6598#
6599>84	belong&0x18000000	=0x00000000	native fpmode
6600>84	belong&0x18000000	=0x10000000	ieee fpmode
6601>84	belong&0x18000000	=0x18000000	undefined fpmode
6602
6603#------------------------------------------------------------------------------
6604# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $
6605# xoverage:  file(1) magic for test coverage data
6606
6607# File formats used to store test coverage data
6608# 2016-05-21, Georg Sauthoff <mail@georg.so>
6609
6610
6611# - GCC gcno - written by GCC at compile time when compiling with
6612# 	gcc -ftest-coverage
6613# - GCC gcda - written by a program that was compiled with
6614#	gcc -fprofile-arcs
6615# - LLVM raw profiles - generated by a program compiled with
6616#	clang -fprofile-instr-generate -fcoverage-mapping ...
6617# - LLVM indexed profiles - generated by
6618#	llvm-profdata
6619# - GCOV reports, i.e. the annotated source code
6620# - LCOV trace files, i.e. aggregated GCC profiles
6621#
6622# GCC coverage tracefiles
6623# .gcno file are created during compile time,
6624# while data collected during runtime is stored in .gcda files
6625# cf. gcov-io.h
6626# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
6627# Examples:
6628# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
6629# Debian 8 PPC64/gcc-4.9.2  : 67 63 6e 6f 34 30 39 2a
66300	lelong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
6631>&3	byte	x	version %c.
6632>&1	byte	x	\b%c
6633
6634# big endian
66350	belong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
6636>&0	byte	x	version %c.
6637>&2	byte	x	\b%c (big-endian)
6638
6639# Examples:
6640# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
6641# Debian 8 PPC64/gcc-4.9.2  : 67 63 64 61 34 30 39 2a
66420	lelong	0x67636461	GCC gcda coverage (-fprofile-arcs),
6643>&3	byte	x	version %c.
6644>&1	byte	x	\b%c
6645
6646# big endian
66470	belong	0x67636461	GCC gcda coverage (-fprofile-arcs),
6648>&0	byte	x	version %c.
6649>&2	byte	x	\b%c (big-endian)
6650
6651
6652# LCOV tracefiles
6653# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
66540	string	TN:
6655>&0	search/64	\nSF:/	LCOV coverage tracefile
6656
6657
6658# Coverage reports generated by gcov
6659# i.e. source code annoted with coverage information
66600	string	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
6661>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
6662>>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data:	GCOV coverage report
6663
6664
6665# LLVM coverage files
6666
6667# raw data after running a program compiled with:
6668# `clang -fprofile-instr-generate -fcoverage-mapping ...`
6669# default name: default.profraw
6670# magic is: \xFF lprofr \x81
6671# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
66720	lequad	0xff6c70726f667281	LLVM raw profile data,
6673>&0	byte	x	version %d
6674
6675# big endian
66760	bequad	0xff6c70726f667281	LLVM raw profile data,
6677>&7	byte	x	version %d (big-endian)
6678
6679
6680# LLVM indexed instruction profile (as generated by llvm-profdata)
6681# magic is: reverse(\xFF lprofi \x81)
6682# cf. http://llvm.org/docs/CoverageMappingFormat.html
6683# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
6684# http://llvm.org/docs/CommandGuide/llvm-cov.html
6685# http://llvm.org/docs/CommandGuide/llvm-profdata.html
66860	lequad	0x8169666f72706cff	LLVM indexed profile data,
6687>&0	byte	x	version %d
6688
6689# big endian
66900	bequad	0x8169666f72706cff	LLVM indexed profile data,
6691>&7	byte	x	version %d (big-endian)
6692
6693
6694#------------------------------------------------------------------------------
6695# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
6696# cracklib:  file (1) magic for cracklib v2.7
6697
66980	lelong	0x70775631	Cracklib password index, little endian
6699>4	long	>0		(%i words)
6700>4	long	0		("64-bit")
6701>>8	long	>-1		(%i words)
67020	belong	0x70775631	Cracklib password index, big endian
6703>4	belong	>-1		(%i words)
6704# really bellong 0x0000000070775631
67050	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
6706>12	belong	>0		(%i words)
6707
6708# ----------------------------------------------------------------------------
6709# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
6710# ctags:  file (1) magic for Exuberant Ctags files
6711# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
67120	search/1	=!_TAG	Exuberant Ctags tag file text
6713
6714#--------------------------------------------------------------
6715# ctf:  file(1) magic for CTF (Common Trace Format) trace files
6716#
6717# Specs. available here: <http://www.efficios.com/ctf>
6718#--------------------------------------------------------------
6719
6720# CTF trace data
67210	lelong	0xc1fc1fc1	Common Trace Format (CTF) trace data (LE)
67220	belong	0xc1fc1fc1	Common Trace Format (CTF) trace data (BE)
6723
6724# CTF metadata (packetized)
67250	lelong	0x75d11d57	Common Trace Format (CTF) packetized metadata (LE)
6726>35	byte	x		\b, v%d
6727>36	byte	x		\b.%d
67280	belong	0x75d11d57	Common Trace Format (CTF) packetized metadata (BE)
6729>35	byte	x		\b, v%d
6730>36	byte	x		\b.%d
6731
6732# CTF metadata (plain text)
67330	string	/*\x20CTF\x20   Common Trace Format (CTF) plain text metadata
6734!:strength + 5			# this is to make sure we beat C
6735>&0	regex	[0-9]+\.[0-9]+	\b, v%s
6736
6737#------------------------------------------------------------------------------
6738# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
6739# file(1) magic(5) data for cubemaps  Martin Erik Werner <martinerikwerner@gmail.com>
6740#
67410	string	ACMP	Map file for the AssaultCube FPS game
67420	string	CUBE	Map file for cube and cube2 engine games
67430	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games
6744
6745#------------------------------------------------------------------------------
6746# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $
6747# Cups: file(1) magic for the cups raster file format
6748# From: Laurent Martelli <martellilaurent@gmail.com>
6749# http://www.cups.org/documentation.php/spec-raster.html
6750#
6751
67520	name		cups-le
6753>280	lelong		x		\b, %d
6754>284	lelong		x		\bx%d dpi
6755>376	lelong		x		\b, %dx
6756>380	lelong		x		\b%d pixels
6757>388	lelong		x		%d bits/color
6758>392	lelong		x		%d bits/pixel
6759>400	lelong		0		ColorOrder=Chunky
6760>400	lelong		1		ColorOrder=Banded
6761>400	lelong		2		ColorOrder=Planar
6762>404	lelong		0		ColorSpace=gray
6763>404	lelong		1		ColorSpace=RGB
6764>404	lelong		2		ColorSpace=RGBA
6765>404	lelong		3		ColorSpace=black
6766>404	lelong		4		ColorSpace=CMY
6767>404	lelong		5		ColorSpace=YMC
6768>404	lelong		6		ColorSpace=CMYK
6769>404	lelong		7		ColorSpace=YMCK
6770>404	lelong		8		ColorSpace=KCMY
6771>404	lelong		9		ColorSpace=KCMYcm
6772>404	lelong		10		ColorSpace=GMCK
6773>404	lelong		11		ColorSpace=GMCS
6774>404	lelong		12		ColorSpace=WHITE
6775>404	lelong		13		ColorSpace=GOLD
6776>404	lelong		14		ColorSpace=SILVER
6777>404	lelong		15		ColorSpace=CIE XYZ
6778>404	lelong		16		ColorSpace=CIE Lab
6779>404	lelong		17		ColorSpace=RGBW
6780>404	lelong		18		ColorSpace=sGray
6781>404	lelong		19		ColorSpace=sRGB
6782>404	lelong		20		ColorSpace=AdobeRGB
6783
6784# Cups Raster image format, Big Endian
67850	string		RaS
6786>3	string		t		Cups Raster version 1, Big Endian
6787>3	string		2		Cups Raster version 2, Big Endian
6788>3	string		3		Cups Raster version 3, Big Endian
6789!:mime	application/vnd.cups-raster
6790>0	use		\^cups-le
6791
6792
6793# Cups Raster image format, Little Endian
67941	string		SaR
6795>0	string		t		Cups Raster version 1, Little Endian
6796>0	string		2		Cups Raster version 2, Little Endian
6797>0	string		3		Cups Raster version 3, Little Endian
6798!:mime	application/vnd.cups-raster
6799>0	use		cups-le
6800
6801#------------------------------------------------------------------------------
6802# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
6803# dact:  file(1) magic for DACT compressed files
6804#
68050	long		0x444354C3	DACT compressed data
6806>4	byte		>-1		(version %i.
6807>5	byte		>-1		$BS%i.
6808>6	byte		>-1		$BS%i)
6809>7	long		>0		$BS, original size: %i bytes
6810>15	long		>30		$BS, block size: %i bytes
6811
6812#------------------------------------------------------------------------------
6813# $File: database,v 1.51 2017/04/28 16:28:16 christos Exp $
6814# database:  file(1) magic for various databases
6815#
6816# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
6817#
6818#
6819# GDBM magic numbers
6820#  Will be maintained as part of the GDBM distribution in the future.
6821#  <downsj@teeny.org>
68220	belong	0x13579acd	GNU dbm 1.x or ndbm database, big endian, 32-bit
6823!:mime	application/x-gdbm
68240	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian, old
6825!:mime	application/x-gdbm
68260	belong	0x13579acf	GNU dbm 1.x or ndbm database, big endian, 64-bit
6827!:mime	application/x-gdbm
68280	lelong	0x13579acd	GNU dbm 1.x or ndbm database, little endian, 32-bit
6829!:mime	application/x-gdbm
68300	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian, old
6831!:mime	application/x-gdbm
68320	lelong	0x13579acf	GNU dbm 1.x or ndbm database, little endian, 64-bit
6833!:mime	application/x-gdbm
68340	string	GDBM		GNU dbm 2.x database
6835!:mime	application/x-gdbm
6836#
6837# Berkeley DB
6838#
6839# Ian Darwin's file /etc/magic files: big/little-endian version.
6840#
6841# Hash 1.85/1.86 databases store metadata in network byte order.
6842# Btree 1.85/1.86 databases store the metadata in host byte order.
6843# Hash and Btree 2.X and later databases store the metadata in host byte order.
6844
68450	long	0x00061561	Berkeley DB
6846!:mime	application/x-dbm
6847>8	belong	4321
6848>>4	belong	>2		1.86
6849>>4	belong	<3		1.85
6850>>4	belong	>0		(Hash, version %d, native byte-order)
6851>8	belong	1234
6852>>4	belong	>2		1.86
6853>>4	belong	<3		1.85
6854>>4	belong	>0		(Hash, version %d, little-endian)
6855
68560	belong	0x00061561	Berkeley DB
6857>8	belong	4321
6858>>4	belong	>2		1.86
6859>>4	belong	<3		1.85
6860>>4	belong	>0		(Hash, version %d, big-endian)
6861>8	belong	1234
6862>>4	belong	>2		1.86
6863>>4	belong	<3		1.85
6864>>4	belong	>0		(Hash, version %d, native byte-order)
6865
68660	long	0x00053162	Berkeley DB 1.85/1.86
6867>4	long	>0		(Btree, version %d, native byte-order)
68680	belong	0x00053162	Berkeley DB 1.85/1.86
6869>4	belong	>0		(Btree, version %d, big-endian)
68700	lelong	0x00053162	Berkeley DB 1.85/1.86
6871>4	lelong	>0		(Btree, version %d, little-endian)
6872
687312	long	0x00061561	Berkeley DB
6874>16	long	>0		(Hash, version %d, native byte-order)
687512	belong	0x00061561	Berkeley DB
6876>16	belong	>0		(Hash, version %d, big-endian)
687712	lelong	0x00061561	Berkeley DB
6878>16	lelong	>0		(Hash, version %d, little-endian)
6879
688012	long	0x00053162	Berkeley DB
6881>16	long	>0		(Btree, version %d, native byte-order)
688212	belong	0x00053162	Berkeley DB
6883>16	belong	>0		(Btree, version %d, big-endian)
688412	lelong	0x00053162	Berkeley DB
6885>16	lelong	>0		(Btree, version %d, little-endian)
6886
688712	long	0x00042253	Berkeley DB
6888>16	long	>0		(Queue, version %d, native byte-order)
688912	belong	0x00042253	Berkeley DB
6890>16	belong	>0		(Queue, version %d, big-endian)
689112	lelong	0x00042253	Berkeley DB
6892>16	lelong	>0		(Queue, version %d, little-endian)
6893
6894# From Max Bowsher.
689512	long	0x00040988	Berkeley DB
6896>16	long	>0		(Log, version %d, native byte-order)
689712	belong	0x00040988	Berkeley DB
6898>16	belong	>0		(Log, version %d, big-endian)
689912	lelong	0x00040988	Berkeley DB
6900>16	lelong	>0		(Log, version %d, little-endian)
6901
6902#
6903#
6904# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
69050	string/b	RRD\0		RRDTool DB
6906>4	string/b	x		version %s
6907
6908>>10	short		!0		16bit aligned
6909>>>10	bedouble	8.642135e+130	big-endian
6910>>>>18	short		x		32bit long (m68k)
6911
6912>>10	short		0
6913>>>12	long		!0		32bit aligned
6914>>>>12	bedouble	8.642135e+130	big-endian
6915>>>>>20 long		0		64bit long
6916>>>>>20 long		!0		32bit long
6917>>>>12	ledouble	8.642135e+130	little-endian
6918>>>>>24 long		0		64bit long
6919>>>>>24 long		!0		32bit long (i386)
6920>>>>12	string		\x43\x2b\x1f\x5b\x2f\x25\xc0\xc7	middle-endian
6921>>>>>24 short		!0		32bit long (arm)
6922
6923>>8	quad		0		64bit aligned
6924>>>16	bedouble	8.642135e+130	big-endian
6925>>>>24	long		0		64bit long (s390x)
6926>>>>24	long		!0		32bit long (hppa/mips/ppc/s390/SPARC)
6927>>>16	ledouble	8.642135e+130	little-endian
6928>>>>28	long		0		64bit long (alpha/amd64/ia64)
6929>>>>28	long		!0		32bit long (armel/mipsel)
6930
6931#----------------------------------------------------------------------
6932# ROOT: file(1) magic for ROOT databases
6933#
69340       string  root\0  ROOT file
6935>4      belong  x       Version %d
6936>33     belong  x       (Compression: %d)
6937
6938# XXX: Weak magic.
6939# Alex Ott <ott@jet.msk.su>
6940## Paradox file formats
6941#2	  leshort	0x0800	Paradox
6942#>0x39	  byte		3	v. 3.0
6943#>0x39	  byte		4	v. 3.5
6944#>0x39	  byte		9	v. 4.x
6945#>0x39	  byte		10	v. 5.x
6946#>0x39	  byte		11	v. 5.x
6947#>0x39	  byte		12	v. 7.x
6948#>>0x04	  byte		0	indexed .DB data file
6949#>>0x04	  byte		1	primary index .PX file
6950#>>0x04	  byte		2	non-indexed .DB data file
6951#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
6952#>>0x04	  byte		4	secondary index .Ynn file
6953#>>0x04	  byte		5	incrementing secondary index .Xnn file
6954#>>0x04	  byte		6	non-incrementing secondary index .XGn file
6955#>>0x04	  byte		7	secondary index .YGn file
6956#>>>0x04	  byte		8	incrementing secondary index .XGn file
6957
6958## XBase database files
6959# updated by Joerg Jenderek at Feb 2013
6960# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
6961# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
6962# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
6963# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
69640	ubelong&0x0000FFFF		<0x00000C20
6965# skip Infocom game Z-machine
6966>2		ubyte			>0
6967# skip Androids *.xml
6968>>3		ubyte			>0
6969>>>3		ubyte			<32
6970# 1 < version VV
6971>>>>0		ubyte			>1
6972# skip HELP.CA3 by test for reserved byte ( NULL )
6973>>>>>27		ubyte			0
6974# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
6975#>>>>>30		ubeshort     		x		30NULL?%x
6976# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
6977>>>>>>24	ubelong&0xffFFFFff	>0x01302000
6978# .DBF or .MDX
6979>>>>>>24	ubelong&0xffFFFFff	<0x01302001
6980# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
6981>>>>>>>24	ubelong&0xffFFFFff	=0
6982# test for 2 reserved NULL bytes,transaction and encryption byte flag
6983>>>>>>>>12	ubelong&0xFFFFfEfE	0
6984# test for MDX flag
6985>>>>>>>>>28	ubyte			x
6986>>>>>>>>>28	ubyte&0xf8		0
6987# header size >= 32
6988>>>>>>>>>>8	uleshort		>31
6989# skip PIC15736.PCX by test for language driver name or field name
6990>>>>>>>>>>>32	ubyte			>0
6991#!:mime	application/x-dbf; charset=unknown-8bit ??
6992#!:mime	application/x-dbase
6993>>>>>>>>>>>>0	use			xbase-type
6994# database file
6995>>>>>>>>>>>>0	ubyte			x		\b DBF
6996>>>>>>>>>>>>4	lelong			0		\b, no records
6997>>>>>>>>>>>>4	lelong			>0		\b, %d record
6998# plural s appended
6999>>>>>>>>>>>>>4	lelong			>1		\bs
7000# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
7001# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
7002>>>>>>>>>>>>10	uleshort		x		* %d
7003# file size = records * record size + header size
7004>>>>>>>>>>>>1	ubyte			x		\b, update-date
7005>>>>>>>>>>>>1	use			xbase-date
7006# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
7007#>>>>>>>>>>>>29	ubyte			=0		\b, codepage ID=0x%x
7008# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
7009>>>>>>>>>>>>29	ubyte			>0		\b, codepage ID=0x%x
7010#>>>>>>>>>>>>28	ubyte&0x01		0		\b, no index file
7011>>>>>>>>>>>>28	ubyte&0x01		1		\b, with index file .MDX
7012>>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
7013>>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
7014# 1st record offset + 1 = header size
7015>>>>>>>>>>>>8	uleshort		>0
7016>>>>>>>>>>>>(8.s+1)	ubyte		>0
7017>>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
7018>>>>>>>>>>>>>(8.s+1)	ubyte		>0
7019>>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
7020# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
7021>>>>>>>24	ubelong&0x0133f7ff	>0
7022# test for reserved NULL byte
7023>>>>>>>>47	ubyte			0
7024# test for valid TAG key format (0x10 or 0)
7025>>>>>>>>>559	ubyte&0xeF		0
7026# test MM <= 12
7027>>>>>>>>>>45	ubeshort		<0x0C20
7028>>>>>>>>>>>45	ubyte			>0
7029>>>>>>>>>>>>46	ubyte			<32
7030>>>>>>>>>>>>>46	ubyte			>0
7031#!:mime	application/x-mdx
7032>>>>>>>>>>>>>>0		use		xbase-type
7033>>>>>>>>>>>>>>0		ubyte		x		\b MDX
7034>>>>>>>>>>>>>>1		ubyte		x		\b, creation-date
7035>>>>>>>>>>>>>>1		use		xbase-date
7036>>>>>>>>>>>>>>44	ubyte		x		\b, update-date
7037>>>>>>>>>>>>>>44	use		xbase-date
7038# No.of tags in use (1,2,5,12)
7039>>>>>>>>>>>>>>28	uleshort	x		\b, %d
7040# No. of entries in tag (0x30)
7041>>>>>>>>>>>>>>25	ubyte		x		\b/%d tags
7042#  Length of tag
7043>>>>>>>>>>>>>>26	ubyte		x		* %d
7044# 1st tag name_
7045>>>>>>>>>>>>>548	string		x		\b, 1st tag "%.11s"
7046# 2nd tag name
7047#>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
7048#
7049#		Print the xBase names of different version variants
70500	name				xbase-type
7051>0	ubyte		<2
7052# 1 < version
7053>0	ubyte		>1
7054>>0	ubyte		0x02		FoxBase
7055# FoxBase+/dBaseIII+, no memo
7056>>0	ubyte		0x03		FoxBase+/dBase III
7057!:mime	application/x-dbf
7058# dBASE IV no memo file
7059>>0	ubyte		0x04		dBase IV
7060!:mime	application/x-dbf
7061# dBASE V no memo file
7062>>0	ubyte		0x05		dBase V
7063!:mime	application/x-dbf
7064>>0	ubyte		0x30		Visual FoxPro
7065!:mime	application/x-dbf
7066>>0	ubyte		0x31		Visual FoxPro, autoincrement
7067!:mime	application/x-dbf
7068# Visual FoxPro, with field type Varchar or Varbinary
7069>>0	ubyte		0x32		Visual FoxPro, with field type Varchar
7070!:mime	application/x-dbf
7071# dBASE IV SQL, no memo;dbv memo var size (Flagship)
7072>>0	ubyte		0x43		dBase IV, with SQL table
7073!:mime	application/x-dbf
7074# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7075#>>0	ubyte		0x62		dBase IV, with SQL table
7076#!:mime	application/x-dbf
7077# dBASE IV, with memo!!
7078>>0	ubyte		0x7b		dBase IV, with memo
7079!:mime	application/x-dbf
7080# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7081#>>0	ubyte		0x82		dBase IV, with SQL system
7082#!:mime	application/x-dbf
7083# FoxBase+/dBaseIII+ with memo .DBT!
7084>>0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
7085!:mime	application/x-dbf
7086# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
7087>>0	ubyte		0x87		VISUAL OBJECTS, with memo file
7088!:mime	application/x-dbf
7089# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7090#>>0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
7091#!:mime	application/x-dbf
7092# dBASE IV with memo!
7093>>0	ubyte		0x8B		dBase IV, with memo .DBT
7094!:mime	application/x-dbf
7095# dBase IV with SQL Table,no memo?
7096>>0	ubyte		0x8E		dBase IV, with SQL table
7097!:mime	application/x-dbf
7098# .dbv and .dbt memo (Flagship)?
7099>>0	ubyte		0xB3		Flagship
7100# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7101#>>0	ubyte		0xCA		dBase IV with memo .DBT
7102#!:mime	application/x-dbf
7103# dBASE IV with SQL table, with memo .DBT
7104>>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
7105!:mime	application/x-dbf
7106# HiPer-Six format;Clipper SIX, with SMT memo file
7107>>0	ubyte		0xE5		Clipper SIX with memo
7108!:mime	application/x-dbf
7109# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7110#>>0	ubyte		0xF4		dBase IV, with SQL table, with memo
7111#!:mime	application/x-dbf
7112>>0	ubyte		0xF5		FoxPro with memo
7113!:mime	application/x-dbf
7114# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7115#>>0	ubyte		0xFA		FoxPro 2.x, with memo
7116#!:mime	application/x-dbf
7117# unknown version (should not happen)
7118>>0	default		x		xBase
7119!:mime	application/x-dbf
7120>>>0	ubyte		x		(0x%x)
7121# flags in version byte
7122# DBT flag (with dBASE III memo .DBT)!!
7123# >>0	ubyte&0x80	>0		DBT_FLAG=%x
7124# memo flag ??
7125# >>0	ubyte&0x08	>0		MEMO_FLAG=%x
7126# SQL flag ??
7127# >>0	ubyte&0x70	>0		SQL_FLAG=%x
7128#		test and print the date of xBase .DBF .MDX
71290	name				xbase-date
7130# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
7131>0	ubelong		x
7132>1	ubyte		<13
7133>>1	ubyte		>0
7134>>>2	ubyte		>0
7135>>>>2	ubyte		<32
7136>>>>>0	ubyte		x
7137# YY is interpreted as 20YY or 19YY
7138>>>>>>0	ubyte		<100		\b %.2d
7139# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
7140>>>>>>0	ubyte		>99		\b %d
7141>>>>>1	ubyte		x		\b-%d
7142>>>>>2	ubyte		x		\b-%d
7143
7144#	dBase memo files .DBT or .FPT
7145# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
714616		ubyte		<4
7147>16		ubyte		!2
7148>>16		ubyte		!1
7149# next free block index is positive
7150>>>0		ulelong		>0
7151# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
7152>>>>17		ubelong&0xFFfdFE00	0x00000000
7153# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
7154>>>>>20		ubelong&0xFF01209B	0x00000000
7155# dBASE III
7156>>>>>>16	ubyte		3
7157# dBASE III DBT
7158>>>>>>>0	use		dbase3-memo-print
7159# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
7160>>>>>>16	ubyte		0
7161# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
7162>>>>>>>20	uleshort	0
7163# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
7164>>>>>>>>8	ulong		=0
7165>>>>>>>>>6	ubeshort	>0
7166# skip emacs.PIF
7167>>>>>>>>>>4	ushort		0
7168>>>>>>>>>>>0	use		foxpro-memo-print
7169# dBASE III DBT , garbage
7170>>>>>>>>>6	ubeshort	0
7171# skip MM*DD*.bin by test for for reserved NULL byte
7172>>>>>>>>>>510	ubeshort	0
7173# skip TK-DOS11.img image by looking for memo text
7174>>>>>>>>>>>512	ubelong		<0xfeffff03
7175# skip EFI executables by looking for memo text
7176>>>>>>>>>>>>512	ubelong		>0x1F202020
7177>>>>>>>>>>>>>513 ubyte		>0
7178# unusual dBASE III DBT like adressen.dbt
7179>>>>>>>>>>>>>>0	use		dbase3-memo-print
7180# dBASE III DBT like angest.dbt, or garbage PCX DBF
7181>>>>>>>>8	ubelong		!0
7182# skip PCX and some DBF by test for for reserved NULL bytes
7183>>>>>>>>>510	ubeshort	0
7184# skip some DBF by test of invalid version
7185>>>>>>>>>>0	ubyte		>5
7186>>>>>>>>>>>0	ubyte		<48
7187>>>>>>>>>>>>0	use		dbase3-memo-print
7188# dBASE IV DBT with positive block size
7189>>>>>>>20	uleshort	>0
7190# dBASE IV DBT with valid block length like 512, 1024
7191# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
7192>>>>>>>>20	uleshort&0x800f	0
7193>>>>>>>>>0	use		dbase4-memo-print
7194
7195#		Print the information of dBase III DBT memo file
71960	name				dbase3-memo-print
7197>0	ubyte			x		dBase III DBT
7198# instead 3 as version number 0 for unusual examples like biblio.dbt
7199>16	ubyte			!3		\b, version number %u
7200# Number of next available block for appending data
7201#>0	lelong			=0		\b, next free block index %u
7202>0	lelong			!0		\b, next free block index %u
7203# no positiv block length
7204#>20	uleshort		=0		\b, block length %u
7205>20	uleshort		!0		\b, block length %u
7206# dBase III memo field terminated by \032\032
7207>512	string			>\0		\b, 1st item "%s"
7208#		Print the information of dBase IV DBT memo file
72090	name				dbase4-memo-print
7210>0		lelong		x		dBase IV DBT
7211!:mime	application/x-dbt
7212!:ext dbt
7213# 8 character shorted main name of coresponding dBASE IV DBF file
7214>8		ubelong		>0x20000000
7215# skip unusual like for angest.dbt
7216>>20		uleshort	>0
7217>>>8		string		>\0		\b of %-.8s.DBF
7218# value 0 implies 512 as size
7219#>4		ulelong		=0		\b, blocks size %u
7220# size of blocks not reliable like 0x2020204C in angest.dbt
7221>4		ulelong		!0
7222>>4		ulelong&0x0000003f	0	\b, blocks size %u
7223# dBase IV DBT with positive block length (found 512 , 1024)
7224>20		uleshort	>0		\b, block length %u
7225# next available block
7226#>0		lelong		=0		\b, next free block index %u
7227>0		lelong		!0		\b, next free block index %u
7228>20		uleshort	>0
7229>>(20.s)	ubelong		x
7230>>>&-4		use		dbase4-memofield-print
7231# unusual dBase IV DBT without block length (implies 512 as length)
7232>20		uleshort	=0
7233>>512		ubelong		x
7234>>>&-4		use				dbase4-memofield-print
7235#		Print the information of dBase IV memo field
72360	name			dbase4-memofield-print
7237# free dBase IV memo field
7238>0		ubelong		!0xFFFF0800
7239>>0		lelong		x		\b, next free block %u
7240>>4		lelong		x		\b, next used block %u
7241# used dBase IV memo field
7242>0		ubelong		=0xFFFF0800
7243# length of memo field
7244>>4		lelong		x		\b, field length %d
7245>>>8		string		>\0		\b, 1st used item "%s"
7246#		Print the information of FoxPro FPT memo file
72470	name				foxpro-memo-print
7248>0		belong		x		FoxPro FPT
7249# Size of blocks for FoxPro ( 64,256 )
7250>6		ubeshort	x		\b, blocks size %u
7251# next available block
7252#>0		belong		=0		\b, next free block index %u
7253>0		belong		!0		\b, next free block index %u
7254# field type ( 0~picture, 1~memo, 2~object )
7255>512		ubelong		<3		\b, field type %u
7256# length of memo field
7257>512		ubelong		1
7258>>516		belong		>0		\b, field length %d
7259>>>520		string		>\0		\b, 1st item "%s"
7260
7261# TODO:
7262# DBASE index file *.NDX
7263# DBASE Compound Index file *.CDX
7264# dBASE IV Printer Driver *.PRF
7265## End of XBase database stuff
7266
7267# MS Access database
72684	string	Standard\ Jet\ DB	Microsoft Access Database
7269!:mime	application/x-msaccess
72704	string	Standard\ ACE\ DB	Microsoft Access Database
7271!:mime	application/x-msaccess
7272
7273# From: Joerg Jenderek
7274# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
7275# Reference: https://github.com/libyal/libesedb/archive/master.zip
7276#	libesedb-master/documentation/
7277#	Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
7278# Note: also known as "JET Blue". Used by numerous Windows components such as
7279# Windows Search, Mail, Exchange and Active Directory.
72804	ubelong		0xefcdab89
7281# unknown1
7282>132	ubelong		0		Extensible storage engine
7283!:mime	application/x-ms-ese
7284# file_type 0~database 1~stream
7285>>12	ulelong		0		DataBase
7286# Security DataBase (sdb)
7287!:ext	edb/sdb
7288>>12	ulelong		1		STreaMing
7289!:ext	stm
7290# format_version 620h
7291>>8	uleshort	x		\b, version 0x%x
7292>>10	uleshort	>0		revision 0x%4.4x
7293>>0	ubelong		x	 	\b, checksum 0x%8.8x
7294# Page size 4096 8192 32768
7295>>236	ulequad		x		\b, page size %lld
7296# database_state
7297>>52	ulelong		1		\b, JustCreated
7298>>52	ulelong		2		\b, DirtyShutdown
7299#>>52	ulelong		3		\b, CleanShutdown
7300>>52	ulelong		4		\b, BeingConverted
7301>>52	ulelong		5		\b, ForceDetach
7302# Windows�NT major version when the databases indexes were updated.
7303>>216	ulelong		x		\b, Windows version %d
7304# Windows�NT minor version
7305>>220	ulelong		x		\b.%d
7306
7307# From: Joerg Jenderek
7308# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility
7309# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
73108	string		sdbf
7311>7	ubyte		0
7312# TAG_TYPE_LIST+TAG_INDEXES
7313>>12	uleshort	0x7802		Windows application compatibility Shim DataBase
7314# version? 2 3
7315#>>>0	ulelong		x		\b, version %d
7316!:mime	application/x-ms-sdb
7317!:ext	sdb
7318
7319# TDB database from Samba et al - Martin Pool <mbp@samba.org>
73200	string	TDB\ file		TDB database
7321>32	lelong	0x2601196D		version 6, little-endian
7322>>36	lelong	x			hash size %d bytes
7323
7324# SE Linux policy database
73250       lelong  0xf97cff8c      SE Linux policy
7326>16     lelong  x               v%d
7327>20     lelong  1      MLS
7328>24     lelong  x       %d symbols
7329>28     lelong  x       %d ocons
7330
7331# ICE authority file data (Wolfram Kleff)
73322	string		ICE		ICE authority data
7333
7334# X11 Xauthority file (Wolfram Kleff)
733510	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
733611	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
733712	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
733813	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
733914	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
734015	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
734116	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
734217	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
734318	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
7344
7345# From: Maxime Henrion <mux@FreeBSD.org>
7346# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
73470	string		PGDMP		PostgreSQL custom database dump
7348>5	byte		x		- v%d
7349>6	byte		x		\b.%d
7350>5	beshort		<0x101		\b-0
7351>5	beshort		>0x100
7352>>7	byte		x		\b-%d
7353
7354# Type: Advanced Data Format (ADF) database
7355# URL:  http://www.grc.nasa.gov/WWW/cgns/adf/
7356# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
73570	string	@(#)ADF\ Database	CGNS Advanced Data Format
7358
7359# Tokyo Cabinet magic data
7360# http://tokyocabinet.sourceforge.net/index.html
73610	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
7362>14	string		x			\b (%s)
7363>32	byte		0			\b, Hash
7364!:mime	application/x-tokyocabinet-hash
7365>32	byte		1			\b, B+ tree
7366!:mime	application/x-tokyocabinet-btree
7367>32	byte		2			\b, Fixed-length
7368!:mime	application/x-tokyocabinet-fixed
7369>32	byte		3			\b, Table
7370!:mime	application/x-tokyocabinet-table
7371>33	byte		&1			\b, [open]
7372>33	byte		&2			\b, [fatal]
7373>34	byte		x			\b, apow=%d
7374>35	byte		x			\b, fpow=%d
7375>36	byte		&0x01			\b, [large]
7376>36	byte		&0x02			\b, [deflate]
7377>36	byte		&0x04			\b, [bzip]
7378>36	byte		&0x08			\b, [tcbs]
7379>36	byte		&0x10			\b, [excodec]
7380>40	lequad		x			\b, bnum=%lld
7381>48	lequad		x			\b, rnum=%lld
7382>56	lequad		x			\b, fsiz=%lld
7383
7384# Type:	QDBM Quick Database Manager
7385# From:	Benoit Sibaud <bsibaud@april.org>
73860	string		\\[depot\\]\n\f		Quick Database Manager, little endian
73870	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian
7388
7389# Type:	TokyoCabinet database
7390# URL:	http://tokyocabinet.sourceforge.net/
7391# From:	Benoit Sibaud <bsibaud@april.org>
73920	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
7393>14	string		x			(version %s)
7394
7395# From:  Stephane Blondon http://www.yaal.fr
7396# Database file for Zope (done by FileStorage)
73970	string	FS21	Zope Object Database File Storage v3 (data)
73980	string	FS30	Zope Object Database File Storage v4 (data)
7399
7400# Cache file for the database of Zope (done by ClientStorage)
74010	string		ZEC3	Zope Object Database Client Cache File (data)
7402
7403# IDA (Interactive Disassembler) database
74040	string		IDA1	IDA (Interactive Disassembler) database
7405
7406# Hopper (reverse engineering tool) http://www.hopperapp.com/
74070	string		hopperdb	Hopper database
7408
7409# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
7410# Reference: http://www.provue.com/Panorama/
7411# From: Joerg Jenderek
7412# NOTE: test only versions 4 and 6.0 with Windows
7413# length of Panorama database name
74145	ubyte				>0
7415# look after database name for "some" null bits
7416>(5.B+7)	ubelong&0xF3ffF000	0
7417# look for first keyword
7418>>&1		search/2		DESIGN		Panorama database
7419#!:mime	application/x-panorama-database
7420!:apple	KASXZEPD
7421!:ext	pan
7422# database name
7423>>>5	pstring				x		\b, "%s"
7424
7425#
7426#
7427# askSam Database by Stefan A. Haubenthal <polluks@web.de>
74280	string	askw40\0	askSam DB
7429
7430#
7431#
7432# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
74330	string	MBSTV\040	MUIbase DB
7434>6	string	x		version %s
7435
7436#
7437# CDB database
74380	string	NBCDB\012	NetBSD Constant Database
7439>7	byte	x		\b, version %d
7440>8	string	x		\b, for '%s'
7441>24	lelong	x		\b, datasize %d
7442>28	lelong	x		\b, entries %d
7443>32	lelong	x		\b, index %d
7444>36	lelong	x		\b, seed %#x
7445#------------------------------------------------------------------------------
7446# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $
7447# der: file(1) magic for DER encoded files
7448#
7449
7450# Certificate information piece
74510	name	certinfo
7452>0	der	seq
7453>>&0	der	set
7454>>>&0	der	seq
7455>>>>&0	der	obj_id3=550406
7456>>>>&0	der	prt_str=x	\b, countryName=%s
7457>>&0	der	set
7458>>>&0	der	seq
7459>>>>&0	der	obj_id3=550408
7460>>>>&0	der	utf8_str=x	\b, stateOrProvinceName=%s
7461>>&0	der	set
7462>>>&0	der	seq
7463>>>>&0	der	obj_id3=55040a
7464>>>>&0	der	utf8_str=x	\b, organizationName=%s
7465>>&0	der	set
7466>>>&0	der	seq
7467>>>>&0	der	obj_id3=550403
7468>>>>&0	der	utf8_str=x	\b, commonName=%s
7469>>&0	der	seq
7470
7471# Certificate requests
74720	der	seq
7473>&0	der	seq
7474>>&0	der	int1=00		DER Encoded Certificate request
7475>>&0	use	certinfo
7476
7477# Key Pairs
74780	der	seq
7479>&0	der	int1=00
7480>&0	der	int65=x
7481>&0	der	int3=010001	DER Encoded Key Pair, 512 bits
7482
74830	der	seq
7484>&0	der	int1=00
7485>&0	der	int129=x
7486>&0	der	int3=010001	DER Encoded Key Pair, 1024 bits
7487
74880	der	seq
7489>&0	der	int1=00
7490>&0	der	int257=x
7491>&0	der	int3=010001	DER Encoded Key Pair, 2048 bits
7492
74930	der	seq
7494>&0	der	int1=00
7495>&0	der	int513=x
7496>&0	der	int3=010001	DER Encoded Key Pair, 4096 bits
7497
74980	der	seq
7499>&0	der	int1=00
7500>&0	der	int1025=x
7501>&0	der	int3=010001	DER Encoded Key Pair, 8192 bits
7502
75030	der	seq
7504>&0	der	int1=00
7505>&0	der	int2049=x
7506>&0	der	int3=010001	DER Encoded Key Pair, 16k bits
7507
75080	der	seq
7509>&0	der	int1=00
7510>&0	der	int4097=x
7511>&0	der	int3=010001	DER Encoded Key Pair, 32k bits
7512
7513# Certificates
75140	der	seq
7515>&0	der	seq
7516>>&0	der	int2=0dfa	DER Encoded Certificate, 512 bits
7517>>&0	der	int2=0dfb	DER Encoded Certificate, 1024 bits
7518>>&0	der	int2=0dfc	DER Encoded Certificate, 2048 bits
7519>>&0	der	int2=0dfd	DER Encoded Certificate, 4096 bits
7520>>&0	der	int2=0dfe	DER Encoded Certificate, 8192 bits
7521>>&0	der	int2=0dff	DER Encoded Certificate, 16k bits
7522>>&0	der	int2=0e04	DER Encoded Certificate, 32k bits
7523>>&0	der	int2=x		DER Encoded Certificate, ? bits (%s)
7524>>&0	der	seq
7525>>>&0	der	obj_id9=2a864886f70d010105	\b, sha1WithRSAEncryption
7526>>>&0	der	obj_id9=x			\b, ? Encryption (%s)
7527>>>&0	der	null
7528>>&0	der	seq
7529>>>&0	der	set
7530>>>>&0	der	seq
7531>>>>>&0	der	obj_id3=550406
7532>>>>>&0	der	prt_str=x	\b, countryName=%s
7533>>>&0	der	set
7534>>>>&0	der	seq
7535>>>>>&0	der	obj_id3=550408
7536>>>>>&0	der	prt_str=x	\b, stateOrProvinceName=%s
7537>>>&0	der	set
7538>>>>&0	der	seq
7539>>>>>&0	der	obj_id3=550407
7540>>>>>&0	der	prt_str=x	\b, localityName=%s
7541>>>&0	der	set
7542>>>>&0	der	seq
7543>>>>>&0	der	obj_id3=55040a
7544>>>>>&0	der	prt_str=x	\b, organizationName=%s
7545>>>&0	der	set
7546>>>>&0	der	seq
7547>>>>>&0	der	obj_id3=55040b
7548>>>>>&0	der	prt_str=x	\b, organizationUnitName=%s
7549>>>&0	der	set
7550>>>>&0	der	seq
7551>>>>>&0	der	obj_id3=550403
7552>>>>>&0	der	prt_str=x	\b, commonName=%s
7553>>>&0	der	set
7554>>>>&0	der	seq
7555>>>>>&0	der	obj_id9=2a864886f70d010901
7556>>>>>&0	der	ia5_str=x	\b, emailAddress=%s
7557>>&0	der	seq
7558>>>&0	der	utc_time=x	\b, utcTime=%s
7559>>>&0	der	utc_time=x	\b, utcTime=%s
7560>>&0	use	certinfo
7561
7562#------------------------------------------------------------------------------
7563# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
7564# diamond:  file(1) magic for Diamond system
7565#
7566# ... diamond is a multi-media mail and electronic conferencing system....
7567#
7568# XXX - I think it was either renamed Slate, or replaced by Slate....
7569#
7570#	The full deal is too long...
7571#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
75720	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
7573
7574#------------------------------------------------------------------------------
7575# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
7576# diff:  file(1) magic for diff(1) output
7577#
75780	search/1	diff\040	diff output text
7579!:mime	text/x-diff
75800	search/1	***\040 	diff output text
7581!:mime	text/x-diff
75820	search/1	Only\040in\040 	diff output text
7583!:mime	text/x-diff
75840	search/1	Common\040subdirectories:\040 	diff output text
7585!:mime	text/x-diff
7586
75870	search/1	Index:		RCS/CVS diff output text
7588!:mime	text/x-diff
7589
7590# bsdiff:  file(1) magic for bsdiff(1) output
75910	string/b		BSDIFF40	bsdiff(1) patch file
7592
7593
7594# unified diff
75950	search/4096	---\040
7596>&0	search/1024 \n
7597>>&0	search/1 +++\040
7598>>>&0	search/1024 \n
7599>>>>&0	search/1 @@	unified diff output text
7600!:mime	text/x-diff
7601!:strength + 90
7602
7603# librsync -- the library for network deltas
7604#
7605# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
7606# this file.
7607#
76080	belong		0x72730236	rdiff network-delta data
7609
76100	belong		0x72730136	rdiff network-delta signature data
7611>4	belong		x		(block length=%d,
7612>8	belong		x		signature strength=%d)
7613
7614#------------------------------------------------------------------------------
7615# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
7616#  Digital UNIX - Info
7617#
76180	string	=!<arch>\n________64E	Alpha archive
7619>22	string	X			-- out of date
7620#
7621
76220	leshort		0603
7623>24	leshort		0410		COFF format alpha pure
7624>24	leshort		0413		COFF format alpha demand paged
7625>>22	leshort&030000	!020000		executable
7626>>22	leshort&020000	!0		dynamically linked
7627>>16	lelong		!0		not stripped
7628>>16	lelong		0		stripped
7629>>27	byte		x		- version %d
7630>>26	byte		x		\b.%d
7631>>28	byte		x		\b-%d
7632>24	leshort		0407		COFF format alpha object
7633>>22	leshort&030000	020000		shared library
7634>>27	byte		x		- version %d
7635>>26	byte		x		\b.%d
7636>>28	byte		x		\b-%d
7637
7638# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
7639#
7640# The actual magic number is just "Core", followed by a 2-byte version
7641# number; however, treating any file that begins with "Core" as a Digital
7642# UNIX core dump file may produce too many false hits, so we include one
7643# byte of the version number as well; DU 5.0 appears only to be up to
7644# version 2.
7645#
76460	string		Core\001	Alpha COFF format core dump (Digital UNIX)
7647>24	string		>\0		\b, from '%s'
76480	string		Core\002	Alpha COFF format core dump (Digital UNIX)
7649>24	string		>\0		\b, from '%s'
7650#
7651# The next is incomplete, we could tell more about this format,
7652# but its not worth it.
76530	leshort		0x188	Alpha compressed COFF
76540	leshort		0x18f	Alpha u-code object
7655#
7656#
7657# Some other interesting Digital formats,
76580	string	\377\377\177		ddis/ddif
76590	string	\377\377\174		ddis/dots archive
76600	string	\377\377\176		ddis/dtif table data
76610	string	\033c\033		LN03 output
76620	long	04553207		X image
7663#
76640	string	=!<PDF>!\n		profiling data file
7665#
7666# Locale data tables (MIPS and Alpha).
7667#
76680	short		0x0501		locale data table
7669>6	short		0x24		for MIPS
7670>6	short		0x40		for Alpha
7671
7672#------------------------------------------------------------------------------
7673# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $
7674# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
7675# from http://www.atsc.org/standards/a_52a.pdf
7676# corrections, additions, etc. are always welcome!
7677#
7678# syncword
76790	beshort		0x0b77	ATSC A/52 aka AC-3 aka Dolby Digital stream,
7680# Proposed audio/ac3 RFC/4184
7681!:mime	audio/vnd.dolby.dd-raw
7682# fscod
7683>4	byte&0xc0 = 0x00	48 kHz,
7684>4	byte&0xc0 = 0x40	44.1 kHz,
7685>4	byte&0xc0 = 0x80	32 kHz,
7686# is this one used for 96 kHz?
7687>4	byte&0xc0 = 0xc0	reserved frequency,
7688#
7689>5	byte&0x07 = 0x00	\b, complete main (CM)
7690>5	byte&0x07 = 0x01	\b, music and effects (ME)
7691>5	byte&0x07 = 0x02	\b, visually impaired (VI)
7692>5	byte&0x07 = 0x03	\b, hearing impaired (HI)
7693>5	byte&0x07 = 0x04	\b, dialogue (D)
7694>5	byte&0x07 = 0x05	\b, commentary (C)
7695>5	byte&0x07 = 0x06	\b, emergency (E)
7696>5	beshort&0x07e0  0x0720	\b, voiceover (VO)
7697>5	beshort&0x07e0 >0x0720	\b, karaoke
7698# acmod
7699>6	byte&0xe0 = 0x00	1+1 front,
7700>>6	byte&0x10 = 0x10	LFE on,
7701>6	byte&0xe0 = 0x20	1 front/0 rear,
7702>>6	byte&0x10 = 0x10	LFE on,
7703>6	byte&0xe0 = 0x40	2 front/0 rear,
7704# dsurmod (for stereo only)
7705>>6	byte&0x18 = 0x00	Dolby Surround not indicated
7706>>6	byte&0x18 = 0x08	not Dolby Surround encoded
7707>>6	byte&0x18 = 0x10	Dolby Surround encoded
7708>>6	byte&0x18 = 0x18	reserved Dolby Surround mode
7709>>6	byte&0x04 = 0x04	LFE on,
7710>6	byte&0xe0 = 0x60	3 front/0 rear,
7711>>6	byte&0x04 = 0x04	LFE on,
7712>6	byte&0xe0 = 0x80	2 front/1 rear,
7713>>6	byte&0x04 = 0x04	LFE on,
7714>6	byte&0xe0 = 0xa0	3 front/1 rear,
7715>>6	byte&0x01 = 0x01	LFE on,
7716>6	byte&0xe0 = 0xc0	2 front/2 rear,
7717>>6	byte&0x04 = 0x04	LFE on,
7718>6	byte&0xe0 = 0xe0	3 front/2 rear,
7719>>6	byte&0x01 = 0x01	LFE on,
7720#
7721>4	byte&0x3e = 0x00	\b, 32 kbit/s
7722>4	byte&0x3e = 0x02	\b, 40 kbit/s
7723>4	byte&0x3e = 0x04	\b, 48 kbit/s
7724>4	byte&0x3e = 0x06	\b, 56 kbit/s
7725>4	byte&0x3e = 0x08	\b, 64 kbit/s
7726>4	byte&0x3e = 0x0a	\b, 80 kbit/s
7727>4	byte&0x3e = 0x0c	\b, 96 kbit/s
7728>4	byte&0x3e = 0x0e	\b, 112 kbit/s
7729>4	byte&0x3e = 0x10	\b, 128 kbit/s
7730>4	byte&0x3e = 0x12	\b, 160 kbit/s
7731>4	byte&0x3e = 0x14	\b, 192 kbit/s
7732>4	byte&0x3e = 0x16	\b, 224 kbit/s
7733>4	byte&0x3e = 0x18	\b, 256 kbit/s
7734>4	byte&0x3e = 0x1a	\b, 320 kbit/s
7735>4	byte&0x3e = 0x1c	\b, 384 kbit/s
7736>4	byte&0x3e = 0x1e	\b, 448 kbit/s
7737>4	byte&0x3e = 0x20	\b, 512 kbit/s
7738>4	byte&0x3e = 0x22	\b, 576 kbit/s
7739>4	byte&0x3e = 0x24	\b, 640 kbit/s
7740
7741#------------------------------------------------------------------------------
7742# $File: dump,v 1.14 2017/03/17 21:35:28 christos Exp $
7743# dump:  file(1) magic for dump file format--for new and old dump filesystems
7744#
7745# We specify both byte orders in order to recognize byte-swapped dumps.
7746#
77470	name	new-dump-be
7748>4	bedate	x		Previous dump %s,
7749>8	bedate	x		This dump %s,
7750>12	belong	>0		Volume %d,
7751>692	belong	0		Level zero, type:
7752>692	belong	>0		Level %d, type:
7753>0	belong	1		tape header,
7754>0	belong	2		beginning of file record,
7755>0	belong	3		map of inodes on tape,
7756>0	belong	4		continuation of file record,
7757>0	belong	5		end of volume,
7758>0	belong	6		map of inodes deleted,
7759>0	belong	7		end of medium (for floppy),
7760>676	string	>\0		Label %s,
7761>696	string	>\0		Filesystem %s,
7762>760	string	>\0		Device %s,
7763>824	string	>\0		Host %s,
7764>888	belong	>0		Flags %x
7765
77660	name	old-dump-be
7767#>4	bedate	x		Previous dump %s,
7768#>8	bedate	x		This dump %s,
7769>12	belong	>0		Volume %d,
7770>692	belong	0		Level zero, type:
7771>692	belong	>0		Level %d, type:
7772>0	belong	1		tape header,
7773>0	belong	2		beginning of file record,
7774>0	belong	3		map of inodes on tape,
7775>0	belong	4		continuation of file record,
7776>0	belong	5		end of volume,
7777>0	belong	6		map of inodes deleted,
7778>0	belong	7		end of medium (for floppy),
7779>676	string	>\0		Label %s,
7780>696	string	>\0		Filesystem %s,
7781>760	string	>\0		Device %s,
7782>824	string	>\0		Host %s,
7783>888	belong	>0		Flags %x
7784
77850	name	ufs2-dump-be
7786>896	beqdate	x		Previous dump %s,
7787>904	beqdate	x		This dump %s,
7788>12	belong	>0		Volume %d,
7789>692	belong	0		Level zero, type:
7790>692	belong	>0		Level %d, type:
7791>0	belong	1		tape header,
7792>0	belong	2		beginning of file record,
7793>0	belong	3		map of inodes on tape,
7794>0	belong	4		continuation of file record,
7795>0	belong	5		end of volume,
7796>0	belong	6		map of inodes deleted,
7797>0	belong	7		end of medium (for floppy),
7798>676	string	>\0		Label %s,
7799>696	string	>\0		Filesystem %s,
7800>760	string	>\0		Device %s,
7801>824	string	>\0		Host %s,
7802>888	belong	>0		Flags %x
7803
780424	belong	60012		new-fs dump file (big endian),
7805>0	use	new-dump-be
7806
780724	belong	60011		old-fs dump file (big endian),
7808>0	use	old-dump-be
7809
781024	lelong	60012		new-fs dump file (little endian),
7811# to correctly recognize '*.mo' GNU message catalog (little endian)
7812!:strength - 15
7813>0	use	\^new-dump-be
7814
781524	lelong	60011		old-fs dump file (little endian),
7816>0	use	\^old-dump-be
7817
7818
781924	belong	0x19540119	new-fs dump file (ufs2, big endian),
7820>0	use	ufs2-dump-be
7821
782224	lelong	0x19540119	new-fs dump file (ufs2, little endian),
7823>0	use	\^ufs2-dump-be
7824
782518	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
7826>2	medate	x		Previous dump %s,
7827>6	medate	x		This dump %s,
7828>10	leshort	>0		Volume %d,
7829>0	leshort	1		tape header.
7830>0	leshort	2		beginning of file record.
7831>0	leshort	3		map of inodes on tape.
7832>0	leshort	4		continuation of file record.
7833>0	leshort	5		end of volume.
7834>0	leshort	6		map of inodes deleted.
7835>0	leshort	7		end of medium (for floppy).
7836
7837#------------------------------------------------------------------------------
7838# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $
7839# Dyadic: file(1) magic for Dyalog APL.
7840#
7841# updated by Joerg Jenderek at Oct 2013
7842# http://en.wikipedia.org/wiki/Dyalog_APL
7843# http://www.dyalog.com/
7844# .DXV Dyalog APL External Variable
7845# .DIN Dyalog APL Input Table
7846# .DOT Dyalog APL Output Table
7847# .DFT Dyalog APL Format File
78480	ubeshort&0xFF60	0xaa00
7849# skip biblio.dbt
7850>1	byte		!4
7851# real Dyalog APL have non zero version numbers like 7.3 or 13.4
7852>>2	ubeshort	>0x0000		Dyalog APL
7853>>>1	byte		0x00		aplcore
7854#>>>1	byte		0x00		incomplete workspace
7855# *.DCF Dyalog APL Component File
7856>>>1	byte		0x01		component file 32-bit non-journaled non-checksummed
7857#>>>1	byte		0x01		component file
7858>>>1	byte		0x02		external variable exclusive
7859#>>>1	byte		0x02		external variable
7860# *.DWS Dyalog APL Workspace
7861>>>1	byte		0x03		workspace
7862>>>>7	byte&0x28	0x00		32-bit
7863>>>>7	byte&0x28	0x20		64-bit
7864>>>>7	byte&0x0c	0x00		classic
7865>>>>7	byte&0x0c	0x04		unicode
7866>>>>7	byte&0x88	0x00		big-endian
7867>>>>7	byte&0x88	0x80		little-endian
7868>>>1	byte		0x06		external variable shared
7869# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
7870>>>1	byte		0x07		session
7871>>>1	byte		0x08		mapped file 32-bit
7872>>>1	byte		0x09		component file 64-bit non-journaled non-checksummed
7873>>>1	byte		0x0a		mapped file 64-bit
7874>>>1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
7875>>>1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
7876>>>1	byte		0x0d		component file 32-bit level 1 journaled checksummed
7877>>>1	byte		0x0e		component file 64-bit level 1 journaled checksummed
7878>>>1	byte		0x0f		component file 32-bit level 2 journaled checksummed
7879>>>1	byte		0x10		component file 64-bit level 2 journaled checksummed
7880>>>1	byte		0x11		component file 32-bit level 3 journaled checksummed
7881>>>1	byte		0x12		component file 64-bit level 3 journaled checksummed
7882>>>1	byte		0x13		component file 32-bit non-journaled checksummed
7883>>>1	byte		0x14		component file 64-bit non-journaled checksummed
7884>>>1	byte		0x15		component file under construction
7885>>>1	byte		0x16		DFS component file 64-bit level 1 journaled checksummed
7886>>>1	byte		0x17		DFS component file 64-bit level 2 journaled checksummed
7887>>>1	byte		0x18		DFS component file 64-bit level 3 journaled checksummed
7888>>>1	byte		0x19		external workspace
7889>>>1	byte		0x80		DDB
7890>>>2	byte		x		version %d
7891>>>3	byte		x		\b.%d
7892#>>>2	byte		x		type %d
7893#>>>3	byte		x		subtype %d
7894
7895# *.DXF Dyalog APL Transfer File
78960	short		0x6060		Dyalog APL transfer
7897
7898#------------------------------------------------------------------------------
7899# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $
7900# ebml:  file(1) magic for various Extensible Binary Meta Language
7901# http://www.matroska.org/technical/specs/index.html#track
79020	belong	0x1a45dfa3	EBML file
7903>4	search/b/100	\102\202
7904>>&1	string	x		\b, creator %.8s
7905
7906#------------------------------------------------------------------------------
7907# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
7908# T602 editor documents
7909# by David Necas <yeti@physics.muni.cz>
79100	string	@CT\ 	T602 document data,
7911>4	string	0	Kamenicky
7912>4	string	1	CP 852
7913>4	string	2	KOI8-CS
7914>4	string	>2	unknown encoding
7915
7916# Vi IMproved Encrypted file
7917# by David Necas <yeti@physics.muni.cz>
79180	string	VimCrypt~	Vim encrypted file data
7919
79200	name	vimnanoswap
7921>67	byte	0
7922>>107	byte	0
7923#>>>2	string	x	%s swap file
7924>>>24	ulelong	x	\b, pid %d
7925>>>28	string	>\0	\b, user %s
7926>>>68	string	>\0	\b, host %s
7927>>>108	string	>\0	\b, file %s
7928>>>1007	byte	0x55	\b, modified
7929
7930# Vi IMproved Swap file
7931# by Sven Wegener <swegener@gentoo.org>
79320	string  b0VIM\ 		Vim swap file
7933>&0	string  >\0		\b, version %s
7934>0	use	vimnanoswap
7935
7936
7937# Lock/swap file for several editors, at least
7938# Vi IMproved and nano
79390	string	b0nano		Nano swap file
7940>0	use	vimnanoswap
7941
7942# kate (K Advanced Text Editor)
79430	string	\x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00	Kate swap file
7944
7945#------------------------------------------------------------------------------
7946# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
7947# efi:  file(1) magic for Universal EFI binaries
7948
79490	lelong	0x0ef1fab9
7950>4	lelong	1		Universal EFI binary with 1 architecture
7951>>&0	lelong	7		\b, i386
7952>>&0	lelong	0x01000007	\b, x86_64
7953>4	lelong	2		Universal EFI binary with 2 architectures
7954>>&0	lelong	7		\b, i386
7955>>&0	lelong	0x01000007	\b, x86_64
7956>>&20	lelong	7		\b, i386
7957>>&20	lelong	0x01000007	\b, x86_64
7958>4	lelong	>2		Universal EFI binary with %d architectures
7959
7960#------------------------------------------------------------------------------
7961# $File: elf,v 1.70 2016/06/02 12:36:30 christos Exp $
7962# elf:  file(1) magic for ELF executables
7963#
7964# We have to check the byte order flag to see what byte order all the
7965# other stuff in the header is in.
7966#
7967# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
7968#
7969# Created by: unknown
7970# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
7971# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
7972# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
7973# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
7974# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
7975
79760	name		elf-mips
7977>0	lelong&0xf0000000	0x00000000	MIPS-I
7978>0	lelong&0xf0000000	0x10000000	MIPS-II
7979>0	lelong&0xf0000000	0x20000000	MIPS-III
7980>0	lelong&0xf0000000	0x30000000	MIPS-IV
7981>0	lelong&0xf0000000	0x40000000	MIPS-V
7982>0	lelong&0xf0000000	0x50000000	MIPS32
7983>0	lelong&0xf0000000	0x60000000	MIPS64
7984>0	lelong&0xf0000000	0x70000000	MIPS32 rel2
7985>0	lelong&0xf0000000	0x80000000	MIPS64 rel2
7986>0	lelong&0xf0000000	0x90000000	MIPS32 rel6
7987>0	lelong&0xf0000000	0xa0000000	MIPS64 rel6
7988
79890	name		elf-sparc
7990>0	lelong&0x00ffff00	0x00000100	V8+ Required,
7991>0	lelong&0x00ffff00	0x00000200	Sun UltraSPARC1 Extensions Required,
7992>0	lelong&0x00ffff00	0x00000400	HaL R1 Extensions Required,
7993>0	lelong&0x00ffff00	0x00000800	Sun UltraSPARC3 Extensions Required,
7994>0	lelong&0x3		0		total store ordering,
7995>0	lelong&0x3		1		partial store ordering,
7996>0	lelong&0x3		2		relaxed memory ordering,
7997
79980	name		elf-pa-risc
7999>2	leshort		0x0214		2.0
8000>0	leshort		&0x0008		(LP64)
8001
80020	name		elf-le
8003>16	leshort		0		no file type,
8004!:mime	application/octet-stream
8005>16	leshort		1		relocatable,
8006!:mime	application/x-object
8007>16	leshort		2		executable,
8008!:mime	application/x-executable
8009>16	leshort		3		shared object,
8010!:mime	application/x-sharedlib
8011>16	leshort		4		core file
8012!:mime	application/x-coredump
8013# Core file detection is not reliable.
8014#>>>(0x38+0xcc) string	>\0		of '%s'
8015#>>>(0x38+0x10) lelong	>0		(signal %d),
8016>16	leshort		&0xff00		processor-specific,
8017>18	clear		x
8018>18	leshort		0		no machine,
8019>18	leshort		1		AT&T WE32100,
8020>18	leshort		2		SPARC,
8021>18	leshort		3		Intel 80386,
8022>18	leshort		4		Motorola m68k,
8023>>4	byte		1
8024>>>36	lelong		&0x01000000	68000,
8025>>>36	lelong		&0x00810000	CPU32,
8026>>>36	lelong		0		68020,
8027>18	leshort		5		Motorola m88k,
8028>18	leshort		6		Intel 80486,
8029>18	leshort		7		Intel 80860,
8030# The official e_machine number for MIPS is now #8, regardless of endianness.
8031# The second number (#10) will be deprecated later. For now, we still
8032# say something if #10 is encountered, but only gory details for #8.
8033>18	leshort		8		MIPS,
8034>>4	byte		1
8035>>>36	lelong		&0x20		N32
8036>18	leshort		10		MIPS,
8037>>4	byte		1
8038>>>36	lelong		&0x20		N32
8039>18	leshort		8
8040# only for 32-bit
8041>>4	byte		1
8042>>>36	use		elf-mips
8043# only for 64-bit
8044>>4	byte		2
8045>>>48	use		elf-mips
8046>18	leshort		9		Amdahl,
8047>18	leshort		10		MIPS (deprecated),
8048>18	leshort		11		RS6000,
8049>18	leshort		15		PA-RISC,
8050# only for 32-bit
8051>>4	byte		1
8052>>>36	use		elf-pa-risc
8053# only for 64-bit
8054>>4	byte		2
8055>>>48	use		elf-pa-risc
8056>18	leshort		16		nCUBE,
8057>18	leshort		17		Fujitsu VPP500,
8058>18	leshort		18		SPARC32PLUS,
8059# only for 32-bit
8060>>4	byte		1
8061>>>36	use		elf-sparc
8062>18	leshort		19		Intel 80960,
8063>18	leshort		20		PowerPC or cisco 4500,
8064>18	leshort		21		64-bit PowerPC or cisco 7500,
8065>18	leshort		22		IBM S/390,
8066>18	leshort		23		Cell SPU,
8067>18	leshort		24		cisco SVIP,
8068>18	leshort		25		cisco 7200,
8069>18	leshort		36		NEC V800 or cisco 12000,
8070>18	leshort		37		Fujitsu FR20,
8071>18	leshort		38		TRW RH-32,
8072>18	leshort		39		Motorola RCE,
8073>18	leshort		40		ARM,
8074>>4	byte		1
8075>>>36	lelong&0xff000000	0x04000000	EABI4
8076>>>36	lelong&0xff000000	0x05000000	EABI5
8077>>>36	lelong		&0x00800000	BE8
8078>>>36	lelong		&0x00400000	LE8
8079>18	leshort		41		Alpha,
8080>18	leshort		42		Renesas SH,
8081>18	leshort		43		SPARC V9,
8082>>4	byte		2
8083>>>48	use		elf-sparc
8084>18	leshort		44		Siemens Tricore Embedded Processor,
8085>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
8086>18	leshort		46		Renesas H8/300,
8087>18	leshort		47		Renesas H8/300H,
8088>18	leshort		48		Renesas H8S,
8089>18	leshort		49		Renesas H8/500,
8090>18	leshort		50		IA-64,
8091>18	leshort		51		Stanford MIPS-X,
8092>18	leshort		52		Motorola Coldfire,
8093>18	leshort		53		Motorola M68HC12,
8094>18	leshort		54		Fujitsu MMA,
8095>18	leshort		55		Siemens PCP,
8096>18	leshort		56		Sony nCPU,
8097>18	leshort		57		Denso NDR1,
8098>18	leshort		58		Start*Core,
8099>18	leshort		59		Toyota ME16,
8100>18	leshort		60		ST100,
8101>18	leshort		61		Tinyj emb.,
8102>18	leshort		62		x86-64,
8103>18	leshort		63		Sony DSP,
8104>18	leshort		64		DEC PDP-10,
8105>18	leshort		65		DEC PDP-11,
8106>18	leshort		66		FX66,
8107>18	leshort		67		ST9+ 8/16 bit,
8108>18	leshort		68		ST7 8 bit,
8109>18	leshort		69		MC68HC16,
8110>18	leshort		70		MC68HC11,
8111>18	leshort		71		MC68HC08,
8112>18	leshort		72		MC68HC05,
8113>18	leshort		73		SGI SVx or Cray NV1,
8114>18	leshort		74		ST19 8 bit,
8115>18	leshort		75		Digital VAX,
8116>18	leshort		76		Axis cris,
8117>18	leshort		77		Infineon 32-bit embedded,
8118>18	leshort		78		Element 14 64-bit DSP,
8119>18	leshort		79		LSI Logic 16-bit DSP,
8120>18	leshort		80		MMIX,
8121>18	leshort		81		Harvard machine-independent,
8122>18	leshort		82		SiTera Prism,
8123>18	leshort		83		Atmel AVR 8-bit,
8124>18	leshort		84		Fujitsu FR30,
8125>18	leshort		85		Mitsubishi D10V,
8126>18	leshort		86		Mitsubishi D30V,
8127>18	leshort		87		NEC v850,
8128>18	leshort		88		Renesas M32R,
8129>18	leshort		89		Matsushita MN10300,
8130>18	leshort		90		Matsushita MN10200,
8131>18	leshort		91		picoJava,
8132>18	leshort		92		OpenRISC,
8133>18	leshort		93		ARC Cores Tangent-A5,
8134>18	leshort		94		Tensilica Xtensa,
8135>18	leshort		95		Alphamosaic VideoCore,
8136>18	leshort		96		Thompson Multimedia,
8137>18	leshort		97		NatSemi 32k,
8138>18	leshort		98		Tenor Network TPC,
8139>18	leshort		99		Trebia SNP 1000,
8140>18	leshort		100		STMicroelectronics ST200,
8141>18	leshort		101		Ubicom IP2022,
8142>18	leshort		102		MAX Processor,
8143>18	leshort		103		NatSemi CompactRISC,
8144>18	leshort		104		Fujitsu F2MC16,
8145>18	leshort		105		TI msp430,
8146>18	leshort		106		Analog Devices Blackfin,
8147>18	leshort		107		S1C33 Family of Seiko Epson,
8148>18	leshort		108		Sharp embedded,
8149>18	leshort		109		Arca RISC,
8150>18	leshort		110		PKU-Unity Ltd.,
8151>18	leshort		111		eXcess: 16/32/64-bit,
8152>18	leshort		112		Icera Deep Execution Processor,
8153>18	leshort		113		Altera Nios II,
8154>18	leshort		114		NatSemi CRX,
8155>18	leshort		115		Motorola XGATE,
8156>18	leshort		116		Infineon C16x/XC16x,
8157>18	leshort		117		Renesas M16C series,
8158>18	leshort		118		Microchip dsPIC30F,
8159>18	leshort		119		Freescale RISC core,
8160>18	leshort		120		Renesas M32C series,
8161>18	leshort		131		Altium TSK3000 core,
8162>18	leshort		132		Freescale RS08,
8163>18	leshort		134		Cyan Technology eCOG2,
8164>18	leshort		135		Sunplus S+core7 RISC,
8165>18	leshort		136		New Japan Radio (NJR) 24-bit DSP,
8166>18	leshort		137		Broadcom VideoCore III,
8167>18	leshort		138		LatticeMico32,
8168>18	leshort		139		Seiko Epson C17 family,
8169>18	leshort		140		TI TMS320C6000 DSP family,
8170>18	leshort		141		TI TMS320C2000 DSP family,
8171>18	leshort		142		TI TMS320C55x DSP family,
8172>18	leshort		160		STMicroelectronics 64bit VLIW DSP,
8173>18	leshort		161		Cypress M8C,
8174>18	leshort		162		Renesas R32C series,
8175>18	leshort		163		NXP TriMedia family,
8176>18	leshort		164		QUALCOMM DSP6,
8177>18	leshort		165		Intel 8051 and variants,
8178>18	leshort		166		STMicroelectronics STxP7x family,
8179>18	leshort		167		Andes embedded RISC,
8180>18	leshort		168		Cyan eCOG1X family,
8181>18	leshort		169		Dallas MAXQ30,
8182>18	leshort		170		New Japan Radio (NJR) 16-bit DSP,
8183>18	leshort		171		M2000 Reconfigurable RISC,
8184>18	leshort		172		Cray NV2 vector architecture,
8185>18	leshort		173		Renesas RX family,
8186>18	leshort		174		META,
8187>18	leshort		175		MCST Elbrus,
8188>18	leshort		176		Cyan Technology eCOG16 family,
8189>18	leshort		177		NatSemi CompactRISC,
8190>18	leshort		178		Freescale Extended Time Processing Unit,
8191>18	leshort		179		Infineon SLE9X,
8192>18	leshort		180		Intel L1OM,
8193>18	leshort		181		Intel K1OM,
8194>18	leshort		183		ARM aarch64,
8195>18	leshort		185		Atmel 32-bit family,
8196>18	leshort		186		STMicroeletronics STM8 8-bit,
8197>18	leshort		187		Tilera TILE64,
8198>18	leshort		188		Tilera TILEPro,
8199>18	leshort		189		Xilinx MicroBlaze 32-bit RISC,
8200>18	leshort		190		NVIDIA CUDA architecture,
8201>18	leshort		191		Tilera TILE-Gx,
8202>18	leshort		197		Renesas RL78 family,
8203>18	leshort		199		Renesas 78K0R,
8204>18	leshort		200		Freescale 56800EX,
8205>18	leshort		201		Beyond BA1,
8206>18	leshort		202		Beyond BA2,
8207>18	leshort		203		XMOS xCORE,
8208>18	leshort		204		Microchip 8-bit PIC(r),
8209>18	leshort		210		KM211 KM32,
8210>18	leshort		211		KM211 KMX32,
8211>18	leshort		212		KM211 KMX16,
8212>18	leshort		213		KM211 KMX8,
8213>18	leshort		214		KM211 KVARC,
8214>18	leshort		215		Paneve CDP,
8215>18	leshort		216		Cognitive Smart Memory,
8216>18	leshort		217		iCelero CoolEngine,
8217>18	leshort		218		Nanoradio Optimized RISC,
8218>18	leshort		243		UCB RISC-V,
8219>18	leshort		0x1057		AVR (unofficial),
8220>18	leshort		0x1059		MSP430 (unofficial),
8221>18	leshort		0x1223		Adapteva Epiphany (unofficial),
8222>18	leshort		0x2530		Morpho MT (unofficial),
8223>18	leshort		0x3330		FR30 (unofficial),
8224>18	leshort		0x3426		OpenRISC (obsolete),
8225>18	leshort		0x4688		Infineon C166 (unofficial),
8226>18	leshort		0x5441		Cygnus FRV (unofficial),
8227>18	leshort		0x5aa5		DLX (unofficial),
8228>18	leshort		0x7650		Cygnus D10V (unofficial),
8229>18	leshort		0x7676		Cygnus D30V (unofficial),
8230>18	leshort		0x8217		Ubicom IP2xxx (unofficial),
8231>18	leshort		0x8472		OpenRISC (obsolete),
8232>18	leshort		0x9025		Cygnus PowerPC (unofficial),
8233>18	leshort		0x9026		Alpha (unofficial),
8234>18	leshort		0x9041		Cygnus M32R (unofficial),
8235>18	leshort		0x9080		Cygnus V850 (unofficial),
8236>18	leshort		0xa390		IBM S/390 (obsolete),
8237>18	leshort		0xabc7		Old Xtensa (unofficial),
8238>18	leshort		0xad45		xstormy16 (unofficial),
8239>18	leshort		0xbaab		Old MicroBlaze (unofficial),,
8240>18	leshort		0xbeef		Cygnus MN10300 (unofficial),
8241>18	leshort		0xdead		Cygnus MN10200 (unofficial),
8242>18	leshort		0xf00d		Toshiba MeP (unofficial),
8243>18	leshort		0xfeb0		Renesas M32C (unofficial),
8244>18	leshort		0xfeba		Vitesse IQ2000 (unofficial),
8245>18	leshort		0xfebb		NIOS (unofficial),
8246>18	leshort		0xfeed		Moxie (unofficial),
8247>18	default		x
8248>>18	leshort		x		*unknown arch 0x%x*
8249>20	lelong		0		invalid version
8250>20	lelong		1		version 1
8251
82520	string		\177ELF		ELF
8253!:strength *2
8254>4	byte		0		invalid class
8255>4	byte		1		32-bit
8256>4	byte		2		64-bit
8257>5	byte		0		invalid byte order
8258>5	byte		1		LSB
8259>>0	use		elf-le
8260>5	byte		2		MSB
8261>>0	use		\^elf-le
8262>7	byte		0		(SYSV)
8263>7	byte		1		(HP-UX)
8264>7	byte		2		(NetBSD)
8265>7	byte		3		(GNU/Linux)
8266>7	byte		4		(GNU/Hurd)
8267>7	byte		5		(86Open)
8268>7	byte		6		(Solaris)
8269>7	byte		7		(Monterey)
8270>7	byte		8		(IRIX)
8271>7	byte		9		(FreeBSD)
8272>7	byte		10		(Tru64)
8273>7	byte		11		(Novell Modesto)
8274>7	byte		12		(OpenBSD)
8275>7	byte		13		(OpenVMS)
8276>7	byte		14		(HP NonStop Kernel)
8277>7	byte		15		(AROS Research Operating System)
8278>7	byte		16		(FenixOS)
8279>7	byte		17		(Nuxi CloudABI)
8280>7	byte		97		(ARM)
8281>7	byte		255		(embedded)
8282
8283#------------------------------------------------------------------------------
8284# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
8285# encore:  file(1) magic for Encore machines
8286#
8287# XXX - needs to have the byte order specified (NS32K was little-endian,
8288# dunno whether they run the 88K in little-endian mode or not).
8289#
82900	short		0x154		Encore
8291>20	short		0x107		executable
8292>20	short		0x108		pure executable
8293>20	short		0x10b		demand-paged executable
8294>20	short		0x10f		unsupported executable
8295>12	long		>0		not stripped
8296>22	short		>0		- version %d
8297>22	short		0		-
8298#>4	date		x		stamp %s
82990	short		0x155		Encore unsupported executable
8300>12	long		>0		not stripped
8301>22	short		>0		- version %d
8302>22	short		0		-
8303#>4	date		x		stamp %s
8304
8305#------------------------------------------------------------------------------
8306# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
8307# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
8308# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
8309# Useful information for improving this file can be found at:
8310# http://software.frodo.looijaard.name/psiconv/formats/Index.html
8311#------------------------------------------------------------------------------
83120	lelong		0x10000037	Psion Series 5
8313>4	lelong		0x10000039	font file
8314>4	lelong		0x1000003A	printer driver
8315>4	lelong		0x1000003B	clipboard
8316>4	lelong		0x10000042	multi-bitmap image
8317!:mime image/x-epoc-mbm
8318>4	lelong		0x1000006A	application information file
8319>4	lelong		0x1000006D
8320>>8	lelong		0x1000007D	Sketch image
8321!:mime image/x-epoc-sketch
8322>>8	lelong		0x1000007E	voice note
8323>>8	lelong		0x1000007F	Word file
8324!:mime application/x-epoc-word
8325>>8	lelong		0x10000085	OPL program (TextEd)
8326!:mime application/x-epoc-opl
8327>>8	lelong		0x10000087	Comms settings
8328>>8	lelong		0x10000088	Sheet file
8329!:mime application/x-epoc-sheet
8330>>8	lelong		0x100001C4	EasyFax initialisation file
8331>4	lelong		0x10000073	OPO module
8332!:mime application/x-epoc-opo
8333>4	lelong		0x10000074	OPL application
8334!:mime application/x-epoc-app
8335>4	lelong		0x1000008A	exported multi-bitmap image
8336>4	lelong		0x1000016D
8337>>8	lelong		0x10000087	Comms names
8338
83390	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
8340
83410	lelong		0x10000050	Psion Series 5
8342>4	lelong		0x1000006D	database
8343>>8	lelong		0x10000084	Agenda file
8344!:mime application/x-epoc-agenda
8345>>8	lelong		0x10000086	Data file
8346!:mime application/x-epoc-data
8347>>8	lelong		0x10000CEA	Jotter file
8348!:mime application/x-epoc-jotter
8349>4	lelong		0x100000E4	ini file
8350
83510	lelong		0x10000079	Psion Series 5 binary:
8352>4	lelong		0x00000000	DLL
8353>4	lelong		0x10000049	comms hardware library
8354>4	lelong		0x1000004A	comms protocol library
8355>4	lelong		0x1000005D	OPX
8356>4	lelong		0x1000006C	application
8357>4	lelong		0x1000008D	DLL
8358>4	lelong		0x100000AC	logical device driver
8359>4	lelong		0x100000AD	physical device driver
8360>4	lelong		0x100000E5	file transfer protocol
8361>4	lelong		0x100000E5	file transfer protocol
8362>4	lelong		0x10000140	printer definition
8363>4	lelong		0x10000141	printer definition
8364
83650	lelong		0x1000007A	Psion Series 5 executable
8366
8367#------------------------------------------------------------------------------
8368# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $
8369# erlang:  file(1) magic for Erlang JAM and BEAM files
8370# URL:  http://www.erlang.org/faq/x779.html#AEN812
8371
8372# OTP R3-R4
83730	string	\0177BEAM!	Old Erlang BEAM file
8374>6	short	>0		- version %d
8375
8376# OTP R5 and onwards
83770	string	FOR1
8378>8	string	BEAM		Erlang BEAM file
8379
8380# 4.2 version may have a copyright notice!
83814	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
838279	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
8383
83844	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3
8385
83860	bequad	0x0000000000ABCDEF	Erlang DETS file
8387
8388#------------------------------------------------------------------------------
8389# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $
8390# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
8391# Based on info from
8392# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
83930	belong	9994	ESRI Shapefile
8394>4	belong	=0
8395>8	belong	=0
8396>12	belong	=0
8397>16	belong	=0
8398>20	belong	=0
8399>28	lelong	x	version %d
8400>24	belong	x	length %d
8401>32	lelong	=0	type Null Shape
8402>32	lelong	=1	type Point
8403>32	lelong	=3	type PolyLine
8404>32	lelong	=5	type Polygon
8405>32	lelong	=8	type MultiPoint
8406>32	lelong	=11	type PointZ
8407>32	lelong	=13	type PolyLineZ
8408>32	lelong	=15	type PolygonZ
8409>32	lelong	=18	type MultiPointZ
8410>32	lelong	=21	type PointM
8411>32	lelong	=23	type PolyLineM
8412>32	lelong	=25	type PolygonM
8413>32	lelong	=28	type MultiPointM
8414>32	lelong	=31	type MultiPatch
8415
8416#------------------------------------------------------------------------------
8417# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
8418# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
8419# From Roger Leigh <roger@whinlatter.uklinux.net>
84200       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
84210       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
84220       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
8423
8424#------------------------------------------------------------------------------
8425# $File: filesystems,v 1.120 2017/03/24 19:29:26 christos Exp $
8426# filesystems:  file(1) magic for different filesystems
8427#
84280	name	partid
8429>0	ubyte	0x00	Unused
8430>0	ubyte	0x01	12-bit FAT
8431>0	ubyte	0x02	XENIX /
8432>0	ubyte	0x03	XENIX /usr
8433>0	ubyte	0x04	16-bit FAT, less than 32M
8434>0	ubyte	0x05	extended partition
8435>0	ubyte	0x06	16-bit FAT, more than 32M
8436>0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
8437>0	ubyte	0x08	AIX or os, or etc.
8438>0	ubyte	0x09	AIX boot partition or Coherent
8439>0	ubyte	0x0a	O/2 boot manager or Coherent swap
8440>0	ubyte	0x0b	32-bit FAT
8441>0	ubyte	0x0c	32-bit FAT, LBA-mapped
8442>0	ubyte	0x0d	7XXX, LBA-mapped
8443>0	ubyte	0x0e	16-bit FAT, LBA-mapped
8444>0	ubyte	0x0f	extended partition, LBA-mapped
8445>0	ubyte	0x10	OPUS
8446>0	ubyte	0x11 	OS/2 DOS 12-bit FAT
8447>0	ubyte	0x12 	Compaq diagnostics
8448>0	ubyte	0x14 	OS/2 DOS 16-bit FAT <32M
8449>0	ubyte	0x16 	OS/2 DOS 16-bit FAT >=32M
8450>0	ubyte	0x17 	OS/2 hidden IFS
8451>0	ubyte	0x18 	AST Windows swapfile
8452>0	ubyte	0x19 	Willowtech Photon coS
8453>0	ubyte	0x1b 	hidden win95 fat 32
8454>0	ubyte	0x1c 	hidden win95 fat 32 lba
8455>0	ubyte	0x1d	hidden win95 fat 16 lba
8456>0	ubyte	0x20 	Willowsoft OFS1
8457>0	ubyte	0x21 	reserved
8458>0	ubyte	0x23 	reserved
8459>0	ubyte	0x24	NEC DOS
8460>0	ubyte	0x26 	reserved
8461>0	ubyte	0x31 	reserved
8462>0	ubyte	0x32	Alien Internet Services NOS
8463>0	ubyte	0x33 	reserved
8464>0	ubyte	0x34 	reserved
8465>0	ubyte	0x35 	JFS on OS2
8466>0	ubyte	0x36 	reserved
8467>0	ubyte	0x38 	Theos
8468>0	ubyte	0x39 	Plan 9, or Theos spanned
8469>0	ubyte	0x3a 	Theos ver 4 4gb partition
8470>0	ubyte	0x3b 	Theos ve 4 extended partition
8471>0	ubyte	0x3c 	PartitionMagic recovery
8472>0	ubyte	0x3d 	Hidden Netware
8473>0	ubyte	0x40 	VENIX 286 or LynxOS
8474>0	ubyte	0x41	PReP
8475>0	ubyte	0x42	linux swap sharing DRDOS disk
8476>0	ubyte	0x43	linux sharing DRDOS disk
8477>0	ubyte	0x44	GoBack change utility
8478>0	ubyte	0x45	Boot US Boot manager
8479>0	ubyte	0x46	EUMEL/Elan or Ergos 3
8480>0	ubyte	0x47	EUMEL/Elan or Ergos 3
8481>0	ubyte	0x48	EUMEL/Elan or Ergos 3
8482>0	ubyte	0x4a	ALFX/THIN filesystem for DOS
8483>0	ubyte	0x4c	Oberon partition
8484>0	ubyte	0x4d 	QNX4.x
8485>0	ubyte	0x4e 	QNX4.x 2nd part
8486>0	ubyte	0x4f 	QNX4.x 3rd part
8487>0	ubyte	0x50 	DM (disk manager)
8488>0	ubyte	0x51 	DM6 Aux1 (or Novell)
8489>0	ubyte	0x52 	CP/M or Microport SysV/AT
8490>0	ubyte	0x53 	DM6 Aux3
8491>0	ubyte	0x54	DM6 DDO
8492>0	ubyte	0x55	EZ-Drive (disk manager)
8493>0	ubyte	0x56	Golden Bow (disk manager)
8494>0	ubyte	0x57	Drive PRO
8495>0	ubyte	0x5c	Priam Edisk (disk manager)
8496>0	ubyte	0x61	SpeedStor
8497>0	ubyte	0x63	GNU HURD or Mach or Sys V/386
8498>0	ubyte	0x64	Novell Netware 2.xx or Speedstore
8499>0	ubyte	0x65	Novell Netware 3.xx
8500>0	ubyte	0x66	Novell 386 Netware
8501>0	ubyte	0x67	Novell
8502>0	ubyte	0x68	Novell
8503>0	ubyte	0x69	Novell
8504>0	ubyte	0x70	DiskSecure Multi-Boot
8505>0	ubyte	0x71	reserved
8506>0	ubyte	0x73	reserved
8507>0	ubyte	0x74	reserved
8508>0	ubyte	0x75	PC/IX
8509>0	ubyte	0x76	reserved
8510>0	ubyte	0x77	M2FS/M2CS partition
8511>0	ubyte	0x78	XOSL boot loader filesystem
8512>0	ubyte	0x80	MINIX until 1.4a
8513>0	ubyte	0x81	MINIX since 1.4b
8514>0	ubyte	0x82	Linux swap or Solaris
8515>0	ubyte	0x83	Linux native
8516>0	ubyte	0x84	OS/2 hidden C: drive
8517>0	ubyte	0x85	Linux extended partition
8518>0	ubyte	0x86	NT FAT volume set
8519>0	ubyte	0x87	NTFS volume set or HPFS mirrored
8520>0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
8521>0	ubyte	0x8b	Legacy Fault tolerant FAT32
8522>0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
8523>0	ubyte	0x8d	Hidden free FDISK FAT12
8524>0	ubyte	0x8e	Linux Logical Volume Manager
8525>0	ubyte	0x90	Hidden free FDISK FAT16
8526>0	ubyte	0x91	Hidden free FDISK DOS EXT
8527>0	ubyte	0x92	Hidden free FDISK FAT16 Big
8528>0	ubyte	0x93	Amoeba filesystem
8529>0	ubyte	0x94	Amoeba bad block table
8530>0	ubyte	0x95	MIT EXOPC native partitions
8531>0	ubyte	0x97	Hidden free FDISK FAT32
8532>0	ubyte	0x98	Datalight ROM-DOS Super-Boot
8533>0	ubyte	0x99	Mylex EISA SCSI
8534>0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
8535>0	ubyte	0x9b	Hidden free FDISK EXT LBA
8536>0	ubyte	0x9f	BSDI?
8537>0	ubyte	0xa0	IBM Thinkpad hibernation
8538>0	ubyte	0xa1	HP Volume expansion (SpeedStor)
8539>0	ubyte	0xa3	HP Volume expansion (SpeedStor)
8540>0	ubyte	0xa4	HP Volume expansion (SpeedStor)
8541>0	ubyte	0xa5	386BSD partition type
8542>0	ubyte	0xa6	OpenBSD partition type
8543>0	ubyte	0xa7	NeXTSTEP 486
8544>0	ubyte	0xa8	Apple UFS
8545>0	ubyte	0xa9	NetBSD partition type
8546>0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
8547>0	ubyte	0xab	Apple Boot
8548>0	ubyte	0xae	SHAG OS filesystem
8549>0	ubyte	0xaf	Apple HFS
8550>0	ubyte	0xb0	BootStar Dummy
8551>0	ubyte	0xb1	reserved
8552>0	ubyte	0xb3	reserved
8553>0	ubyte	0xb4	reserved
8554>0	ubyte	0xb6	reserved
8555>0	ubyte	0xb7	BSDI BSD/386 filesystem
8556>0	ubyte	0xb8	BSDI BSD/386 swap
8557>0	ubyte	0xbb	Boot Wizard Hidden
8558>0	ubyte	0xbe	Solaris 8 partition type
8559>0	ubyte	0xbf	Solaris partition type
8560>0	ubyte	0xc0 	CTOS
8561>0	ubyte	0xc1 	DRDOS/sec (FAT-12)
8562>0	ubyte	0xc2 	Hidden Linux
8563>0	ubyte	0xc3 	Hidden Linux swap
8564>0	ubyte	0xc4 	DRDOS/sec (FAT-16, < 32M)
8565>0	ubyte	0xc5 	DRDOS/sec (EXT)
8566>0	ubyte	0xc6 	DRDOS/sec (FAT-16, >= 32M)
8567>0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
8568>0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
8569>0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
8570>0	ubyte	0xca 	Reserved for DR-DOS 8.0+
8571>0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
8572>0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
8573>0	ubyte	0xcd	CTOS Memdump
8574>0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
8575>0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
8576>0	ubyte	0xd0 	REAL/32 secure big partition
8577>0	ubyte	0xd1 	Old Multiuser DOS FAT12
8578>0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
8579>0	ubyte	0xd5 	Old Multiuser DOS Extended
8580>0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
8581>0	ubyte	0xd8 	CP/M 86
8582>0	ubyte	0xdb 	CP/M or Concurrent CP/M
8583>0	ubyte	0xdd 	Hidden CTOS Memdump
8584>0	ubyte	0xde 	Dell PowerEdge Server utilities
8585>0	ubyte	0xdf 	DG/UX virtual disk manager
8586>0	ubyte	0xe0 	STMicroelectronics ST AVFS
8587>0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
8588>0	ubyte	0xe3 	DOS R/O or Storage Dimensions
8589>0	ubyte	0xe4 	SpeedStor 16-bit FAT < 1024 cyl.
8590>0	ubyte	0xe5	reserved
8591>0	ubyte	0xe6	reserved
8592>0	ubyte	0xeb 	BeOS
8593>0	ubyte	0xee	GPT Protective MBR
8594>0	ubyte	0xef	EFI system partition
8595>0	ubyte	0xf0 	Linux PA-RISC boot loader
8596>0	ubyte	0xf1 	SpeedStor or Storage Dimensions
8597>0	ubyte	0xf2 	DOS 3.3+ Secondary
8598>0	ubyte	0xf3	reserved
8599>0	ubyte	0xf4	SpeedStor large partition
8600>0	ubyte	0xf5	Prologue multi-volumen partition
8601>0	ubyte	0xf6 	reserved
8602>0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
8603>0	ubyte	0xfa 	Bochs x86 emulator
8604>0	ubyte	0xfb 	VMware File System
8605>0	ubyte	0xfc 	VMware Swap
8606>0	ubyte	0xfd 	Linux RAID partition persistent sb
8607>0	ubyte	0xfe	LANstep or IBM PS/2 IML
8608>0	ubyte	0xff 	Xenix Bad Block Table
8609
86100	string	\366\366\366\366	PC formatted floppy with no filesystem
8611# Sun disk labels
8612# From /usr/include/sun/dklabel.h:
86130774	beshort		0xdabe
8614# modified by Joerg Jenderek, because original test
8615# succeeds for Cabinet archive dao360.dl_ with negative blocks
8616>0770	long		>0		Sun disk label
8617>>0	string		x		'%s
8618>>>31	string		>\0		\b%s
8619>>>>63	string		>\0		\b%s
8620>>>>>95	string		>\0		\b%s
8621>>0	string		x		\b'
8622>>0734	short		>0		%d rpm,
8623>>0736	short		>0		%d phys cys,
8624>>0740	short		>0		%d alts/cyl,
8625>>0746	short		>0		%d interleave,
8626>>0750	short		>0		%d data cyls,
8627>>0752	short		>0		%d alt cyls,
8628>>0754	short		>0		%d heads/partition,
8629>>0756	short		>0		%d sectors/track,
8630>>0764	long		>0		start cyl %d,
8631>>0770	long		x		%d blocks
8632# Is there a boot block written 1 sector in?
8633>512    belong&077777777	0600407	\b, boot block present
8634
8635# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
8636# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
86370		string	SBMBAKUP_	Smart Boot Manager backup file
8638>9		string	x		\b, version %-5.5s
8639>>14		string	=_
8640>>>15		string	x		%-.1s
8641>>>>16		string	=_		\b.
8642>>>>>17		string	x		\b%-.1s
8643>>>>>>18	string	=_		\b.
8644>>>>>>>19	string	x		\b%-.1s
8645>>>22		ubyte	0
8646>>>>21		ubyte	x		\b, from drive 0x%x
8647>>>22		ubyte	>0
8648>>>>21		string	x		\b, from drive %s
8649>>>535		search/17	\x55\xAA
8650>>>>&-512	indirect	x	\b; contains
8651
8652# updated by Joerg Jenderek at Nov 2012
8653# DOS Emulator image is 128 byte, null right padded header + harddisc image
86540	string	DOSEMU\0
8655>0x27E	leshort	0xAA55
8656#offset is 128
8657>>19	ubyte	128
8658>>>(19.b-1)	ubyte	0x0	DOS Emulator image
8659>>>>7	ulelong	>0		\b, %u heads
8660>>>>11	ulelong	>0		\b, %d sectors/track
8661>>>>15	ulelong	>0		\b, %d cylinders
8662>>>>128	indirect	x	\b; contains
8663
8664# added by Joerg Jenderek at Nov 2012
8665# http://www.thenakedpc.com/articles/v04/08/0408-05.html
8666# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
86670	string	PNCIHISK\0		Norton Utilities disc image data
8668# real x86 boot sector with jump instruction
8669>509	search/1026	\x55\xAA\xeb
8670>>&-1	indirect	x		\b; contains
8671# http://file-extension.net/seeker/file_extension_dat
86720	string	PNCIUNDO		Norton Disk Doctor UnDo file
8673#
8674
8675# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
8676# for any allowed sector sizes
867730		search/481	\x55\xAA
8678# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
8679# DOS BPB information (70) and after DOS floppy (120) like in previous file version
8680!:strength +65
8681# for sector sizes < 512 Bytes
8682>11		uleshort	<512
8683>>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
8684# for sector sizes with 512 or more Bytes
8685>0x1FE		leshort		0xAA55		DOS/MBR boot sector
8686
8687# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
8688# only for sector sizes with 512 or more Bytes
86890x1FE          leshort         0xAA55         	DOS/MBR boot sector
8690#
8691# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
8692!:strength +65
8693>2		string		OSBS		OS/BS MBR
8694# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
8695# and http://en.wikipedia.org/wiki/Master_Boot_Record
8696# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
8697# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
8698>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
8699# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
8700# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
8701>>8	ubequad		0x8bf45007501ffbfc
8702# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
8703>>>0x16	ubyte		0xF3				\b,DOS 2
8704>>>>219	regex		Author\ -\ 			Author:
8705# found "David Litton" , "A Pehrsson  "
8706>>>>>&0	string		x				"%s"
8707>>>0x16	ubyte		0xF2
8708# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
8709# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
8710>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
8711# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
8712>>>>0x22	default	x				\b,D0S version 3.3-7.0
8713# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
8714# where nn is string offset varying for different languages
8715# "Invalid partition table"				nn=0x8b for english version
8716>>>>>(0x49.b)	string		Invalid\ partition\ table		english
8717>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
8718>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
8719>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
8720>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
8721>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
8722>>>>>0x49	ubyte		>0			at offset 0x%x
8723>>>>>>(0x49.b)	string		>\0			"%s"
8724# "Error loading operating system"			nn=0xa3 for english version
8725# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
8726# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
8727# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
8728# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
8729# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
8730>>>>>0x74	ubyte		>0			at offset 0x%x
8731>>>>>>(0x74.b)	string		>\0			"%s"
8732# "Missing operating system"				nn=0xc2 for english version
8733# "Betriebssystem fehlt"				nn=0xcd for german version
8734# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
8735# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
8736# "Falta sistema operativo"				nn=0xca for spanish version
8737# "Sistema operativo mancante"				nn=0xe2 for italian version
8738>>>>>0x79	ubyte		>0			at offset 0x%x
8739>>>>>>(0x79.b)	string		>\0			"%s"
8740# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
8741# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
8742>>8	ubequad		0x5007501ffcbe1b7c
8743# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
8744>>>24		ubequad	0xf3a4cbbebe07b104		9M
8745# "Invalid partition table"				nn=0x10F for english version
8746# "Ung\201ltige Partitionstabelle"				nn=0x10F for german version
8747# "Table de partition erron\202e"				nn=0x10F for french version
8748# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
8749>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
8750>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
8751>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
8752>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
8753>>>>0x3C		ubyte	x			at offset 0x%x+0xFF
8754>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
8755# "Error loading operating system"			nn=0x127 for english version
8756# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
8757# "Erreur lors du chargement du syst\212me d'exploitation"	nn=0x12a for french version
8758# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
8759>>>>0xBD		ubyte	x			at offset 0x1%x
8760>>>>(0xBD.b+0x100)	string	>\0			"%s"
8761# "Missing operating system"				nn=0x146 for english version
8762# "Betriebssystem fehlt"				nn=0x151 for german version
8763# "Syst\212me d'exploitation manquant"			nn=0x15e for french version
8764# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
8765>>>>0xA9		ubyte	x			at offset 0x1%x
8766>>>>(0xA9.b+0x100)	string	>\0			"%s"
8767# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
8768# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
8769>>>24		ubequad	0xf3a4cbbdbe07b104		XP
8770# where xxyyzz are lower bits from offsets of error messages varying for different languages
8771>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
8772>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
8773# "Invalid partition table"				xx=0x12C for english version
8774# "Ung\201ltige Partitionstabelle"				xx=0x12C for german version
8775>>>>0x1b5	ubyte		>0			at offset 0x1%x
8776>>>>(0x1b5.b+0x100)	string	>\0			"%s"
8777# "Error loading operating system"			yy=0x144 for english version
8778# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
8779>>>>0x1b6	ubyte		>0			at offset 0x1%x
8780>>>>(0x1b6.b+0x100)	string	>\0			"%s"
8781# "Missing operating system"				zz=0x163 for english version
8782# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
8783>>>>0x1b7	ubyte		>0			at offset 0x1%x
8784>>>>(0x1b7.b+0x100)	string	>\0			"%s"
8785# Microsoft Windows Vista or 7
8786# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
8787>>8	ubequad		0xc08ed8be007cbf00
8788# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
8789# assembler instructions: jnz 0729;cmp ebx,"TCPA"
8790>>>0xEC		ubequad	0x753b6681fb544350		Vista
8791# where xxyyzz are lower bits from offsets of error messages varying for different languages
8792>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
8793#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
8794# "Invalid partition table"				xx=0x162 for english version
8795# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
8796>>>>0x1b5	ubyte		>0			at offset 0x1%x
8797>>>>(0x1b5.b+0x100)	string	>\0			"%s"
8798# "Error loading operating system"			yy=0x17a for english version
8799# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
8800>>>>0x1b6	ubyte		>0			at offset 0x1%x
8801>>>>(0x1b6.b+0x100)	string	>\0			"%s"
8802# "Missing operating system"				zz=0x199 for english version
8803# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
8804>>>>0x1b7	ubyte		>0			at offset 0x1%x
8805>>>>(0x1b7.b+0x100)	string	>\0			"%s"
8806# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
8807# assembler instructions: cmp ebx,"TCPA";cmp
8808>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
8809# where xxyyzz are lower bits from offsets of error messages varying for different languages
8810>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
8811#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
8812# "Invalid partition table"				xx=0x163 for english version
8813# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
8814>>>>0x1b5	ubyte		>0			at offset 0x1%x
8815>>>>(0x1b5.b+0x100)	string	>\0			"%s"
8816# "Error loading operating system"			yy=0x17b for english version
8817# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
8818>>>>0x1b6	ubyte		>0			at offset 0x1%x
8819>>>>(0x1b6.b+0x100)	string	>\0			"%s"
8820# "Missing operating system"				zz=0x19a for english version
8821# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
8822>>>>0x1b7	ubyte		>0			at offset 0x1%x
8823>>>>(0x1b7.b+0x100)	string	>\0			"%s"
8824# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
8825# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
8826>>0x1b8	ulelong		>0				\b, disk signature 0x%-.4x
8827# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
8828>>0xDA	uleshort		0
8829>>>0xDC 	ulelong		>0			\b, created
8830# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
8831>>>>0xDC	ubyte		x			with driveID 0x%x
8832# hours, minutes and seconds
8833>>>>0xDf	ubyte		x			at %x
8834>>>>0xDe	ubyte		x			\b:%x
8835>>>>0xDd	ubyte		x			\b:%x
8836# special case for Microsoft MS-DOS 3.21 spanish
8837# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
8838>0	ubequad		0xfab830008ed0bc00
8839# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
8840>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
8841# Microsoft MBR IPL end
8842
8843# dr-dos with some upper-, lowercase variants
8844>0x9D	string	Invalid\ partition\ table$
8845>>181	string	No\ Operating\ System$
8846>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
8847>0x9D	string	Invalid\ partition\ table$
8848>>181	string	No\ operating\ system$
8849>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
8850>342	string	Invalid\ partition\ table$
8851>>366	string	No\ operating\ system$
8852>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
8853>295	string	NEWLDR\0
8854>>302	string	Bad\ PT\ $
8855>>>310	string	No\ OS\ $
8856>>>>317	string	OS\ load\ err$
8857>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
8858>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
8859>>>>>>>387	string	Copyright\ (c)\ 1984,1998
8860>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
8861#
8862# tests for different MS-DOS Master Boot Records (MBR) moved and merged
8863#
8864#>0x145	string	Default:\ F				\b, FREE-DOS MBR
8865#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
8866>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
8867#>>313		string	F0\ .\ .\ .
8868#>>>322		string	disk\ 1
8869#>>>>382	string	FAT3
8870>64	string	no\ active\ partition\ found
8871>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
8872# Ranish Partition Manager http://www.ranish.com/part/
8873>387	search/4	\0\ Error!\r
8874>>378	search/7	Virus!
8875>>>397	search/4	Booting\040
8876>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
8877>>>>>416	string	Writing\ changes...		\b2.37
8878>>>>>>438	ubyte		x			\b,0x%x dots
8879>>>>>>440	ubyte		>0			\b,virus check
8880>>>>>>441	ubyte		>0			\b,partition %c
8881#2.38,2.42,2.44
8882>>>>>416	string	!Writing\ changes...		\b
8883>>>>>>418	ubyte	1				\bvirus check,
8884>>>>>>419	ubyte	x				\b0x%x seconds
8885>>>>>>420	ubyte&0x0F	>0			\b,partition
8886>>>>>>>420	ubyte&0x0F	<5			\b %x
8887>>>>>>>420	ubyte&0x0F	0Xf			\b ask
8888>>>>>420	ubyte		x			\b)
8889#
8890# SYSLINUX MBR moved
8891# http://www.acronis.de/
8892>362	string	MBR\ Error\ \0\r
8893>>376	string	ress\ any\ key\ to\040
8894>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
8895# added by Joerg Jenderek
8896# http://www.visopsys.org/
8897# http://partitionlogic.org.uk/
8898>309	string	No\ bootable\ partition\ found\r
8899>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
8900>349	string	No\ bootable\ partition\ found\r
8901>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
8902# bootloader, bootmanager
8903>0x40	string	SBML
8904# label with 11 characters of FAT 12 bit filesystem
8905>>43	string	SMART\ BTMGR
8906>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
8907# OEM-ID not always "SBM"
8908#>>>>3	strings	SBM
8909>>>>6	string	>\0                             \b, version %s
8910>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
8911>6	string	LILO				\b, LInux i386 boot LOader
8912>>120	string	LILO				\b, version 22.3.4 SuSe
8913>>172	string	LILO				\b, version 22.5.8 Debian
8914# updated by Joerg Jenderek at Oct 2008
8915# variables according to grub-0.97/stage1/stage1.S or
8916# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
8917# usual values are marked with comments to get only informations of strange GRUB loaders
8918>342		search/60	\0Geom\0
8919#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
8920>>0x41		ubyte		<2
8921>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
8922# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
8923>>>>0x3E	ubyte		x		\b, stage1 version 0x%x
8924#If it is 0xFF, use a drive passed by BIOS
8925>>>>0x40	ubyte		<0xFF		\b, boot drive 0x%x
8926# in most case 0,1,0x2e for GRUB 0.5.95
8927>>>>0x41	ubyte		>0		\b, LBA flag 0x%x
8928>>>>0x42	uleshort	<0x8000		\b, stage2 address 0x%x
8929#>>>>0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
8930>>>>0x42	uleshort	>0x8000		\b, stage2 address 0x%x
8931#>>>>0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
8932>>>>0x44	ulelong		>1		\b, 1st sector stage2 0x%x
8933>>>>0x48	uleshort	<0x800		\b, stage2 segment 0x%x
8934#>>>>0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
8935>>>>0x48	uleshort	>0x800		\b, stage2 segment 0x%x
8936>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
8937>>>>>394	string	stage1			\b, GRUB version 0.5.95
8938>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
8939>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
8940>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
8941>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
8942>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
8943>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
8944>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
8945>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
8946# unknown version
8947>>>343		string	Geom\0Read\0\ Error\0
8948>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
8949>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
8950>>>>374		string	GRUB\ \0		\b, GRUB version n.m
8951# SYSLINUX bootloader moved
8952>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
8953# http://www.bcdwb.de/bcdw/index_e.htm
8954>3	string	BCDL
8955>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
8956# mbr partition table entries updated by Joerg Jenderek at Sep 2013
8957# skip Norton Utilities disc image data
8958>3		string		!IHISK
8959# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
8960>>0		belong		!0xb8c0078e
8961# not Linux kernel
8962>>>514		string		!HdrS
8963# not BeOS
8964>>>>422		string		!Be\ Boot\ Loader
8965# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
8966>>>>>0		ubelong&0xFD000000	=0xE9000000
8967# AdvanceMAME mbr
8968>>>>>>(1.b+2)	ubequad		0xfa31c08ed88ec08e
8969>>>>>>>446	use		partition-table
8970# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
8971>>>>>0		ubelong&0xFD000000	!0xE9000000
8972# skip FSInfosector
8973>>>>>>0		string		!RRaA
8974# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
8975# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
8976>>>>>>>0	ubequad		!0xfa660fb64610668b
8977# skip 13rd sector of MS x86 bootloader
8978>>>>>>>>0	ubequad		!0x660fb64610668b4e
8979# skip sector starting with DOS new line
8980>>>>>>>>>0	string		!\r\n
8981# allowed active flag 0,80h-FFh
8982>>>>>>>>>>446	ubyte		0
8983>>>>>>>>>>>446	use		partition-table
8984>>>>>>>>>>446	ubyte		>0x7F
8985>>>>>>>>>>>446	use		partition-table
8986# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
8987# mbr partition table entries end
8988# http://www.acronis.de/
8989#FAT label=ACRONIS\ SZ
8990#OEM-ID=BOOTWIZ0
8991>442	string	Non-system\ disk,\040
8992>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
8993# updated by Joerg Jenderek at Nov 2012, Sep 2013
8994# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
8995# display 1 space
8996>>>447	ubyte	x		\b
8997>>>477	use	DOS-filename
8998#
8999>185	string	FDBOOT\ Version\040
9000>>204	string	\rNo\ Systemdisk.\040
9001>>>220	string	Booting\ from\ harddisk.\n\r
9002>>>245	string	Cannot\ load\ from\ harddisk.\n\r
9003>>>>273 string	Insert\ Systemdisk\040
9004>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
9005>>>>>>200 string	>\0                             \b, version %-3s
9006>242	string	Bootsector\ from\ C.H.\ Hochst\204
9007# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
9008# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
9009# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
9010>242	search/127	Bootsector\ from\ C.H.\ Hochst
9011>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
9012# followed by variants with point,CR-NL or NL-CR
9013>>>208	search/261	Cannot\ load\ from\ harddisk.
9014# followed by variants CR-NL or NL-CR
9015>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
9016# followed by variants with point,CR-NL or NL-CR
9017>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
9018# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
9019>>>>>>&0	string		x 					\b, version %-4.4s
9020>(1.b+2)	ubyte		0xe
9021>>(1.b+3)	ubyte		0x1f
9022>>>(1.b+4)	ubyte		0xbe
9023# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
9024>>>>(1.b+5)	ubyte&0xd3	0x53
9025>>>>>(1.b+6)	ubyte		0x7c
9026# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
9027>>>>>>(1.b+7)	ubyte		0xac
9028>>>>>>>(1.b+8)	ubyte		0x22
9029>>>>>>>>(1.b+9)	ubyte		0xc0
9030>>>>>>>>>(1.b+10)	ubyte	0x74
9031>>>>>>>>>>(1.b+11)	ubyte	0x0b
9032>>>>>>>>>>>(1.b+12)	ubyte	0x56
9033>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
9034# FAT1X version
9035>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
9036>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
9037# FAT32 version
9038>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
9039>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
9040>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
9041#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
9042#>>>170	string	Sorry,\ could\ not\ load\ an\040
9043#>>>>195	string	operating\ system.\r\n
9044#
9045>103	string	This\ is\ not\ a\ bootable\ disk.\040
9046>>132	string	Please\ insert\ a\ bootable\040
9047>>>157	string	floppy\ and\r\n
9048>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
9049#
9050>66	string	Solaris\ Boot\ Sector
9051>>99	string	Incomplete\ MDBoot\ load.
9052>>>89	string	Version 				\b, Sun Solaris Bootloader
9053>>>>97	byte	x					version %c
9054#
9055>408	string	OS/2\ !!\ SYS01475\r\0
9056>>429	string	OS/2\ !!\ SYS02025\r\0
9057>>>450	string	OS/2\ !!\ SYS02027\r\0
9058>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
9059#
9060>409	string	OS/2\ !!\ SYS01475\r\0
9061>>430	string	OS/2\ !!\ SYS02025\r\0
9062>>>451	string	OS/2\ !!\ SYS02027\r\0
9063>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
9064>112		string	This\ disk\ is\ not\ bootable\r
9065>>142		string	If\ you\ wish\ to\ make\ it\ bootable
9066>>>176		string	run\ the\ DOS\ program\ SYS\040
9067>>>200		string	after\ the\r
9068>>>>216		string	system\ has\ been\ loaded\r\n
9069>>>>>242	string	Please\ insert\ a\ DOS\ diskette\040
9070>>>>>271	string	into\r\n\ the\ drive\ and\040
9071>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
9072# XP
9073>430	string	NTLDR\ is\ missing\xFF\r\n
9074>>449	string	Disk\ error\xFF\r\n
9075>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
9076# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
9077>>>>417		ubyte&0xDF	>0
9078>>>>>417	string		x			%-.5s
9079>>>>>>422	ubyte&0xDF	>0
9080>>>>>>>422	string		x 			\b%-.3s
9081>>>>>425	ubyte&0xDF	>0
9082>>>>>>425	string		>\ 			\b.%-.3s
9083#
9084>>>>371		ubyte		>0x20
9085>>>>>368	ubyte&0xDF	>0
9086>>>>>>368	string		x 			%-.5s
9087>>>>>>>373	ubyte&0xDF	>0
9088>>>>>>>>373	string		x 			\b%-.3s
9089>>>>>>376	ubyte&0xDF	>0
9090>>>>>>>376	string		x 			\b.%-.3s
9091#
9092>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
9093>>453	string	Datentr\204gerfehler\xFF\r\n
9094>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
9095>>>>417		ubyte&0xDF	>0
9096>>>>>417	string		x			%-.5s
9097>>>>>>422	ubyte&0xDF	>0
9098>>>>>>>422	string		x 			\b%-.3s
9099>>>>>425	ubyte&0xDF	>0
9100>>>>>>425	string		>\ 			\b.%-.3s
9101# offset variant
9102>>>>379	string	\0
9103>>>>>368	ubyte&0xDF	>0
9104>>>>>>368	string		x 			%-.5s
9105>>>>>>>373	ubyte&0xDF	>0
9106>>>>>>>>373	string		x 			\b%-.3s
9107#
9108>430	string	NTLDR\ fehlt\xFF\r\n
9109>>444	string	Datentr\204gerfehler\xFF\r\n
9110>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
9111>>>>417		ubyte&0xDF	>0
9112>>>>>417	string		x			%-.5s
9113>>>>>>422	ubyte&0xDF	>0
9114>>>>>>>422	string		x 			\b%-.3s
9115>>>>>425	ubyte&0xDF	>0
9116>>>>>>425	string		>\ 			\b.%-.3s
9117# variant
9118>>>>371		ubyte		>0x20
9119>>>>>368	ubyte&0xDF	>0
9120>>>>>>368	string		x 			%-.5s
9121>>>>>>>373	ubyte&0xDF	>0
9122>>>>>>>>373	string		x 			\b%-.3s
9123>>>>>>376	ubyte&0xDF	>0
9124>>>>>>>376	string		x 			\b.%-.3s
9125#
9126>430	string	NTLDR\ fehlt\xFF\r\n
9127>>444	string	Medienfehler\xFF\r\n
9128>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
9129>>>>371		ubyte		>0x20
9130>>>>>368	ubyte&0xDF	>0
9131>>>>>>368	string		x 			%-.5s
9132>>>>>>>373	ubyte&0xDF	>0
9133>>>>>>>>373	string		x 			\b%-.3s
9134>>>>>>376	ubyte&0xDF	>0
9135>>>>>>>376	string		x 			\b.%-.3s
9136# variant
9137>>>>417		ubyte&0xDF	>0
9138>>>>>417	string		x			%-.5s
9139>>>>>>422	ubyte&0xDF	>0
9140>>>>>>>422	string		x 			\b%-.3s
9141>>>>>425	ubyte&0xDF	>0
9142>>>>>>425	string		>\ 			\b.%-.3s
9143#
9144>430	string	Datentr\204ger\ entfernen\xFF\r\n
9145>>454	string	Medienfehler\xFF\r\n
9146>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
9147>>>>379		string		\0
9148>>>>>368	ubyte&0xDF	>0
9149>>>>>>368	string		x 			%-.5s
9150>>>>>>>373	ubyte&0xDF	>0
9151>>>>>>>>373	string		x 			\b%-.3s
9152>>>>>>376	ubyte&0xDF	>0
9153>>>>>>>376	string		x 			\b.%-.3s
9154# variant
9155>>>>417		ubyte&0xDF	>0
9156>>>>>417	string		x			%-.5s
9157>>>>>>422	ubyte&0xDF	>0
9158>>>>>>>422	string		x 			\b%-.3s
9159>>>>>425	ubyte&0xDF	>0
9160>>>>>>425	string		>\ 			\b.%-.3s
9161#
9162
9163#>3	string	NTFS\ \ \ \040
9164>389	string	Fehler\ beim\ Lesen\040
9165>>407	string	des\ Datentr\204gers
9166>>>426	string	NTLDR\ fehlt
9167>>>>440	string	NTLDR\ ist\ komprimiert
9168>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
9169#>3	string	NTFS\ \ \ \040
9170>313	string	A\ disk\ read\ error\ occurred.\r
9171>>345	string	A\ kernel\ file\ is\ missing\040
9172>>>370	string	from\ the\ disk.\r
9173>>>>484	string	NTLDR\ is\ compressed
9174>>>>>429 string	Insert\ a\ system\ diskette\040
9175>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
9176# DOS loader variants different languages,offsets
9177>472	ubyte&0xDF	>0
9178>>389	string	Invalid\ system\ disk\xFF\r\n
9179>>>411	string	Disk\ I/O\ error
9180>>>>428	string	Replace\ the\ disk,\ and\040
9181>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
9182#IO.SYS
9183>>>>>>472	ubyte&0xDF	>0
9184>>>>>>>472	string		x 			\b %-.2s
9185>>>>>>>>474	ubyte&0xDF	>0
9186>>>>>>>>>474	string		x 			\b%-.5s
9187>>>>>>>>>>479	ubyte&0xDF	>0
9188>>>>>>>>>>>479 string		x 			\b%-.1s
9189>>>>>>>480	ubyte&0xDF	>0
9190>>>>>>>>480	string		x 			\b.%-.3s
9191#MSDOS.SYS
9192>>>>>>>483	ubyte&0xDF	>0			\b+
9193>>>>>>>>483	string		x 			\b%-.5s
9194>>>>>>>>>488	ubyte&0xDF	>0
9195>>>>>>>>>>488	string		x 			\b%-.3s
9196>>>>>>>>491	ubyte&0xDF	>0
9197>>>>>>>>>491	string		x 			\b.%-.3s
9198#
9199>>390	string	Invalid\ system\ disk\xFF\r\n
9200>>>412	string	Disk\ I/O\ error\xFF\r\n
9201>>>>429	string	Replace\ the\ disk,\ and\040
9202>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
9203>>388	string	Ungueltiges\ System\ \xFF\r\n
9204>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
9205>>>>427	string	Datentraeger\ wechseln\ und\040
9206>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
9207#WINBOOT.SYS only not spaces (0xDF)
9208>>>>>>497	ubyte&0xDF	>0
9209>>>>>>>497	string		x 			%-.5s
9210>>>>>>>>502	ubyte&0xDF	>0
9211>>>>>>>>>502	string		x 			\b%-.1s
9212>>>>>>>>>>503	ubyte&0xDF	>0
9213>>>>>>>>>>>503	string		x 			\b%-.1s
9214>>>>>>>>>>>>504	ubyte&0xDF	>0
9215>>>>>>>>>>>>>504 string		x 			\b%-.1s
9216>>>>>>505	ubyte&0xDF	>0
9217>>>>>>>505	string		x 			\b.%-.3s
9218#IO.SYS
9219>>>>>>472	ubyte&0xDF	>0			or
9220>>>>>>>472	string		x 			\b %-.2s
9221>>>>>>>>474	ubyte&0xDF	>0
9222>>>>>>>>>474	string		x 			\b%-.5s
9223>>>>>>>>>>479	ubyte&0xDF	>0
9224>>>>>>>>>>>479 string		x 			\b%-.1s
9225>>>>>>>480	ubyte&0xDF	>0
9226>>>>>>>>480	string		x 			\b.%-.3s
9227#MSDOS.SYS
9228>>>>>>>483	ubyte&0xDF	>0			\b+
9229>>>>>>>>483	string		x 			\b%-.5s
9230>>>>>>>>>488	ubyte&0xDF	>0
9231>>>>>>>>>>488	string		x 			\b%-.3s
9232>>>>>>>>491	ubyte&0xDF	>0
9233>>>>>>>>>491	string		x 			\b.%-.3s
9234#
9235>>390	string	Ungueltiges\ System\ \xFF\r\n
9236>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
9237>>>>429	string	Datentraeger\ wechseln\ und\040
9238>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
9239#WINBOOT.SYS only not spaces (0xDF)
9240>>>>>>497	ubyte&0xDF	>0
9241>>>>>>>497	string		x 			%-.7s
9242>>>>>>>>504	ubyte&0xDF	>0
9243>>>>>>>>>504	string		x 			\b%-.1s
9244>>>>>>505	ubyte&0xDF	>0
9245>>>>>>>505	string		x 			\b.%-.3s
9246#IO.SYS
9247>>>>>>472	ubyte&0xDF	>0			or
9248>>>>>>>472	string		x 			\b %-.2s
9249>>>>>>>>474	ubyte&0xDF	>0
9250>>>>>>>>>474	string		x 			\b%-.6s
9251>>>>>>>480	ubyte&0xDF	>0
9252>>>>>>>>480	string		x 			\b.%-.3s
9253#MSDOS.SYS
9254>>>>>>>483	ubyte&0xDF	>0			\b+
9255>>>>>>>>483	string		x 			\b%-.5s
9256>>>>>>>>>488	ubyte&0xDF	>0
9257>>>>>>>>>>488	string		x 			\b%-.3s
9258>>>>>>>>491	ubyte&0xDF	>0
9259>>>>>>>>>491	string		x 			\b.%-.3s
9260#
9261>>389	string	Ungueltiges\ System\ \xFF\r\n
9262>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
9263>>>>428	string	Datentraeger\ wechseln\ und\040
9264>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
9265# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
9266>>>>>>472	string		x 			%-.2s
9267>>>>>>>474	ubyte&0xDF	>0
9268>>>>>>>>474	string		x 			\b%-.5s
9269>>>>>>>>479	ubyte&0xDF	>0
9270>>>>>>>>>479	string		x 			\b%-.1s
9271>>>>>>480	ubyte&0xDF	>0
9272>>>>>>>480	string		x 			\b.%-.3s
9273>>>>>>483	ubyte&0xDF	>0			\b+
9274>>>>>>>483	string		x 			\b%-.5s
9275>>>>>>>488	ubyte&0xDF	>0
9276>>>>>>>>488	string		x 			\b%-.2s
9277>>>>>>>>490	ubyte&0xDF	>0
9278>>>>>>>>>490	string		x 			\b%-.1s
9279>>>>>>>491	ubyte&0xDF	>0
9280>>>>>>>>491	string		x 			\b.%-.3s
9281>479	ubyte&0xDF	>0
9282>>416	string	Kein\ System\ oder\040
9283>>>433	string	Laufwerksfehler
9284>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
9285#IO.SYS
9286>>>>>479	string		x 			\b %-.2s
9287>>>>>>481	ubyte&0xDF	>0
9288>>>>>>>481	string		x 			\b%-.6s
9289>>>>>487	ubyte&0xDF	>0
9290>>>>>>487	string		x 			\b.%-.3s
9291#MSDOS.SYS
9292>>>>>>490	ubyte&0xDF	>0			\b+
9293>>>>>>>490	string		x 			\b%-.5s
9294>>>>>>>>495	ubyte&0xDF	>0
9295>>>>>>>>>495	string		x 			\b%-.3s
9296>>>>>>>498	ubyte&0xDF	>0
9297>>>>>>>>498	string		x 			\b.%-.3s
9298#
9299>376	search/41	Non-System\ disk\ or\040
9300>>395	search/41	disk\ error\r
9301>>>407	search/41	Replace\ and\040
9302>>>>419	search/41	press\ 				\b,
9303>>>>419	search/41	strike\ 			\b, old
9304>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
9305#449			Disk\ Boot\ failure\r		MS 3.21
9306#466			Boot\ Failure\r			MS 3.30
9307>>>>>468 search/18	\0
9308#IO.SYS,IBMBIO.COM
9309>>>>>>&0	string		x 			\b %-.2s
9310>>>>>>>&-20	ubyte&0xDF	>0
9311>>>>>>>>&-1	string		x 			\b%-.4s
9312>>>>>>>>>&-16	ubyte&0xDF	>0
9313>>>>>>>>>>&-1	string		x 			\b%-.2s
9314>>>>>>&8	ubyte&0xDF	>0			\b.
9315>>>>>>>&-1	string		x 			\b%-.3s
9316#MSDOS.SYS,IBMDOS.COM
9317>>>>>>&11	ubyte&0xDF	>0			\b+
9318>>>>>>>&-1	string		x 			\b%-.5s
9319>>>>>>>>&-6	ubyte&0xDF	>0
9320>>>>>>>>>&-1	string		x 			\b%-.1s
9321>>>>>>>>>>&-5	ubyte&0xDF	>0
9322>>>>>>>>>>>&-1	string		x 			\b%-.2s
9323>>>>>>>&7	ubyte&0xDF	>0			\b.
9324>>>>>>>>&-1	string		x 			\b%-.3s
9325>441	string	Cannot\ load\ from\ harddisk.\n\r
9326>>469	string	Insert\ Systemdisk\040
9327>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
9328#>43	string	\224R-LOADER\ \ SYS			=label
9329>54	string	SYS
9330>>324	string	VASKK
9331>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
9332#
9333>98	string	Press\ a\ key\ to\ retry\0\r
9334>>120	string	Cannot\ find\ file\ \0\r
9335>>>139	string	Disk\ read\ error\0\r
9336>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
9337#DRBIOS.SYS
9338>>>>>44		ubyte&0xDF	>0
9339>>>>>>44	string		x			\b %-.6s
9340>>>>>>>50	ubyte&0xDF	>0
9341>>>>>>>>50	string		x 			\b%-.2s
9342>>>>>>52	ubyte&0xDF	>0
9343>>>>>>>52	string		x 			\b.%-.3s
9344#
9345>70	string	IBMBIO\ \ COM
9346>>472	string	Cannot\ load\ DOS!\040
9347>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
9348>>471	string	Cannot\ load\ DOS\040
9349>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
9350#??
9351>444	string	KERNEL\ \ SYS
9352>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
9353>499	string	KERNEL\ \ SYS
9354>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
9355>449	string	KERNEL\ \ SYS
9356>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
9357#
9358>449	string	Loading\ FreeDOS
9359>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
9360>>>497		ubyte&0xDF	>0
9361>>>>497		string		x 			\b %-.6s
9362>>>>>503	ubyte&0xDF	>0
9363>>>>>>503	string		x 			\b%-.1s
9364>>>>>>>504	ubyte&0xDF	>0
9365>>>>>>>>504	string		x 			\b%-.1s
9366>>>>505		ubyte&0xDF	>0
9367>>>>>505	string		x 			\b.%-.3s
9368#
9369>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
9370#
9371>125	string	Loading\ FreeDOS...\r
9372>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
9373>>>441		ubyte&0xDF	>0
9374>>>>441		string		x 			\b %-.6s
9375>>>>>447	ubyte&0xDF	>0
9376>>>>>>447	string		x 			\b%-.1s
9377>>>>>>>448	ubyte&0xDF	>0
9378>>>>>>>>448	string		x 			\b%-.1s
9379>>>>449		ubyte&0xDF	>0
9380>>>>>449	string		x 			\b.%-.3s
9381>124	string	FreeDOS\0
9382>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
9383# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
9384>>>497		ubyte&0xDF	>0
9385>>>>497		string		x 			\b %-.6s
9386>>>>>503	ubyte&0xDF	>0
9387>>>>>>503	string		x 			\b%-.1s
9388>>>>>>>504	ubyte&0xDF	>0
9389>>>>>>>>504	string		x 			\b%-.1s
9390>>>>505		ubyte&0xDF	>0
9391>>>>>505	string		x 			\b.%-.3s
9392>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
9393>>>497		ubyte&0xDF	>0
9394>>>>497		string		x 			\b %-.6s
9395>>>>>503	ubyte&0xDF	>0
9396>>>>>>503	string		x 			\b%-.1s
9397>>>>>>>504	ubyte&0xDF	>0
9398>>>>>>>>504	string		x 			\b%-.1s
9399>>>>505		ubyte&0xDF	>0
9400>>>>>505	string		x 			\b.%-.3s
9401>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
9402>>>497		ubyte&0xDF	>0
9403>>>>497		string		x 			\b %-.6s
9404>>>>>503	ubyte&0xDF	>0
9405>>>>>>503	string		x 			\b%-.1s
9406>>>>>>>504	ubyte&0xDF	>0
9407>>>>>>>>504	string		x 			\b%-.1s
9408>>>>505		ubyte&0xDF	>0
9409>>>>>505	string		x 			\b.%-.3s
9410>336	string	Error!\040
9411>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
9412>>>497		ubyte&0xDF	>0
9413>>>>497		string		x 			\b %-.6s
9414>>>>>503	ubyte&0xDF	>0
9415>>>>>>503	string		x 			\b%-.1s
9416>>>>>>>504	ubyte&0xDF	>0
9417>>>>>>>>504	string		x 			\b%-.1s
9418>>>>505		ubyte&0xDF	>0
9419>>>>>505	string		x 			\b.%-.3s
9420# added by Joerg Jenderek
9421# http://www.visopsys.org/
9422# http://partitionlogic.org.uk/
9423# OEM-ID=Visopsys
9424>478		ulelong	0
9425>>(1.b+326)	string	I/O\ Error\ reading\040
9426>>>(1.b+344)	string	Visopsys\ loader\r
9427>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
9428# http://alexfru.chat.ru/epm.html#bootprog
9429>494	ubyte	>0x4D
9430>>495	string	>E
9431>>>495	string	<S
9432#OEM-ID is not reliable
9433>>>>3	string	BootProg
9434# It just looks for a program file name at the root directory
9435# and loads corresponding file with following execution.
9436# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
9437>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
9438>>>>>499		use		DOS-filename
9439#If the boot sector fails to read any other sector,
9440#it prints a very short message ("RE") to the screen and hangs the computer.
9441#If the boot sector fails to find needed program in the root directory,
9442#it also hangs with another message ("NF").
9443>>>>>492		string		RENF		\b, FAT (12 bit)
9444>>>>>495		string		RENF		\b, FAT (16 bit)
9445#If the boot sector fails to read any other sector,
9446#it prints a very short message ("RE") to the screen and hangs the computer.
9447# x86 bootloader end
9448
9449# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
9450# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
9451>0		string		RRaA
9452>>0x1E4		string		rrAa		\b, FSInfosector
9453#>>0x1FC	uleshort	=0		SHOULD BE ZERO
9454>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
9455>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
9456
9457# updated by Joerg Jenderek at Sep 2007
9458>3	ubyte	0
9459#no active flag
9460>>446	ubyte	0
9461# partition 1 not empty
9462>>>450	ubyte	>0
9463# partitions 3,4 empty
9464>>>>482		ubyte	0
9465>>>>>498	ubyte	0
9466# partition 2 ID=0,5,15
9467>>>>>>466	ubyte	<0x10
9468>>>>>>>466	ubyte	0x05			\b, extended partition table
9469>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
9470>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
9471
9472# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
9473
9474>0x200	lelong	0x82564557		\b, BSD disklabel
9475
9476# by Joerg Jenderek at Apr 2013
9477#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
9478#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
94790	name			DOS-filename
9480# space=0x20 (00100000b) means empty
9481>0			ubyte&0xDF	>0
9482>>0			ubyte		x 		\b%c
9483>>>1			ubyte&0xDF	>0
9484>>>>1			ubyte		x 		\b%c
9485>>>>>2			ubyte&0xDF	>0
9486>>>>>>2			ubyte		x 		\b%c
9487>>>>>>>3		ubyte&0xDF	>0
9488>>>>>>>>3		ubyte		x 		\b%c
9489>>>>>>>>>4		ubyte&0xDF	>0
9490>>>>>>>>>>4		ubyte		x 		\b%c
9491>>>>>>>>>>>5		ubyte&0xDF	>0
9492>>>>>>>>>>>>5		ubyte		x 		\b%c
9493>>>>>>>>>>>>>6		ubyte&0xDF	>0
9494>>>>>>>>>>>>>>6		ubyte		x 		\b%c
9495>>>>>>>>>>>>>>>7	ubyte&0xDF	>0
9496>>>>>>>>>>>>>>>>7	ubyte		x 		\b%c
9497# DOS filename extension
9498>>8			ubyte&0xDF	>0		\b.
9499>>>8			ubyte		x 		\b%c
9500>>>>9			ubyte&0xDF	>0
9501>>>>>9			ubyte		x 		\b%c
9502>>>>>>10		ubyte&0xDF	>0
9503>>>>>>>10		ubyte		x 		\b%c
9504#	Print 2 following DOS filenames from directory entry form
9505#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
95060	name			2xDOS-filename
9507# display 1 space
9508>0			ubyte		x		\b
9509>0			use		DOS-filename
9510>11			ubyte		x		\b+
9511>11			use		DOS-filename
9512
9513# http://en.wikipedia.org/wiki/Master_boot_record#PTE
9514# display standard partition table
95150	name				partition-table
9516#>0		ubyte		x	PARTITION-TABLE
9517# test and display 1st til 4th partition table entry
9518>0		use			partition-entry-test
9519>16		use			partition-entry-test
9520>32		use			partition-entry-test
9521>48		use			partition-entry-test
9522#		test for entry of partition table
95230	name				partition-entry-test
9524# partition type ID > 0
9525>4		ubyte		>0
9526# active flag 0
9527>>0		ubyte		0
9528>>>0		use		partition-entry
9529# active flag 0x80, 0x81, ...
9530>>0		ubyte		>0x7F
9531>>>0		use		partition-entry
9532#		Print entry of partition table
95330	name				partition-entry
9534# partition type ID > 0
9535>4		ubyte		>0	\b; partition
9536>>64		leshort		0xAA55	1
9537>>48		leshort		0xAA55	2
9538>>32		leshort		0xAA55	3
9539>>16		leshort		0xAA55	4
9540>>4		ubyte		x	: ID=0x%x
9541>>0		ubyte&0x80	0x80	\b, active
9542>>0		ubyte		>0x80	0x%x
9543>>1		ubyte		x	\b, start-CHS (
9544>>1		use		partition-chs
9545>>5		ubyte		x	\b), end-CHS (
9546>>5		use		partition-chs
9547>>8		ulelong		x	\b), startsector %u
9548>>12		ulelong		x	\b, %u sectors
9549#		Print cylinder,head,sector (CHS) of partition entry
95500	name				partition-chs
9551# cylinder
9552>1		ubyte		x	\b0x
9553>1		ubyte&0xC0	0x40	\b1
9554>1		ubyte&0xC0	0x80	\b2
9555>1		ubyte&0xC0	0xC0	\b3
9556>2		ubyte		x	\b%x
9557# head
9558>0		ubyte		x	\b,%u
9559# sector
9560>1		ubyte&0x3F	x	\b,%u
9561
9562# FATX
95630		string		FATX		FATX filesystem data
9564
9565# romfs filesystems - Juan Cespedes <cespedes@debian.org>
95660	string		-rom1fs-	romfs filesystem, version 1
9567>8	belong	x			%d bytes,
9568>16	string	x			named %s.
9569
9570# netboot image - Juan Cespedes <cespedes@debian.org>
95710	lelong		0x1b031336L	Netboot image,
9572>4	lelong&0xFFFFFF00	0
9573>>4	lelong&0x100	0x000		mode 2
9574>>4	lelong&0x100	0x100		mode 3
9575>4	lelong&0xFFFFFF00	!0	unknown mode
9576
95770x18b	string	OS/2	OS/2 Boot Manager
9578
9579# updated by Joerg Jenderek at Oct 2008 and Sep 2012
9580# http://syslinux.zytor.com/iso.php
9581# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
9582# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
95830	ulequad&0x909000007cc0eafa	0x909000007c40eafa
9584>631	search/689	ISOLINUX\ 	isolinux Loader
9585>>&0	string		x		(version %-4.4s)
9586# http://syslinux.zytor.com/pxe.php
9587# assembler instructions: jmp 7C05
95880	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
9589# assembler instructions: pushfd;pushad
95900	ulelong	0x60669c66		pxelinux loader
9591# assembler instructions: jmp 05
95920	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
9593# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
95940	string	LDLINUX\ SYS\ 		SYSLINUX loader
9595>12	string	x			(older version %-4.4s)
95960	string	\r\nSYSLINUX\ 		SYSLINUX loader
9597>11	string	x			(version %-4.4s)
9598# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
9599# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
96000	ulelong&0x80909bEB	0x009018EB
9601# OEM-ID not always "SYSLINUX"
9602>434	search/47	Boot\ failed
9603# followed by \r\n\0 or :\
9604>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
9605>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
9606>459	search/30	Boot\ error\r\n\0
9607>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
9608# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
9609# assembler instructions: mov di,0600h;mov cx,0100h
961016	search/4	\xbf\x00\x06\xb9\x00\x01
9611# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
9612!:strength +36
9613>94	search/249	Missing\ operating\ system
9614# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
9615# skip Ranish MBR
9616>>408	search/4	HD1/\0
9617>>408	default		x
9618>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
9619# followed by "ing " or space
9620>>>>292	search/98	error
9621>>>>>&0	string		\r		    			(version 3.35 or older)
9622>>>>>&0	string		.\r					(version 3.52 or newer)
9623>>>>>&0	default		x					(version 3.36-3.51 )
9624>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
9625>>156	search/10	\0Boot\ partition\ not\ found\r\n
9626>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
9627>>174	search/10	\0Missing\ OS\r\n
9628>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
9629# SYSLINUX END
9630
9631# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
9632# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
96330	ubequad		0x31c08ed0bc007c8e
9634# mbr_bootsel magic before partition table not reliable with small ipl fragments
9635#>444	uleshort	0xb5e1
9636>0004	uleshort	x
9637# ERRorTeXT
9638>>181	search/166		Error\ \0\r\n				NetBSD mbr
9639# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
9640>>>0x1B8	ubelong		>0					\b,Serial 0x%-.8x
9641# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
9642>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
9643# BOOT_EXTENDED definitions contains assembler instructions:
9644# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
9645>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
9646# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
9647>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
9648# not TERSE_ERROR
9649>>>196		search/106	No\ active\ partition\0
9650>>>>&0		string		Disk\ read\ error\0
9651>>>>>&0		string		No\ operating\ system\0			\b,verbose
9652# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
9653>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
9654# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
9655>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
9656# assembler instructions: movw nametab,bx
9657>>>0x26	    search/21	\xBB\x94\x07
9658# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
9659>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
9660>>>>>181	search/166		Error\ \0
9661# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
9662>>>>>>&3	string			x				\b,"%s"
9663>>>446	use		partition-table
9664# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
9665# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
9666# assembler instructions: jmp short 0x58;nop;ASCII
96670	ubequad&0xeb58908000000000	0xeb58900000000000
9668# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
9669>(1.b+2)	ubequad			0xfa31c08ed88ec08e
9670# Error messages at end of code
9671>>376		string	No\ operating\ system\r\n\0
9672>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
9673>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
9674
9675# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
9676# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
9677# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
9678# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
96790	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
9680# pointer to the data starting with Neil Turton signature string
9681>(0x1BC.s)		string		NDTmbr
9682>>&-14			string		1234F\0			Turton mbr (
9683# parameters also viewed by install-mbr --list
9684>>>(0x1BC.s+7)		ubyte		x			\b%u<=
9685>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
9686#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
9687>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
9688# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
9689>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
9690#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
9691#>>>(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
9692#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
9693#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
9694# for older versions
9695>>>(0x1BC.s+9)		ubyte		<2
9696#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
9697>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
9698# floppy A: or B:
9699>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy 0x%x
9700>>>>(0x1BC.s+13)	ubyte		>1
9701# 1st hard disc
9702#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
9703# not 1st hard disc
9704>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
9705# for version >= 2 maximal timeout can be 65534
9706>>>(0x1BC.s+9)		ubyte		>1
9707#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
9708>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
9709# floppy A: or B:
9710>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy 0x%x
9711>>>>(0x1BC.s+14)	ubyte		>1
9712# 1st hard disc
9713#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
9714# not 1st hard disc
9715>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
9716>>>0	ubyte		x					\b)
9717
9718# added by Joerg Jenderek
9719# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
9720# grub-1.94/kern/i386/pc/startup.S
9721# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
9722# usual values are marked with comments to get only informations of strange GRUB loaders
97230x200	uleshort		0x70EA
9724# found only version 3.{1,2}
9725>0x206		ubeshort	>0x0300
9726# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
9727>>0x212 	ubyte		>0x29
9728>>>0x213 	ubyte		>0x29
9729# not iso9660_stage1_5
9730#>>>0	ulelong&0x00BE5652	0x00BE5652
9731>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
9732# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
9733>>>>0x217 	ubyte		0xFF		stage1_5
9734>>>>0x217 	ubyte		<0xFF		stage2
9735>>>>0x206	ubyte		x		\b version %u
9736>>>>0x207	ubyte		x		\b.%u
9737# module_size for 1.94
9738>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
9739#>>>>0x208	ulelong		=0xffffff	\b, %lu (default)
9740>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
9741# GRUB 0.5.95 unofficial
9742>>>>0x20C	ulelong&0x2E300000 0x2E300000
9743# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
9744>>>>>0x20C	ubyte		x		\b, identifier 0x%x
9745#>>>>>0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
9746>>>>>0x20D	ubyte		>0		\b, LBA flag 0x%x
9747# GRUB version as string
9748>>>>>0x20E 	string		>\0		\b, GRUB version %-s
9749# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
9750>>>>>>0x215 	ulong		0xffffffff
9751>>>>>>>0x219 	string		>\0		\b, configuration file %-s
9752>>>>>>0x215 	ulong		!0xffffffff
9753>>>>>>>0x215 	string		>\0		\b, configuration file %-s
9754# newer GRUB versions
9755>>>>0x20C	ulelong&0x2E300000 !0x2E300000
9756##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
9757>>>>>0x20C	ulelong		>0		\b, saved entry %d
9758# for 1.94 contains kernel image size
9759# for 0.93,0.94,0.96,0.97
9760# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
9761>>>>>0x210	ubyte		x		\b, identifier 0x%x
9762# The flag for LBA forcing is in most cases 0
9763#>>>>>0x211	ubyte		=0		\b, LBA flag 0x%x (default)
9764>>>>>0x211	ubyte		>0		\b, LBA flag 0x%x
9765# GRUB version as string
9766>>>>>0x212 	string		>\0		\b, GRUB version %-s
9767# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
9768>>>>>0x217 	ulong		0xffffffff
9769>>>>>>0x21b 	string		>\0		\b, configuration file %-s
9770>>>>>0x217 	ulong		!0xffffffff
9771>>>>>>0x217 	string		>\0		\b, configuration file %-s
9772
9773# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
9774# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
9775# over BIOS parameter block (BPB)
9776# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
9777# older drives may use Near JuMP instruction E9 xx xx
9778# minimal short forward jump found 0x29 for bootloaders or 0x0
9779# maximal short forward jump is 0x7f
9780# OEM-ID is empty or contain readable bytes
97810		ulelong&0x804000E9	0x000000E9
9782!:strength	+60
9783# mtools-3.9.8/msdos.h
9784# usual values are marked with comments to get only informations of strange FAT systems
9785# valid sectorsize must be a power of 2 from 32 to 32768
9786>11		uleshort&0x001f	0
9787>>11		uleshort	<32769
9788>>>11		uleshort	>31
9789>>>>21		ubyte&0xf0	0xF0
9790>>>>>0		ubyte		0xEB		DOS/MBR boot sector
9791>>>>>>1		ubyte		x		\b, code offset 0x%x+2
9792>>>>>0		ubyte		0xE9
9793>>>>>>1		uleshort	x		\b, code offset 0x%x+3
9794>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
9795#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
9796>>>>>>8		string		IHC		\b cached by Windows 9M
9797>>>>>11		uleshort	>512		\b, Bytes/sector %u
9798#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
9799>>>>>11		uleshort	<512		\b, Bytes/sector %u
9800>>>>>13		ubyte		>1		\b, sectors/cluster %u
9801#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
9802# for lazy FAT32 implementation like Transcend digital photo frame PF830
9803>>>>>82		string/c	fat32
9804>>>>>>14	uleshort	!32		\b, reserved sectors %u
9805#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
9806>>>>>82		string/c	!fat32
9807>>>>>>14	uleshort	>1		\b, reserved sectors %u
9808#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
9809#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
9810>>>>>16		ubyte		>2		\b, FATs %u
9811#>>>>>16	ubyte		=2		\b, FATs %u (usual)
9812>>>>>16		ubyte		=1		\b, FAT  %u
9813>>>>>16		ubyte		>0
9814>>>>>17		uleshort	>0		\b, root entries %u
9815#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
9816>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
9817#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
9818>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
9819#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
9820>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
9821>>>>>22		uleshort	>0		\b, sectors/FAT %u
9822#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
9823>>>>>24		uleshort	x		\b, sectors/track %u
9824>>>>>26		ubyte		>2		\b, heads %u
9825#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
9826>>>>>26		ubyte		=1		\b, heads %u
9827# valid only for sector sizes with more then 32 Bytes
9828>>>>>11		uleshort	>32
9829# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
9830# skip for values 2,2Ah,70h,73h,DFh
9831# and continue for extended boot signature values 0,28h,29h,80h
9832>>>>>>38	ubyte&0x56	=0
9833>>>>>>>28	ulelong		>0		\b, hidden sectors %u
9834#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
9835>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
9836#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
9837# FAT<32 bit specific
9838>>>>>>>82	string/c	!fat32
9839#>>>>>>>>36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
9840#>>>>>>>>36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
9841>>>>>>>>36	ubyte		!0x80
9842>>>>>>>>>36	ubyte		!0		\b, physical drive 0x%x
9843# VGA-copy CRC or
9844# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
9845>>>>>>>>37	ubyte		>0		\b, reserved 0x%x
9846#>>>>>>>>37	ubyte		=0		\b, reserved 0x%x
9847# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
9848>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
9849>>>>>>>>38	ubyte&0xFE	=0x28
9850>>>>>>>>>39	ulelong		x		\b, serial number 0x%x
9851>>>>>>>>38	ubyte		=0x29
9852>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
9853>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
9854>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
9855# there exist some old floppies without word FAT at offset 54
9856# a word like "FATnm   " is only a hint for a FAT size on nm-bits
9857# Normally the number of clusters is calculated by the values of BPP.
9858# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
9859# otherwise FAT is 16 bit.
9860# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
9861>>>>>82		string/c	!fat32
9862>>>>>>54	string		FAT12		\b, FAT (12 bit)
9863>>>>>>54	string		FAT16		\b, FAT (16 bit)
9864>>>>>>54	default		x
9865# determinate FAT bit size by media descriptor
9866# small floppies implies FAT12
9867>>>>>>>21	ubyte		<0xF0		\b, FAT (12 bit by descriptor)
9868# with media descriptor F0h floppy or maybe superfloppy with FAT16
9869>>>>>>>21	ubyte		=0xF0
9870# superfloppy (many sectors) implies FAT16
9871>>>>>>>>32	ulelong		>0xFFFF		\b, FAT (16 bit by descriptor+sectors)
9872# no superfloppy with media descriptor F0h implies FAT12
9873>>>>>>>>32	default		x		\b, FAT (12 bit by descriptor+sectors)
9874# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
9875>>>>>>>21	ubyte		=0xF8
9876# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
9877>>>>>>>>19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
9878# hard disc with FAT12 or FAT16
9879>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
9880# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
9881>>>>>>>21	ubyte		=0xFA
9882# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
9883>>>>>>>>19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
9884# RAM disc with FAT12 or FAT16 or Tandy hard disc
9885>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
9886# others are floppy
9887>>>>>>>21	default		x		\b, FAT (12 bit by descriptor)
9888# FAT32 bit specific
9889>>>>>82		string/c	fat32		\b, FAT (32 bit)
9890>>>>>>36	ulelong		x		\b, sectors/FAT %u
9891# http://technet.microsoft.com/en-us/library/cc977221.aspx
9892>>>>>>40	uleshort	>0		\b, extension flags 0x%x
9893#>>>>>>40	uleshort	=0		\b, extension flags %hu
9894>>>>>>42	uleshort	>0		\b, fsVersion %u
9895#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
9896>>>>>>44	ulelong		>2		\b, rootdir cluster %u
9897#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
9898#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
9899>>>>>>48	uleshort	>1		\b, infoSector %u
9900#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
9901>>>>>>48	uleshort	<1		\b, infoSector %u
9902# 0 or 0xFFFF instead of usual 6 means no backup sector
9903>>>>>>50	uleshort	=0xFFFF		\b, no Backup boot sector
9904>>>>>>50	uleshort	=0		\b, no Backup boot sector
9905#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
9906>>>>>>50	default		x
9907>>>>>>>50	uleshort	x		\b, Backup boot sector %u
9908# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
9909>>>>>>52	ulelong		>0		\b, reserved1 0x%x
9910>>>>>>56	ulelong		>0		\b, reserved2 0x%x
9911>>>>>>60	ulelong		>0		\b, reserved3 0x%x
9912# same structure as FAT1X
9913#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
9914#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
9915>>>>>>64	ubyte		!0x80
9916>>>>>>>64	ubyte		>0		\b, physical drive 0x%x
9917# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
9918>>>>>>65	ubyte		>0		\b, reserved 0x%x
9919>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
9920>>>>>>66	ubyte		=0x29
9921>>>>>>>67	ulelong		x		\b, serial number 0x%x
9922>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
9923>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
9924>>>>>>>71	string		=NO\ NAME	\b, unlabeled
9925# additional tests for floppy image added by Joerg Jenderek
9926# no fixed disk
9927>>>>>21		ubyte		!0xF8
9928# floppy media with 12 bit FAT
9929>>>>>>54	string		!FAT16
9930# test for FAT after bootsector
9931>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
9932# floppy image
9933!:mime application/x-ima
9934# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
9935# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
9936# 0 FATs
9937>>>>>16	ubyte		=0
9938# 0 root entries
9939>>>>>>17	uleshort	=0
9940# 0 DOS sectors
9941>>>>>>>19	uleshort	=0
9942# 0 sectors/FAT
9943# dos < 4.0 BootSector value found is 0x80
9944#38	ubyte		=0x80			\b, dos < 4.0 BootSector (0x%x)
9945>>>>>>>>22	uleshort	=0		\b; NTFS
9946>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
9947>>>>>>>>>36	ulelong		!0x800080	\b, physical drive 0x%x
9948>>>>>>>>>40	ulequad		>0		\b, sectors %lld
9949>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
9950>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
9951# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
9952# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
9953>>>>>>>>>64	lelong		<256
9954>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
9955>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%i)
9956# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
9957# Values 128 to 255 represent index block sizes of 2^(256-N) byte
9958>>>>>>>>>68	ulelong		<256
9959>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
9960#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
9961>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%i)
9962>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
9963>>>>>>>>>80	ulelong		>0		\b, checksum 0x%x
9964#>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
9965>>>>>>>>>0x258	ulelong&0x00009090	=0x00009090
9966>>>>>>>>>>&-92		indirect	x	\b; contains
9967# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
9968# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
9969# unused assembler instructions JMP y2;NOP;NOP
99700x056		ulelong&0xFFFF0FFF	0x909002EB
9971# unicode loadername terminated by CTRL-D
9972>(0.s*2)	ulelong&0xFFFFFF00	0x00040000
9973# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
9974>>0x002		lestring16	x	Microsoft Windows XP/VISTA bootloader %-5.5s
9975>>0x12		string		$
9976>>>0x0c		lestring16	x	\b%-2.2s
9977### DOS,NTFS boot sectors end
9978
9979# ntfsclone-image is a special save format for NTFS volumes,
9980# created and restored by the ntfsclone program
99810	string	\0ntfsclone-image	ntfsclone image,
9982>0x10	byte	x			version %d.
9983>0x11	byte	x			\b%d,
9984>0x12	lelong	x			cluster size %d,
9985>0x16	lequad	x			device size %lld,
9986>0x1e	lequad	x			%lld total clusters,
9987>0x26	lequad	x			%lld clusters in use
9988
99899564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
9990>8404	string		x		last mounted on %s,
9991#>9504	ledate		x		last checked at %s,
9992>8224	ledate		x		last written at %s,
9993>8401	byte		x		clean flag %d,
9994>8228	lelong		x		number of blocks %d,
9995>8232	lelong		x		number of data blocks %d,
9996>8236	lelong		x		number of cylinder groups %d,
9997>8240	lelong		x		block size %d,
9998>8244	lelong		x		fragment size %d,
9999>8252	lelong		x		minimum percentage of free blocks %d,
10000>8256	lelong		x		rotational delay %dms,
10001>8260	lelong		x		disk rotational speed %drps,
10002>8320	lelong		0		TIME optimization
10003>8320	lelong		1		SPACE optimization
10004
1000542332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
10006>&-1164	string		x		last mounted on %s,
10007>&-696	string		>\0		volume name %s,
10008>&-304	leqldate	x		last written at %s,
10009>&-1167	byte		x		clean flag %d,
10010>&-1168	byte		x		readonly flag %d,
10011>&-296	lequad		x		number of blocks %lld,
10012>&-288	lequad		x		number of data blocks %lld,
10013>&-1332	lelong		x		number of cylinder groups %d,
10014>&-1328	lelong		x		block size %d,
10015>&-1324	lelong		x		fragment size %d,
10016>&-180	lelong		x		average file size %d,
10017>&-176	lelong		x		average number of files in dir %d,
10018>&-272	lequad		x		pending blocks to free %lld,
10019>&-264	lelong		x		pending inodes to free %d,
10020>&-664	lequad		x		system-wide uuid %0llx,
10021>&-1316	lelong		x		minimum percentage of free blocks %d,
10022>&-1248	lelong		0		TIME optimization
10023>&-1248	lelong		1		SPACE optimization
10024
1002566908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
10026>&-1164	string		x		last mounted on %s,
10027>&-696	string		>\0		volume name %s,
10028>&-304	leqldate	x		last written at %s,
10029>&-1167	byte		x		clean flag %d,
10030>&-1168	byte		x		readonly flag %d,
10031>&-296	lequad		x		number of blocks %lld,
10032>&-288	lequad		x		number of data blocks %lld,
10033>&-1332	lelong		x		number of cylinder groups %d,
10034>&-1328	lelong		x		block size %d,
10035>&-1324	lelong		x		fragment size %d,
10036>&-180	lelong		x		average file size %d,
10037>&-176	lelong		x		average number of files in dir %d,
10038>&-272	lequad		x		pending blocks to free %lld,
10039>&-264	lelong		x		pending inodes to free %d,
10040>&-664	lequad		x		system-wide uuid %0llx,
10041>&-1316	lelong		x		minimum percentage of free blocks %d,
10042>&-1248	lelong		0		TIME optimization
10043>&-1248	lelong		1		SPACE optimization
10044
100459564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
10046>7168   belong		0x4c41424c	Apple UFS Volume
10047>>7186  string		x		named %s,
10048>>7176  belong		x		volume label version %d,
10049>>7180  bedate		x		created on %s,
10050>8404	string		x		last mounted on %s,
10051#>9504	bedate		x		last checked at %s,
10052>8224	bedate		x		last written at %s,
10053>8401	byte		x		clean flag %d,
10054>8228	belong		x		number of blocks %d,
10055>8232	belong		x		number of data blocks %d,
10056>8236	belong		x		number of cylinder groups %d,
10057>8240	belong		x		block size %d,
10058>8244	belong		x		fragment size %d,
10059>8252	belong		x		minimum percentage of free blocks %d,
10060>8256	belong		x		rotational delay %dms,
10061>8260	belong		x		disk rotational speed %drps,
10062>8320	belong		0		TIME optimization
10063>8320	belong		1		SPACE optimization
10064
1006542332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
10066>&-1164	string		x		last mounted on %s,
10067>&-696	string		>\0		volume name %s,
10068>&-304	beqldate	x		last written at %s,
10069>&-1167	byte		x		clean flag %d,
10070>&-1168	byte		x		readonly flag %d,
10071>&-296	bequad		x		number of blocks %lld,
10072>&-288	bequad		x		number of data blocks %lld,
10073>&-1332	belong		x		number of cylinder groups %d,
10074>&-1328	belong		x		block size %d,
10075>&-1324	belong		x		fragment size %d,
10076>&-180	belong		x		average file size %d,
10077>&-176	belong		x		average number of files in dir %d,
10078>&-272	bequad		x		pending blocks to free %lld,
10079>&-264	belong		x		pending inodes to free %d,
10080>&-664	bequad		x		system-wide uuid %0llx,
10081>&-1316	belong		x		minimum percentage of free blocks %d,
10082>&-1248	belong		0		TIME optimization
10083>&-1248	belong		1		SPACE optimization
10084
1008566908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
10086>&-1164	string		x		last mounted on %s,
10087>&-696	string		>\0		volume name %s,
10088>&-304	beqldate	x		last written at %s,
10089>&-1167	byte		x		clean flag %d,
10090>&-1168	byte		x		readonly flag %d,
10091>&-296	bequad		x		number of blocks %lld,
10092>&-288	bequad		x		number of data blocks %lld,
10093>&-1332	belong		x		number of cylinder groups %d,
10094>&-1328	belong		x		block size %d,
10095>&-1324	belong		x		fragment size %d,
10096>&-180	belong		x		average file size %d,
10097>&-176	belong		x		average number of files in dir %d,
10098>&-272	bequad		x		pending blocks to free %lld,
10099>&-264	belong		x		pending inodes to free %d,
10100>&-664	bequad		x		system-wide uuid %0llx,
10101>&-1316	belong		x		minimum percentage of free blocks %d,
10102>&-1248	belong		0		TIME optimization
10103>&-1248	belong		1		SPACE optimization
10104
101050	ulequad		0xc8414d4dc5523031	HAMMER filesystem (little-endian),
10106>0x90	lelong+1	x			volume %d
10107>0x94	lelong		x			(of %d),
10108>0x50	string		x			name %s,
10109>0x98	ulelong		x			version %u,
10110>0xa0	ulelong		x			flags 0x%x
10111
10112# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
10113# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
10114# volume label and UUID Russell Coker
10115# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
101160x438   leshort         0xEF53          Linux
10117>0x44c  lelong          x               rev %d
10118>0x43e  leshort         x               \b.%d
10119# No journal?  ext2
10120>0x45c  lelong          ^0x0000004      ext2 filesystem data
10121>>0x43a leshort         ^0x0000001      (mounted or unclean)
10122# Has a journal?  ext3 or ext4
10123>0x45c  lelong          &0x0000004
10124#  and small INCOMPAT?
10125>>0x460 lelong          <0x0000040
10126#   and small RO_COMPAT?
10127>>>0x464 lelong         <0x0000008      ext3 filesystem data
10128#   else large RO_COMPAT?
10129>>>0x464 lelong         >0x0000007      ext4 filesystem data
10130#  else large INCOMPAT?
10131>>0x460	lelong          >0x000003f      ext4 filesystem data
10132>0x468	belong		x		\b, UUID=%08x
10133>0x46c	beshort		x		\b-%04x
10134>0x46e	beshort		x		\b-%04x
10135>0x470	beshort		x		\b-%04x
10136>0x472	belong		x		\b-%08x
10137>0x476	beshort		x		\b%04x
10138>0x478	string		>0		\b, volume name "%s"
10139# General flags for any ext* fs
10140>0x460	lelong          &0x0000004      (needs journal recovery)
10141>0x43a	leshort         &0x0000002      (errors)
10142# INCOMPAT flags
10143>0x460	lelong          &0x0000001      (compressed)
10144#>0x460	lelong          &0x0000002      (filetype)
10145#>0x460	lelong          &0x0000010      (meta bg)
10146>0x460	lelong          &0x0000040      (extents)
10147>0x460	lelong          &0x0000080      (64bit)
10148#>0x460	lelong          &0x0000100      (mmp)
10149#>0x460	lelong          &0x0000200      (flex bg)
10150# RO_INCOMPAT flags
10151#>0x464	lelong          &0x0000001      (sparse super)
10152>0x464	lelong          &0x0000002      (large files)
10153>0x464	lelong          &0x0000008      (huge files)
10154#>0x464	lelong          &0x0000010      (gdt checksum)
10155#>0x464	lelong          &0x0000020      (many subdirs)
10156#>0x463	lelong          &0x0000040      (extra isize)
10157
10158# Minix filesystems - Juan Cespedes <cespedes@debian.org>
101590x410	leshort		0x137f
10160!:strength / 2
10161>0x402	beshort		< 100
10162>0x402	beshort		> -1		Minix filesystem, V1, 14 char names, %d zones
10163>0x1e	string		minix		\b, bootable
101640x410	beshort		0x137f
10165!:strength / 2
10166>0x402	beshort		< 100
10167>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
10168>0x1e	string		minix		\b, bootable
101690x410	leshort		0x138f
10170!:strength / 2
10171>0x402	beshort		< 100
10172>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
10173>0x1e	string		minix		\b, bootable
101740x410	beshort		0x138f
10175!:strength / 2
10176>0x402	beshort		< 100
10177>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
10178>0x1e	string		minix		\b, bootable
10179# Weak Magic: this is $x
10180#0x410	leshort		0x2468
10181#>0x402	beshort		< 100
10182#>>0x402	beshort		> -1		Minix filesystem, V2, 14 char names
10183#>0x1e	string		minix		\b, bootable
10184#0x410	beshort		0x2468
10185#>0x402	beshort		< 100
10186#>0x402	beshort		> -1		Minix filesystem, V2 (big endian)
10187#>0x1e	string		minix		\b, bootable
10188#0x410	leshort		0x2478
10189#>0x402	beshort		< 100
10190#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
10191#>0x1e	string		minix		\b, bootable
10192#0x410	leshort		0x2478
10193#>0x402	beshort		< 100
10194#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
10195#>0x1e	string		minix		\b, bootable
10196#0x410	beshort		0x2478
10197#>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian)
10198#>0x1e	string		minix		\b, bootable
10199# Weak Magic! this is MD
10200#0x418	leshort		0x4d5a
10201#>0x402	beshort		<100
10202#>>0x402	beshort		> -1		Minix filesystem, V3, 60 char names
10203
10204# SGI disk labels - Nathan Scott <nathans@debian.org>
102050	belong		0x0BE5A941	SGI disk label (volume header)
10206
10207# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
102080	belong		0x58465342	SGI XFS filesystem data
10209>0x4	belong		x		(blksz %d,
10210>0x68	beshort		x		inosz %d,
10211>0x64	beshort		^0x2004		v1 dirs)
10212>0x64	beshort		&0x2004		v2 dirs)
10213
10214############################################################################
10215# Minix-ST kernel floppy
102160x800	belong		0x46fc2700	Atari-ST Minix kernel image
10217# http://en.wikipedia.org/wiki/BIOS_parameter_block
10218# floppies with valid BPB and any instruction at beginning
10219>19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
10220>19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy
10221
10222############################################################################
10223# Hmmm, is this a better way of detecting _standard_ floppy images ?
1022419	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
10225>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1022619	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
10227>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1022819	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
10229>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
10230
1023119	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
10232>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1023319	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
10234>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
10235
1023619	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
1023719	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
10238#			|       |   |     |     |
10239#			|       |   |     |     heads
10240#			|       |   |     sectors/track
10241#			|       |   sectors/FAT
10242#			|       media descriptor
10243#		BPB:	sectors
10244
10245#  Valid media descriptor bytes for MS-DOS:
10246#
10247#     Byte   Capacity   Media Size and Type
10248#     -------------------------------------------------
10249#
10250#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
10251#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
10252#     F9     720K       3.5-inch, 2-sided, 9-sector
10253#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
10254#     FD     360K       5.25-inch, 2-sided, 9-sector
10255#     FF     320K       5.25-inch, 2-sided, 8-sector
10256#     FC     180K       5.25-inch, 1-sided, 9-sector
10257#     FE     160K       5.25-inch, 1-sided, 8-sector
10258#     FE     250K       8-inch, 1-sided, single-density
10259#     FD     500K       8-inch, 2-sided, single-density
10260#     FE     1.2 MB     8-inch, 2-sided, double-density
10261#     F8     -----      Fixed disk
10262#
10263#     FC     xxxK       Apricot 70x1x9 boot disk.
10264#
10265# Originally a bitmap:
10266#  xxxxxxx0	Not two sided
10267#  xxxxxxx1	Double sided
10268#  xxxxxx0x	Not 8 SPT
10269#  xxxxxx1x	8 SPT
10270#  xxxxx0xx	Not Removable drive
10271#  xxxxx1xx	Removable drive
10272#  11111xxx	Must be one.
10273#
10274# But now it's rather random:
10275#  111111xx	Low density disk
10276#        00	SS, Not 8 SPT
10277#        01	DS, Not 8 SPT
10278#        10	SS, 8 SPT
10279#        11	DS, 8 SPT
10280#
10281#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
10282#  11110000	High density 3 1/2 floppy disk
10283#  11111000	Hard disk any format
10284#
10285
10286# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
10287# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
10288# Too Weak.
10289#512		ubelong&0xE0ffff00	0xE0ffff00
10290# without valid Media descriptor in place of BPB, cases with are done at other places
10291#>21		ubyte			<0xE5			floppy with old FAT filesystem
10292# but valid Media descriptor at begin of FAT
10293#>>512		ubyte			=0xed			720k
10294#>>512		ubyte			=0xf0			1440k
10295#>>512		ubyte			=0xf8			720k
10296#>>512		ubyte			=0xf9			1220k
10297#>>512		ubyte			=0xfa			320k
10298#>>512		ubyte			=0xfb			640k
10299#>>512		ubyte			=0xfc			180k
10300# look like an an old DOS directory entry
10301#>>>0xA0E	ubequad			0
10302#>>>>0xA00	ubequad			!0
10303#!:mime application/x-ima
10304#>>512		ubyte			=0xfd
10305# look for 2nd FAT at different location to distinguish between 360k and 500k
10306#>>>0x600	ubelong&0xE0ffff00	0xE0ffff00		360k
10307#>>>0x500	ubelong&0xE0ffff00	0xE0ffff00		500k
10308#>>>0xA0E	ubequad			0
10309#!:mime application/x-ima
10310#>>512		ubyte			=0xfe
10311#>>>0x400	ubelong&0xE0ffff00	0xE0ffff00		160k
10312#>>>>0x60E	ubequad			0
10313#>>>>>0x600	ubequad			!0
10314#!:mime application/x-ima
10315#>>>0xC00	ubelong&0xE0ffff00	0xE0ffff00		1200k
10316#>>512		ubyte			=0xff			320k
10317#>>>0x60E	ubequad			0
10318#>>>>0x600	ubequad			!0
10319#!:mime application/x-ima
10320#>>512		ubyte			x			\b, Media descriptor 0x%x
10321# without x86 jump instruction
10322#>>0		ulelong&0x804000E9	!0x000000E9
10323# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
10324#>>>0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
10325# IOSYS.COM+MSDOS.COM
10326#>>>>0xc4	use			2xDOS-filename
10327#>>0		ulelong&0x804000E9	=0x000000E9
10328# only x86 short jump instruction found
10329#>>>0		ubyte			=0xEB
10330#>>>>1		ubyte			x			\b, code offset 0x%x+2
10331# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
10332# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
10333#>>>>(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
10334# ibmbio.com+ibmdos.com
10335#>>>>>0x176	use			DOS-filename
10336#>>>>>0x181	ubyte			x			\b+
10337#>>>>>0x182	use			DOS-filename
10338# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
10339# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
10340#>>>>(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
10341# ibmbio.com+ibmdos.com
10342#>>>>>0x18b	use			DOS-filename
10343#>>>>>0x196	ubyte			x			\b+
10344#>>>>>0x197	use			DOS-filename
10345# http://en.wikipedia.org/wiki/Zenith_Data_Systems
10346# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
10347#>>>>(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
10348# IO.SYS+MSDOS.SYS
10349#>>>>>0x20	use			2xDOS-filename
10350# http://en.wikipedia.org/wiki/Corona_Data_Systems
10351# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
10352#>>>>(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
10353# IO.SYS+MSDOS.SYS
10354#>>>>>0x69	use			2xDOS-filename
10355# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
10356#>>>>(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
10357# defect IO.SYS+MSDOS.SYS ?
10358#>>>>>0x162	use			2xDOS-filename
10359
103600	name				cdrom
10361>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
10362!:mime	application/x-iso9660-image
10363>38913	string    NSR0      UDF filesystem data
10364!:mime	application/x-iso9660-image
10365>>38917	string    1         (version 1.0)
10366>>38917	string    2         (version 1.5)
10367>>38917	string    3         (version 2.0)
10368>>38917	byte     >0x33      (unknown version, ID 0x%X)
10369>>38917	byte     <0x31      (unknown version, ID 0x%X)
10370# The next line is not necessary because the MBR staff is done looking for boot signature
10371>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
10372# "application id" which appears to be used as a volume label
10373>32808	string/T  >\0       '%s'
10374>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
1037537633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
10376!:mime	application/x-iso9660-image
1037732777	string    CDROM     High Sierra CD-ROM filesystem data
10378
10379# CDROM Filesystems
10380# https://en.wikipedia.org/wiki/ISO_9660
10381# Modified for UDF by gerardo.cacciari@gmail.com
1038232769	string    CD001
10383# mime line at that position does not work
10384# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
10385!:strength -11
10386# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
10387# does not work
10388#!:strength +33
10389>0	use cdrom
10390
10391# .cso files
10392# Reference: http://pismotec.com/ciso/ciso.h
10393# NOTE: There are two other formats with the same magic but
10394# completely incompatible specifications:
10395# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
10396# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
103970    string    CISO
10398# Other fields are used to determine what type of CISO this is:
10399# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
10400# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
10401# - None of the above: Compact ISO.
10402>4	lelong	!0
10403>>4	lelong	!0x200000
10404>>>0x10	lelong	!0x800		Compressed ISO CD image
10405
10406# cramfs filesystem - russell@coker.com.au
104070       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
10408>4      lelong  x size %u
10409>8      lelong  &1 version #2
10410>8      lelong  &2 sorted_dirs
10411>8      lelong  &4 hole_support
10412>32     lelong  x CRC 0x%x,
10413>36     lelong  x edition %u,
10414>40     lelong  x %u blocks,
10415>44     lelong  x %u files
10416
104170       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
10418>4      belong  x size %u
10419>8      belong  &1 version #2
10420>8      belong  &2 sorted_dirs
10421>8      belong  &4 hole_support
10422>32     belong  x CRC 0x%x,
10423>36     belong  x edition %u,
10424>40     belong  x %u blocks,
10425>44     belong  x %u files
10426
10427# reiserfs - russell@coker.com.au
104280x10034		string	ReIsErFs	ReiserFS V3.5
104290x10034		string	ReIsEr2Fs	ReiserFS V3.6
104300x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
10431>0x1002c 	leshort	x		block size %d
10432>0x10032	leshort	&2		(mounted or unclean)
10433>0x10000	lelong	x		num blocks %d
10434>0x10040	lelong	1		tea hash
10435>0x10040	lelong	2		yura hash
10436>0x10040	lelong	3		r5 hash
10437
10438# JFFS - russell@coker.com.au
104390	lelong	0x34383931	Linux Journalled Flash File system, little endian
104400	belong	0x34383931	Linux Journalled Flash File system, big endian
10441
10442# EST flat binary format (which isn't, but anyway)
10443# From: Mark Brown <broonie@sirena.org.uk>
104440	string	ESTFBINR	EST flat binary
10445
10446# Aculab VoIP firmware
10447# From: Mark Brown <broonie@sirena.org.uk>
104480	string	VoIP\ Startup\ and	Aculab VoIP firmware
10449>35	string	x	format %s
10450
10451# From: Mark Brown <broonie@sirena.org.uk> [old]
10452# From: Behan Webster <behanw@websterwood.com>
104530	belong	0x27051956	u-boot legacy uImage,
10454>32	string	x		%s,
10455>28	byte	0		Invalid os/
10456>28	byte	1		OpenBSD/
10457>28	byte	2		NetBSD/
10458>28	byte	3		FreeBSD/
10459>28	byte	4		4.4BSD/
10460>28	byte	5		Linux/
10461>28	byte	6		SVR4/
10462>28	byte	7		Esix/
10463>28	byte	8		Solaris/
10464>28	byte	9		Irix/
10465>28	byte	10		SCO/
10466>28	byte	11		Dell/
10467>28	byte	12		NCR/
10468>28	byte	13		LynxOS/
10469>28	byte	14		VxWorks/
10470>28	byte	15		pSOS/
10471>28	byte	16		QNX/
10472>28	byte	17		Firmware/
10473>28	byte	18		RTEMS/
10474>28	byte	19		ARTOS/
10475>28	byte	20		Unity OS/
10476>28	byte	21		INTEGRITY/
10477>29	byte	0		\bInvalid CPU,
10478>29	byte	1		\bAlpha,
10479>29	byte	2		\bARM,
10480>29	byte	3		\bIntel x86,
10481>29	byte	4		\bIA64,
10482>29	byte	5		\bMIPS,
10483>29	byte	6		\bMIPS 64-bit,
10484>29	byte	7		\bPowerPC,
10485>29	byte	8		\bIBM S390,
10486>29	byte	9		\bSuperH,
10487>29	byte	10		\bSparc,
10488>29	byte	11		\bSparc 64-bit,
10489>29	byte	12		\bM68K,
10490>29	byte	13		\bNios-32,
10491>29	byte	14		\bMicroBlaze,
10492>29	byte	15		\bNios-II,
10493>29	byte	16		\bBlackfin,
10494>29	byte	17		\bAVR32,
10495>29	byte	18		\bSTMicroelectronics ST200,
10496>29	byte	19		\bSandbox architecture,
10497>29	byte	20		\bANDES Technology NDS32,
10498>29	byte	21		\bOpenRISC 1000,
10499>29	byte	22		\bARM 64-bit,
10500>29	byte	23		\bDesignWare ARC,
10501>29	byte	24		\bx86_64,
10502>29	byte	25		\bXtensa,
10503>30	byte	0		Invalid Image
10504>30	byte	1		Standalone Program
10505>30	byte	2		OS Kernel Image
10506>30	byte	3		RAMDisk Image
10507>30	byte	4		Multi-File Image
10508>30	byte	5		Firmware Image
10509>30	byte	6		Script File
10510>30	byte	7		Filesystem Image (any type)
10511>30	byte	8		Binary Flat Device Tree BLOB
10512>31	byte	0		(Not compressed),
10513>31	byte	1		(gzip),
10514>31	byte	2		(bzip2),
10515>31	byte	3		(lzma),
10516>12	belong	x		%d bytes,
10517>8	bedate	x		%s,
10518>16	belong	x		Load Address: 0x%08X,
10519>20	belong	x		Entry Point: 0x%08X,
10520>4	belong	x		Header CRC: 0x%08X,
10521>24	belong	x		Data CRC: 0x%08X
10522
10523# JFFS2 file system
105240	leshort	0x1984		Linux old jffs2 filesystem data little endian
105250	leshort	0x1985		Linux jffs2 filesystem data little endian
10526
10527# Squashfs
105280	string	sqsh	Squashfs filesystem, big endian,
10529>28	beshort	x	version %d.
10530>30	beshort x	\b%d,
10531>28	beshort <3
10532>>8	belong	x	%d bytes,
10533>28	beshort >2
10534>>28 beshort <4
10535>>>63	bequad x	%lld bytes,
10536>>28 beshort >3
10537>>>40	bequad x	%lld bytes,
10538#>>67	belong	x	%d bytes,
10539>4	belong	x	%d inodes,
10540>28	beshort <2
10541>>32	beshort	x	blocksize: %d bytes,
10542>28	beshort >1
10543>>28 beshort <4
10544>>>51	belong	x	blocksize: %d bytes,
10545>>28 beshort >3
10546>>>12	belong	x	blocksize: %d bytes,
10547>28 beshort <4
10548>>39	bedate	x	created: %s
10549>28 beshort >3
10550>>8	bedate	x	created: %s
105510	string	hsqs	Squashfs filesystem, little endian,
10552>28	leshort	x	version %d.
10553>30	leshort	x	\b%d,
10554>28	leshort <3
10555>>8	lelong	x	%d bytes,
10556>28	leshort >2
10557>>28 leshort <4
10558>>>63	lequad x	%lld bytes,
10559>>28 leshort >3
10560>>>40	lequad x	%lld bytes,
10561#>>63	lelong	x	%d bytes,
10562>4	lelong	x	%d inodes,
10563>28	leshort <2
10564>>32	leshort	x	blocksize: %d bytes,
10565>28	leshort >1
10566>>28 leshort <4
10567>>>51	lelong	x	blocksize: %d bytes,
10568>>28 leshort >3
10569>>>12	lelong	x	blocksize: %d bytes,
10570>28 leshort <4
10571>>39	ledate	x	created: %s
10572>28 leshort >3
10573>>8	ledate	x	created: %s
10574
10575# AFS Dump Magic
10576# From: Ty Sarna <tsarna@sarna.org>
105770       string                  \x01\xb3\xa1\x13\x22    AFS Dump
10578>&0     belong                  x                       (v%d)
10579>>&0    byte                    0x76
10580>>>&0   belong                  x                       Vol %d,
10581>>>>&0  byte                    0x6e
10582>>>>>&0 string                  x                       %s
10583>>>>>>&1        byte            0x74
10584>>>>>>>&0       beshort         2
10585>>>>>>>>&4      bedate          x                       on: %s
10586>>>>>>>>&0      bedate          =0                      full dump
10587>>>>>>>>&0      bedate          !0                      incremental since: %s
10588
10589#----------------------------------------------------------
10590#delta ISO    Daniel Novotny (dnovotny@redhat.com)
105910	string  DISO	Delta ISO data
10592!:strength +50
10593>4	belong  x	version %d
10594
10595# VMS backup savesets - gerardo.cacciari@gmail.com
10596#
105974            string  \x01\x00\x01\x00\x01\x00
10598>(0.s+16)    string  \x01\x01
10599>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
10600>>>40        lelong  x          (block size %d,
10601>>>49        string  >\0        original name '%s',
10602>>>2         short   1024       VAX generated)
10603>>>2         short   2048       AXP generated)
10604>>>2         short   4096       I64 generated)
10605
10606# Summary: Oracle Clustered Filesystem
10607# Created by: Aaron Botsis <redhat@digitalmafia.org>
106088	string		OracleCFS	Oracle Clustered Filesystem,
10609>4	long		x		rev %d
10610>0	long		x		\b.%d,
10611>560	string		x		label: %.64s,
10612>136	string		x		mountpoint: %.128s
10613
10614# Summary: Oracle ASM tagged volume
10615# Created by: Aaron Botsis <redhat@digitalmafia.org>
1061632	string		ORCLDISK	Oracle ASM Volume,
10617>40	string		x		Disk Name: %0.12s
1061832	string		ORCLCLRD	Oracle ASM Volume (cleared),
10619>40	string		x		Disk Name: %0.12s
10620
10621# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
106228	string		OracleCFS	Oracle Clustered Filesystem,
10623>4	long		x		rev %d
10624>0	long		x		\b.%d,
10625>560	string		x		label: %.64s,
10626>136	string		x		mountpoint: %.128s
10627
10628# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
1062932	string		ORCLDISK	Oracle ASM Volume,
10630>40	string		x		Disk Name: %0.12s
1063132	string		ORCLCLRD	Oracle ASM Volume (cleared),
10632>40	string		x		Disk Name: %0.12s
10633
10634# Compaq/HP RILOE floppy image
10635# From: Dirk Jagdmann <doj@cubic.org>
106360	string	CPQRFBLO	Compaq/HP RILOE floppy image
10637
10638#------------------------------------------------------------------------------
10639# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
10640# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
10641# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
10642#
106431008    string          DECFILE11       Files-11 On-Disk Structure
10644>525    byte            x               (ODS-%d);
10645>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
10646>1017   string          B
10647>>525   byte            2               VAX/VMS or OpenVMS file system;
10648>>525   byte            5               OpenVMS Alpha or Itanium file system;
10649>984    string          x               volume label is '%-12.12s'
10650
10651# From: Thomas Klausner <wiz@NetBSD.org>
10652# http://filext.com/file-extension/DAA
10653# describes the daa file format. The magic would be:
106540	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
10655
10656# From Albert Cahalan <acahalan@gmail.com>
10657# really le32 operation,destination,payloadsize (but quite predictable)
10658# 01 00 00 00 00 00 00 c0 00 02 00 00
106590	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
10660
10661# From Eric Sandeen
10662# GFS2
106630x10000         belong          0x01161970
10664>0x10018        belong          0x0000051d      GFS1 Filesystem
10665>>0x10024        belong          x               (blocksize %d,
10666>>0x10060        string          >\0             lockproto %s)
10667>0x10018        belong          0x00000709      GFS2 Filesystem
10668>>0x10024        belong          x               (blocksize %d,
10669>>0x10060        string          >\0             lockproto %s)
10670
10671# Russell Coker <russell@coker.com.au>
106720x10040		string	_BHRfS_M	BTRFS Filesystem
10673>0x1012b	string	>\0		label "%s",
10674>0x10090	lelong	x		sectorsize %d,
10675>0x10094	lelong	x		nodesize %d,
10676>0x10098	lelong	x		leafsize %d,
10677>0x10020	belong	x		UUID=%08x-
10678>0x10024	beshort	x		\b%04x-
10679>0x10026	beshort	x		\b%04x-
10680>0x10028	beshort	x		\b%04x-
10681>0x1002a	beshort	x		\b%04x
10682>0x1002c	belong	x		\b%08x,
10683>0x10078	lequad	x		%lld/
10684>0x10070	lequad	x		\b%lld bytes used,
10685>0x10088	lequad	x		%lld devices
10686
10687# dvdisaster's .ecc
10688# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
106890	string	*dvdisaster*	dvdisaster error correction file
10690
10691# xfs metadump image
10692# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
10693# but can we do the << ?  For now it's always 512 (0x200) anyway.
106940	string XFSM
10695>0x200	string XFSB	XFS filesystem metadump image
10696
10697# Type:	CROM filesystem
10698# From:	Werner Fink <werner@suse.de>
106990	string	CROMFS	CROMFS
10700>6	string	>\0	\b version %2.2s,
10701>8	ulequad	>0	\b block data at %lld,
10702>16	ulequad	>0	\b fblock table at %lld,
10703>24	ulequad	>0	\b inode table at %lld,
10704>32	ulequad	>0	\b root at %lld,
10705>40	ulelong	>0	\b fblock size = %d,
10706>44	ulelong	>0	\b block size = %d,
10707>48	ulequad	>0	\b bytes = %lld
10708
10709# Type:	xfs metadump image
10710# From:	Daniel Novotny <dnovotny@redhat.com>
10711# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
10712# but can we do the << ? For now it's always 512 (0x200) anyway.
107130	string	XFSM
10714>0x200	string	XFSB	XFS filesystem metadump image
10715
10716# Type:	delta ISO
10717# From:	Daniel Novotny <dnovotny@redhat.com>
107180	string	DISO	Delta ISO data,
10719>4	belong	x	version %d
10720
10721# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
10722# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
10723# From: Adam Buchbinder <adam.buchbinder@gmail.com>
107240x8000	string	JFS1
10725# Because it's text-only magic, check a binary value (version) to be sure.
10726# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
10727# mountable.
10728>&0	lelong	<3	JFS2 filesystem image
10729# Label is followed by a UUID; we have to limit string length to avoid
10730# appending the UUID in the case of a 16-byte label.
10731>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
10732>>&0	lequad	x	\b, %lld blocks
10733>>&8	lelong	x	\b, blocksize %d
10734>>&32	lelong&0x00000006	>0	(dirty)
10735>>&36	lelong	>0	(compressed)
10736
10737# LFS
107380	lelong	0x070162	LFS filesystem image
10739>4	lelong	1		version 1,
10740>>8	lelong	x		\b blocks %u,
10741>>12	lelong	x		\b blocks per segment %u,
10742>4	lelong	2		version 2,
10743>>8	lelong	x		\b fragments %u,
10744>>12	lelong	x		\b bytes per segment %u,
10745>16	lelong	x		\b disk blocks %u,
10746>20	lelong	x		\b block size %u,
10747>24	lelong	x		\b fragment size %u,
10748>28	lelong	x		\b fragments per block %u,
10749>32	lelong	x		\b start for free list %u,
10750>36	lelong	x		\b number of free blocks %d,
10751>40	lelong	x		\b number of files %u,
10752>44	lelong	x		\b blocks available for writing %d,
10753>48	lelong	x		\b inodes in cache %d,
10754>52	lelong	x		\b inode file disk address 0x%x,
10755>56	lelong	x		\b inode file inode number %u,
10756>60	lelong	x		\b address of last segment written 0x%x,
10757>64	lelong	x		\b address of next segment to write 0x%x,
10758>68	lelong	x		\b address of current segment written 0x%x
10759
107600	string	td\000		floppy image data (TeleDisk, compressed)
107610	string	TD\000		floppy image data (TeleDisk)
10762
107630	string	CQ\024		floppy image data (CopyQM,
10764>16	leshort	x		%d sectors,
10765>18	leshort	x		%d heads.)
10766
107670	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
10768
107690	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
107700	beshort	0xAA59		floppy image data (IBM SaveDskF)
107710	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)
10772
107730	string	\074CPM_Disk\076	disk image data (YAZE)
10774
10775# ReFS
10776# Richard W.M. Jones <rjones@redhat.com>
107770	string	\0\0\0ReFS\0	ReFS filesystem image
10778
10779# EFW encase image file format:
10780# Gregoire Passault
10781# http://www.forensicswiki.org/wiki/Encase_image_file_format
107820	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format
10783
10784# UBIfs
10785# Linux kernel sources: fs/ubifs/ubifs-media.h
107860	lelong	0x06101831
10787>0x16	leshort	0		UBIfs image
10788>0x08	lequad	x		\b, sequence number %llu
10789>0x10	leshort x		\b, length %u
10790>0x04	lelong	x		\b, CRC 0x%08x
10791
107920	lelong	0x23494255
10793>0x04	leshort	<2
10794>0x05	string	\0\0\0
10795>0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
10796>0x04	leshort	x		UBI image, version %u
10797
10798# NEC PC-88 2D disk image
10799# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
108000x20		ulelong&0xFFFFFEFF	0x2A0
10801>0x10		string			\0\0\0\0\0\0\0\0\0\0
10802>>0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
10803>>>0x1A		ubyte&0xEF		0
10804>>>>0x1B	ubyte&0x8F		0
10805>>>>>0x1B	ubyte&70		<0x40
10806>>>>>>0x1C	ulelong			>0x21
10807>>>>>>>0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
10808>>>>>>>>0x1B	ubyte	0		\b, media=2D
10809>>>>>>>>0x1B	ubyte	0x10		\b, media=2DD
10810>>>>>>>>0x1B	ubyte	0x20		\b, media=2HD
10811>>>>>>>>0x1B	ubyte	0x30		\b, media=1D
10812>>>>>>>>0x1B	ubyte	0x40		\b, media=1DD
10813>>>>>>>>0x1A	ubyte	0x10		\b, write-protected
10814
10815#------------------------------------------------------------------------------
10816# $File: finger,v 1.2 2015/10/07 02:37:57 christos Exp $
10817# fingerprint:  file(1) magic for fingerprint data
10818# XPM bitmaps)
10819#
10820
10821# http://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
10822
108230	string	FP1		libfprint fingerprint data V1
10824>3	beshort	x		\b, driver_id %x
10825>5	belong	x		\b, devtype %x
10826
108270	string	FP2		libfprint fingerprint data V2
10828>3	beshort	x		\b, driver_id %x
10829>5	belong	x		\b, devtype %x
10830
10831#------------------------------------------------------------------------------
10832# $File: flash,v 1.12 2017/02/07 23:25:26 christos Exp $
10833# flash:	file(1) magic for Macromedia Flash file format
10834#
10835# See
10836#
10837#	http://www.macromedia.com/software/flash/open/
10838#	http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
10839#	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
10840#
10841
108420   name        swf-details
10843
10844>0      string      F
10845>>8     byte&0xfd   0x08    Macromedia Flash data
10846!:mime  application/x-shockwave-flash
10847>>>3    byte        x       \b, version %d
10848>>8     byte&0xfe   0x10    Macromedia Flash data
10849!:mime  application/x-shockwave-flash
10850>>>3    byte        x       \b, version %d
10851>>8     byte        0x18    Macromedia Flash data
10852!:mime  application/x-shockwave-flash
10853>>>3    byte        x       \b, version %d
10854>>8     beshort&ff87 0x2000 Macromedia Flash data
10855!:mime  application/x-shockwave-flash
10856>>>3    byte        x       \b, version %d
10857>>8     beshort&ffe0 0x3000 Macromedia Flash data
10858!:mime  application/x-shockwave-flash
10859>>>3    byte        x       \b, version %d
10860>>8     byte&0x7    0
10861>>>8    ubyte       >0x2f
10862>>>>9   ubyte       <0x20   Macromedia Flash data
10863!:mime  application/x-shockwave-flash
10864>>>>>3  byte        x       \b, version %d
10865
10866>0      string      C
10867>>8     byte        0x78    Macromedia Flash data (compressed)
10868!:mime  application/x-shockwave-flash
10869>>>3    byte        x       \b, version %d
10870
10871>0      string      Z
10872>>8     byte        0x5d    Macromedia Flash data (lzma compressed)
10873!:mime  application/x-shockwave-flash
10874>>>3    byte        x      \b, version %d
10875
10876
108771   string      WS
10878>4  ulelong     >14
10879>>3 ubyte       !0
10880>>>0   use      swf-details
10881
10882# From: Cal Peake <cp@absolutedigital.net>
108830	string		FLV\x01		Macromedia Flash Video
10884!:mime	video/x-flv
10885
10886#
10887# Yosu Gomez
108880       string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
108890       string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
10890# From Dave Wilson
108910	string AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
10892
10893#------------------------------------------------------------------------------
10894#	$File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $
10895#	flif:	Magic	data	for	file(1)	command.
10896#	FLIF	(Free	Lossless	Image	Format)
10897
108980	string	FLIF	FLIF
10899>4	string	<H	image data
10900>>6	beshort	x	\b, %u
10901>>8	beshort	x	\bx%u
10902>>5	string	1	\b, 8-bit/color,
10903>>5	string	2	\b, 16-bit/color,
10904>>4	string	1	\b, grayscale, non-interlaced
10905>>4	string	3	\b, RGB, non-interlaced
10906>>4	string	4	\b, RGBA, non-interlaced
10907>>4	string	A	\b, grayscale
10908>>4	string	C	\b, RGB, interlaced
10909>>4	string	D	\b, RGBA, interlaced
10910>4	string	>H	\b, animation data
10911>>5	ubyte	<255	\b, %i frames
10912>>>7	beshort	x	\b, %u
10913>>>9	beshort	x	\bx%u
10914>>>6	string	=1	\b, 8-bit/color
10915>>>6	string	=2	\b, 16-bit/color
10916>>5	ubyte	0xFF
10917>>>6	beshort	x	\b, %i frames,
10918>>>9	beshort	x	\b, %u
10919>>>11	beshort	x	\bx%u
10920>>>8	string	=1	\b, 8-bit/color
10921>>>8	string	=2	\b, 16-bit/color
10922>>4	string	=Q	\b, grayscale, non-interlaced
10923>>4	string	=S	\b, RGB, non-interlaced
10924>>4	string	=T	\b, RGBA, non-interlaced
10925>>4	string	=a	\b, grayscale
10926>>4	string	=c	\b, RGB, interlaced
10927>>4	string	=d	\b, RGBA, interlaced
10928
10929#------------------------------------------------------------------------------
10930# $File: fonts,v 1.35 2017/03/17 21:35:28 christos Exp $
10931# fonts:  file(1) magic for font data
10932#
109330	search/1	FONT		ASCII vfont text
109340	short		0436		Berkeley vfont data
109350	short		017001		byte-swapped Berkeley vfont data
10936
10937# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
109380	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
10939>20	string		>\0			(%s)
109406	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
109410	string		%!FontType1	PostScript Type 1 font program data
109426	string		%!FontType1	PostScript Type 1 font program data
109430	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text
10944
10945# Summary:	PostScript Type 1 Printer Font Metrics
10946# URL:		https://en.wikipedia.org/wiki/PostScript_fonts
10947# Reference:	http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
10948# Modified by:	Joerg Jenderek
10949# Note:		moved from ./msdos magic
10950# dfVersion 256=0100h
109510		uleshort	0x0100
10952# GRR: line above is too general as it catches also TrueType font,
10953# raw G3 data FAX, WhatsApp encrypted and Panorama database
10954# dfType 129=0081h
10955>66		uleshort	0x0081
10956# dfVertRes 300=012Ch not needed as additional test
10957#>>70		uleshort	0x012c
10958# dfHorizRes 300=012Ch
10959#>>>72		uleshort	0x012c
10960# dfDriverInfo points to postscript information section
10961>>(101.l)	string/c	Postscript	Printer Font Metrics
10962# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
10963!:mime	application/x-font-pfm
10964# AppleShare Print Server
10965#!:apple	ASPS????
10966!:ext	pfm
10967# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
10968#>>>6		string		>\060		- %-.60s
10969# dfDriverInfo
10970>>>139		ulelong		>0
10971# often abbreviated and same as filename
10972>>>>(139.l)	string		x		%s
10973# dfSize
10974>>>2		ulelong		x		\b, %d bytes
10975# dfFace 210=D2h 9Eh
10976>>>105		ulelong		>0
10977# Windows font name
10978>>>>(105.l)	string		x		\b, %s
10979# dfItalic
10980>>>80		ubyte		1		italic
10981# dfUnderline
10982>>>81		ubyte		1		underline
10983# dfStrikeOut
10984>>>82		ubyte		1		strikeout
10985# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc
10986>>>83		uleshort	>699		bold
10987# dfPitchAndFamily 16 17 48 49 64 65
10988>>>90		ubyte		16		serif
10989>>>90		ubyte		17		serif proportional
10990#>>>90		ubyte		48		other
10991>>>90		ubyte		49		proportional
10992>>>90		ubyte		64		script
10993>>>90		ubyte		65		script proportional
10994
10995# X11 font files in SNF (Server Natural Format) format
10996# updated by Joerg Jenderek at Feb 2013
10997# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
109980	belong		00000004		X11 SNF font data, MSB first
10999#>104	belong		00000004		X11 SNF font data, MSB first
11000!:mime	application/x-font-sfn
11001# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
110020	lelong		00000004
11003>104	lelong		00000004		X11 SNF font data, LSB first
11004!:mime	application/x-font-sfn
11005
11006# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
110070	search/1	STARTFONT\ 		X11 BDF font text
11008
11009# From: Joerg Jenderek
11010# URL: http://grub.gibibit.com/New_font_format
11011# Reference: util/grub-mkfont.c
11012#		include/grub/fontformat.h
11013# FONT_FORMAT_SECTION_NAMES_FILE
110140			string		FILE
11015# FONT_FORMAT_PFF2_MAGIC
11016>8			string		PFF2
11017# leng 4 only at the moment
11018>>4			ubelong		4
11019# FONT_FORMAT_SECTION_NAMES_FONT_NAME
11020>>>12			string		NAME		GRUB2 font
11021!:mime			application/x-font-pf2
11022!:ext			pf2
11023# length of font_name
11024>>>>16			ubelong		>0
11025# font_name
11026>>>>>20			string		>\0		"%-s"
11027
11028# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
11029# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
110300	string		\001fcp			X11 Portable Compiled Font data,
11031>12	lelong		^0x08			bit: LSB,
11032>12	lelong		&0x08			bit: MSB,
11033>12	lelong		^0x04			byte: LSB first
11034>12	lelong		&0x04			byte: MSB first
110350	string		D1.0\015		X11 Speedo font data
11036
11037#------------------------------------------------------------------------------
11038# FIGlet fonts and controlfiles
11039# From figmagic supplied with Figlet version 2.2
11040# "David E. O'Brien" <obrien@FreeBSD.ORG>
110410	string		flf		FIGlet font
11042>3	string		>2a		version %-2.2s
110430	string		flc		FIGlet controlfile
11044>3	string		>2a		version %-2.2s
11045
11046# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
11047# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
110480	belong		0x14025919	libGrx font data,
11049>8	leshort		x		%dx
11050>10	leshort		x		\b%d
11051>40	string		x		%s
11052# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
110530	belong		0xff464f4e	DOS code page font data collection
110547	belong		0x00454741	DOS code page font data
110557	belong		0x00564944	DOS code page font data (from Linux?)
110564098	string		DOSFONT		DOSFONT2 encrypted font data
11057
11058# downloadable fonts for browser (prints type) anthon@mnt.org
11059# https://tools.ietf.org/html/rfc3073
110600	string		PFR1		Portable Font Resource font data (new)
11061>102	string		>0		\b: %s
110620	string		PFR0		Portable Font Resource font data (old)
11063>4	beshort		>0		version %d
11064
11065# True Type fonts
110660	string	\000\001\000\000\000	TrueType font data
11067!:mime application/x-font-ttf
11068
110690	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
110700	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
11071
11072# TrueType/OpenType font collections (.ttc)
11073# http://www.microsoft.com/typography/otspec/otff.htm
110740	string		ttcf		TrueType font collection data
11075>4	belong		0x00010000	\b, 1.0
11076>>8	belong		>0		\b, %d fonts
11077>4	belong		0x00020000	\b, 2.0
11078>>8	belong		>0		\b, %d fonts
11079# 0x44454947 = 'DSIG'
11080>>>16	belong		0x44534947	\b, digitally signed
11081
11082# Opentype font data from Avi Bercovich
110830	string		OTTO		OpenType font data
11084!:mime application/vnd.ms-opentype
11085
11086# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
110870	string		SplineFontDB:	Spline Font Database
11088!:mime application/vnd.font-fontforge-sfd
11089>14	string		x		version %s
11090
11091# EOT
110920x40	string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
11093>0x22	string		LP		Embedded OpenType (EOT)
11094# workaround until there's lepstring16
11095# >>0x52	lepstring16/h	>\0		\b, %s family
11096>>0x52	short	!0
11097>>>0x54	lestring16	x		\b, %s family
11098!:mime application/vnd.ms-fontobject
11099
11100# Web Open Font Format (.woff)
111010	name		woff
11102>4	belong		0x00010000	\b, TrueType
11103>4	belong		0x4F54544F	\b, CFF
11104>4	belong		0x74727565	\b, TrueType
11105>4	default		x
11106>>4	belong		x		\b, flavor %d
11107>8	belong		x		\b, length %d
11108#>12	beshort		x		\b, numTables %d
11109#>14	beshort		x		\b, reserved %d
11110#>16	belong		x		\b, totalSfntSize %d
11111
11112# http://www.w3.org/TR/WOFF/
111130	string		wOFF	Web Open Font Format
11114>0	use		woff
11115>20	beshort		x	\b, version %d
11116>22	beshort		x	\b.%d
11117# http://www.w3.org/TR/WOFF2/
111180	string		wOF2	Web Open Font Format (Version 2)
11119>0	use		woff
11120#>20	belong		x	\b, totalCompressedSize %d
11121>24	beshort		x	\b, version %d
11122>26	beshort		x	\b.%d
11123
11124#------------------------------------------------------------------------------
11125# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $
11126# FORTRAN source
11127# Check that the first 100 lines start with C or whitespace first.
111280       regex/100l      !\^[^Cc\ \t].*$
11129>0	regex/100l	\^[Cc][\ \t]	FORTRAN program text
11130!:mime	text/x-fortran
11131!:strength - 5
11132
11133#------------------------------------------------------------------------------
11134# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $
11135# frame:  file(1) magic for FrameMaker files
11136#
11137# This stuff came on a FrameMaker demo tape, most of which is
11138# copyright, but this file is "published" as witness the following:
11139#
11140# Note that this is the Framemaker Maker Interchange Format, not the
11141# Normal format which would be application/vnd.framemaker.
11142#
111430	string		\<MakerFile	FrameMaker document
11144!:mime	application/x-mif
11145>11	string		5.5		 (5.5
11146>11	string		5.0		 (5.0
11147>11	string		4.0		 (4.0
11148>11	string		3.0		 (3.0
11149>11	string		2.0		 (2.0
11150>11	string		1.0		 (1.0
11151>14	byte		x		  %c)
111520	string		\<MIFFile	FrameMaker MIF (ASCII) file
11153!:mime	application/x-mif
11154>9	string		4.0		 (4.0)
11155>9	string		3.0		 (3.0)
11156>9	string		2.0		 (2.0)
11157>9	string		1.0		 (1.x)
111580	search/1	\<MakerDictionary	FrameMaker Dictionary text
11159!:mime	application/x-mif
11160>17	string		3.0		 (3.0)
11161>17	string		2.0		 (2.0)
11162>17	string		1.0		 (1.x)
111630	string		\<MakerScreenFont	FrameMaker Font file
11164!:mime	application/x-mif
11165>17	string		1.01		 (%s)
111660	string		\<MML		FrameMaker MML file
11167!:mime	application/x-mif
111680	string		\<BookFile	FrameMaker Book file
11169!:mime	application/x-mif
11170>10	string		3.0		 (3.0
11171>10	string		2.0		 (2.0
11172>10	string		1.0		 (1.0
11173>13	byte		x		  %c)
11174# XXX - this book entry should be verified, if you find one, uncomment this
11175#0	string		\<Book\040 	FrameMaker Book (ASCII) file
11176#!:mime	application/x-mif
11177#>6	string		3.0		 (3.0)
11178#>6	string		2.0		 (2.0)
11179#>6	string		1.0		 (1.0)
111800	string		\<Maker\040Intermediate\040Print\040File	FrameMaker IPL file
11181!:mime	application/x-mif
11182
11183#------------------------------------------------------------------------------
11184# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
11185# freebsd:  file(1) magic for FreeBSD objects
11186#
11187# All new-style FreeBSD magic numbers are in host byte order (i.e.,
11188# little-endian on x86).
11189#
11190# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
11191# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
11192# schemes for distinguishing between executable images, shared libraries,
11193# and object files.
11194#
11195# FreeBSD says:
11196#
11197#    Regardless of whether it's pure, demand-paged, or none of the
11198#    above:
11199#
11200#	if the entry point is < 4096, then it's a shared library if
11201#	the "has run-time loader information" bit is set, and is
11202#	position-independent if the "is position-independent" bit
11203#	is set;
11204#
11205#	if the entry point is >= 4096 (or >4095, same thing), then it's
11206#	an executable, and is dynamically-linked if the "has run-time
11207#	loader information" bit is set.
11208#
11209# On x86, NetBSD says:
11210#
11211#    If it's neither pure nor demand-paged:
11212#
11213#	if it has the "has run-time loader information" bit set, it's
11214#	a dynamically-linked executable;
11215#
11216#	if it doesn't have that bit set, then:
11217#
11218#	    if it has the "is position-independent" bit set, it's
11219#	    position-independent;
11220#
11221#	    if the entry point is non-zero, it's an executable, otherwise
11222#	    it's an object file.
11223#
11224#    If it's pure:
11225#
11226#	if it has the "has run-time loader information" bit set, it's
11227#	a dynamically-linked executable, otherwise it's just an
11228#	executable.
11229#
11230#    If it's demand-paged:
11231#
11232#	if it has the "has run-time loader information" bit set,
11233#	then:
11234#
11235#	    if the entry point is < 4096, it's a shared library;
11236#
11237#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
11238#	    it's a dynamically-linked executable);
11239#
11240#	if it doesn't have the "has run-time loader information" bit
11241#	set, then it's just an executable.
11242#
11243# (On non-x86, NetBSD does much the same thing, except that it uses
11244# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
11245# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
11246# had 8K pages; dunno about MIPS.)
11247#
11248# I suspect the two will differ only in perverse and uninteresting cases
11249# ("shared" libraries that aren't demand-paged and whose pages probably
11250# won't actually be shared, executables with entry points <4096).
11251#
11252# I leave it to those more familiar with FreeBSD and NetBSD to figure out
11253# what the right answer is (although using ">4095", FreeBSD-style, is
11254# probably better than separately checking for "=4096" and ">4096",
11255# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
11256# executables using the NetBSD technique.)
11257#
112580	lelong&0377777777	041400407	FreeBSD/i386
11259>20	lelong			<4096
11260>>3	byte&0xC0		&0x80		shared library
11261>>3	byte&0xC0		0x40		PIC object
11262>>3	byte&0xC0		0x00		object
11263>20	lelong			>4095
11264>>3	byte&0x80		0x80		dynamically linked executable
11265>>3	byte&0x80		0x00		executable
11266>16	lelong			>0		not stripped
11267
112680	lelong&0377777777	041400410	FreeBSD/i386 pure
11269>20	lelong			<4096
11270>>3	byte&0xC0		&0x80		shared library
11271>>3	byte&0xC0		0x40		PIC object
11272>>3	byte&0xC0		0x00		object
11273>20	lelong			>4095
11274>>3	byte&0x80		0x80		dynamically linked executable
11275>>3	byte&0x80		0x00		executable
11276>16	lelong			>0		not stripped
11277
112780	lelong&0377777777	041400413	FreeBSD/i386 demand paged
11279>20	lelong			<4096
11280>>3	byte&0xC0		&0x80		shared library
11281>>3	byte&0xC0		0x40		PIC object
11282>>3	byte&0xC0		0x00		object
11283>20	lelong			>4095
11284>>3	byte&0x80		0x80		dynamically linked executable
11285>>3	byte&0x80		0x00		executable
11286>16	lelong			>0		not stripped
11287
112880	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
11289>20	lelong			<4096
11290>>3	byte&0xC0		&0x80		shared library
11291>>3	byte&0xC0		0x40		PIC object
11292>>3	byte&0xC0		0x00		object
11293>20	lelong			>4095
11294>>3	byte&0x80		0x80		dynamically linked executable
11295>>3	byte&0x80		0x00		executable
11296>16	lelong			>0		not stripped
11297
11298# XXX gross hack to identify core files
11299# cores start with a struct tss; we take advantage of the following:
11300# byte 7:     highest byte of the kernel stack pointer, always 0xfe
11301#      8/9:   kernel (ring 0) ss value, always 0x0010
11302#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
11303#      28:    low order byte of the current PTD entry, always 0 since the
11304#             PTD is page-aligned
11305#
113067	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
11307>1039	string	>\0	from '%s'
11308
11309# /var/run/ld.so.hints
11310# What are you laughing about?
113110	lelong			011421044151	ld.so hints file (Little Endian
11312>4	lelong			>0		\b, version %d)
11313>4	belong			<1		\b)
113140	belong			011421044151	ld.so hints file (Big Endian
11315>4	belong			>0		\b, version %d)
11316>4	belong			<1		\b)
11317
11318#
11319# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
11320#
113210	string	SCRSHOT_	scrshot(1) screenshot,
11322>8	byte	x		version %d,
11323>9	byte	2		%d bytes in header,
11324>>10	byte	x		%d chars wide by
11325>>11	byte	x		%d chars high
11326
11327#------------------------------------------------------------------------------
11328# $File: fsav,v 1.14 2017/03/17 21:35:28 christos Exp $
11329# fsav:  file(1) magic for datafellows fsav virus definition files
11330# Anthon van der Neut (anthon@mnt.org)
11331
11332# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
113330	beshort		0x1575		fsav macro virus signatures
11334>8	leshort		>0		(%d-
11335>11	byte		>0		\b%02d-
11336>10	byte		>0		\b%02d)
11337# ftp://ftp.f-prot.com/pub/sign.zip
11338#10	ubyte		<12
11339#>9	ubyte		<32
11340#>>8	ubyte		0x0a
11341#>>>12	ubyte		0x07
11342#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
11343#>>>>10	byte		0		\b01-
11344#>>>>10	byte		1		\b02-
11345#>>>>10	byte		2		\b03-
11346#>>>>10	byte		3		\b04-
11347#>>>>10	byte		4		\b05-
11348#>>>>10	byte		5		\b06-
11349#>>>>10	byte		6		\b07-
11350#>>>>10	byte		7		\b08-
11351#>>>>10	byte		8		\b09-
11352#>>>>10	byte		9		\b10-
11353#>>>>10	byte		10		\b11-
11354#>>>>10	byte		11		\b12-
11355#>>>>9	ubyte		>0		\b%02d)
11356# ftp://ftp.f-prot.com/pub/sign2.zip
11357#0	ubyte		0x62
11358#>1	ubyte		0xF5
11359#>>2	ubyte		0x1
11360#>>>3	ubyte		0x1
11361#>>>>4	ubyte		0x0e
11362#>>>>>13		ubyte	>0		fsav virus signatures
11363#>>>>>>11	ubyte	x		size 0x%02x
11364#>>>>>>12	ubyte	x		\b%02x
11365#>>>>>>13	ubyte	x		\b%02x bytes
11366
11367# Joerg Jenderek: joerg dot jenderek at web dot de
11368# http://www.clamav.net/doc/latest/html/node45.html
11369# .cvd files start with a 512 bytes colon separated header
11370# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
11371# + gzipped tarball files
113720	string		ClamAV-VDB:
11373>11	string		>\0		Clam AntiVirus database %-.23s
11374>>34	string		:
11375>>>35		string		!:	\b, version
11376>>>>35		string		x 	\b%-.1s
11377>>>>>36		string 		!:
11378>>>>>>36	string		x 	\b%-.1s
11379>>>>>>>37	string		!:
11380>>>>>>>>37	string		x 	\b%-.1s
11381>>>>>>>>>38	string		!:
11382>>>>>>>>>>38	string		x 	\b%-.1s
11383>512	string		\037\213	\b, gzipped
11384>769	string		ustar\0		\b, tarred
11385
11386# Type: Grisoft AVG AntiVirus
11387# From: David Newgas <david@newgas.net>
113880	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data
11389
113900	string	X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
11391>33	string	-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*	EICAR virus test files
11392
11393#------------------------------------------------------------------------------
11394# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
11395# fusecompress:   file(1) magic for fusecompress
113960	string	\037\135\211	FuseCompress(ed) data
11397>3	byte	0x00	(none format)
11398>3	byte	0x01	(bz2 format)
11399>3	byte	0x02	(gz format)
11400>3	byte	0x03	(lzo format)
11401>3	byte	0x04	(xor format)
11402>3	byte	>0x04	(unknown format)
11403>4	long	x	uncompressed size: %d
11404
11405#------------------------------------------------------------------------------
11406# $File: games,v 1.15 2017/03/17 21:35:28 christos Exp $
11407# games:  file(1) for games
11408
11409# Fabio Bonelli <fabiobonelli@libero.it>
11410# Quake II - III data files
114110       string  IDP2        	Quake II 3D Model file,
11412>20     long    x               %u skin(s),
11413>8      long    x               (%u x
11414>12     long    x 		%u),
11415>40     long    x               %u frame(s),
11416>16     long    x               Frame size %u bytes,
11417>24     long  	x               %u vertices/frame,
11418>28     long    x            	%u texture coordinates,
11419>32     long    x               %u triangles/frame
11420
114210       string  IBSP            Quake
11422>4      long    0x26            II Map file (BSP)
11423>4      long    0x2E      	III Map file (BSP)
11424
114250       string  IDS2            Quake II SP2 sprite file
11426
11427#---------------------------------------------------------------------------
11428# Doom and Quake
11429# submitted by Nicolas Patrois
11430
114310       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
11432# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
11433
1143424      string  LxD\ 203        Linuxdoom save
11435>0      string  x       , name=%s
11436>44     string  x       , world=%s
11437
11438# Quake
11439
114400       string  PACK    Quake I or II world or extension
11441>8	lelong	>0	\b, %d entries
11442
11443#0       string  -1\x0a  Quake I demo
11444#>30     string  x        version %.4s
11445#>61     string  x        level %s
11446
11447#0       string  5\x0a   Quake I save
11448
11449# The levels
11450
11451# Quake 1
11452
114530	string	5\x0aIntroduction             Quake I save: start Introduction
114540	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
114550	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
114560	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
114570	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
114580	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
114590	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
114600	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
114610	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
114620	string	5\x0athe_Installation         Quake I save: e2m1 The installation
114630	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
114640	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
114650	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
114660	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
114670	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
114680	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
114690	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
114700	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
114710	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
114720	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
114730	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
114740	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
114750	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
114760	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
114770	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
114780	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
114790	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
114800	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
114810	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
114820	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
114830	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
114840	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
11485
11486# Quake DeathMatch levels
11487
114880	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
114890	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
114900	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
114910	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
114920	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
114930	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
11494
11495# Scourge of Armagon
11496
114970	string	5\x0aCommand_HQ               Quake I save: start Command HQ
114980	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
114990	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
115000	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
115010	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
115020	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
115030	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
115040	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
115050	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
115060	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
115070	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
115080	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
115090	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
115100	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
115110	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
115120	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
115130	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
115140	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
11515
11516# Malice
11517
115180	string	5\x0aThe_Academy      Quake I save: start The academy
115190	string	5\x0aThe_Lab          Quake I save: d1 The lab
115200	string	5\x0aArea_33          Quake I save: d1b Area 33
115210	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
115220	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
115230	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
115240	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
115250	string	5\x0aArea44           Quake I save: d1c Area 44
115260	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
115270	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
115280	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
115290	string	5\x0aThe_Flood        Quake I save: d5 The flood
115300	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
115310	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
115320	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
115330	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
115340	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
115350	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
115360	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
115370	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
115380	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
11539
11540# Malice DeathMatch levels
11541
115420	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
115430	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
115440	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
115450	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
115460	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
115470	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
115480	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
11549
11550
115510	string	MComprHD	MAME CHD compressed hard disk image,
11552>12	belong	x		version %u
11553
11554# doom - submitted by Jon Dowland
11555
115560	string	=IWAD		doom main IWAD data
11557>4	lelong	x		containing %d lumps
115580	string	=PWAD		doom patch PWAD data
11559>4	lelong	x		containing %d lumps
11560
11561# Build engine group files (Duke Nukem, Shadow Warrior, ...)
11562# Extension: .grp
11563# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
115640	string	KenSilverman	Build engine group file
11565>12	lelong	x		containing %d files
11566
11567# Summary: Warcraft 3 save
11568# Extension: .w3g
11569# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
115700	string		Warcraft\ III\ recorded\ game	%s
11571
11572
11573# Summary: Warcraft 3 map
11574# Extension: .w3m
11575# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
115760	string		HM3W		Warcraft III map file
11577
11578
11579# Summary: SGF Smart Game Format
11580# Extension: .sgf
11581# Reference: http://www.red-bean.com/sgf/
11582# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
11583# Modified by (1): Abel Cheung (regex, more game format)
11584# FIXME: Some games don't have GM (game type)
115850	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
11586>2	search/0x200/b	GM[
11587>>&0	string		1]	(Go)
11588>>&0	string		2]	(Othello)
11589>>&0	string		3]	(chess)
11590>>&0	string		4]	(Gomoku+Renju)
11591>>&0	string		5]	(Nine Men's Morris)
11592>>&0	string		6]	(Backgammon)
11593>>&0	string		7]	(Chinese chess)
11594>>&0	string		8]	(Shogi)
11595>>&0	string		9]	(Lines of Action)
11596>>&0	string		10]	(Ataxx)
11597>>&0	string		11]	(Hex)
11598>>&0	string		12]	(Jungle)
11599>>&0	string		13]	(Neutron)
11600>>&0	string		14]	(Philosopher's Football)
11601>>&0	string		15]	(Quadrature)
11602>>&0	string		16]	(Trax)
11603>>&0	string		17]	(Tantrix)
11604>>&0	string		18]	(Amazons)
11605>>&0	string		19]	(Octi)
11606>>&0	string		20]	(Gess)
11607>>&0	string		21]	(Twixt)
11608>>&0	string		22]	(Zertz)
11609>>&0	string		23]	(Plateau)
11610>>&0	string		24]	(Yinsh)
11611>>&0	string		25]	(Punct)
11612>>&0	string		26]	(Gobblet)
11613>>&0	string		27]	(hive)
11614>>&0	string		28]	(Exxit)
11615>>&0	string		29]	(Hnefatal)
11616>>&0	string		30]	(Kuba)
11617>>&0	string		31]	(Tripples)
11618>>&0	string		32]	(Chase)
11619>>&0	string		33]	(Tumbling Down)
11620>>&0	string		34]	(Sahara)
11621>>&0	string		35]	(Byte)
11622>>&0	string		36]	(Focus)
11623>>&0	string		37]	(Dvonn)
11624>>&0	string		38]	(Tamsk)
11625>>&0	string		39]	(Gipf)
11626>>&0	string		40]	(Kropki)
11627
11628##############################################
11629# NetImmerse/Gamebryo game engine entries
11630
11631# Summary: Gamebryo game engine file
11632# Extension: .nif, .kf
11633# Created by: Abel Cheung <abelcheung@gmail.com>
116340		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
11635>&0		regex		[0-9a-z.]+				\b, version %s
11636
11637# Summary: Gamebryo game engine file
11638# Extension: .kfm
11639# Created by: Abel Cheung <abelcheung@gmail.com>
116400		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
11641>&0		regex		[0-9a-z.]+				\b, version %s
11642
11643# Summary: NetImmerse game engine file
11644# Extension .nif
11645# Created by: Abel Cheung <abelcheung@gmail.com>
116460		string		NetImmerse\ File\ Format,\ Versio
11647>&0		string		n\ 					NetImmerse game engine file
11648>>&0		regex		[0-9a-z.]+				\b, version %s
11649
11650# Type:	SGF Smart Game Format
11651# URL:	http://www.red-bean.com/sgf/
11652# From:	Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
116532	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
11654>2	regex/c	GM\\[1\\]			- Go Game
11655>2	regex/c	GM\\[6\\]			- BackGammon Game
11656>2	regex/c	GM\\[11\\]			- Hex Game
11657>2	regex/c	GM\\[18\\]			- Amazons Game
11658>2	regex/c	GM\\[19\\]			- Octi Game
11659>2	regex/c	GM\\[20\\]			- Gess Game
11660>2	regex/c	GM\\[21\\]			- twix Game
11661
11662# Epic Games/Unreal Engine Package
11663#
116640	lelong		0x9E2A83C1	Unreal Engine Package,
11665>4	leshort		x		version: %i
11666>12	lelong		!0		\b, names: %i
11667>28	lelong		!0		\b, imports: %i
11668>20	lelong		!0		\b, exports: %i
11669
11670#------------------------------------------------------------------------------
11671# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $
11672# gcc:  file(1) magic for GCC special files
11673#
116740	string		gpch		GCC precompiled header
11675
11676# The version field is annoying.  It's 3 characters, not zero-terminated.
11677>5	byte		x			(version %c
11678>6	byte		x			\b%c
11679>7	byte		x			\b%c)
11680
11681# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
11682>4	byte		67			for C
11683>4	byte		111			for Objective-C
11684>4	byte		43			for C++
11685>4	byte		79			for Objective-C++
11686
11687#------------------------------------------------------------------------------
11688# $File: geo,v 1.4 2017/03/17 21:35:28 christos Exp $
11689# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
11690
11691######################################################################
11692#
11693# Acoustic Doppler Current Profilers (ADCP)
11694#
11695######################################################################
11696
116970	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)
11698
11699######################################################################
11700#
11701# Metadata
11702#
11703######################################################################
11704
117050	string	Identification_Information	FGDC ASCII metadata
11706
11707######################################################################
11708#
11709# Seimsic / Subbottom
11710#
11711######################################################################
11712
11713# Knudsen subbottom chirp profiler - Binary File Format: B9
11714# KEB D409-03167 V1.75 Huffman
117150	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
11716>4	regex	[-A-Z0-9]*	Software: %s
11717>>&1	regex	V[0-9]*\.[0-9]*	version %s
11718
11719######################################################################
11720#
11721# LIDAR - Laser altimetry or bathy
11722#
11723######################################################################
11724
11725
11726# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
117270	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
11728>4	regex [0-9]*\.[0-9]*	version %s
11729
117300	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
11731>3      byte    x	version %d .
11732>4	byte	x	%d
11733
11734
11735######################################################################
11736#
11737# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
11738#
11739######################################################################
11740
11741# GeoAcoustics - GeoSwath Plus
117424	beshort	0x2002	GeoSwath RDF
117430	string	Start:-	GeoSwatch auf text file
11744
11745# Seabeam 2100
11746# mbsystem code mb41
117470	string SB2100	SeaBeam 2100 multibeam sonar
117480	string SB2100DR	SeaBeam 2100 DR multibeam sonar
117490	string SB2100PR SeaBeam 2100 PR multibeam sonar
11750
11751# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
11752# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
117530    string $HSF    XSE multibeam
11754
11755# mb121 http://www.saic.com/maritime/gsf/
117568	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
11757>&0	regex [0-9]*\.[0-9]*	version %s
11758
11759# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
11760# mb161
117619	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format
11762
11763# MBSystem processing caches the mbinfo output
117641	string	Swath\ Data\ File:	mbsystem info cache
11765
11766# Caris John Hughes Clark format
117670	string	HDCS	Caris multibeam sonar related data
117681	string	Start/Stop\ parameter\ header:	Caris ASCII project summary
11769
11770######################################################################
11771#
11772# Visualization and 3D modeling
11773#
11774######################################################################
11775
11776# IVS - IVS3d.com Tagged Data Represetation
117770	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file
11778
11779# http://www.ecma-international.org/publications/standards/Ecma-363.htm
11780# 3D in PDFs
117810	string	U3D	ECMA-363, Universal 3D
11782
11783######################################################################
11784#
11785# Support files
11786#
11787######################################################################
11788
11789# https://midas.psi.ch/elog/
117900	string	$@MID@$	elog journal entry
11791
11792# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
117930	string		DSBB	Surfer 6 binary grid file
11794>4	leshort		x	\b, %d
11795>6	leshort		x	\bx%d
11796>8	ledouble	x	\b, minx=%g
11797>16	ledouble	x	\b, maxx=%g
11798>24	ledouble	x	\b, miny=%g
11799>32	ledouble	x	\b, maxy=%g
11800>40	ledouble	x	\b, minz=%g
11801>48	ledouble	x	\b, maxz=%g
11802
11803
11804#------------------------------------------------------------------------------
11805# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
11806# GEOS files (Vidar Madsen, vidar@gimp.org)
11807# semi-commonly used in embedded and handheld systems.
118080	belong	0xc745c153	GEOS
11809>40	byte	1	executable
11810>40	byte	2	VMFile
11811>40	byte	3	binary
11812>40	byte	4	directory label
11813>40	byte	<1	unknown
11814>40	byte	>4	unknown
11815>4	string	>\0	\b, name "%s"
11816#>44	short	x	\b, version %d
11817#>46	short	x	\b.%d
11818#>48	short	x	\b, rev %d
11819#>50	short	x	\b.%d
11820#>52	short	x	\b, proto %d
11821#>54	short	x	\br%d
11822#>168	string	>\0	\b, copyright "%s"
11823
11824#------------------------------------------------------------------------------
11825# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $
11826# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
11827# by Federico Mena <federico@nuclecu.unam.mx>
11828
118290       string/t        GIMP\ Gradient  GIMP gradient data
11830
11831# GIMP palette (.gpl)
11832# From: Markus Heidelberg <markus.heidelberg@web.de>
118330       string/t        GIMP\ Palette   GIMP palette data
11834
11835#------------------------------------------------------------------------------
11836# XCF:  file(1) magic for the XCF image format used in the GIMP (.xcf) developed
11837#       by Spencer Kimball and Peter Mattis
11838#       ('Bucky' LaDieu, nega@vt.edu)
11839
118400	string		gimp\ xcf	GIMP XCF image data,
11841!:mime	image/x-xcf
11842>9	string		file		version 0,
11843>9	string		v		version
11844>>10	string		>\0		%s,
11845>14	belong		x		%u x
11846>18	belong		x		%u,
11847>22     belong          0               RGB Color
11848>22     belong          1               Greyscale
11849>22     belong          2               Indexed Color
11850>22	belong		>2		Unknown Image Type.
11851
11852#------------------------------------------------------------------------------
11853# XCF:  file(1) magic for the patterns used in the GIMP (.pat), developed
11854#       by Spencer Kimball and Peter Mattis
11855#       ('Bucky' LaDieu, nega@vt.edu)
11856
1185720      string          GPAT            GIMP pattern data,
11858>24     string          x               %s
11859
11860#------------------------------------------------------------------------------
11861# XCF:  file(1) magic for the brushes used in the GIMP (.gbr), developed
11862#       by Spencer Kimball and Peter Mattis
11863#       ('Bucky' LaDieu, nega@vt.edu)
11864
1186520      string          GIMP            GIMP brush data
11866
11867# GIMP Curves File
11868# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
118690	string	#\040GIMP\040Curves\040File	GIMP curve file
11870
11871#------------------------------------------------------------------------------
11872# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $
11873# GNOME related files
11874
11875# Contributed by Josh Triplett
11876# FIXME: Could be simplified if pstring supported two-byte counts
118770         string   GnomeKeyring\n\r\0\n GNOME keyring
11878>&0       ubyte    0                    \b, major version 0
11879>>&0      ubyte    0                    \b, minor version 0
11880>>>&0     ubyte    0                    \b, crypto type 0 (AES)
11881>>>&0     ubyte    >0                   \b, crypto type %u (unknown)
11882>>>&1     ubyte    0                    \b, hash type 0 (MD5)
11883>>>&1     ubyte    >0                   \b, hash type %u (unknown)
11884>>>&2     ubelong  0xFFFFFFFF           \b, name NULL
11885>>>&2     ubelong  !0xFFFFFFFF
11886>>>>&-4   ubelong  >255                 \b, name too long for file's pstring type
11887>>>>&-4   ubelong  <256
11888>>>>>&-1  pstring  x                    \b, name "%s"
11889>>>>>>&0  ubeqdate x                    \b, last modified %s
11890>>>>>>&8  ubeqdate x                    \b, created %s
11891>>>>>>&16 ubelong  &1
11892>>>>>>>&0 ubelong  x                    \b, locked if idle for %u seconds
11893>>>>>>&16 ubelong  ^1                   \b, not locked if idle
11894>>>>>>&24 ubelong  x                    \b, hash iterations %u
11895>>>>>>&28 ubequad  x                    \b, salt %llu
11896>>>>>>&52 ubelong  x                    \b, %u item(s)
11897
11898# From: Alex Beregszaszi <alex@fsn.hu>
118994	string	gtktalog		GNOME Catalogue (gtktalog)
11900>13	string	>\0			version %s
11901
11902# Summary: GStreamer binary registry
11903# Extension: .bin
11904# Submitted by: Josh Triplett <josh@joshtriplett.org>
119050	belong	0xc0def00d		GStreamer binary registry
11906>4	string	x			\b, version %s
11907
11908# GVariant Database file
11909# By Elan Ruusamae <glen@delfi.ee>
11910# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
11911# It's always "GVariant", it's byte swapped on incompatible archs
11912# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
11913# file_builder_serialise()
11914# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
119150	string	GVariant	GVariant Database file,
11916# version is never filled. probably future extension
11917>8	lelong	x		version %d
11918# not sure are these usable, so commented out
11919#>>16	lelong	x		start %d,
11920#>>>20	lelong	x		end %d
11921
11922# G-IR database made by gobject-introspect toolset,
11923# http://live.gnome.org/GObjectIntrospection
119240	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
11925>16	byte		x			\b, v%d
11926>17	byte		x			\b.%d
11927>20	leshort		x			\b, %d entries
11928>22	leshort		x			\b/%d local
11929
11930#------------------------------------------------------------------------------
11931# $File: gnu,v 1.18 2017/03/17 21:35:28 christos Exp $
11932# gnu:  file(1) magic for various GNU tools
11933#
11934# GNU nlsutils message catalog file format
11935#
11936# GNU message catalog (.mo and .gmo files)
11937
119380	string		\336\22\4\225	GNU message catalog (little endian),
11939>6	leshort		x		revision %d.
11940>4	leshort		>0		\b%d,
11941>>8	lelong		x		%d messages,
11942>>36	lelong		x		%d sysdep messages
11943>4	leshort		=0		\b%d,
11944>>8	lelong		x		%d messages
11945
119460	string		\225\4\22\336	GNU message catalog (big endian),
11947>4	beshort		x		revision %d.
11948>6	beshort		>0		\b%d,
11949>>8	belong		x		%d messages,
11950>>36	belong		x		%d sysdep messages
11951>6	beshort		=0		\b%d,
11952>>8	belong		x		%d messages
11953
11954
11955# GnuPG
11956# The format is very similar to pgp
119570	string          \001gpg                 GPG key trust database
11958>4	byte            x                       version %d
11959# Note: magic.mime had 0x8501 for the next line instead of 0x8502
119600	beshort		0x8502			GPG encrypted data
11961!:mime	text/PGP # encoding: data
11962
11963# This magic is not particularly good, as the keyrings don't have true
11964# magic. Nevertheless, it covers many keyrings.
119650	ubeshort-0x9901	<2
11966>3	byte		4
11967>>4	bedate		x		GPG key public ring, created %s
11968!:mime application/x-gnupg-keyring
11969
11970
11971# Symmetric encryption
119720	leshort		0x0d8c
11973>4	leshort		0x0203
11974>>2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
11975>>2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
11976>>2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
11977>>2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
11978>>2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
11979>>2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
11980>>2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
11981>>2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
11982>>2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
11983>>2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)
11984
11985
11986# GnuPG Keybox file
11987# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
11988# From: Philipp Hahn <hahn@univention.de>
119890	belong	32
11990>4	byte	1
11991>>8	string	KBXf	GPG keybox database
11992>>>5	byte	1	version %d
11993>>>16	bedate	x	\b, created-at %s
11994>>>20	bedate	x	\b, last-maintained %s
11995
11996
11997# Gnumeric spreadsheet
11998# This entry is only semi-helpful, as Gnumeric compresses its files, so
11999# they will ordinarily reported as "compressed", but at least -z helps
1200039      string          =<gmr:Workbook           Gnumeric spreadsheet
12001
12002# From: James Youngman <jay@gnu.org>
12003# gnu find magic
120040	string	\0LOCATE	GNU findutils locate database data
12005>7	string	>\0		\b, format %s
12006>7	string	02		\b (frcode)
12007
12008# Files produced by GNU gettext
120090	long	0xDE120495		GNU-format message catalog data
120100	long	0x950412DE		GNU-format message catalog data
12011
12012# gettext message catalogue
120130	search/1024	\nmsgid
12014>&0	search/1024	\nmsgstr	GNU gettext message catalogue text
12015!:strength +100
12016!:mime text/x-po
12017
12018#------------------------------------------------------------------------------
12019# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
12020# gnumeric:  file(1) magic for Gnumeric spreadsheet
12021# This entry is only semi-helpful, as Gnumeric compresses its files, so
12022# they will ordinarily reported as "compressed", but at least -z helps
1202339	string	=<gmr:Workbook	Gnumeric spreadsheet
12024!:mime	application/x-gnumeric
12025
12026#------------------------------------------------------------------------------
12027# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
12028#
12029# GPT Partition table patterns.
12030# Author: Rogier Goossens (goossens.rogier@gmail.com)
12031# Note that a GPT-formatted disk must contain an MBR as well.
12032#
12033
12034# The initial segment (up to >>>>>>>>422) was copied from the X86
12035# partition table code (aka MBR).
12036# This is kept separate, so that MBR partitions are not reported as well.
12037# (use -k if you do want them as well)
12038
12039# First, detect the MBR partiton table
12040# If more than one GPT protective MBR partition exists, don't print anything
12041# (the other MBR detection code will then just print the MBR partition table)
120420x1FE			leshort		0xAA55
12043>3			string		!MS
12044>>3			string		!SYSLINUX
12045>>>3			string		!MTOOL
12046>>>>3			string		!NEWLDR
12047>>>>>5			string		!DOS
12048# not FAT (32 bit)
12049>>>>>>82		string		!FAT32
12050#not Linux kernel
12051>>>>>>>514		string		!HdrS
12052#not BeOS
12053>>>>>>>>422		string		!Be\ Boot\ Loader
12054# GPT with protective MBR entry in partition 1 (only)
12055>>>>>>>>>450		ubyte		0xee
12056>>>>>>>>>>466		ubyte		!0xee
12057>>>>>>>>>>>482		ubyte		!0xee
12058>>>>>>>>>>>>498		ubyte		!0xee
12059#>>>>>>>>>>>>>446	use		gpt-mbr-partition
12060>>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
12061>>>>>>>>>>>>>>0			use		gpt-mbr-type
12062>>>>>>>>>>>>>>&-8		use		gpt-table
12063>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
12064>>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
12065>>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
12066>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12067>>>>>>>>>>>>>>>&-8		use		gpt-table
12068>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
12069>>>>>>>>>>>>>>(454.l*4096)	string		!EFI\ PART
12070>>>>>>>>>>>>>>>(454.l*2048)	string		EFI\ PART	GPT partition table
12071>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12072>>>>>>>>>>>>>>>>&-8		use		gpt-table
12073>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
12074>>>>>>>>>>>>>>>(454.l*2048)	string		!EFI\ PART
12075>>>>>>>>>>>>>>>>(454.l*1024)	string		EFI\ PART	GPT partition table
12076>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12077>>>>>>>>>>>>>>>>>&-8		use		gpt-table
12078>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
12079>>>>>>>>>>>>>>>>(454.l*1024)	string		!EFI\ PART
12080>>>>>>>>>>>>>>>>>(454.l*512)	string		EFI\ PART	GPT partition table
12081>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12082>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
12083>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
12084# GPT with protective MBR entry in partition 2 (only)
12085>>>>>>>>>450		ubyte		!0xee
12086>>>>>>>>>>466		ubyte		0xee
12087>>>>>>>>>>>482		ubyte		!0xee
12088>>>>>>>>>>>>498		ubyte		!0xee
12089#>>>>>>>>>>>>>462	use		gpt-mbr-partition
12090>>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
12091>>>>>>>>>>>>>>0			use		gpt-mbr-type
12092>>>>>>>>>>>>>>&-8		use		gpt-table
12093>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
12094>>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
12095>>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
12096>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12097>>>>>>>>>>>>>>>&-8		use		gpt-table
12098>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
12099>>>>>>>>>>>>>>(470.l*4096)	string		!EFI\ PART
12100>>>>>>>>>>>>>>>(470.l*2048)	string		EFI\ PART	GPT partition table
12101>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12102>>>>>>>>>>>>>>>>&-8		use		gpt-table
12103>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
12104>>>>>>>>>>>>>>>(470.l*2048)	string		!EFI\ PART
12105>>>>>>>>>>>>>>>>(470.l*1024)	string		EFI\ PART	GPT partition table
12106>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12107>>>>>>>>>>>>>>>>>&-8		use		gpt-table
12108>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
12109>>>>>>>>>>>>>>>>(470.l*1024)	string		!EFI\ PART
12110>>>>>>>>>>>>>>>>>(470.l*512)	string		EFI\ PART	GPT partition table
12111>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12112>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
12113>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
12114# GPT with protective MBR entry in partition 3 (only)
12115>>>>>>>>>450		ubyte		!0xee
12116>>>>>>>>>>466		ubyte		!0xee
12117>>>>>>>>>>>482		ubyte		0xee
12118>>>>>>>>>>>>498		ubyte		!0xee
12119#>>>>>>>>>>>>>478	use		gpt-mbr-partition
12120>>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
12121>>>>>>>>>>>>>>0			use		gpt-mbr-type
12122>>>>>>>>>>>>>>&-8		use		gpt-table
12123>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
12124>>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
12125>>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
12126>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12127>>>>>>>>>>>>>>>&-8		use		gpt-table
12128>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
12129>>>>>>>>>>>>>>(486.l*4096)	string		!EFI\ PART
12130>>>>>>>>>>>>>>>(486.l*2048)	string		EFI\ PART	GPT partition table
12131>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12132>>>>>>>>>>>>>>>>&-8		use		gpt-table
12133>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
12134>>>>>>>>>>>>>>>(486.l*2048)	string		!EFI\ PART
12135>>>>>>>>>>>>>>>>(486.l*1024)	string		EFI\ PART	GPT partition table
12136>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12137>>>>>>>>>>>>>>>>>&-8		use		gpt-table
12138>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
12139>>>>>>>>>>>>>>>>(486.l*1024)	string		!EFI\ PART
12140>>>>>>>>>>>>>>>>>(486.l*512)	string		EFI\ PART	GPT partition table
12141>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12142>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
12143>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
12144# GPT with protective MBR entry in partition 4 (only)
12145>>>>>>>>>450		ubyte		!0xee
12146>>>>>>>>>>466		ubyte		!0xee
12147>>>>>>>>>>>482		ubyte		!0xee
12148>>>>>>>>>>>>498		ubyte		0xee
12149#>>>>>>>>>>>>>494	use		gpt-mbr-partition
12150>>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
12151>>>>>>>>>>>>>>0			use		gpt-mbr-type
12152>>>>>>>>>>>>>>&-8		use		gpt-table
12153>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
12154>>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
12155>>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
12156>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12157>>>>>>>>>>>>>>>&-8		use		gpt-table
12158>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
12159>>>>>>>>>>>>>>(502.l*4096)	string		!EFI\ PART
12160>>>>>>>>>>>>>>>(502.l*2048)	string		EFI\ PART	GPT partition table
12161>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12162>>>>>>>>>>>>>>>>&-8		use		gpt-table
12163>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
12164>>>>>>>>>>>>>>>(502.l*2048)	string		!EFI\ PART
12165>>>>>>>>>>>>>>>>(502.l*1024)	string		EFI\ PART	GPT partition table
12166>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12167>>>>>>>>>>>>>>>>>&-8		use		gpt-table
12168>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
12169>>>>>>>>>>>>>>>>(502.l*1024)	string		!EFI\ PART
12170>>>>>>>>>>>>>>>>>(502.l*512)	string		EFI\ PART	GPT partition table
12171>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
12172>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
12173>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
12174
12175# The following code does GPT detection and processing, including
12176# sector size detection.
12177# It has to be duplicated above because the top-level pattern
12178# (i.e. not called using 'use') must print *something* for file
12179# to count it as a match. Text only printed in named patterns is
12180# not counted, and causes file to continue, and try and match
12181# other patterns.
12182#
12183# Unfortunately, when assuming sector sizes >=16k, if the sector size
12184# happens to be 512 instead, we may find confusing data after the GPT
12185# table...  If the GPT table has less than 128 entries, this may even
12186# happen for assumed sector sizes as small as 4k
12187# This could be solved by checking for the presence of the backup GPT
12188# header as well, but that makes the logic extremely complex
12189##0		name		gpt-mbr-partition
12190##>(8.l*8192)	string		EFI\ PART
12191##>>(8.l*8192)	use		gpt-mbr-type
12192##>>&-8		use		gpt-table
12193##>>0		ubyte		x		of 8192 bytes
12194##>(8.l*8192)	string		!EFI\ PART
12195##>>(8.l*4096)	string		EFI\ PART	GPT partition table
12196##>>>0		use		gpt-mbr-type
12197##>>>&-8		use		gpt-table
12198##>>>0		ubyte		x		of 4096 bytes
12199##>>(8.l*4096)	string		!EFI\ PART
12200##>>>(8.l*2048)	string		EFI\ PART	GPT partition table
12201##>>>>0		use		gpt-mbr-type
12202##>>>>&-8		use		gpt-table
12203##>>>>0		ubyte		x		of 2048 bytes
12204##>>>(8.l*2048)	string		!EFI\ PART
12205##>>>>(8.l*1024)	string		EFI\ PART	GPT partition table
12206##>>>>>0		use		gpt-mbr-type
12207##>>>>>&-8	use		gpt-table
12208##>>>>>0		ubyte		x		of 1024 bytes
12209##>>>>(8.l*1024)	string		!EFI\ PART
12210##>>>>>(8.l*512)	string		EFI\ PART	GPT partition table
12211##>>>>>>0		use		gpt-mbr-type
12212##>>>>>>&-8	use		gpt-table
12213##>>>>>>0		ubyte		x		of 512 bytes
12214
12215# Print details of MBR type for a GPT-disk
12216# Calling code ensures that there is only one 0xee partition.
122170		name		gpt-mbr-type
12218# GPT with protective MBR entry in partition 1
12219>450		ubyte		0xee
12220>>454		ulelong		1
12221>>>462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
12222>>454		ulelong		!1													\b (nonstandard: not at LBA 1)
12223# GPT with protective MBR entry in partition 2
12224>466		ubyte		0xee
12225>>470		ulelong		1
12226>>>478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
12227>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
12228>>>478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
12229>>470		ulelong		!1									\b (nonstandard: not at LBA 1)
12230# GPT with protective MBR entry in partition 3
12231>482		ubyte		0xee
12232>>486		ulelong		1
12233>>>494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
12234>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
12235>>>494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
12236>>486		ulelong		!1									\b (nonstandard: not at LBA 1)
12237# GPT with protective MBR entry in partition 4
12238>498		ubyte		0xee
12239>>502		ulelong		1
12240>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
12241>>502		ulelong		!1													\b (nonstandard: not at LBA 1)
12242
12243# Print the information from a GPT partition table structure
122440		name		gpt-table
12245>10		uleshort	x		\b, version %u
12246>8		uleshort	x		\b.%u
12247>56		ulelong		x		\b, GUID: %08x
12248>60		uleshort	x		\b-%04x
12249>62		uleshort	x		\b-%04x
12250>64		ubeshort	x		\b-%04x
12251>66		ubeshort	x		\b-%04x
12252>68		ubelong		x		\b%08x
12253#>80		uleshort	x		\b, %d partition entries
12254>32		ulequad+1	x		\b, disk size: %lld sectors
12255
12256# In case a GPT data-structure is at LBA 0, report it as well
12257# This covers systems which are not GPT-aware, and which show
12258# and allow access to the protective partition. This code will
12259# detect the contents of such a partition.
122600		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
12261>0		use		gpt-table
12262>0		ubyte		x		(sector size unknown)
12263
12264
12265
12266#------------------------------------------------------------------------------
12267# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
12268# gpu: file(1) magic for GPU input files
12269
12270# Standard Portable Intermediate Representation (SPIR)
12271# Documentation: https://www.khronos.org/spir
12272# Typical file extension: .spv
12273
122740	belong	0x07230203	Khronos SPIR-V binary, big-endian
12275>4	belong	x		\b, version 0x%08x
12276>8	belong	x		\b, generator 0x%08x
12277
122780	lelong	0x07230203      Khronos SPIR-V binary, little-endian
12279>4	lelong	x		\b, version 0x%08x
12280>8	lelong	x		\b, generator 0x%08x
12281
12282# Vulkan Trace file
12283# Documentation:
12284# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
12285# vktrace_trace_packet_identifiers.h
12286# Typical file extension: .vktrace
12287
122888	lequad  0xABADD068ADEAFD0C	Vulkan trace file, little-endian
12289>0	leshort	x			\b, version %d
12290
122918	bequad  0xABADD068ADEAFD0C	Vulkan trace file, big-endian
12292>0	beshort	x			\b, version %d
12293
12294#------------------------------------------------------------------------------
12295# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
12296# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
12297#
12298# ACE/gr binary
122990	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
12300>39	byte	>0			- version %c
12301# ACE/gr ascii
123020	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
123030	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
123040	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
12305# Grace projects
123060	string	#\ Grace\ project\ file		Grace project file
12307>23	string	@version\  			(version
12308>>32	byte	>0 				%c
12309>>33	string	>\0 				\b.%.2s
12310>>35	string	>\0 				\b.%.2s)
12311# ACE/gr fit description files
123120	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
12313# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
12314
12315#------------------------------------------------------------------------------
12316# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $
12317# graphviz:  file(1) magic for http://www.graphviz.org/
12318
12319# FIXME: These patterns match too generally. For example, the first
12320# line matches a LaTeX file containing the word "graph" (with a {
12321# following later) and the second line matches this file.
12322#0	regex/100l	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
12323#!:mime	text/vnd.graphviz
12324#0	regex/100l	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
12325#!:mime	text/vnd.graphviz
12326
12327#------------------------------------------------------------------------------
12328# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
12329# gringotts:  file(1) magic for Gringotts
12330# http://devel.pluto.linux.it/projects/Gringotts/
12331# author: Germano Rizzo <mano@pluto.linux.it>
12332#GRG3????Y
123330	string	GRG		Gringotts data file
12334#file format 1
12335>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
12336#file format 2
12337>3	string		2		v.2, MCRYPT S2K,
12338>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
12339>>8	byte&0x70	0x10		SERPENT crypt,
12340>>8	byte&0x70	0x20		TWOFISH crypt,
12341>>8	byte&0x70	0x30		CAST-256 crypt,
12342>>8	byte&0x70	0x40		SAFER+ crypt,
12343>>8	byte&0x70	0x50		LOKI97 crypt,
12344>>8	byte&0x70	0x60		3DES crypt,
12345>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
12346>>8	byte&0x08	0x00		SHA1 hash,
12347>>8	byte&0x08	0x08		RIPEMD-160 hash,
12348>>8	byte&0x04	0x00		ZLib
12349>>8	byte&0x04	0x04		BZip2
12350>>8	byte&0x03	0x00		lvl.0
12351>>8	byte&0x03	0x01		lvl.3
12352>>8	byte&0x03	0x02		lvl.6
12353>>8	byte&0x03	0x03		lvl.9
12354#file format 3
12355>3	string		3		v.3, OpenPGP S2K,
12356>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
12357>>8	byte&0x70	0x10		SERPENT crypt,
12358>>8	byte&0x70	0x20		TWOFISH crypt,
12359>>8	byte&0x70	0x30		CAST-256 crypt,
12360>>8	byte&0x70	0x40		SAFER+ crypt,
12361>>8	byte&0x70	0x50		LOKI97 crypt,
12362>>8	byte&0x70	0x60		3DES crypt,
12363>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
12364>>8	byte&0x08	0x00		SHA1 hash,
12365>>8	byte&0x08	0x08		RIPEMD-160 hash,
12366>>8	byte&0x04	0x00		ZLib
12367>>8	byte&0x04	0x04		BZip2
12368>>8	byte&0x03	0x00		lvl.0
12369>>8	byte&0x03	0x01		lvl.3
12370>>8	byte&0x03	0x02		lvl.6
12371>>8	byte&0x03	0x03		lvl.9
12372#file format >3
12373>3	string		>3		v.%.1s (unknown details)
12374
12375#------------------------------------------------------------------------------
12376# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $
12377# Guile file magic from <dalepsmith@gmail.com>
12378# http://www.gnu.org/s/guile/
12379# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
12380
123810	string	GOOF----	Guile Object
12382>8	string	LE		\b, little endian
12383>8	string	BE		\b, big endian
12384>11	string	4		\b, 32bit
12385>11	string	8		\b, 64bit
12386>13	regex	.\..		\b, bytecode v%s
12387
12388#------------------------------------------------------------------------------
12389# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $
12390# hitach-sh: file(1) magic for Hitachi Super-H
12391#
12392# Super-H COFF
12393#
12394# updated by Joerg Jenderek at Oct 2015
12395# https://en.wikipedia.org/wiki/COFF
12396# https://de.wikipedia.org/wiki/Common_Object_File_Format
12397# http://www.delorie.com/djgpp/doc/coff/filhdr.html
12398# below test line conflicts with 2nd NTFS filesystem sector
12399# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
12400# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
124010	beshort		0x0500
12402# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
12403>18	ubeshort&0x8E80	0
12404# use big endian variant of subroutine to display name+variables+flags
12405# for common object formated files
12406>>0	use				\^display-coff
12407
124080	leshort		0x0550
12409# test for unused flag bits in f_flags
12410>18	uleshort&0x8E80	0
12411# use little endian variant of subroutine to
12412# display name+variables+flags for common object formated files
12413>>0	use				display-coff
12414
12415
12416#------------------------------------------------------------------------------
12417# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $
12418# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
12419#
12420# XXX - somebody should figure out whether any byte order needs to be
12421# applied to the "TML" stuff; I'm assuming the Apollo stuff is
12422# big-endian as it was mostly 68K-based.
12423#
12424# I think the 500 series was the old stack-based machines, running a
12425# UNIX environment atop the "SUN kernel"; dunno whether it was
12426# big-endian or little-endian.
12427#
12428# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
12429# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
12430# HP magic is useful for reference, but using "long" magic is a better
12431# practice in order to avoid collisions.
12432#
12433# Guy Harris (guy@netapp.com): some additions to this list came from
12434# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
12435# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
12436# "/etc/magic", though, except for the "archive file relocatable library"
12437# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
12438# used in executables, or have they just not yet updated "/etc/magic"
12439# completely?
12440#
12441# 0	beshort		200		hp200 (68010) BSD binary
12442# 0	beshort		300		hp300 (68020+68881) BSD binary
12443# 0	beshort		0x20c		hp200/300 HP-UX binary
12444# 0	beshort		0x20d		hp400 (68030) HP-UX binary
12445# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
12446# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
12447# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
12448# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
12449# 0	beshort		0x214		PA-RISC2.0 HP-UX binary
12450
12451#
12452# The "misc" stuff needs a byte order; the archives look suspiciously
12453# like the old 177545 archives (0xff65 = 0177545).
12454#
12455#### Old Apollo stuff
124560	beshort		0627		Apollo m68k COFF executable
12457>18	beshort		^040000		not stripped
12458>22	beshort		>0		- version %d
124590	beshort		0624		apollo a88k COFF executable
12460>18	beshort		^040000		not stripped
12461>22	beshort		>0		- version %d
124620       long            01203604016     TML 0123 byte-order format
124630       long            01702407010     TML 1032 byte-order format
124640       long            01003405017     TML 2301 byte-order format
124650       long            01602007412     TML 3210 byte-order format
12466#### PA-RISC 1.1
124670	belong 		0x02100106	PA-RISC1.1 relocatable object
124680	belong 		0x02100107	PA-RISC1.1 executable
12469>168	belong		&0x00000004	dynamically linked
12470>(144)	belong		0x054ef630	dynamically linked
12471>96	belong		>0		- not stripped
12472
124730	belong 		0x02100108	PA-RISC1.1 shared executable
12474>168	belong&0x4	0x4		dynamically linked
12475>(144)	belong		0x054ef630	dynamically linked
12476>96	belong		>0		- not stripped
12477
124780	belong 		0x0210010b	PA-RISC1.1 demand-load executable
12479>168	belong&0x4	0x4		dynamically linked
12480>(144)	belong		0x054ef630	dynamically linked
12481>96	belong		>0		- not stripped
12482
124830	belong 		0x0210010e	PA-RISC1.1 shared library
12484>96	belong		>0		- not stripped
12485
124860	belong 		0x0210010d	PA-RISC1.1 dynamic load library
12487>96	belong		>0		- not stripped
12488
12489#### PA-RISC 2.0
124900	belong		0x02140106	PA-RISC2.0 relocatable object
12491
124920       belong		0x02140107	PA-RISC2.0 executable
12493>168	belong		&0x00000004	dynamically linked
12494>(144)	belong		0x054ef630	dynamically linked
12495>96	belong		>0		- not stripped
12496
124970       belong		0x02140108	PA-RISC2.0 shared executable
12498>168	belong		&0x00000004	dynamically linked
12499>(144)	belong		0x054ef630	dynamically linked
12500>96	belong		>0		- not stripped
12501
125020       belong		0x0214010b	PA-RISC2.0 demand-load executable
12503>168	belong		&0x00000004	dynamically linked
12504>(144)	belong		0x054ef630	dynamically linked
12505>96	belong		>0		- not stripped
12506
125070       belong		0x0214010e	PA-RISC2.0 shared library
12508>96	belong		>0		- not stripped
12509
125100       belong		0x0214010d	PA-RISC2.0 dynamic load library
12511>96	belong		>0		- not stripped
12512
12513#### 800
125140	belong 		0x020b0106	PA-RISC1.0 relocatable object
12515
125160	belong 		0x020b0107	PA-RISC1.0 executable
12517>168	belong&0x4	0x4		dynamically linked
12518>(144)	belong		0x054ef630	dynamically linked
12519>96	belong		>0		- not stripped
12520
125210	belong 		0x020b0108	PA-RISC1.0 shared executable
12522>168	belong&0x4	0x4		dynamically linked
12523>(144)	belong		0x054ef630	dynamically linked
12524>96	belong		>0		- not stripped
12525
125260	belong 		0x020b010b	PA-RISC1.0 demand-load executable
12527>168	belong&0x4	0x4		dynamically linked
12528>(144)	belong		0x054ef630	dynamically linked
12529>96	belong		>0		- not stripped
12530
125310	belong 		0x020b010e	PA-RISC1.0 shared library
12532>96	belong		>0		- not stripped
12533
125340	belong 		0x020b010d	PA-RISC1.0 dynamic load library
12535>96	belong		>0		- not stripped
12536
125370	belong		0x213c6172	archive file
12538>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
12539>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
12540>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
12541>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
12542
12543#### 500
125440	long		0x02080106	HP s500 relocatable executable
12545>16	long		>0		- version %d
12546
125470	long		0x02080107	HP s500 executable
12548>16	long		>0		- version %d
12549
125500	long		0x02080108	HP s500 pure executable
12551>16	long		>0		- version %d
12552
12553#### 200
125540	belong 		0x020c0108	HP s200 pure executable
12555>4	beshort		>0		- version %d
12556>8	belong		&0x80000000	save fp regs
12557>8	belong		&0x40000000	dynamically linked
12558>8	belong		&0x20000000	debuggable
12559>36	belong		>0		not stripped
12560
125610	belong		0x020c0107	HP s200 executable
12562>4	beshort		>0		- version %d
12563>8	belong		&0x80000000	save fp regs
12564>8	belong		&0x40000000	dynamically linked
12565>8	belong		&0x20000000	debuggable
12566>36	belong		>0		not stripped
12567
125680	belong		0x020c010b	HP s200 demand-load executable
12569>4	beshort		>0		- version %d
12570>8	belong		&0x80000000	save fp regs
12571>8	belong		&0x40000000	dynamically linked
12572>8	belong		&0x20000000	debuggable
12573>36	belong		>0		not stripped
12574
125750	belong		0x020c0106	HP s200 relocatable executable
12576>4	beshort		>0		- version %d
12577>6	beshort		>0		- highwater %d
12578>8	belong		&0x80000000	save fp regs
12579>8	belong		&0x20000000	debuggable
12580>8	belong		&0x10000000	PIC
12581
125820	belong 		0x020a0108	HP s200 (2.x release) pure executable
12583>4	beshort		>0		- version %d
12584>36	belong		>0		not stripped
12585
125860	belong		0x020a0107	HP s200 (2.x release) executable
12587>4	beshort		>0		- version %d
12588>36	belong		>0		not stripped
12589
125900	belong		0x020c010e	HP s200 shared library
12591>4	beshort		>0		- version %d
12592>6	beshort		>0		- highwater %d
12593>36	belong		>0		not stripped
12594
125950	belong		0x020c010d	HP s200 dynamic load library
12596>4	beshort		>0		- version %d
12597>6	beshort		>0		- highwater %d
12598>36	belong		>0		not stripped
12599
12600#### MISC
126010	long		0x0000ff65	HP old archive
126020	long		0x020aff65	HP s200 old archive
126030	long		0x020cff65	HP s200 old archive
126040	long		0x0208ff65	HP s500 old archive
12605
126060	long		0x015821a6	HP core file
12607
126080	long		0x4da7eee8	HP-WINDOWS font
12609>8	byte		>0		- version %d
126100	string		Bitmapfile	HP Bitmapfile
12611
126120	string		IMGfile	CIS 	compimg HP Bitmapfile
12613# XXX - see "lif"
12614#0	short		0x8000		lif file
126150	long		0x020c010c	compiled Lisp
12616
126170	string		msgcat01	HP NLS message catalog,
12618>8	long		>0		%d messages
12619
12620# Summary: HP-48/49 calculator
12621# Created by: phk@data.fls.dk
12622# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
12623# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
126240	string		HPHP		HP
12625>4	string		48		48 binary
12626>4	string		49		49 binary
12627>7	byte		>64		- Rev %c
12628>8	leshort		0x2911		(ADR)
12629>8	leshort		0x2933		(REAL)
12630>8	leshort		0x2955		(LREAL)
12631>8	leshort		0x2977		(COMPLX)
12632>8	leshort		0x299d		(LCOMPLX)
12633>8	leshort		0x29bf		(CHAR)
12634>8	leshort		0x29e8		(ARRAY)
12635>8	leshort		0x2a0a		(LNKARRAY)
12636>8	leshort		0x2a2c		(STRING)
12637>8	leshort		0x2a4e		(HXS)
12638>8	leshort		0x2a74		(LIST)
12639>8	leshort		0x2a96		(DIR)
12640>8	leshort		0x2ab8		(ALG)
12641>8	leshort		0x2ada		(UNIT)
12642>8	leshort		0x2afc		(TAGGED)
12643>8	leshort		0x2b1e		(GROB)
12644>8	leshort		0x2b40		(LIB)
12645>8	leshort		0x2b62		(BACKUP)
12646>8	leshort		0x2b88		(LIBDATA)
12647>8	leshort		0x2d9d		(PROG)
12648>8	leshort		0x2dcc		(CODE)
12649>8	leshort		0x2e48		(GNAME)
12650>8	leshort		0x2e6d		(LNAME)
12651>8	leshort		0x2e92		(XLIB)
12652
126530	string		%%HP:		HP text
12654>6	string		T(0)		- T(0)
12655>6	string		T(1)		- T(1)
12656>6	string		T(2)		- T(2)
12657>6	string		T(3)		- T(3)
12658>10	string		A(D)		A(D)
12659>10	string		A(R)		A(R)
12660>10	string		A(G)		A(G)
12661>14	string		F(.)		F(.);
12662>14	string		F(,)		F(,);
12663
12664
12665# Summary: HP-38/39 calculator
12666# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
126670	string		HP3
12668>3	string		8		HP 38
12669>3	string		9		HP 39
12670>4	string		Bin		binary
12671>4	string		Asc		ASCII
12672>7	string		A		(Directory List)
12673>7	string		B		(Zaplet)
12674>7	string		C		(Note)
12675>7	string		D		(Program)
12676>7	string		E		(Variable)
12677>7	string		F		(List)
12678>7	string		G		(Matrix)
12679>7	string		H		(Library)
12680>7	string		I		(Target List)
12681>7	string		J		(ASCII Vector specification)
12682>7	string		K		(wildcard)
12683
12684# Summary: HP-38/39 calculator
12685# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
126860	string		HP3
12687>3	string		8		HP 38
12688>3	string		9		HP 39
12689>4	string		Bin		binary
12690>4	string		Asc		ASCII
12691>7	string		A		(Directory List)
12692>7	string		B		(Zaplet)
12693>7	string		C		(Note)
12694>7	string		D		(Program)
12695>7	string		E		(Variable)
12696>7	string		F		(List)
12697>7	string		G		(Matrix)
12698>7	string		H		(Library)
12699>7	string		I		(Target List)
12700>7	string		J		(ASCII Vector specification)
12701>7	string		K		(wildcard)
12702
12703# hpBSD magic numbers
127040	beshort		200		hp200 (68010) BSD
12705>2	beshort		0407		impure binary
12706>2	beshort		0410		read-only binary
12707>2	beshort		0413		demand paged binary
127080	beshort		300		hp300 (68020+68881) BSD
12709>2	beshort		0407		impure binary
12710>2	beshort		0410		read-only binary
12711>2	beshort		0413		demand paged binary
12712#
12713# From David Gero <dgero@nortelnetworks.com>
12714# HP-UX 10.20 core file format from /usr/include/sys/core.h
12715# Unfortunately, HP-UX uses corehead blocks without specifying the order
12716# There are four we care about:
12717#     CORE_KERNEL, which starts with the string "HP-UX"
12718#     CORE_EXEC, which contains the name of the command
12719#     CORE_PROC, which contains the signal number that caused the core dump
12720#     CORE_FORMAT, which contains the version of the core file format (== 1)
12721# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
12722# but we include all 6 variations of the order of the first 3, and
12723# assume that PROC will always be last
12724# Order 1: KERNEL, EXEC, FORMAT, PROC
127250x10		string	HP-UX
12726>0		belong	2
12727>>0xC		belong	0x3C
12728>>>0x4C		belong	0x100
12729>>>>0x58	belong	0x44
12730>>>>>0xA0	belong	1
12731>>>>>>0xAC	belong	4
12732>>>>>>>0xB0	belong	1
12733>>>>>>>>0xB4	belong	4		core file
12734>>>>>>>>>0x90	string	>\0		from '%s'
12735>>>>>>>>>0xC4	belong	3		- received SIGQUIT
12736>>>>>>>>>0xC4	belong	4		- received SIGILL
12737>>>>>>>>>0xC4	belong	5		- received SIGTRAP
12738>>>>>>>>>0xC4	belong	6		- received SIGABRT
12739>>>>>>>>>0xC4	belong	7		- received SIGEMT
12740>>>>>>>>>0xC4	belong	8		- received SIGFPE
12741>>>>>>>>>0xC4	belong	10		- received SIGBUS
12742>>>>>>>>>0xC4	belong	11		- received SIGSEGV
12743>>>>>>>>>0xC4	belong	12		- received SIGSYS
12744>>>>>>>>>0xC4	belong	33		- received SIGXCPU
12745>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
12746# Order 2: KERNEL, FORMAT, EXEC, PROC
12747>>>0x4C		belong	1
12748>>>>0x58	belong	4
12749>>>>>0x5C	belong	1
12750>>>>>>0x60	belong	0x100
12751>>>>>>>0x6C	belong	0x44
12752>>>>>>>>0xB4	belong	4		core file
12753>>>>>>>>>0xA4	string	>\0		from '%s'
12754>>>>>>>>>0xC4	belong	3		- received SIGQUIT
12755>>>>>>>>>0xC4	belong	4		- received SIGILL
12756>>>>>>>>>0xC4	belong	5		- received SIGTRAP
12757>>>>>>>>>0xC4	belong	6		- received SIGABRT
12758>>>>>>>>>0xC4	belong	7		- received SIGEMT
12759>>>>>>>>>0xC4	belong	8		- received SIGFPE
12760>>>>>>>>>0xC4	belong	10		- received SIGBUS
12761>>>>>>>>>0xC4	belong	11		- received SIGSEGV
12762>>>>>>>>>0xC4	belong	12		- received SIGSYS
12763>>>>>>>>>0xC4	belong	33		- received SIGXCPU
12764>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
12765# Order 3: FORMAT, KERNEL, EXEC, PROC
127660x24		string	HP-UX
12767>0		belong	1
12768>>0xC		belong	4
12769>>>0x10		belong	1
12770>>>>0x14	belong	2
12771>>>>>0x20	belong	0x3C
12772>>>>>>0x60	belong	0x100
12773>>>>>>>0x6C	belong	0x44
12774>>>>>>>>0xB4	belong	4		core file
12775>>>>>>>>>0xA4	string	>\0		from '%s'
12776>>>>>>>>>0xC4	belong	3		- received SIGQUIT
12777>>>>>>>>>0xC4	belong	4		- received SIGILL
12778>>>>>>>>>0xC4	belong	5		- received SIGTRAP
12779>>>>>>>>>0xC4	belong	6		- received SIGABRT
12780>>>>>>>>>0xC4	belong	7		- received SIGEMT
12781>>>>>>>>>0xC4	belong	8		- received SIGFPE
12782>>>>>>>>>0xC4	belong	10		- received SIGBUS
12783>>>>>>>>>0xC4	belong	11		- received SIGSEGV
12784>>>>>>>>>0xC4	belong	12		- received SIGSYS
12785>>>>>>>>>0xC4	belong	33		- received SIGXCPU
12786>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
12787# Order 4: EXEC, KERNEL, FORMAT, PROC
127880x64		string	HP-UX
12789>0		belong	0x100
12790>>0xC		belong	0x44
12791>>>0x54		belong	2
12792>>>>0x60	belong	0x3C
12793>>>>>0xA0	belong	1
12794>>>>>>0xAC	belong	4
12795>>>>>>>0xB0	belong	1
12796>>>>>>>>0xB4	belong	4		core file
12797>>>>>>>>>0x44	string	>\0		from '%s'
12798>>>>>>>>>0xC4	belong	3		- received SIGQUIT
12799>>>>>>>>>0xC4	belong	4		- received SIGILL
12800>>>>>>>>>0xC4	belong	5		- received SIGTRAP
12801>>>>>>>>>0xC4	belong	6		- received SIGABRT
12802>>>>>>>>>0xC4	belong	7		- received SIGEMT
12803>>>>>>>>>0xC4	belong	8		- received SIGFPE
12804>>>>>>>>>0xC4	belong	10		- received SIGBUS
12805>>>>>>>>>0xC4	belong	11		- received SIGSEGV
12806>>>>>>>>>0xC4	belong	12		- received SIGSYS
12807>>>>>>>>>0xC4	belong	33		- received SIGXCPU
12808>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
12809# Order 5: FORMAT, EXEC, KERNEL, PROC
128100x78		string	HP-UX
12811>0		belong	1
12812>>0xC		belong	4
12813>>>0x10		belong	1
12814>>>>0x14	belong	0x100
12815>>>>>0x20	belong	0x44
12816>>>>>>0x68	belong	2
12817>>>>>>>0x74	belong	0x3C
12818>>>>>>>>0xB4	belong	4		core file
12819>>>>>>>>>0x58	string	>\0		from '%s'
12820>>>>>>>>>0xC4	belong	3		- received SIGQUIT
12821>>>>>>>>>0xC4	belong	4		- received SIGILL
12822>>>>>>>>>0xC4	belong	5		- received SIGTRAP
12823>>>>>>>>>0xC4	belong	6		- received SIGABRT
12824>>>>>>>>>0xC4	belong	7		- received SIGEMT
12825>>>>>>>>>0xC4	belong	8		- received SIGFPE
12826>>>>>>>>>0xC4	belong	10		- received SIGBUS
12827>>>>>>>>>0xC4	belong	11		- received SIGSEGV
12828>>>>>>>>>0xC4	belong	12		- received SIGSYS
12829>>>>>>>>>0xC4	belong	33		- received SIGXCPU
12830>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
12831# Order 6: EXEC, FORMAT, KERNEL, PROC
12832>0		belong	0x100
12833>>0xC		belong	0x44
12834>>>0x54		belong	1
12835>>>>0x60	belong	4
12836>>>>>0x64	belong	1
12837>>>>>>0x68	belong	2
12838>>>>>>>0x74	belong	0x2C
12839>>>>>>>>0xB4	belong	4		core file
12840>>>>>>>>>0x44	string	>\0		from '%s'
12841>>>>>>>>>0xC4	belong	3		- received SIGQUIT
12842>>>>>>>>>0xC4	belong	4		- received SIGILL
12843>>>>>>>>>0xC4	belong	5		- received SIGTRAP
12844>>>>>>>>>0xC4	belong	6		- received SIGABRT
12845>>>>>>>>>0xC4	belong	7		- received SIGEMT
12846>>>>>>>>>0xC4	belong	8		- received SIGFPE
12847>>>>>>>>>0xC4	belong	10		- received SIGBUS
12848>>>>>>>>>0xC4	belong	11		- received SIGSEGV
12849>>>>>>>>>0xC4	belong	12		- received SIGSYS
12850>>>>>>>>>0xC4	belong	33		- received SIGXCPU
12851>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
12852
12853
12854
12855#------------------------------------------------------------------------------
12856# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
12857# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
12858# Magic too short!
12859#0		string	HU		Human68k
12860#>68		string	LZX		LZX compressed
12861#>>72		string	>\0		(version %s)
12862#>(8.L+74)	string	LZX		LZX compressed
12863#>>(8.L+78)	string	>\0		(version %s)
12864#>60		belong	>0		binded
12865#>(8.L+66)	string	#HUPAIR		hupair
12866#>0		string	HU		X executable
12867#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
12868#>4		belong	>0		- base address 0x%x
12869#>28		belong	>0		not stripped
12870#>32		belong	>0		with debug information
12871#0		beshort	0x601a		Human68k Z executable
12872#0		beshort	0x6000		Human68k object file
12873#0		belong	0xd1000000	Human68k ar binary archive
12874#0		belong	0xd1010000	Human68k ar ascii archive
12875#0		beshort	0x0068		Human68k lib archive
12876#4		string	LZX		Human68k LZX compressed
12877#>8		string	>\0		(version %s)
12878#>4		string	LZX		R executable
12879#2		string	#HUPAIR		Human68k hupair R executable
12880
12881#------------------------------------------------------------------------------
12882# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
12883# ibm370:  file(1) magic for IBM 370 and compatibles.
12884#
12885# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
12886# What the heck *is* "USS/370"?
12887# AIX 4.1's "/etc/magic" has
12888#
12889#	0	short		0535		370 sysV executable
12890#	>12	long		>0		not stripped
12891#	>22	short		>0		- version %d
12892#	>30	long		>0		- 5.2 format
12893#	0	short		0530		370 sysV pure executable
12894#	>12	long		>0		not stripped
12895#	>22	short		>0		- version %d
12896#	>30	long		>0		- 5.2 format
12897#
12898# instead of the "USS/370" versions of the same magic numbers.
12899#
129000	beshort		0537		370 XA sysV executable
12901>12	belong		>0		not stripped
12902>22	beshort		>0		- version %d
12903>30	belong		>0		- 5.2 format
129040	beshort		0532		370 XA sysV pure executable
12905>12	belong		>0		not stripped
12906>22	beshort		>0		- version %d
12907>30	belong		>0		- 5.2 format
129080	beshort		054001		370 sysV pure executable
12909>12	belong		>0		not stripped
129100	beshort		055001		370 XA sysV pure executable
12911>12	belong		>0		not stripped
129120	beshort		056401		370 sysV executable
12913>12	belong		>0		not stripped
129140	beshort		057401		370 XA sysV executable
12915>12	belong		>0		not stripped
129160       beshort		0531		SVR2 executable (Amdahl-UTS)
12917>12	belong		>0		not stripped
12918>24     belong		>0		- version %d
129190	beshort		0534		SVR2 pure executable (Amdahl-UTS)
12920>12	belong		>0		not stripped
12921>24	belong		>0		- version %d
129220	beshort		0530		SVR2 pure executable (USS/370)
12923>12	belong		>0		not stripped
12924>24	belong		>0		- version %d
129250	beshort		0535		SVR2 executable (USS/370)
12926>12	belong		>0		not stripped
12927>24	belong		>0		- version %d
12928
12929#------------------------------------------------------------------------------
12930# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $
12931# ibm6000:  file(1) magic for RS/6000 and the RT PC.
12932#
129330	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
12934>12	belong		>0		not stripped
12935# Breaks sun4 statically linked execs.
12936#0      beshort		0x0103		executable (RT Version 2) or obj module
12937#>2	byte		0x50		pure
12938#>28	belong		>0		not stripped
12939#>6	beshort		>0		- version %ld
129400	beshort		0x0104		shared library
129410	beshort		0x0105		ctab data
129420	beshort		0xfe04		structured file
129430	string		0xabcdef	AIX message catalog
129440	belong		0x000001f9	AIX compiled message catalog
129450	string		\<aiaff>	archive
129460	string		\<bigaf>	archive (big format)
12947
129480	beshort		0x01f7		64-bit XCOFF executable or object module
12949>20	belong		0		not stripped
12950# GRR: this test is still too general as it catches also many FATs of DOS filesystems
129514	belong		&0x0feeddb0
12952# real core dump could not be 32-bit and 64-bit together
12953>7	byte&0x03	!3		AIX core file
12954>>1	byte		&0x01		fulldump
12955>>7	byte		&0x01		32-bit
12956>>>0x6e0	string	>\0		\b, %s
12957>>7	byte		&0x02		64-bit
12958>>>0x524	string	>\0		\b, %s
12959
12960#------------------------------------------------------------------------------
12961# $File: icc,v 1.4 2017/03/17 22:20:22 christos Exp $
12962# icc:  file(1) magic for International Color Consortium file formats
12963
12964#
12965# Color profiles as per the ICC's "Image technology colour management -
12966# Architecture, profile format, and data structure" specification.
12967# See
12968#
12969#	http://www.color.org/specification/ICC1v43_2010-12.pdf
12970#
12971# for Specification ICC.1:2010 (Profile version 4.3.0.0).
12972# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
12973# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
12974# Update: Joerg Jenderek
12975#
12976# Bytes 36 to 39 contain a generic profile file signature of "acsp";
12977# bytes 40 to 43 "may be used to identify the primary platform/operating
12978# system framework for which the profile was created".
12979#
12980#	check and display ICC/ICM color profile
129810	name	color-profile
12982>36	string		acsp
12983# skip ASCII like Cognacspirit.txt by month <= 12
12984>>26	ubeshort	<13
12985# platform/operating system. Only 5 mentioned
12986
12987#
12988# This appears to be what's used for Apple ColorSync profiles.
12989# Instead of adding that, Apple just changed the generic "acsp" entry
12990# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
12991# Management System, ICC Profile".
12992# Yes, it's "APPL", not "AAPL"; see the spec.
12993>>>40	string		APPL		ColorSync
12994
12995# Microsoft ICM color profile
12996>>>40	string		MSFT		Microsoft
12997
12998# Yes, that's a blank after "SGI".
12999>>>40	string		SGI\ 		SGI
13000
13001# XXX - is this what's used for the Sun KCMS or not?  The standard file
13002# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
13003# and there *is* an identified "primary platform" value of SUNW.
13004>>>40	string		SUNW		Sun KCMS
13005
13006# 5th platform
13007>>>40	string		TGNT		Taligent
13008
13009# remaing "l" "e" of "color profile" printed later to avoid error
13010>>>40	string		x 		color profi
13011#>>>40	string		x		(%.4s)
13012!:mime	application/vnd.iccprofile
13013# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
13014>>>8	ubyte		=2
13015# do not use empty message text to a avoid error like
13016# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
13017# file.exe: could not find any valid magic files!
13018>>>>9	ubyte		!0		\ble
13019!:ext	icc/icm
13020# minor version
13021>>>>9	ubyte		=0		\bl
13022# Kodak colour management system
13023>>>>>4	string		=KCMS		\be
13024!:ext	icc/icm/cc
13025>>>>>4	string		!KCMS		\be
13026!:ext	icc/icm
13027>>>8	ubyte		!2		\ble
13028!:ext	icc
13029# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
13030>>>8	ubyte		x		%u
13031>>>9	ubyte/16	x		\b.%u
13032# reserved and shall be null but 205.205 in umx1220u.icm
13033>>>10	ubyte		>0		\b.%u
13034>>>>11	ubyte		>0		\b.%u
13035# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF  "
13036# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
13037>>>4	string		>\ 		\b, type %.2s
13038>>>>6	string		>\  		\b%.1s
13039>>>>>7	string		>\  		\b%.1s
13040# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
13041>>>16	string		x		\b, %.3s
13042>>>19	string		>\  		\b%.1s
13043# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
13044# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
13045>>>20	string		>\0		\b/%.3s
13046>>>>23	string		>\ 		\b%.1s
13047# eleven device classes
13048>>>12	string		x		\b-%.4s device
13049# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
13050>>>52	string		>\040
13051# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
13052>>>>52	ubelong		!0x6e6f6e65
13053# device manufacturer field like "HP  " "IBM " EPSO
13054>>>>>48	string		x		\b, %.2s
13055>>>>>50	string		>\  		\b%.1s
13056>>>>>51	string		>\  		\b%.1s
13057# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
13058>>>>>52	string		>\ \  		\b/%.3s
13059>>>>>>55 string		>\  		\b%.1s
13060>>>>>52	string		x		model
13061# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
13062>>>80	string		>\0		by %.2s
13063>>>>82	string		>\  		\b%.1s
13064>>>>>83	string		>\  		\b%.1s
13065# profile size
13066>>>0	ubelong		x		\b, %u bytes
13067# skip invalid date 0 like in linearSRGB.icc
13068>>>24	ubequad		!0
13069# datetime dd-mm-yyyy hh:mm:ss
13070>>>>28	ubeshort	x		\b, %u
13071# month <= 12
13072>>>>26	ubeshort	x		\b-%u
13073# year
13074>>>>24	ubeshort	x		\b-%u
13075# do not display midnight time like in CNHP8308.ICC
13076>>>>30	ubequad&0xFFffFFffFFff0000	!0
13077# hour <= 24
13078>>>>>30	ubeshort	x		%u
13079# minutes <= 59
13080>>>>>32	ubeshort	x		\b:%.2u
13081# seconds <= 59
13082>>>>>34	ubeshort	x		\b:%.2u
13083# vendor specific flags like 2 in HPCLJ5.ICM
13084>>>44	ubeshort	>0		\b, 0x%x vendor flags
13085# profile flags bits 0-2 of least 16 used by ICC
13086#>>>44	ubelong		>0		\b, 0x%x flags
13087# icEmbeddedProfileTrue
13088>>>44	ubelong		&1		\b, embedded
13089# icEmbeddedProfileFalse
13090#>>>44	ubelong		^1		\b, not embedded
13091# icUseWithEmbeddedDataOnly
13092>>>44	ubelong		&2		\b, dependently
13093# icUseAnywhere
13094#>>>44	ubelong		^2		\b, independently
13095>>>44	ubelong		&4		\b, MCS
13096#>>>44	ubelong		^4		\b, no MCS
13097# vendor specific device attributes 1~srgb.icc
13098# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
13099>>>56	ubelong		>0		\b, 0x%x vendor attribute
13100# ICC device attributes bits 0-7 used
13101#>>>60	ubelong		x		\b, 0x%x attribute
13102# http://www.color.org/icc34.h
13103>>>60	ubelong		&0x01		\b, transparent
13104#>>>60	ubelong		^0x01		\b, reflective
13105>>>60	ubelong		&0x02		\b, matte
13106#>>>60	ubelong		^0x02		\b, glossy
13107>>>60	ubelong		&0x04		\b, negative
13108#>>>60	ubelong		^0x04		\b, positive
13109>>>60	ubelong		&0x08		\b, black&white
13110#>>>60	ubelong		^0x08		\b, colour
13111>>>60	ubelong		&0x10		\b, non-paper
13112#>>>60	ubelong		^0x10		\b, paper
13113>>>60	ubelong		&0x20		\b, non-textured
13114#>>>60	ubelong		^0x20		\b, textured
13115>>>60	ubelong		&0x40		\b, non-isotropic
13116#>>>60	ubelong		^0x40		\b, isotropic
13117>>>60	ubelong		&0x80		\b, self-luminous
13118#>>>60	ubelong		^0x80		\b, non-self-luminous
13119# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
13120>>>64	ubelong		>3		\b, 0x%x rendering intent
13121#>>>64	ubelong		=0		\b, perceptual
13122>>>64	ubelong		=1		\b, relative colorimetric
13123>>>64	ubelong		=2		\b, saturation
13124>>>64	ubelong		=3		\b, absolute colorimetric
13125# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
13126>>>71	ubequad		!0xd6000100000000d3	\b, PCS
13127# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
13128# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
13129>>>>68	ubelong			!0x0000f6d5	X=0x%x
13130# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
13131>>>>72	ubelong			!0x00010000	Y=0x%x
13132# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
13133# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
13134>>>>76	ubelong			!0x0000d32d	Z=0x%x
13135# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
13136>>>84	ubequad		>0		\b, 0x%llx MD5
13137# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
13138#>>100	ubequad		x		\b 0x%llx reserved
13139# tag table
13140# 6 <= tags count <= 43
13141#>>>128	ubelong		>43		\b, %u tags
13142>>>128	ubelong		x
13143# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
13144# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
13145>>>>132	search/508	cprt
13146# but no copyright tag in linearSRGB.icc
13147# beneath /System/Library/Frameworks/WebKit.framework/
13148# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
13149>>>>132	default		x		\b, no copyright tag
13150# 1st tag
13151#>>>132	string		x		\b, 1st tag %.4s
13152#>>>136	ubelong		x		0x%x offset
13153#>>>140	ubelong		x		0x%x len
13154# 2nd tag,...
13155# look also for profileDescriptionTag "desc"
13156>>>132	search/508	desc
13157# look further for TextDescriptionType "desc" signature
13158>>>>(&0.L)	string		=desc
13159>>>>>&4		pstring/l	x	"%s"
13160# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
13161>>>>(&0.L)	string		=mluc
13162>>>>>&(&8.L)	ubequad		x
13163>>>>>>&4	bestring16	x	'%s'
13164
13165# Any other profile.
13166# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
13167# and use "acsp" for everything else and dump the "primary platform"
13168# string in those cases?
1316936	string		acsp
13170>0	use		color-profile
13171
13172
13173
13174#------------------------------------------------------------------------------
13175# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $
13176# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
13177#
13178# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
13179# Arts for file interchange.  It has also been used by Apple, SGI, and
13180# especially Commodore-Amiga.
13181#
13182# IFF files begin with an 8 byte FORM header, followed by a 4 character
13183# FORM type, which is followed by the first chunk in the FORM.
13184
131850	string		FORM		IFF data
13186#>4	belong		x		\b, FORM is %d bytes long
13187# audio formats
13188>8	string		AIFF		\b, AIFF audio
13189!:mime	audio/x-aiff
13190>8	string		AIFC		\b, AIFF-C compressed audio
13191!:mime	audio/x-aiff
13192>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
13193!:mime	audio/x-aiff
13194>8	string		16SV		\b, 16SV 16-bit sampled sound voice
13195>8	string		SAMP		\b, SAMP sampled audio
13196>8	string		MAUD		\b, MAUD MacroSystem audio
13197>8	string		SMUS		\b, SMUS simple music
13198>8	string		CMUS		\b, CMUS complex music
13199# image formats
13200>8	string		ILBMBMHD	\b, ILBM interleaved image
13201>>20	beshort		x		\b, %d x
13202>>22	beshort		x		%d
13203>8	string		RGBN		\b, RGBN 12-bit RGB image
13204>8	string		RGB8		\b, RGB8 24-bit RGB image
13205>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
13206>8	string		DR2D		\b, DR2D 2-D object
13207>8	string		TDDD		\b, TDDD 3-D rendering
13208>8	string		LWOB		\b, LWOB 3-D object
13209>8	string		LWO2		\b, LWO2 3-D object, v2
13210>8	string		LWLO		\b, LWLO 3-D layered object
13211>8	string		REAL		\b, REAL Real3D rendering
13212>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
13213>8	string		ANIM		\b, ANIM animation
13214>8	string		YAFA		\b, YAFA animation
13215>8	string		SSA\ 		\b, SSA super smooth animation
13216>8	string		ACBM		\b, ACBM continuous image
13217>8	string		FAXX		\b, FAXX fax image
13218# other formats
13219>8	string		FTXT		\b, FTXT formatted text
13220>8	string		CTLG		\b, CTLG message catalog
13221>8	string		PREF		\b, PREF preferences
13222>8	string		DTYP		\b, DTYP datatype description
13223>8	string		PTCH		\b, PTCH binary patch
13224>8	string		AMFF		\b, AMFF AmigaMetaFile format
13225>8	string		WZRD		\b, WZRD StormWIZARD resource
13226>8	string		DOC\ 		\b, DOC desktop publishing document
13227>8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
13228>>24	leshort		x		%d video frames,
13229>>26	leshort		x		%d x
13230>>28	leshort		x		%d
13231>8	string		MOVE		\b, Wing Commander III Video
13232>>12	string		_PC_		\b, PC version
13233>>12	string		3DO_		\b, 3DO version
13234
13235# These go at the end of the iff rules
13236#
13237# David Griffith <dave@661.org>
13238# I don't see why these might collide with anything else.
13239#
13240# Interactive Fiction related formats
13241#
13242>8	string		IFRS		\b, Blorb Interactive Fiction
13243>>24	string		Exec		with executable chunk
13244>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
13245!:mime	application/x-blorb
13246
13247#------------------------------------------------------------------------------
13248# $File: images,v 1.123 2017/04/04 20:34:24 christos Exp $
13249# images:  file(1) magic for image formats (see also "iff", and "c-lang" for
13250# XPM bitmaps)
13251#
13252# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
13253# additions by janl@ifi.uio.no as well as others. Jan also suggested
13254# merging several one- and two-line files into here.
13255#
13256# little magic: PCX (first byte is 0x0a)
13257
13258# Targa - matches `povray', `ppmtotga' and `xv' outputs
13259# by Philippe De Muyter <phdm@macqel.be>
13260# URL: http://justsolve.archiveteam.org/wiki/TGA
13261# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
13262# Update: Joerg Jenderek
13263# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
13264#	,32 or 33 (both not observed)
13265# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
13266#	or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications
13267# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
13268# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
13269# `tgatoppm' recognizes a superset (Index may be anything)
13270#
13271# test of Color Map Type 0~no 1~color map
13272# and Image Type 1 2 3 9 10 11 32 33
13273# and Color Map Entry Size 0 15 16 24 32
132740	ubequad&0x00FeC400000000C0	0
13275# skip more garbage by looking for positive image type
13276>2	ubyte			>0
13277# skip some compiled terminfo by looking for image type less equal 33
13278>>2	ubyte			<34
13279# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel sizes 15 16 24 32
13280>>>16	ubyte			<33
13281# skip more by looking for pixel size 0Fh 10h 18h 20h
13282>>>>16	ubyte&0xC0		0x00
13283# Color Map
13284>>>>>1	belong&0xfff7ffff	0x01010000
13285>>>>>>0		use		tga-image
13286>>>>>1	belong&0xfff7ffff	0x00020000
13287>>>>>>0		use		tga-image
13288>>>>>1	belong&0xfff7ffff	0x00030000
13289>>>>>>0		use		tga-image
13290>>>>>1	default			x
13291# skip 260-16.ico by looking for no color map
13292>>>>>>1	ubyte			0
13293# implies no first map entry
13294>>>>>>>3	uleshort		0
13295>>>>>>>>0	use		tga-image
13296#	display tga bitmap image information
132970	name				tga-image
13298>2	ubyte		<34		Targa image data
13299!:mime	image/x-tga
13300!:apple	????TPIC
13301# normal extension .tga but some Truevision products used others:
13302# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
13303!:ext	tga/tpic/icb/vda/vst
13304# image type 1 2 3 9 10 11 32 33
13305>2	ubyte&0xF7	1		- Map
13306>2	ubyte&0xF7	2		- RGB
13307# alpha channel
13308>>17	ubyte&0x0F	>0		\bA
13309>2	ubyte&0xF7	3		- Mono
13310# type not found, but by http://www.fileformat.info/format/tga/corion.htm
13311# Compressed color-mapped data, using Huffman, Delta, and runlength encoding
13312>2	ubyte		32		- Color
13313# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process
13314>2	ubyte		33		- Color
13315# Color Map Type 0~no 1~color map
13316>1	ubyte		1		(
13317# first color map entry, 0 normal
13318>>3	uleshort	>0		\b%d-
13319# color map length 0 2 1dh 3bh d9h 100h
13320>>5	uleshort	x		\b%d)
13321# 8~run length encoding bit
13322>2	ubyte&0x08	8		- RLE
13323# gimp can create big pictures!
13324>12	uleshort	>0		%d x
13325>12	uleshort	=0		65536 x
13326# image height. 0 interpreted as 65536
13327>14	uleshort	>0		%d
13328>14	uleshort	=0		65536
13329# Image Pixel Size 15 16 24 32
13330>16	ubyte		x		x %d
13331# X origin of image. 0 normal
13332>8	uleshort	>0		+%d
13333# Y origin of image. 0 normal; positive for top
13334>10	uleshort	>0		+%d
13335# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
13336>17	ubyte&0x0F	>0		- %d-bit alpha
13337# bits 5-4 give direction. normal bottom left
13338>17	ubyte		&0x20		- top
13339#>17	ubyte		^0x20		- bottom
13340>17	ubyte		&0x10		- right
13341#>17	ubyte		^0x10		- left
13342# some info say other bits 6-7 should be zero
13343# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
13344# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
13345#>17	ubyte&0xC0	0x00		- no interleave
13346>17	ubyte&0xC0	0x40		- interleave
13347>17	ubyte&0xC0	0x80		- four way interleave
13348>17	ubyte&0xC0	0xC0		- reserved
13349# positive length implies identification field
13350>0	ubyte		>0
13351>>18	string		x		"%s"
13352# last 18 bytes of newer tga file footer signature
13353>18	search/4261301/s	TRUEVISION-XFILE.\0
13354# extension area offset if not 0
13355>>&-8		ulelong			>0
13356# length of the extension area. normal 495 for version 2.0
13357>>>(&-4.l)	uleshort		0x01EF
13358# AuthorName[41]
13359>>>>&0		string			>\0		- author "%-.40s"
13360# Comment[324]=4 * 80 null terminated
13361>>>>&41		string			>\0		- comment "%-.80s"
13362# date
13363>>>>&365	ubequad&0xffffFFFFffff0000	!0
13364# Day
13365>>>>>&-6		uleshort		x		%d
13366# Month
13367>>>>>&-8		uleshort		x		\b-%d
13368# Year
13369>>>>>&-4		uleshort		x		\b-%d
13370# time
13371>>>>&371	ubequad&0xffffFFFFffff0000	!0
13372# hour
13373>>>>>&-8		uleshort		x		%d
13374# minutes
13375>>>>>&-6		uleshort		x		\b:%.2d
13376# second
13377>>>>>&-4		uleshort		x		\b:%.2d
13378# JobName[41]
13379>>>>&377		string			>\0		- job "%-.40s"
13380# JobHour Jobminute Jobsecond
13381>>>>&418	ubequad&0xffffFFFFffff0000	!0
13382>>>>>&-8		uleshort		x		%d
13383>>>>>&-6		uleshort		x		\b:%.2d
13384>>>>>&-4		uleshort		x		\b:%.2d
13385# SoftwareId[41]
13386>>>>&424		string			>\0		- %-.40s
13387# SoftwareVersionNumber
13388>>>>&424	ubyte				>0
13389>>>>>&40		uleshort/100		x		%d
13390>>>>>&40		uleshort%100		x		\b.%d
13391# VersionLetter
13392>>>>>&42		ubyte			>0x20		\b%c
13393# KeyColor
13394>>>>&468		ulelong			>0		- keycolor 0x%8.8x
13395# Denominator of Pixel ratio. 0~no pixel aspect
13396>>>>&474	uleshort			>0
13397# Numerator
13398>>>>>&-4		uleshort		>0		- aspect %d
13399>>>>>&-2		uleshort		x		\b/%d
13400# Denominator of Gamma ratio. 0~no Gamma value
13401>>>>&478	uleshort			>0
13402# Numerator
13403>>>>>&-4		uleshort		>0		- gamma %d
13404>>>>>&-2		uleshort		x		\b/%d
13405# ColorOffset
13406#>>>>&480	ulelong			x		- col offset 0x%8.8x
13407# StampOffset
13408#>>>>&484	ulelong			x		- stamp offset 0x%8.8x
13409# ScanOffset
13410#>>>>&488	ulelong			x		- scan offset 0x%8.8x
13411# AttributesType
13412#>>>>&492	ubyte			x		- Attributes 0x%x
13413## EndOfTGA
13414
13415# PBMPLUS images
13416# The next byte following the magic is always whitespace.
13417# strength is changed to try these patterns before "x86 boot sector"
134180	name		netpbm
13419>3	regex/s		=[0-9]{1,50}\ [0-9]{1,50}	Netpbm image data
13420>>&0	regex		=[0-9]{1,50} 			\b, size = %s x
13421>>>&0	regex		=[0-9]{1,50}			\b %s
13422
134230	search/1	P1
13424>0	regex/4		P1[\040\t\f\r\n]
13425>>0	use		netpbm
13426>>>0	string		x	\b, bitmap
13427!:strength + 45
13428!:mime	image/x-portable-bitmap
13429
134300	search/1	P2
13431>0	regex/4		P2[\040\t\f\r\n]
13432>>0	use		netpbm
13433>>>0	string		x	\b, greymap
13434!:strength + 45
13435!:mime	image/x-portable-greymap
13436
134370	search/1	P3
13438>0	regex/4		P3[\040\t\f\r\n]
13439>>0	use		netpbm
13440>>>0	string		x	\b, pixmap
13441!:strength + 45
13442!:mime	image/x-portable-pixmap
13443
134440	string		P4
13445>0	regex/4		P4[\040\t\f\r\n]
13446>>0	use		netpbm
13447>>>0	string		x	\b, rawbits, bitmap
13448!:strength + 45
13449!:mime	image/x-portable-bitmap
13450
134510	string		P5
13452>0	regex/4		P5[\040\t\f\r\n]
13453>>0	use		netpbm
13454>>>0	string		x	\b, rawbits, greymap
13455!:strength + 45
13456!:mime	image/x-portable-greymap
13457
134580	string		P6
13459>0	regex/4		P6[\040\t\f\r\n]
13460>>0	use		netpbm
13461>>>0	string		x	\b, rawbits, pixmap
13462!:strength + 45
13463!:mime	image/x-portable-pixmap
13464
134650	string		P7		Netpbm PAM image file
13466!:mime	image/x-portable-pixmap
13467
13468# From: bryanh@giraffe-data.com (Bryan Henderson)
134690	string		\117\072	Solitaire Image Recorder format
13470>4	string		\013		MGI Type 11
13471>4	string		\021		MGI Type 17
134720	string		.MDA		MicroDesign data
13473>21	byte		48		version 2
13474>21	byte		51		version 3
134750	string		.MDP		MicroDesign page data
13476>21	byte		48		version 2
13477>21	byte		51		version 3
13478
13479# NIFF (Navy Interchange File Format, a modification of TIFF) images
13480# [GRR:  this *must* go before TIFF]
134810	string		IIN1		NIFF image data
13482!:mime	image/x-niff
13483
13484# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
13485# (CIFF) file. These are apparently all little-endian.
13486# From: Adam Buchbinder <adam.buchbinder@gmail.com>
13487# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
134880	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
13489!:mime	image/x-canon-crw
13490>16	leshort		x	\b, version %d.
13491>14	leshort		x	\b%d
13492
13493# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
13494# number. Put this above the TIFF test to make sure we detect them.
13495# These are apparently all little-endian.
13496# From: Adam Buchbinder <adam.buchbinder@gmail.com>
13497# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
134980	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
13499!:mime	image/x-canon-cr2
13500>10	byte		x	\b, version %d.
13501>11	byte		x	\b%d
13502
13503# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
13504# The second word of TIFF files is the TIFF version number, 42, which has
13505# never changed.  The TIFF specification recommends testing for it.
135060	string		MM\x00\x2a	TIFF image data, big-endian
13507!:mime	image/tiff
13508>(4.L)	use		\^tiff_ifd
135090	string		II\x2a\x00	TIFF image data, little-endian
13510!:mime	image/tiff
13511>(4.l)	use		tiff_ifd
13512
135130	name		tiff_ifd
13514>0	leshort		x		\b, direntries=%d
13515>2	use		tiff_entry
13516
135170	name		tiff_entry
13518# NewSubFileType
13519>0	leshort		0xfe
13520>>12	use		tiff_entry
13521>0	leshort		0x100
13522>>4	lelong		1
13523>>>12	use		tiff_entry
13524>>>8	leshort		x		\b, width=%d
13525>0	leshort		0x101
13526>>4	lelong		1
13527>>>8	leshort		x		\b, height=%d
13528>>>12	use		tiff_entry
13529>0	leshort		0x102
13530>>8	leshort		x		\b, bps=%d
13531>>12	use		tiff_entry
13532>0	leshort		0x103
13533>>4	lelong		1		\b, compression=
13534>>>8	leshort		1		\bnone
13535>>>8	leshort		2		\bhuffman
13536>>>8	leshort		3		\bbi-level group 3
13537>>>8	leshort		4		\bbi-level group 4
13538>>>8	leshort		5		\bLZW
13539>>>8	leshort		6		\bJPEG (old)
13540>>>8	leshort		7		\bJPEG
13541>>>8	leshort		8		\bdeflate
13542>>>8	leshort		9		\bJBIG, ITU-T T.85
13543>>>8	leshort		0xa		\bJBIG, ITU-T T.43
13544>>>8	leshort		0x7ffe		\bNeXT RLE 2-bit
13545>>>8	leshort		0x8005		\bPackBits (Macintosh RLE)
13546>>>8	leshort		0x8029		\bThunderscan RLE
13547>>>8	leshort		0x807f		\bRasterPadding (CT or MP)
13548>>>8	leshort		0x8080		\bRLE (Line Work)
13549>>>8	leshort		0x8081		\bRLE (High-Res Cont-Tone)
13550>>>8	leshort		0x8082		\bRLE (Binary Line Work)
13551>>>8	leshort		0x80b2		\bDeflate (PKZIP)
13552>>>8	leshort		0x80b3		\bKodak DCS
13553>>>8	leshort		0x8765		\bJBIG
13554>>>8	leshort		0x8798		\bJPEG2000
13555>>>8	leshort		0x8799		\bNikon NEF Compressed
13556>>>8	default		x
13557>>>>8	leshort		x		\b(unknown 0x%x)
13558>>>12	use		tiff_entry
13559>0	leshort		0x106		\b, PhotometricIntepretation=
13560>>8	clear		x
13561>>8	leshort		0		\bWhiteIsZero
13562>>8	leshort		1		\bBlackIsZero
13563>>8	leshort		2		\bRGB
13564>>8	leshort		3		\bRGB Palette
13565>>8	leshort		4		\bTransparency Mask
13566>>8	leshort		5		\bCMYK
13567>>8	leshort		6		\bYCbCr
13568>>8	leshort		8		\bCIELab
13569>>8	default		x
13570>>>8	leshort		x		\b(unknown=0x%x)
13571>>12	use		tiff_entry
13572# FillOrder
13573>0	leshort		0x10a
13574>>4	lelong		1
13575>>>12	use		tiff_entry
13576# DocumentName
13577>0	leshort		0x10d
13578>>(8.l)	string		x		\b, name=%s
13579>>>12	use		tiff_entry
13580# ImageDescription
13581>0	leshort		0x10e
13582>>(8.l)	string		x		\b, description=%s
13583>>>12	use		tiff_entry
13584# Make
13585>0	leshort		0x10f
13586>>(8.l)	string		x		\b, manufacturer=%s
13587>>>12	use		tiff_entry
13588# Model
13589>0	leshort		0x110
13590>>(8.l)	string		x		\b, model=%s
13591>>>12	use		tiff_entry
13592# StripOffsets
13593>0	leshort		0x111
13594>>12	use		tiff_entry
13595# Orientation
13596>0	leshort		0x112		\b, orientation=
13597>>8	leshort		1		\bupper-left
13598>>8	leshort		3		\blower-right
13599>>8	leshort		6		\bupper-right
13600>>8	leshort		8		\blower-left
13601>>8	leshort		9		\bundefined
13602>>8	default		x
13603>>>8	leshort		x		\b[*%d*]
13604>>12	use		tiff_entry
13605# XResolution
13606>0	leshort		0x11a
13607>>8	lelong		x		\b, xresolution=%d
13608>>12	use		tiff_entry
13609# YResolution
13610>0	leshort		0x11b
13611>>8	lelong		x		\b, yresolution=%d
13612>>12	use		tiff_entry
13613# ResolutionUnit
13614>0	leshort		0x128
13615>>8	leshort		x		\b, resolutionunit=%d
13616>>12	use		tiff_entry
13617# Software
13618>0	leshort		0x131
13619>>(8.l)	string		x		\b, software=%s
13620>>12	use		tiff_entry
13621# Datetime
13622>0	leshort		0x132
13623>>(8.l)	string		x		\b, datetime=%s
13624>>12	use		tiff_entry
13625# HostComputer
13626>0	leshort		0x13c
13627>>(8.l)	string		x		\b, hostcomputer=%s
13628>>12	use		tiff_entry
13629# WhitePoint
13630>0	leshort		0x13e
13631>>12	use		tiff_entry
13632# PrimaryChromaticities
13633>0	leshort		0x13f
13634>>12	use		tiff_entry
13635# YCbCrCoefficients
13636>0	leshort		0x211
13637>>12	use		tiff_entry
13638# YCbCrPositioning
13639>0	leshort		0x213
13640>>12	use		tiff_entry
13641# ReferenceBlackWhite
13642>0	leshort		0x214
13643>>12	use		tiff_entry
13644# Copyright
13645>0	leshort		0x8298
13646>>(8.l)	string		x		\b, copyright=%s
13647>>12	use		tiff_entry
13648# ExifOffset
13649>0	leshort		0x8769
13650>>12	use		tiff_entry
13651# GPS IFD
13652>0	leshort		0x8825		\b, GPS-Data
13653>>12	use		tiff_entry
13654
13655#>0	leshort		x		\b, unknown=0x%x
13656#>>12	use		tiff_entry
13657
136580	string		MM\x00\x2b	Big TIFF image data, big-endian
13659!:mime	image/tiff
136600	string		II\x2b\x00	Big TIFF image data, little-endian
13661!:mime	image/tiff
13662
13663# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
13664# (Greg Roelofs, newt@uchicago.edu)
13665# (Albert Cahalan, acahalan@cs.uml.edu)
13666#
13667# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
13668#
136690	string		\x89PNG\x0d\x0a\x1a\x0a		PNG image data
13670!:mime	image/png
13671!:strength +10
13672>16	belong		x		\b, %d x
13673>20	belong		x		%d,
13674>24	byte		x		%d-bit
13675>25	byte		0		grayscale,
13676>25	byte		2		\b/color RGB,
13677>25	byte		3		colormap,
13678>25	byte		4		gray+alpha,
13679>25	byte		6		\b/color RGBA,
13680#>26	byte		0		deflate/32K,
13681>28	byte		0		non-interlaced
13682>28	byte		1		interlaced
13683
13684# possible GIF replacements; none yet released!
13685# (Greg Roelofs, newt@uchicago.edu)
13686#
13687# GRR 950115:  this was mine ("Zip GIF"):
136880	string		GIF94z		ZIF image (GIF+deflate alpha)
13689!:mime	image/x-unknown
13690#
13691# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
13692#
136930	string		FGF95a		FGF image (GIF+deflate beta)
13694!:mime	image/x-unknown
13695#
13696# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
13697# (best; not yet implemented):
13698#
136990	string		PBF		PBF image (deflate compression)
13700!:mime	image/x-unknown
13701
13702# GIF
13703# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
137040	string		GIF8		GIF image data
13705!:strength +80
13706!:mime	image/gif
13707!:apple	8BIMGIFf
13708>4	string		7a		\b, version 8%s,
13709>4	string		9a		\b, version 8%s,
13710>6	leshort		>0		%d x
13711>8	leshort		>0		%d
13712#>10	byte		&0x80		color mapped,
13713#>10	byte&0x07	=0x00		2 colors
13714#>10	byte&0x07	=0x01		4 colors
13715#>10	byte&0x07	=0x02		8 colors
13716#>10	byte&0x07	=0x03		16 colors
13717#>10	byte&0x07	=0x04		32 colors
13718#>10	byte&0x07	=0x05		64 colors
13719#>10	byte&0x07	=0x06		128 colors
13720#>10	byte&0x07	=0x07		256 colors
13721
13722# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
13723# 1 plane, no encoding.
137240	string		\361\0\100\273	CMU window manager raster image data
13725>4	lelong		>0		%d x
13726>8	lelong		>0		%d,
13727>12	lelong		>0		%d-bit
13728
13729# Magick Image File Format
137300	string		id=ImageMagick	MIFF image data
13731
13732# Artisan
137330	long		1123028772	Artisan image data
13734>4	long		1		\b, rectangular 24-bit
13735>4	long		2		\b, rectangular 8-bit with colormap
13736>4	long		3		\b, rectangular 32-bit (24-bit with matte)
13737
13738# FIG (Facility for Interactive Generation of figures), an object-based format
137390	search/1	#FIG		FIG image text
13740>5	string		x		\b, version %.3s
13741
13742# PHIGS
137430	string		ARF_BEGARF		PHIGS clear text archive
137440	string		@(#)SunPHIGS		SunPHIGS
13745# version number follows, in the form m.n
13746>40	string		SunBin			binary
13747>32	string		archive			archive
13748
13749# GKS (Graphics Kernel System)
137500	string		GKSM		GKS Metafile
13751>24	string		SunGKS		\b, SunGKS
13752
13753# CGM image files
137540	string		BEGMF		clear text Computer Graphics Metafile
13755
13756# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
137570	string	yz	MGR bitmap, modern format, 8-bit aligned
137580	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
137590	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
137600	string	yx	MGR bitmap, modern format, squeezed
13761
13762# Fuzzy Bitmap (FBM) images
137630	string		%bitmap\0	FBM image data
13764>30	long		0x31		\b, mono
13765>30	long		0x33		\b, color
13766
13767# facsimile data
137681	string		PC\ Research,\ Inc	group 3 fax data
13769>29	byte		0		\b, normal resolution (204x98 DPI)
13770>29	byte		1		\b, fine resolution (204x196 DPI)
13771# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
137720	string		Sfff		structured fax file
13773
13774# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
13775# most files with the extension .EPA and some with .BMP
137760	string		\x11\x06	Award BIOS Logo, 136 x 84
13777!:mime	image/x-award-bioslogo
137780	string		\x11\x09	Award BIOS Logo, 136 x 126
13779!:mime	image/x-award-bioslogo
13780#0	string		\x07\x1f	BIOS Logo corrupted?
13781# http://www.blackfiveservices.co.uk/awbmtools.shtml
13782# http://biosgfx.narod.ru/v3/
13783# http://biosgfx.narod.ru/abr-2/
137840	string		AWBM
13785>4	leshort		<1981		Award BIOS bitmap
13786!:mime	image/x-award-bmp
13787# image width is a multiple of 4
13788>>4	leshort&0x0003	0
13789>>>4		leshort	x		\b, %d
13790>>>6		leshort	x		x %d
13791>>4	leshort&0x0003	>0		\b,
13792>>>4	leshort&0x0003	=1
13793>>>>4		leshort	x		%d+3
13794>>>4	leshort&0x0003	=2
13795>>>>4		leshort	x		%d+2
13796>>>4	leshort&0x0003	=3
13797>>>>4		leshort	x		%d+1
13798>>>6		leshort	x		x %d
13799# at offset 8 starts imagedata followed by "RGB " marker
13800
13801# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
13802# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
13803# 28bitmap_information_header.29
138040	string		BM
13805>14	leshort		12		PC bitmap, OS/2 1.x format
13806!:mime	image/x-ms-bmp
13807>>18	leshort		x		\b, %d x
13808>>20	leshort		x		%d
13809>14	leshort		64		PC bitmap, OS/2 2.x format
13810!:mime	image/x-ms-bmp
13811>>18	leshort		x		\b, %d x
13812>>20	leshort		x		%d
13813>14	leshort		40		PC bitmap, Windows 3.x format
13814!:mime	image/x-ms-bmp
13815>>18	lelong		x		\b, %d x
13816>>22	lelong		x		%d x
13817>>28	leshort		x		%d
13818>14	leshort		124		PC bitmap, Windows 98/2000 and newer format
13819!:mime	image/x-ms-bmp
13820>>18	lelong		x		\b, %d x
13821>>22	lelong		x		%d x
13822>>28	leshort		x		%d
13823>14	leshort		108		PC bitmap, Windows 95/NT4 and newer format
13824!:mime	image/x-ms-bmp
13825>>18	lelong		x		\b, %d x
13826>>22	lelong		x		%d x
13827>>28	leshort		x		%d
13828>14	leshort		128		PC bitmap, Windows NT/2000 format
13829!:mime	image/x-ms-bmp
13830>>18	lelong		x		\b, %d x
13831>>22	lelong		x		%d x
13832>>28	leshort		x		%d
13833# Too simple - MPi
13834#0	string		IC		PC icon data
13835#0	string		PI		PC pointer image data
13836#0	string		CI		PC color icon data
13837#0	string		CP		PC color pointer image data
13838# Conflicts with other entries [BABYL]
13839#0	string		BA		PC bitmap array data
13840
13841# XPM icons (Greg Roelofs, newt@uchicago.edu)
138420	search/1	/*\ XPM\ */	X pixmap image text
13843!:mime	image/x-xpmi
13844
13845# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
138460	leshort		0xcc52		RLE image data,
13847>6	leshort		x		%d x
13848>8	leshort		x		%d
13849>2	leshort		>0		\b, lower left corner: %d
13850>4	leshort		>0		\b, lower right corner: %d
13851>10	byte&0x1	=0x1		\b, clear first
13852>10	byte&0x2	=0x2		\b, no background
13853>10	byte&0x4	=0x4		\b, alpha channel
13854>10	byte&0x8	=0x8		\b, comment
13855>11	byte		>0		\b, %d color channels
13856>12	byte		>0		\b, %d bits per pixel
13857>13	byte		>0		\b, %d color map channels
13858
13859# image file format (Robert Potter, potter@cs.rochester.edu)
138600	string		Imagefile\ version-	iff image data
13861# this adds the whole header (inc. version number), informative but longish
13862>10	string		>\0		%s
13863
13864# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
138650	belong		0x59a66a95	Sun raster image data
13866>4	belong		>0		\b, %d x
13867>8	belong		>0		%d,
13868>12	belong		>0		%d-bit,
13869#>16	belong		>0		%d bytes long,
13870>20	belong		0		old format,
13871#>20	belong		1		standard,
13872>20	belong		2		compressed,
13873>20	belong		3		RGB,
13874>20	belong		4		TIFF,
13875>20	belong		5		IFF,
13876>20	belong		0xffff		reserved for testing,
13877>24	belong		0		no colormap
13878>24	belong		1		RGB colormap
13879>24	belong		2		raw colormap
13880#>28	belong		>0		colormap is %d bytes long
13881
13882# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
13883#
13884# See
13885#	http://reality.sgi.com/grafica/sgiimage.html
13886#
138870	beshort		474		SGI image data
13888#>2	byte		0		\b, verbatim
13889>2	byte		1		\b, RLE
13890#>3	byte		1		\b, normal precision
13891>3	byte		2		\b, high precision
13892>4	beshort		x		\b, %d-D
13893>6	beshort		x		\b, %d x
13894>8	beshort		x		%d
13895>10	beshort		x		\b, %d channel
13896>10	beshort		!1		\bs
13897>80	string		>0		\b, "%s"
13898
138990	string		IT01		FIT image data
13900>4	belong		x		\b, %d x
13901>8	belong		x		%d x
13902>12	belong		x		%d
13903#
139040	string		IT02		FIT image data
13905>4	belong		x		\b, %d x
13906>8	belong		x		%d x
13907>12	belong		x		%d
13908#
139092048	string		PCD_IPI		Kodak Photo CD image pack file
13910>0xe02	byte&0x03	0x00		, landscape mode
13911>0xe02	byte&0x03	0x01		, portrait mode
13912>0xe02	byte&0x03	0x02		, landscape mode
13913>0xe02	byte&0x03	0x03		, portrait mode
139140	string		PCD_OPA		Kodak Photo CD overview pack file
13915
13916# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
13917# FITS is the Flexible Image Transport System, the de facto standard for
13918# data and image transfer, storage, etc., for the astronomical community.
13919# (FITS floating point formats are big-endian.)
139200	string	SIMPLE\ \ =	FITS image data
13921>109	string	8		\b, 8-bit, character or unsigned binary integer
13922>108	string	16		\b, 16-bit, two's complement binary integer
13923>107	string	\ 32		\b, 32-bit, two's complement binary integer
13924>107	string	-32		\b, 32-bit, floating point, single precision
13925>107	string	-64		\b, 64-bit, floating point, double precision
13926
13927# other images
139280	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
13929
13930# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
13931# stuff.
13932#
139330	beshort		0x1010		PEX Binary Archive
13934
13935# DICOM medical imaging data
13936# URL:		https://en.wikipedia.org/wiki/DICOM#Data_format
13937# Note:		"dcm" is the official file name extension
13938# 		XnView mention also "dc3" and "acr" as file name extension
13939128	string	DICM			DICOM medical imaging data
13940!:mime	application/dicom
13941!:ext dcm/dicom/dic
13942
13943# XWD - X Window Dump file.
13944#   As described in /usr/X11R6/include/X11/XWDFile.h
13945#   used by the xwd program.
13946#   Bradford Castalia, idaeim, 1/01
13947#   updated by Adam Buchbinder, 2/09
13948# The following assumes version 7 of the format; the first long is the length
13949# of the header, which is at least 25 4-byte longs, and the one at offset 8
13950# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
13951# which is a maximum of 32.
139520	belong	>100
13953>8	belong	<3
13954>>12	belong	<33
13955>>>4	belong	7			XWD X Window Dump image data
13956!:mime	image/x-xwindowdump
13957>>>>100	string	>\0			\b, "%s"
13958>>>>16	belong	x			\b, %dx
13959>>>>20	belong	x			\b%dx
13960>>>>12	belong	x			\b%d
13961
13962# PDS - Planetary Data System
13963#   These files use Parameter Value Language in the header section.
13964#   Unfortunately, there is no certain magic, but the following
13965#   strings have been found to be most likely.
139660	string	NJPL1I00		PDS (JPL) image data
139672	string	NJPL1I			PDS (JPL) image data
139680	string	CCSD3ZF			PDS (CCSD) image data
139692	string	CCSD3Z			PDS (CCSD) image data
139700	string	PDS_			PDS image data
139710	string	LBLSIZE=		PDS (VICAR) image data
13972
13973# pM8x: ATARI STAD compressed bitmap format
13974#
13975# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
13976# p M 8 5/6 xx yy zz data...
13977# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
13978# bytes either run horizontally (pM85) or vertically (pM86). yy is the
13979# most frequent byte, xx and zz are runlength escape codes, where xx is
13980# used for runs of yy.
13981#
139820	string	pM85		Atari ST STAD bitmap image data (hor)
13983>5	byte	0x00		(white background)
13984>5	byte	0xFF		(black background)
139850	string	pM86		Atari ST STAD bitmap image data (vert)
13986>5	byte	0x00		(white background)
13987>5	byte	0xFF		(black background)
13988
13989# Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
13990# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
139910	leshort	0x0296		Atari ATR image
13992
13993# XXX:
13994# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
13995# magic.
13996# SGI RICE image file <mpruett@sgi.com>
13997#0	beshort	0x5249		RICE image
13998#>2	beshort	x		v%d
13999#>4	beshort	x		(%d x
14000#>6	beshort	x		%d)
14001#>8	beshort	0		8 bit
14002#>8	beshort	1		10 bit
14003#>8	beshort	2		12 bit
14004#>8	beshort	3		13 bit
14005#>10	beshort	0		4:2:2
14006#>10	beshort	1		4:2:2:4
14007#>10	beshort	2		4:4:4
14008#>10	beshort	3		4:4:4:4
14009#>12	beshort	1		RGB
14010#>12	beshort	2		CCIR601
14011#>12	beshort	3		RP175
14012#>12	beshort	4		YUV
14013
14014# PCX image files
14015# From: Dan Fandrich <dan@coneharvesters.com>
14016# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
14017# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
14018# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
14019# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
140200	ubelong&0xffF8fe00	0x0a000000
14021# for PCX bit depth > 0
14022>3	ubyte		>0
14023# test for valid versions
14024>>1	ubyte		<6
14025>>>1	ubyte		!1	PCX
14026!:mime	image/x-pcx
14027#!:mime	image/pcx
14028>>>>1	ubyte		0	ver. 2.5 image data
14029>>>>1	ubyte		2	ver. 2.8 image data, with palette
14030>>>>1	ubyte		3	ver. 2.8 image data, without palette
14031>>>>1	ubyte		4	for Windows image data
14032>>>>1	ubyte		5	ver. 3.0 image data
14033>>>>4	uleshort	x	bounding box [%d,
14034>>>>6	uleshort	x	%d] -
14035>>>>8	uleshort	x	[%d,
14036>>>>10	uleshort	x	%d],
14037>>>>65	ubyte		>1	%d planes each of
14038>>>>3	ubyte		x	%d-bit
14039>>>>68	byte		1	colour,
14040>>>>68	byte		2	grayscale,
14041# this should not happen
14042>>>>68	default		x	image,
14043>>>>12	leshort		>0	%d x
14044>>>>>14	uleshort	x	%d dpi,
14045>>>>2	byte		0	uncompressed
14046>>>>2	byte		1	RLE compressed
14047
14048# Adobe Photoshop
14049# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
140500	string		8BPS Adobe Photoshop Image
14051!:mime	image/vnd.adobe.photoshop
14052>4   beshort 2 (PSB)
14053>18  belong  x \b, %d x
14054>14  belong  x %d,
14055>24  beshort 0 bitmap
14056>24  beshort 1 grayscale
14057>>12 beshort 2 with alpha
14058>24  beshort 2 indexed
14059>24  beshort 3 RGB
14060>>12 beshort 4 \bA
14061>24  beshort 4 CMYK
14062>>12 beshort 5 \bA
14063>24  beshort 7 multichannel
14064>24  beshort 8 duotone
14065>24  beshort 9 lab
14066>12  beshort > 1
14067>>12  beshort x \b, %dx
14068>12  beshort 1 \b,
14069>22  beshort x %d-bit channel
14070>12  beshort > 1 \bs
14071
14072# XV thumbnail indicator (ThMO)
140730	string		P7\ 332		XV thumbnail image data
14074
14075# NITF is defined by United States MIL-STD-2500A
140760	string	NITF	National Imagery Transmission Format
14077>25	string	>\0	dated %.14s
14078
14079# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
14080# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
14081# Update: Joerg Jenderek
14082# See http://fileformats.archiveteam.org/wiki/GEM_Raster
14083# For variations, also see:
14084#    http://www.seasip.info/Gem/ff_img.html (Ventura)
14085#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
14086#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
14087#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
140880       beshort     0x0001
14089# header_size
14090>2      beshort     0x0008
14091>>0     use gem_info
14092>2      beshort     0x0009
14093>>0     use gem_info
14094# no example for NOSIG
14095>2      beshort     24
14096>>0     use gem_info
14097# no example for HYPERPAINT
14098>2      beshort     25
14099>>0     use gem_info
1410016      string      XIMG\0
14101>0      use gem_info
14102# no example
1410316      string      STTT\0\x10
14104>0      use gem_info
14105# no example or description
1410616      string      TIMG\0
14107>0      use gem_info
14108
141090   name        gem_info
14110# version is 2 for some XIMG and 1 for all others
14111>0	beshort		<0x0003		GEM
14112# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
14113!:mime	image/x-gem
14114# header_size 24 25 27 59 779 words for colored bitmaps
14115>>2	beshort		>9
14116>>>16	string		STTT\0\x10	STTT
14117>>>16	string		TIMG\0		TIMG
14118# HYPERPAINT or NOSIG variant
14119>>>16	string		\0\x80
14120>>>>2	beshort		=24		NOSIG
14121>>>>2	beshort		!24		HYPERPAINT
14122# NOSIG or XIMG variant
14123>>>16	default		x
14124>>>>16	string		!XIMG\0		NOSIG
14125>>16	string		=XIMG\0		XIMG Image data
14126!:ext	img/ximg
14127# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type
14128>>16	string		!XIMG\0		Image data
14129!:ext	img
14130# header_size is 9 for Ventura files and 8 for other GEM Paint files
14131>>2	beshort		9		(Ventura)
14132#>>2	beshort		8		(Paint)
14133>>12	beshort		x		%d x
14134>>14	beshort		x		%d,
14135# 1 4 8
14136>>4	beshort		x		%d planes,
14137# in tenths of a millimetre
14138>>8	beshort		x		%d x
14139>>10	beshort		x		%d pixelsize
14140# pattern_size 1-8. 2 for GEM Paint
14141>>6	beshort		!2		\b, pattern size %d
14142
14143# GEM Metafile (Wolfram Kleff)
141440	lelong		0x0018FFFF	GEM Metafile data
14145>4	leshort		x		version %d
14146
14147#
14148# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
14149# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
14150#
141510	string	\0\nSMJPEG	SMJPEG
14152>8	belong	x		%d.x data
14153# According to the specification you could find any number of _TXT
14154# headers here, but I can't think of any way of handling that. None of
14155# the SMJPEG files I tried it on used this feature. Even if such a
14156# file is encountered the output should still be reasonable.
14157>16	string	_SND		\b,
14158>>24	beshort	>0		%d Hz
14159>>26	byte	8		8-bit
14160>>26	byte	16		16-bit
14161>>28	string	NONE		uncompressed
14162# >>28	string	APCM		ADPCM compressed
14163>>27	byte	1		mono
14164>>28	byte	2		stereo
14165# Help! Isn't there any way to avoid writing this part twice?
14166>>32	string	_VID		\b,
14167# >>>48	string	JFIF		JPEG
14168>>>40	belong	>0		%d frames
14169>>>44	beshort	>0		(%d x
14170>>>46	beshort	>0		%d)
14171>16	string	_VID		\b,
14172# >>32	string	JFIF		JPEG
14173>>24	belong	>0		%d frames
14174>>28	beshort	>0		(%d x
14175>>30	beshort	>0		%d)
14176
141770	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
14178
14179# "thumbnail file" (icon)
14180# descended from "xv", but in use by other applications as well (Wolfram Kleff)
141810       string          P7\ 332         XV "thumbnail file" (icon) data
14182
14183# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
141840       string          KiSS            KISS/GS
14185>4      byte            16              color
14186>>5     byte            x               %d bit
14187>>8     leshort         x               %d colors
14188>>10    leshort         x               %d groups
14189>4      byte            32              cell
14190>>5     byte            x               %d bit
14191>>8     leshort         x               %d x
14192>>10    leshort         x               %d
14193>>12    leshort         x               +%d
14194>>14    leshort         x               +%d
14195
14196# Webshots (www.webshots.com), by John Harrison
141970       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
14198
14199# Hercules DASD image files
14200# From Jan Jaeger <jj@septa.nl>
142010       string  CKD_P370        Hercules CKD DASD image file
14202>8      long    x               \b, %d heads per cylinder
14203>12     long    x               \b, track size %d bytes
14204>16     byte    x               \b, device type 33%2.2X
14205
142060       string  CKD_C370        Hercules compressed CKD DASD image file
14207>8      long    x               \b, %d heads per cylinder
14208>12     long    x               \b, track size %d bytes
14209>16     byte    x               \b, device type 33%2.2X
14210
142110       string  CKD_S370        Hercules CKD DASD shadow file
14212>8      long    x               \b, %d heads per cylinder
14213>12     long    x               \b, track size %d bytes
14214>16     byte    x               \b, device type 33%2.2X
14215
14216# Squeak images and programs - etoffi@softhome.net
142170	string		\146\031\0\0	Squeak image data
142180	search/1	'From\040Squeak	Squeak program text
14219
14220# partimage: file(1) magic for PartImage files (experimental, incomplete)
14221# Author: Hans-Joachim Baader <hjb@pro-linux.de>
142220		string	PaRtImAgE-VoLuMe	PartImage
14223>0x0020		string	0.6.1		file version %s
14224>>0x0060	lelong	>-1		volume %d
14225#>>0x0064 8 byte identifier
14226#>>0x007c reserved
14227>>0x0200	string	>\0		type %s
14228>>0x1400	string	>\0		device %s,
14229>>0x1600	string	>\0		original filename %s,
14230# Some fields omitted
14231>>0x2744	lelong	0		not compressed
14232>>0x2744	lelong	1		gzip compressed
14233>>0x2744	lelong	2		bzip2 compressed
14234>>0x2744	lelong	>2		compressed with unknown algorithm
14235>0x0020		string	>0.6.1		file version %s
14236>0x0020		string	<0.6.1		file version %s
14237
14238# DCX is multi-page PCX, using a simple header of up to 1024
14239# offsets for the respective PCX components.
14240# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
142410	lelong	987654321	DCX multi-page PCX image data
14242
14243# Simon Walton <simonw@matteworld.com>
14244# Kodak Cineon format for scanned negatives
14245# http://www.kodak.com/US/en/motion/support/dlad/
142460	lelong  0xd75f2a80	Cineon image data
14247>200	belong  >0		\b, %d x
14248>204	belong  >0		%d
14249
14250
14251# Bio-Rad .PIC is an image format used by microscope control systems
14252# and related image processing software used by biologists.
14253# From: Vebjorn Ljosa <vebjorn@ljosa.com>
14254# BOOL values are two-byte integers; use them to rule out false positives.
14255# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
14256# Samples: http://www.loci.wisc.edu/software/sample-data
1425714	leshort <2
14258>62	leshort <2
14259>>54	leshort 12345		Bio-Rad .PIC Image File
14260>>>0	leshort >0		%d x
14261>>>2	leshort >0		%d,
14262>>>4	leshort =1		1 image in file
14263>>>4	leshort >1		%d images in file
14264
14265# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
14266# The description of *.mrw format can be found at
14267# http://www.dalibor.cz/minolta/raw_file_format.htm
142680	string	\000MRM			Minolta Dimage camera raw image data
14269
14270# Summary: DjVu image / document
14271# Extension: .djvu
14272# Reference: http://djvu.org/docs/DjVu3Spec.djvu
14273# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
14274# Modified by (1): Abel Cheung <abelcheung@gmail.com>
142750	string	AT&TFORM
14276>12	string	DJVM		DjVu multiple page document
14277!:mime	image/vnd.djvu
14278>12	string	DJVU		DjVu image or single page document
14279!:mime	image/vnd.djvu
14280>12	string	DJVI		DjVu shared document
14281!:mime	image/vnd.djvu
14282>12	string	THUM		DjVu page thumbnails
14283!:mime	image/vnd.djvu
14284
14285# Originally by Marc Espie
14286# Modified by Robert Minsk <robertminsk at yahoo.com>
14287# http://www.openexr.com/openexrfilelayout.pdf
142880	lelong		20000630	OpenEXR image data,
14289!:mime image/x-exr
14290>4	lelong&0x000000ff x		version %d,
14291>4	lelong		^0x00000200	storage: scanline
14292>4	lelong		&0x00000200	storage: tiled
14293>8	search/0x1000	compression\0	\b, compression:
14294>>&16	byte		0		none
14295>>&16	byte		1		rle
14296>>&16	byte		2		zips
14297>>&16	byte		3		zip
14298>>&16	byte		4		piz
14299>>&16	byte		5		pxr24
14300>>&16	byte		6		b44
14301>>&16	byte		7		b44a
14302>>&16	byte		>7		unknown
14303>8	 search/0x1000	dataWindow\0	\b, dataWindow:
14304>>&10	lelong		x		(%d
14305>>&14	lelong		x		%d)-
14306>>&18	lelong		x		\b(%d
14307>>&22	lelong		x		%d)
14308>8	search/0x1000	displayWindow\0	\b, displayWindow:
14309>>&10	lelong		x		(%d
14310>>&14	lelong		x		%d)-
14311>>&18	lelong		x		\b(%d
14312>>&22	lelong		x		%d)
14313>8	search/0x1000	lineOrder\0	 \b, lineOrder:
14314>>&14	byte		0		increasing y
14315>>&14	byte		1		decreasing y
14316>>&14	byte		2		random y
14317>>&14	byte		>2		unknown
14318
14319# SMPTE Digital Picture Exchange Format, SMPTE DPX
14320#
14321# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
14322# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
14323# Robert Minsk <robertminsk at yahoo.com>
143240	string		SDPX	DPX image data, big-endian,
14325!:mime image/x-dpx
14326>768	beshort		<4
14327>>772	belong		x	%dx
14328>>776	belong		x	\b%d,
14329>768	beshort		>3
14330>>776	belong		x	%dx
14331>>772	belong		x	\b%d,
14332>768	beshort		0	left to right/top to bottom
14333>768	beshort		1	right to left/top to bottom
14334>768	beshort		2	left to right/bottom to top
14335>768	beshort		3	right to left/bottom to top
14336>768	beshort		4	top to bottom/left to right
14337>768	beshort		5	top to bottom/right to left
14338>768	leshort		6	bottom to top/left to right
14339>768	leshort		7	bottom to top/right to left
14340
14341# From: Tom Hilinski <tom.hilinski@comcast.net>
14342# http://www.unidata.ucar.edu/packages/netcdf/
143430	string	CDF\001			NetCDF Data Format data
14344
14345#-----------------------------------------------------------------------
14346# Hierarchical Data Format, used to facilitate scientific data exchange
14347# specifications at http://hdf.ncsa.uiuc.edu/
143480	belong	0x0e031301	Hierarchical Data Format (version 4) data
14349!:mime	application/x-hdf
143500	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
14351!:mime	application/x-hdf
14352512	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 512 bytes user block
14353!:mime	application/x-hdf
143541024	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 1k user block
14355!:mime	application/x-hdf
143562048	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 2k user block
14357!:mime	application/x-hdf
143584096	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 4k user block
14359!:mime	application/x-hdf
14360
14361
14362# From: Tobias Burnus <burnus@net-b.de>
14363# Xara (for a while: Corel Xara) is a graphic package, see
14364# http://www.xara.com/ for Windows and as GPL application for Linux
143650	string	XARA\243\243	Xara graphics file
14366
14367# http://www.cartesianinc.com/Tech/
143680	string	CPC\262		Cartesian Perceptual Compression image
14369!:mime	image/x-cpi
14370
14371# From Albert Cahalan <acahalan@gmail.com>
14372# puredigital used it for the CVS disposable camcorder
14373#8       lelong  4       ZBM bitmap image data
14374#>4      leshort x       %u x
14375#>6      leshort x       %u
14376
14377# From Albert Cahalan <acahalan@gmail.com>
14378# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
143790       string C565     OLPC firmware icon image data
14380>4      leshort x       %u x
14381>6      leshort x       %u
14382
14383# Applied Images - Image files from Cytovision
14384# Gustavo Junior Alves <gjalves@gjalves.com.br>
143850	string	\xce\xda\xde\xfa	Cytovision Metaphases file
143860	string	\xed\xad\xef\xac	Cytovision Karyotype file
143870	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
143880	string	\xed\xfe\xda\xbe	Cytovision FLEX file
143890	string	\xed\xab\xed\xfe	Cytovision FLEX file
143900	string	\xad\xfd\xea\xad	Cytovision RATS file
14391
14392# Wavelet Scalar Quantization format used in gray-scale fingerprint images
14393# From Tano M Fotang <mfotang@quanteq.com>
143940	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data
14395
14396# Type:		PCO B16 image files
14397# URL:		http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
14398# From:		Florian Philipp <florian.philipp@binarywings.net>
14399# Extension:	.b16
14400# Description:	Pixel image format produced by PCO Camware, typically used
14401#		together with PCO cameras.
14402# Note:		Different versions exist for e.g. 8 bit and 16 bit images.
14403#		Documentation is incomplete.
144040	string/b	PCO-	PCO B16 image data
14405>12	lelong		x	\b, %dx
14406>16	lelong		x	\b%d
14407>20	lelong		0	\b, short header
14408>20	lelong		-1	\b, extended header
14409>>24	lelong		0	\b, grayscale
14410>>>36	lelong		0	linear LUT
14411>>>36	lelong		1	logarithmic LUT
14412>>>28	lelong		x	[%d
14413>>>32	lelong		x	\b,%d]
14414>>24	lelong		1	\b, color
14415>>>64	lelong		0	linear LUT
14416>>>64	lelong		1	logarithmic LUT
14417>>>40	lelong		x	r[%d
14418>>>44	lelong		x	\b,%d]
14419>>>48	lelong		x	g[%d
14420>>>52	lelong		x	\b,%d]
14421>>>56	lelong		x	b[%d
14422>>>60	lelong		x	\b,%d]
14423
14424# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
14425# From: Markus Heidelberg <markus.heidelberg at web.de>
144260	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
14427!:mime	image/x-polar-monitor-bitmap
14428
14429# From: Rick Richardson <rickrich@gmail.com>
14430# updated by: Joerg Jenderek
14431# URL: http://techmods.net/nuvi/
144320	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
14433# extension is also used for
14434# Sony SRF raw image (image/x-sony-srf)
14435# SRF map
14436# Terragen Surface Map (http://www.planetside.co.uk/terragen)
14437# FileLocator Pro search criteria file (http://www.mythicsoft.com/filelocatorpro)
14438!:ext srf
14439#!:mime	image/x-garmin-srf
14440# version 1.00,2.00,2.10,2.40,2.50
14441>0x2f	string		>0		\b, version %4.4s
14442# width (2880,2881,3240)
14443>0x55	uleshort	>0		\b, %dx
14444# height (80,90)
14445>>0x53	uleshort	x		\b%d
14446
14447# Type:	Ulead Photo Explorer5 (.pe5)
14448# URL:	http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
14449# From:	Simon Horman <horms@debian.org>
144500	string	IIO2H			Ulead Photo Explorer5
14451
14452# Type:	X11 cursor
14453# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
14454# From:	Mathias Brodala <info@noctus.net>
144550	string	Xcur			X11 cursor
14456
14457# Type:	Olympus ORF raw images.
14458# URL:	http://libopenraw.freedesktop.org/wiki/Olympus_ORF
14459# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
144600	string		MMOR		Olympus ORF raw image data, big-endian
14461!:mime	image/x-olympus-orf
144620	string		IIRO		Olympus ORF raw image data, little-endian
14463!:mime	image/x-olympus-orf
144640	string		IIRS		Olympus ORF raw image data, little-endian
14465!:mime	image/x-olympus-orf
14466
14467# Type: files used in modern AVCHD camcoders to store clip information
14468# Extension: .cpi
14469# From: Alexander Danilov <alexander.a.danilov@gmail.com>
144700	string	HDMV0100	AVCHD Clip Information
14471
14472# From: Adam Buchbinder <adam.buchbinder@gmail.com>
14473# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
14474# Radiance HDR; usually has .pic or .hdr extension.
144750	string	#?RADIANCE\n	Radiance HDR image data
14476#!mime	image/vnd.radiance
14477
14478# From: Adam Buchbinder <adam.buchbinder@gmail.com>
14479# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
14480# Used by the pfstools packages. The regex matches for the image size could
14481# probably use some work. The MIME type is made up; if there's one in
14482# actual common use, it should replace the one below.
144830	string	PFS1\x0a	PFS HDR image data
14484#!mime	image/x-pfs
14485>1	regex	[0-9]*\ 		\b, %s
14486>>1	regex	\ [0-9]{4}		\bx%s
14487
14488# Type: Foveon X3F
14489# URL:  http://www.photofo.com/downloads/x3f-raw-format.pdf
14490# From: Adam Buchbinder <adam.buchbinder@gmail.com>
14491# Note that the MIME type isn't defined anywhere that I can find; if
14492# there's a canonical type for this format, it should replace this one.
144930	string	FOVb	Foveon X3F raw image data
14494!:mime	image/x-x3f
14495>6	leshort	x	\b, version %d.
14496>4	leshort	x	\b%d
14497>28	lelong	x	\b, %dx
14498>32	lelong	x	\b%d
14499
14500# Paint.NET file
14501# From Adam Buchbinder <adam.buchbinder@gmail.com>
145020	string	PDN3	Paint.NET image data
14503!:mime	image/x-paintnet
14504
14505# Not really an image.
14506# From: "Tano M. Fotang" <mfotang@quanteq.com>
145070	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)
14508
14509# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
14510# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
1451190	bequad		0x574D50484F544F00	JPEG-XR Image
14512>98	byte&0x08	=0x08			\b, hard tiling
14513>99	byte&0x80	=0x80			\b, tiling present
14514>99	byte&0x40	=0x40			\b, codestream present
14515>99	byte&0x38	x			\b, spatial xform=
14516>99	byte&0x38	0x00			\bTL
14517>99	byte&0x38	0x08			\bBL
14518>99	byte&0x38	0x10			\bTR
14519>99	byte&0x38	0x18			\bBR
14520>99	byte&0x38	0x20			\bBT
14521>99	byte&0x38	0x28			\bRB
14522>99	byte&0x38	0x30			\bLT
14523>99	byte&0x38	0x38			\bLB
14524>100	byte&0x80	=0x80			\b, short header
14525>>102	beshort+1	x			\b, %d
14526>>104	beshort+1	x			\bx%d
14527>100	byte&0x80	=0x00			\b, long header
14528>>102	belong+1	x			\b, %x
14529>>106	belong+1	x			\bx%x
14530>101	beshort&0xf	x			\b, bitdepth=
14531>>101	beshort&0xf	0x0			\b1-WHITE=1
14532>>101	beshort&0xf	0x1			\b8
14533>>101	beshort&0xf	0x2			\b16
14534>>101	beshort&0xf	0x3			\b16-SIGNED
14535>>101	beshort&0xf	0x4			\b16-FLOAT
14536>>101	beshort&0xf	0x5			\b(reserved 5)
14537>>101	beshort&0xf	0x6			\b32-SIGNED
14538>>101	beshort&0xf	0x7			\b32-FLOAT
14539>>101	beshort&0xf	0x8			\b5
14540>>101	beshort&0xf	0x9			\b10
14541>>101	beshort&0xf	0xa			\b5-6-5
14542>>101	beshort&0xf	0xb			\b(reserved %d)
14543>>101	beshort&0xf	0xc			\b(reserved %d)
14544>>101	beshort&0xf	0xd			\b(reserved %d)
14545>>101	beshort&0xf	0xe			\b(reserved %d)
14546>>101	beshort&0xf	0xf			\b1-BLACK=1
14547>101	beshort&0xf0	x			\b, colorfmt=
14548>>101	beshort&0xf0	0x00			\bYONLY
14549>>101	beshort&0xf0	0x10			\bYUV240
14550>>101	beshort&0xf0	0x20			\bYWV422
14551>>101	beshort&0xf0	0x30			\bYWV444
14552>>101	beshort&0xf0	0x40			\bCMYK
14553>>101	beshort&0xf0	0x50			\bCMYKDIRECT
14554>>101	beshort&0xf0	0x60			\bNCOMPONENT
14555>>101	beshort&0xf0	0x70			\bRGB
14556>>101	beshort&0xf0	0x80			\bRGBE
14557>>101	beshort&0xf0	>0x80			\b(reserved 0x%x)
14558
14559# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
14560#
14561# BPG (Better Portable Graphics) format
14562# http://bellard.org/bpg/
14563# http://fileformats.archiveteam.org/wiki/BPG
14564#
145650	string	\x42\x50\x47\xFB	BPG (Better Portable Graphics)
14566!:mime  image/bpg
14567
14568# From: Joerg Jenderek
14569# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format
145700	string		icns		Mac OS X icon
14571!:mime	image/x-icns
14572!:apple	????icns
14573!:ext icns
14574>4	ubelong		>0
14575# file size
14576>>4	ubelong		x		\b, %d bytes
14577# icon type
14578>>8	string		x		\b, "%4.4s" type
14579
14580# TIM images
145810		lelong		0x00000010	TIM image,
14582>4		lelong  	0x8		4-Bit,
14583>4		lelong  	0x9		8-Bit,
14584>4		lelong  	0x2		15-Bit,
14585>4		lelong  	0x3		24-Bit,
14586>4		lelong 		&8
14587>>(8.l+12)	leshort		x		Pixel at (%d,
14588>>(8.l+14)	leshort		x		\b%d)
14589>>(8.l+16)	leshort		x		Size=%dx
14590>>(8.l+18)	leshort		x		\b%d,
14591>>4		lelong 		0x8		16 CLUT Entries at
14592>>4		lelong 		0x9		256 CLUT Entries at
14593>>12		leshort		x		(%d,
14594>>14		leshort		x		\b%d)
14595>4		lelong		^8
14596>>12		leshort		x		Pixel at (%d,
14597>>14		leshort		x		\b%d)
14598>>16		leshort		x		Size=%dx
14599>>18		leshort		x		\b%d
14600
14601# MDEC streams
146020		lelong		0x80010160	MDEC video stream,
14603>16		leshort		x		%dx
14604>18		leshort		x		\b%d
14605#>8		lelong		x		%d frames
14606#>4		leshort		x		secCount=%d;
14607#>6		leshort		x		nSectors=%d;
14608#>12		lelong		x		frameSize=%d;
14609
14610# BS encoded bitstreams
146112		leshort		0x3800		BS image,
14612>6		leshort		x		Version %d,
14613>4		leshort		x		Quantization %d,
14614>0		leshort		x		(Decompresses to %d words)
14615
14616# Type: farbfeld image.
14617# Url: http://tools.suckless.org/farbfeld/
14618# From: Ian D. Scott <ian@iandouglasscott.com>
14619#
146200		string		farbfeld	farbfeld image data,
14621>8		ubelong		x		%dx
14622>12		ubelong		x		\b%d
14623
14624# Type: Sega PVR image.
14625# From: David Korth <gerbilsoft@gerbilsoft.com>
14626# References:
14627# - http://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
14628# - https://github.com/yazgoo/pvrx2png
14629# - https://github.com/nickworonekin/puyotools
14630
14631# Sega PVR header.
146320	name	sega-pvr-image-header
14633>0x0C	leshort	x	%d x
14634>0x0E	leshort	x	%d
14635# Image format.
14636>0x08	byte	0	\b, ARGB1555
14637>0x08	byte	1	\b, RGB565
14638>0x08	byte	2	\b, ARGB4444
14639>0x08	byte	3	\b, YUV442
14640>0x08	byte	4	\b, Bump
14641>0x08	byte	5	\b, 4bpp
14642>0x08	byte	6	\b, 8bpp
14643# Image data type.
14644>0x09	byte	0x01	\b, square twiddled
14645>0x09	byte	0x02	\b, square twiddled & mipmap
14646>0x09	byte	0x03	\b, VQ
14647>0x09	byte	0x04	\b, VQ & mipmap
14648>0x09	byte	0x05	\b, 8-bit CLUT twiddled
14649>0x09	byte	0x06	\b, 4-bit CLUT twiddled
14650>0x09	byte	0x07	\b, 8-bit direct twiddled
14651>0x09	byte	0x08	\b, 4-bit direct twiddled
14652>0x09	byte	0x09	\b, rectangle
14653>0x09	byte	0x0B	\b, rectangular stride
14654>0x09	byte	0x0D	\b, rectangular twiddled
14655>0x09	byte	0x10	\b, small VQ
14656>0x09	byte	0x11	\b, small VQ & mipmap
14657>0x09	byte	0x12	\b, square twiddled & mipmap
14658
14659# Sega PVR (Xbox) image header.
14660# Contains an embedded DirectDraw surface instead of PVR data.
146610	name	sega-pvr-xbox-dds-header
14662>16	lelong	x	%d x
14663>12	lelong	x	%d,
14664>84	string	x	%.4s
14665
14666# Sega PVR image.
146670	string	PVRT
14668>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
14669>>0x20	use	sega-pvr-xbox-dds-header
14670>0x10	belong	!0x44445320		Sega PVR image:
14671>>0	use	sega-pvr-image-header
14672
14673# Sega PVR image with GBIX.
146740	string	GBIX
14675>0x10	string	PVRT
14676>>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
14677>>>0x20	use	sega-pvr-xbox-dds-header
14678>>0x10	belong	!0x44445320		Sega PVR image:
14679>>>0x10	use	sega-pvr-image-header
14680>>0x08	lelong	x	\b, global index = %u
14681
14682# Sega GVR header.
146830	name	sega-gvr-image-header
14684>0x0C	beshort	x	%d x
14685>0x0E	beshort	x	%d
14686# Image data format.
14687>0x0B	byte	0	\b, I4
14688>0x0B	byte	1	\b, I8
14689>0x0B	byte	2	\b, IA4
14690>0x0B	byte	3	\b, IA8
14691>0x0B	byte	4	\b, RGB565
14692>0x0B	byte	5	\b, RGB5A3
14693>0x0B	byte	6	\b, ARGB8888
14694>0x0B	byte	8	\b, CI4
14695>0x0B	byte	9	\b, CI8
14696>0x0B	byte	14	\b, DXT1
14697
14698# Sega GVR image.
146990	string	GVRT	Sega GVR image:
14700>0x10	use	sega-gvr-image-header
14701
14702# Sega GVR image with GBIX.
147030	string	GBIX
14704>0x10	string	GVRT	Sega GVR image:
14705>>0x10	use	sega-gvr-image-header
14706>>0x08	belong	x	\b, global index = %u
14707
14708# Light Field Picture
14709# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
14710# Typical file extensions: .lfp .lfr .lfx
14711
147120	belong	0x894C4650
14713>4	belong	0x0D0A1A0A
14714>12	belong	0x00000000	Lytro Light Field Picture
14715>8	belong	x		\b, version %d
14716
14717#------------------------------------------------------------------------------
14718# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
14719# inform:  file(1) magic for Inform interactive fiction language
14720
14721# URL:  http://www.inform-fiction.org/
14722# From: Reuben Thomas <rrt@sc3d.org>
14723
147240	search/100/cW	constant\ story		Inform source text
14725
14726#------------------------------------------------------------------------------
14727# $File: intel,v 1.15 2017/03/17 21:35:28 christos Exp $
14728# intel:  file(1) magic for x86 Unix
14729#
14730# Various flavors of x86 UNIX executable/object (other than Xenix, which
14731# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
14732# Windows as well.
14733#
14734# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
14735# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
14736# as well, if, as, and when IBM makes it portable.
14737#
14738# The `versions' should be un-commented if they work for you.
14739# (Was the problem just one of endianness?)
14740#
147410	leshort		0502		basic-16 executable
14742>12	lelong		>0		not stripped
14743#>22	leshort		>0		- version %d
147440	leshort		0503		basic-16 executable (TV)
14745>12	lelong		>0		not stripped
14746#>22	leshort		>0		- version %d
147470	leshort		0510		x86 executable
14748>12	lelong		>0		not stripped
147490	leshort		0511		x86 executable (TV)
14750>12	lelong		>0		not stripped
147510	leshort		=0512		iAPX 286 executable small model (COFF)
14752>12	lelong		>0		not stripped
14753#>22	leshort		>0		- version %d
147540	leshort		=0522		iAPX 286 executable large model (COFF)
14755>12	lelong		>0		not stripped
14756#>22	leshort		>0		- version %d
14757# updated by Joerg Jenderek at Oct 2015
14758# https://de.wikipedia.org/wiki/Common_Object_File_Format
14759# http://www.delorie.com/djgpp/doc/coff/filhdr.html
14760# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
14761# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
14762# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
147630	leshort		=0514
14764# use subroutine to display name+flags+variables for common object formated files
14765>0	use				display-coff
14766#>12	lelong		>0		not stripped
14767# no hint found, that at offset 22 is version
14768#>22	leshort		>0		- version %d
14769
14770# rom: file(1) magic for BIOS ROM Extensions found in intel machines
14771#      mapped into memory between 0xC0000 and 0xFFFFF
14772# From Gurkan Sengun <gurkan@linuks.mine.nu>, www.linuks.mine.nu
14773# updated by Joerg Jenderek
14774# https://en.wikipedia.org/wiki/Option_ROM
147750        beshort         0x55AA       BIOS (ia32) ROM Ext.
14776!:mime	application/octet-stream
14777!:ext	rom/bin
14778>5       string          USB          USB
14779>7       string          LDR          UNDI image
14780>30      string          IBM          IBM comp. Video
14781>26      string          Adaptec      Adaptec
14782>28      string          Adaptec      Adaptec
14783>42      string          PROMISE      Promise
14784>2       byte            x            (%d*512)
14785
14786# Flash descriptors for Intel SPI flash roms.
14787# From Dr. Jesus <j@hug.gs>
147880	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
1478916	lelong		0x0ff0a55a	Intel serial flash for PCH ROM
14790
14791#------------------------------------------------------------------------------
14792# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
14793# interleaf:  file(1) magic for InterLeaf TPS:
14794#
147950	string		=\210OPS	Interleaf saved data
147960	string		=<!OPS		Interleaf document text
14797>5	string		,\ Version\ =	\b, version
14798>>17	string		>\0		%.3s
14799
14800#------------------------------------------------------------------------------
14801# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
14802# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
14803# "/etc/magic":
14804# From: guy@netapp.com (Guy Harris)
14805#
148064	string		pgscriptver	IslandWrite document
1480713	string		DrawFile	IslandDraw document
14808
14809
14810#------------------------------------------------------------------------------
14811# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
14812# ispell:  file(1) magic for ispell
14813#
14814# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
14815# will match 0x9600 through 0x9603 in *both* little endian and big endian.
14816# (No other current magic entries collide.)
14817#
14818# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
14819#
148200	leshort&0xFFFC	0x9600		little endian ispell
14821>0	byte		0		hash file (?),
14822>0	byte		1		3.0 hash file,
14823>0	byte		2		3.1 hash file,
14824>0	byte		3		hash file (?),
14825>2	leshort		0x00		8-bit, no capitalization, 26 flags
14826>2	leshort		0x01		7-bit, no capitalization, 26 flags
14827>2	leshort		0x02		8-bit, capitalization, 26 flags
14828>2	leshort		0x03		7-bit, capitalization, 26 flags
14829>2	leshort		0x04		8-bit, no capitalization, 52 flags
14830>2	leshort		0x05		7-bit, no capitalization, 52 flags
14831>2	leshort		0x06		8-bit, capitalization, 52 flags
14832>2	leshort		0x07		7-bit, capitalization, 52 flags
14833>2	leshort		0x08		8-bit, no capitalization, 128 flags
14834>2	leshort		0x09		7-bit, no capitalization, 128 flags
14835>2	leshort		0x0A		8-bit, capitalization, 128 flags
14836>2	leshort		0x0B		7-bit, capitalization, 128 flags
14837>2	leshort		0x0C		8-bit, no capitalization, 256 flags
14838>2	leshort		0x0D		7-bit, no capitalization, 256 flags
14839>2	leshort		0x0E		8-bit, capitalization, 256 flags
14840>2	leshort		0x0F		7-bit, capitalization, 256 flags
14841>4	leshort		>0		and %d string characters
148420	beshort&0xFFFC	0x9600		big endian ispell
14843>1	byte		0		hash file (?),
14844>1	byte		1		3.0 hash file,
14845>1	byte		2		3.1 hash file,
14846>1	byte		3		hash file (?),
14847>2	beshort		0x00		8-bit, no capitalization, 26 flags
14848>2	beshort		0x01		7-bit, no capitalization, 26 flags
14849>2	beshort		0x02		8-bit, capitalization, 26 flags
14850>2	beshort		0x03		7-bit, capitalization, 26 flags
14851>2	beshort		0x04		8-bit, no capitalization, 52 flags
14852>2	beshort		0x05		7-bit, no capitalization, 52 flags
14853>2	beshort		0x06		8-bit, capitalization, 52 flags
14854>2	beshort		0x07		7-bit, capitalization, 52 flags
14855>2	beshort		0x08		8-bit, no capitalization, 128 flags
14856>2	beshort		0x09		7-bit, no capitalization, 128 flags
14857>2	beshort		0x0A		8-bit, capitalization, 128 flags
14858>2	beshort		0x0B		7-bit, capitalization, 128 flags
14859>2	beshort		0x0C		8-bit, no capitalization, 256 flags
14860>2	beshort		0x0D		7-bit, no capitalization, 256 flags
14861>2	beshort		0x0E		8-bit, capitalization, 256 flags
14862>2	beshort		0x0F		7-bit, capitalization, 256 flags
14863>4	beshort		>0		and %d string characters
14864# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
14865# Ispell 4.0
148660       string          ISPL            ispell
14867>4      long            x               hash file version %d,
14868>8      long            x               lexletters %d,
14869>12     long            x               lexsize %d,
14870>16     long            x               hashsize %d,
14871>20     long            x               stblsize %d
14872
14873#------------------------------------------------------------------------------
14874# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $
14875# ISO Zipped file format
14876# http://www.ezbsystems.com/isz/iszspec.txt
148770	string	IsZ!	ISO Zipped file
14878>4	byte	x	\b, header size %u
14879>5	byte	x	\b, version %u
14880>8	lelong	x	\b, serial %u
14881#12	leshort	x	\b, sector size %u
14882#>16	lelong	x	\b, total sectors %u
14883>17	byte	>0	\b, password protected
14884#>24	lequad	x	\b, segment size %llu
14885#>32	lelong	x	\b, blocks %u
14886#>36	lelong	x	\b, block size %u
14887
14888#------------------------------------------------------------
14889# $File: java,v 1.18 2015/11/29 22:08:14 christos Exp $
14890# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
14891# same magic number, 0xcafebabe, so they are both handled
14892# in the entry called "cafebabe".
14893#------------------------------------------------------------
14894# Java serialization
14895# From Martin Pool (m.pool@pharos.com.au)
148960	beshort		0xaced		Java serialization data
14897>2	beshort		>0x0004		\b, version %d
14898
148990	belong		0xfeedfeed	Java KeyStore
14900!:mime	application/x-java-keystore
149010	belong		0xcececece	Java JCE KeyStore
14902!:mime	application/x-java-jce-keystore
14903
14904# Java source
149050	regex	\^import.*;$	Java source
14906!:mime	text/x-java
14907
14908# Java HPROF dumps
14909# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
149100	string		JAVA\x20PROFILE\x201.0.
14911>0x12	short		0
14912>>0x11	ushort-0x31	<2      Java HPROF dump,
14913>>0x17	beqdate/1000	x       created %s
14914
14915#------------------------------------------------------------------------------
14916# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $
14917# javascript:  magic for javascript and node.js scripts.
14918#
149190	search/1/w	#!/bin/node		Node.js script text executable
14920!:mime application/javascript
149210	search/1/w	#!/usr/bin/node		Node.js script text executable
14922!:mime application/javascript
149230	search/1/w	#!/bin/nodejs		Node.js script text executable
14924!:mime application/javascript
149250	search/1/w	#!/usr/bin/nodejs	Node.js script text executable
14926!:mime application/javascript
149270	search/1	#!/usr/bin/env\ node	Node.js script text executable
14928!:mime application/javascript
149290	search/1	#!/usr/bin/env\ nodejs	Node.js script text executable
14930!:mime application/javascript
14931
14932#------------------------------------------------------------------------------
14933# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $
14934# JPEG images
14935# SunOS 5.5.1 had
14936#
14937#	0	string		\377\330\377\340	JPEG file
14938#	0	string		\377\330\377\356	JPG file
14939#
14940# both of which turn into "JPEG image data" here.
14941#
149420	beshort		0xffd8		JPEG image data
14943!:mime	image/jpeg
14944!:apple	8BIMJPEG
14945!:strength *3
14946!:ext jpeg/jpg/jpe/jfif
14947>6	string		JFIF		\b, JFIF standard
14948# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
14949# in a vain attempt to add image size reporting for JFIF.  Note that these
14950# tests are not fool-proof since some perfectly valid JPEGs are currently
14951# impossible to specify in magic(4) format.
14952# First, a little JFIF version info:
14953>>11	byte		x		\b %d.
14954>>12	byte		x		\b%02d
14955# Next, the resolution or aspect ratio of the image:
14956>>13	byte		0		\b, aspect ratio
14957>>13	byte		1		\b, resolution (DPI)
14958>>13	byte		2		\b, resolution (DPCM)
14959>>14	beshort		x		\b, density %dx
14960>>16	beshort		x		\b%d
14961>>4	beshort		x		\b, segment length %d
14962# Next, show thumbnail info, if it exists:
14963>>18	byte		!0		\b, thumbnail %dx
14964>>>19	byte		x		\b%d
14965>6	string		Exif		\b, Exif standard: [
14966>>12	indirect/r	x
14967>>12	string		x		\b]
14968
14969# Jump to the first segment
14970>(4.S+4)	use		jpeg_segment
14971
14972# This uses recursion...
149730		name		jpeg_segment
14974>0	beshort		0xFFFE
14975# Recursion handled by FFE0
14976#>>(2.S+2)	use			jpeg_segment
14977>>2	pstring/HJ	x		\b, comment: "%s"
14978
14979>0	beshort		0xFFC0
14980>>(2.S+2)	use			jpeg_segment
14981>>4	byte		x		\b, baseline, precision %d
14982>>7	beshort		x		\b, %dx
14983>>5	beshort		x		\b%d
14984>>9	byte		x		\b, frames %d
14985
14986>0	beshort		0xFFC1
14987>>(2.S+2)	use			jpeg_segment
14988>>4	byte		x		\b, extended sequential, precision %d
14989>>7	beshort		x		\b, %dx
14990>>5	beshort		x		\b%d
14991>>9	byte		x		\b, frames %d
14992
14993>0	beshort		0xFFC2
14994>>(2.S+2)	use			jpeg_segment
14995>>4	byte		x		\b, progressive, precision %d
14996>>7	beshort		x		\b, %dx
14997>>5	beshort		x		\b%d
14998>>9	byte		x		\b, frames %d
14999
15000# Define Huffman Tables
15001>0	beshort		0xFFC4
15002>>(2.S+2)	use			jpeg_segment
15003
15004>0	beshort		0xFFE1
15005# Recursion handled by FFE0
15006#>>(2.S+2)	use			jpeg_segment
15007>>4	string		Exif		\b, Exif Standard: [
15008>>>10	indirect/r	x
15009>>>10	string		x		\b]
15010
15011# Application specific markers
15012>0	beshort&0xFFE0	=0xFFE0
15013>>(2.S+2)	use			jpeg_segment
15014
15015# DB: Define Quantization tables
15016# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
15017# D8: Start of image
15018# D9: End of image
15019# Dn: Restart
15020>0	beshort&0xFFD0	=0xFFD0
15021>>0	beshort&0xFFE0	!0xFFE0
15022>>>(2.S+2)	use			jpeg_segment
15023
15024#>0	beshort		x		unknown 0x%x
15025#>>(2.S+2)	use			jpeg_segment
15026
15027# HSI is Handmade Software's proprietary JPEG encoding scheme
150280	string		hsi1		JPEG image data, HSI proprietary
15029
15030# From: David Santinoli <david@santinoli.com>
150310	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
15032# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
15033# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
15034# https://github.com/bitsgalore/jp2kMagic
15035#
15036# Now read value of 'Brand' field, which yields a few possibilities:
15037>20	string		\x6a\x70\x32\x20	Part 1 (JP2)
15038!:mime	image/jp2
15039>20	string		\x6a\x70\x78\x20	Part 2 (JPX)
15040!:mime	image/jpx
15041>20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
15042!:mime	image/jpm
15043>20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
15044!:mime	video/mj2
15045
15046# Type: JPEG 2000 codesream
15047# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
150480	belong		0xff4fff51						JPEG 2000 codestream
1504945	beshort		0xff52
15050
15051# JPEG extended range
150520	string		\x49\x49\xbc
15053>3	byte		1
15054>>4	lelong%2	0	JPEG-XR
15055!:mime	image/jxr
15056!:ext	jxr
15057
15058#------------------------------------------------------------------------------
15059# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $
15060# karma:  file(1) magic for Karma data files
15061#
15062# From <rgooch@atnf.csiro.au>
15063
150640	string	KarmaRHD\040Version	Karma Data Structure Version
15065>16	belong		x		%u
15066
15067#------------------------------------------------------------------------------
15068# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
15069# kde:  file(1) magic for KDE
15070
150710		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
15072!:mime	application/x-kdelnk
150730		string/t	#\ KDE\ Config\ File	KDE config file
15074!:mime	application/x-kdelnk
150750		string/t	#\ xmcd	xmcd database file for kscd
15076!:mime	text/x-xmcd
15077
15078#------------------------------------------------------------------------------
15079# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $
15080# keepass: file(1) magic for KeePass file
15081#
15082# Keepass Password Safe:
15083#  * original one: http://keepass.info/
15084#  * *nix port:    http://www.keepassx.org/
15085#  * android port: http://code.google.com/p/keepassdroid/
15086
150870	lelong		0x9AA2D903	Keepass password database
15088>4	lelong		0xB54BFB65	1.x KDB
15089>>48	lelong		>0		\b, %d groups
15090>>52	lelong		>0		\b, %d entries
15091>>8	lelong&0x0f	1		\b, SHA-256
15092>>8	lelong&0x0f	2		\b, AES
15093>>8	lelong&0x0f	4		\b, RC4
15094>>8	lelong&0x0f	8		\b, Twofish
15095>>120	lelong		>0		\b, %d key transformation rounds
15096>4	lelong		0xB54BFB67	2.x KDBX
15097
15098#------------------------------------------------------------------------------
15099# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $
15100# kerberos: MIT kerberos file binary formats
15101#
15102
15103# This magic entry is for demonstration purposes and could be improved
15104# if the following features were implemented in file:
15105#
15106# Strings inside [[ .. ]] in the descriptions have special meanings and
15107# are not printed.
15108#
15109# 	- Provide some form of iteration in number of components
15110#		[[${counter}=%d]] in the description
15111#		then append
15112#		[${counter}--] in the offset of the entries
15113#	- Provide a way to round the next offset
15114#		Add [R:4] after the offset?
15115#	- Provide a way to have optional entries
15116#		XXX: Syntax:
15117#	- Provide a way to "save" entries to print them later.
15118#		if the description is [[${name}=%s]], then nothing is
15119#		printed and a subsequent entry in the same magic file
15120#		can refer to ${name}
15121#	- Provide a way to format strings as hex values
15122#
15123# http://www.gnu.org/software/shishi/manual/html_node/\
15124#	The-Keytab-Binary-File-Format.html
15125#
15126
151270		name		keytab_entry
15128#>0		beshort		x		\b, size=%d
15129#>2		beshort		x		\b, components=%d
15130>4		pstring/H	x		\b, realm=%s
15131>>&0		pstring/H	x		\b, principal=%s/
15132>>>&0		pstring/H	x		\b%s
15133>>>>&0		belong		x		\b, type=%d
15134>>>>>&0		bedate		x		\b, date=%s
15135>>>>>>&0	byte		x		\b, kvno=%u
15136#>>>>>>>&0	pstring/H	x
15137#>>>>>>>>&0	belong		x
15138#>>>>>>>>>>&0	use		keytab_entry
15139
151400		belong		0x05020000	Kerberos Keytab file
15141>4		use		keytab_entry
15142
15143#------------------------------------------------------------------------------
15144# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $
15145# Type: Google KML, formerly Keyhole Markup Language
15146# Future development of this format has been handed
15147# over to the Open Geospatial Consortium.
15148# http://www.opengeospatial.org/standards/kml/
15149# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
151500 string/t    \<?xml
15151>20  search/400 \ xmlns=
15152>>&0 regex ['"]http://earth.google.com/kml Google KML document
15153!:mime application/vnd.google-earth.kml+xml
15154>>>&1 string 2.0' \b, version 2.0
15155>>>&1 string 2.1' \b, version 2.1
15156>>>&1 string 2.2' \b, version 2.2
15157
15158#------------------------------------------------------------------------------
15159# Type: OpenGIS KML, formerly Keyhole Markup Language
15160# This standard is maintained by the
15161# Open Geospatial Consortium.
15162# http://www.opengeospatial.org/standards/kml/
15163# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
15164>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
15165!:mime application/vnd.google-earth.kml+xml
15166>>>&1 string/t 2.2 \b, version 2.2
15167
15168#------------------------------------------------------------------------------
15169# Type: Google KML Archive (ZIP based)
15170# http://code.google.com/apis/kml/documentation/kml_tut.html
15171# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
151720 string    PK\003\004
15173>4  byte    0x14
15174>>30  string doc.kml Compressed Google KML Document, including resources.
15175!:mime application/vnd.google-earth.kmz
15176
15177#------------------------------------------------------------------------------
15178# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
15179# DEC SRC Virtual Paper: Lectern files
15180# Karl M. Hegbloom <karlheg@inetarena.com>
151810	string	lect	DEC SRC Virtual Paper Lectern file
15182
15183#------------------------------------------------------------------------------
15184# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
15185# lex:  file(1) magic for lex
15186#
15187#	derived empirically, your offsets may vary!
151880	search/100	yyprevious	C program text (from lex)
15189>3	search/1	>\0		 for %s
15190# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
151910	search/100	generated\ by\ flex	C program text (from flex)
15192# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
151930	search/1	%{		lex description text
15194
15195#------------------------------------------------------------------------------
15196# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
15197# lif:  file(1) magic for lif
15198#
15199# (Daniel Quinlan <quinlan@yggdrasil.com>)
15200#
152010	beshort		0x8000		lif file
15202
15203#------------------------------------------------------------------------------
15204# $File: linux,v 1.64 2017/03/17 21:35:28 christos Exp $
15205# linux:  file(1) magic for Linux files
15206#
15207# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
15208# The following basic Linux magic is useful for reference, but using
15209# "long" magic is a better practice in order to avoid collisions.
15210#
15211# 2	leshort		100		Linux/i386
15212# >0	leshort		0407		impure executable (OMAGIC)
15213# >0	leshort		0410		pure executable (NMAGIC)
15214# >0	leshort		0413		demand-paged executable (ZMAGIC)
15215# >0	leshort		0314		demand-paged executable (QMAGIC)
15216#
152170	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
15218>16	lelong		0		\b, stripped
152190	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
15220>16	lelong		0		\b, stripped
152210	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
15222>16	lelong		0		\b, stripped
152230	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
15224>16	lelong		0		\b, stripped
15225#
152260	string		\007\001\000	Linux/i386 object file
15227>20	lelong		>0x1020		\b, DLL library
15228# Linux-8086 stuff:
152290	string		\01\03\020\04	Linux-8086 impure executable
15230>28	long		!0		not stripped
152310	string		\01\03\040\04	Linux-8086 executable
15232>28	long		!0		not stripped
15233#
152340	string		\243\206\001\0	Linux-8086 object file
15235#
152360	string		\01\03\020\20	Minix-386 impure executable
15237>28	long		!0		not stripped
152380	string		\01\03\040\20	Minix-386 executable
15239>28	long		!0		not stripped
152400	string		\01\03\04\20	Minix-386 NSYM/GNU executable
15241>28	long		!0		not stripped
15242# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
15243216	lelong		0421		Linux/i386 core file
15244!:strength / 2
15245>220	string		>\0		of '%s'
15246>200	lelong		>0		(signal %d)
15247#
15248# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
15249# this can be overridden by the DOS executable (COM) entry
152502	string		LILO		Linux/i386 LILO boot/chain loader
15251#
15252# Linux make config build file, from Ole Aamot <oka@oka.no>
15253# Updated by Ken Sharp
1525428	string		make\ config		Linux make config build file (old)
1525549	search/70	Kernel\ Configuration	Linux make config build file
15256
15257#
15258# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
15259# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
15260# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
152610	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
15262>2	byte&0x01	0		256 characters,
15263>2	byte&0x01	!0		512 characters,
15264>2	byte&0x02	0		no directory,
15265>2	byte&0x02	!0		Unicode directory,
15266>3	byte		>0		8x%d
152670	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
15268>16	lelong		x		%d characters,
15269>12	lelong&0x01	0		no directory,
15270>12	lelong&0x01	!0		Unicode directory,
15271>24	lelong		x		%d
15272>28	lelong		x		\bx%d
15273
15274# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
152754086	string		SWAP-SPACE	Linux/i386 swap file
15276# From: Jeff Bailey <jbailey@ubuntu.com>
15277# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
152784076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
15279# From: James Hunt <james.hunt@ubuntu.com>
152804076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
15281# according to man page of mkswap (8) March 1999
15282# volume label and UUID Russell Coker
15283# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
152844086	string		SWAPSPACE2	Linux/i386 swap file (new style),
15285>0x400	long		x		version %d (4K pages),
15286>0x404	long		x		size %d pages,
15287>1052	string		\0		no label,
15288>1052	string		>\0		LABEL=%s,
15289>0x40c	belong		x		UUID=%08x
15290>0x410	beshort		x		\b-%04x
15291>0x412	beshort		x		\b-%04x
15292>0x414	beshort		x		\b-%04x
15293>0x416	belong		x		\b-%08x
15294>0x41a	beshort		x		\b%04x
15295# From Daniel Novotny <dnovotny@redhat.com>
15296# swap file for PowerPC
1529765526	string		SWAPSPACE2	Linux/ppc swap file
1529816374	string		SWAPSPACE2	Linux/ia64 swap file
15299#
15300# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
15301# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
15302# and Nicolas Lichtmaier <nick@debian.org>
15303# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
15304# Linux kernel boot images (i386 arch) (Wolfram Kleff)
15305514	string		HdrS		Linux kernel
15306!:strength + 55
15307>510	leshort		0xAA55		x86 boot executable
15308>>518	leshort		>0x1ff
15309>>>529	byte		0		zImage,
15310>>>529	byte		1		bzImage,
15311>>>526	lelong		>0
15312>>>>(526.s+0x200) string	>\0	version %s,
15313>>498	leshort		1		RO-rootFS,
15314>>498	leshort		0		RW-rootFS,
15315>>508	leshort		>0		root_dev 0x%X,
15316>>502	leshort		>0		swap_dev 0x%X,
15317>>504	leshort		>0		RAMdisksize %u KB,
15318>>506	leshort		0xFFFF		Normal VGA
15319>>506	leshort		0xFFFE		Extended VGA
15320>>506	leshort		0xFFFD		Prompt for Videomode
15321>>506	leshort		>0		Video mode %d
15322# This also matches new kernels, which were caught above by "HdrS".
153230		belong	0xb8c0078e	Linux kernel
15324>0x1e3		string	Loading		version 1.3.79 or older
15325>0x1e9		string	Loading		from prehistoric times
15326
15327# System.map files - Nicolas Lichtmaier <nick@debian.org>
153288	search/1	\ A\ _text	Linux kernel symbol map text
15329
15330# LSM entries - Nicolas Lichtmaier <nick@debian.org>
153310	search/1	Begin3	Linux Software Map entry text
153320	search/1	Begin4	Linux Software Map entry text (new format)
15333
15334# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
153350	belong	0x4f4f4f4d	User-mode Linux COW file
15336>4	belong	<3		\b, version %d
15337>>8	string	>\0		\b, backing file %s
15338>4	belong	>2		\b, version %d
15339>>32	string	>\0		\b, backing file %s
15340
15341############################################################################
15342# Linux kernel versions
15343
153440		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
15345>497		leshort		0		x86 boot sector
15346>>514		belong		0x8e	of a kernel from the dawn of time!
15347>>514		belong		0x908ed8b4	version 0.99-1.1.42
15348>>514		belong		0x908ed8b8	for memtest86
15349
15350>497		leshort		!0		x86 kernel
15351>>504		leshort		>0		RAMdisksize=%u KB
15352>>502		leshort		>0		swap=0x%X
15353>>508		leshort		>0		root=0x%X
15354>>>498		leshort		1		\b-ro
15355>>>498		leshort		0		\b-rw
15356>>506		leshort		0xFFFF		vga=normal
15357>>506		leshort		0xFFFE		vga=extended
15358>>506		leshort		0xFFFD		vga=ask
15359>>506		leshort		>0		vga=%d
15360>>514		belong		0x908ed881	version 1.1.43-1.1.45
15361>>514		belong		0x15b281cd
15362>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
15363>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
15364>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
15365>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
15366>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
15367>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
15368>>514		string		HdrS
15369>>>518		leshort		>0x1FF
15370>>>>529		byte		0		\b, zImage
15371>>>>529		byte		1		\b, bzImage
15372>>>>(526.s+0x200) string 	>\0		\b, version %s
15373
15374# Linux boot sector thefts.
153750		belong		0xb8c0078e	Linux
15376>0x1e6		belong		0x454c4b53	ELKS Kernel
15377>0x1e6		belong		!0x454c4b53	style boot sector
15378
15379############################################################################
15380# Linux S390 kernel image
15381# Created by: Jan Kaluza <jkaluza@redhat.com>
153828 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
15383>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
15384# 64bit
15385>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
15386>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
15387>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
15388>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
15389# 32bit
15390>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
15391>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
15392>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
15393>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
15394
15395# Linux ARM compressed kernel image
15396# From: Kevin Cernekee <cernekee@gmail.com>
1539736	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
1539836	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
15399
15400############################################################################
15401# Linux 8086 executable
154020	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
15403>5	string		.
15404>>4	string		>\0		\b, libc version %s
15405
154060	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
15407>2	byte&0x01	!0		\b, unmapped zero page
15408>2	byte&0x20	0		\b, impure
15409>2	byte&0x20	!0
15410>>2	byte&0x10	!0		\b, A_EXEC
15411>2	byte&0x02	!0		\b, A_PAL
15412>2	byte&0x04	!0		\b, A_NSYM
15413>2	byte&0x08	!0		\b, A_STAND
15414>2	byte&0x40	!0		\b, A_PURE
15415>2	byte&0x80	!0		\b, A_TOVLY
15416>28     long            !0              \b, not stripped
15417>37	string		.
15418>>36	string		>\0		\b, libc version %s
15419
15420# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
15421# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
15422# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
15423# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
15424
15425# SYSLINUX boot logo files (from 'ppmtolss16' sources)
15426# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
15427# file extension .lss .16
154280	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
15429# syslinux-4.05/mime/image/x-lss16.xml
15430!:mime image/x-lss16
15431>4	leshort	x			\b, width %d
15432>6	leshort	x			\b, height %d
15433
154340	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
15435>4	belong	x			version %d
15436
15437# SE Linux policy database
15438# From: Mike Frysinger <vapier@gentoo.org>
154390	lelong	0xf97cff8c		SE Linux policy
15440>16	lelong	x			v%d
15441>20	lelong	1			MLS
15442>24	lelong	x			%d symbols
15443>28	lelong	x			%d ocons
15444
15445# Linux Logical Volume Manager (LVM)
15446# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
15447#
15448# System ID, UUID and volume group name are 128 bytes long
15449# but they should never be full and initialized with zeros...
15450#
15451# LVM1
15452#
154530x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
15454>0x12c	string	>\0		, System ID: %s
15455
154560x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
15457>0x12c	string	>\0		, System ID: %s
15458
15459#  LVM2
15460#
15461# It seems that the label header can be in one the four first sector
15462# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
15463#
15464# 0x200 seems to be the common case
15465
154660x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
15467# read the offset to add to the start of the header, and the header
15468# start in 0x200
15469>&(&-12.l-0x21) byte    x
15470# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
15471>>&0x0          string  >\x2f          \b, UUID: %.6s
15472>>&0x6          string  >\x2f          \b-%.4s
15473>>&0xa          string  >\x2f          \b-%.4s
15474>>&0xe          string  >\x2f          \b-%.4s
15475>>&0x12         string  >\x2f          \b-%.4s
15476>>&0x16         string  >\x2f          \b-%.4s
15477>>&0x1a         string  >\x2f          \b-%.6s
15478>>&0x20         lequad  x              \b, size: %lld
15479
154800x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
15481>&(&-12.l-0x21) byte    x
15482# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
15483>>&0x0          string  >\x2f          \b, UUID: %.6s
15484>>&0x6          string  >\x2f          \b-%.4s
15485>>&0xa          string  >\x2f          \b-%.4s
15486>>&0xe          string  >\x2f          \b-%.4s
15487>>&0x12         string  >\x2f          \b-%.4s
15488>>&0x16         string  >\x2f          \b-%.4s
15489>>&0x1a         string  >\x2f          \b-%.6s
15490>>&0x20         lequad  x              \b, size: %lld
15491
154920x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
15493>&(&-12.l-0x21) byte    x
15494# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
15495>>&0x0          string  >\x2f          \b, UUID: %.6s
15496>>&0x6          string  >\x2f          \b-%.4s
15497>>&0xa          string  >\x2f          \b-%.4s
15498>>&0xe          string  >\x2f          \b-%.4s
15499>>&0x12         string  >\x2f          \b-%.4s
15500>>&0x16         string  >\x2f          \b-%.4s
15501>>&0x1a         string  >\x2f          \b-%.6s
15502>>&0x20         lequad  x              \b, size: %lld
15503
155040x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
15505>&(&-12.l-0x21) byte    x
15506# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
15507>>&0x0          string  >\x2f          \b, UUID: %.6s
15508>>&0x6          string  >\x2f          \b-%.4s
15509>>&0xa          string  >\x2f          \b-%.4s
15510>>&0xe          string  >\x2f          \b-%.4s
15511>>&0x12         string  >\x2f          \b-%.4s
15512>>&0x16         string  >\x2f          \b-%.4s
15513>>&0x1a         string  >\x2f          \b-%.6s
15514>>&0x20         lequad  x              \b, size: %lld
15515
15516# LVM snapshot
15517# from Jason Farrel
155180	string	SnAp	LVM Snapshot (CopyOnWrite store)
15519>4	lelong	!0	- valid,
15520>4	lelong	0	- invalid,
15521>8	lelong	x	version %d,
15522>12	lelong	x	chunk_size %d
15523
15524# SE Linux policy database
155250	lelong	0xf97cff8c		SE Linux policy
15526>16	lelong	x			v%d
15527>20	lelong	1			MLS
15528>24	lelong	x			%d symbols
15529>28	lelong	x			%d ocons
15530
15531# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
15532# Anthon van der Neut (anthon@mnt.org)
155330	string	LUKS\xba\xbe	LUKS encrypted file,
15534>6	beshort x		ver %d
15535>8	string	x		[%s,
15536>40	string	x		%s,
15537>72	string	x		%s]
15538>168	string	x		UUID: %s
15539
15540
15541# Summary: Xen saved domain file
15542# Created by: Radek Vokal <rvokal@redhat.com>
155430	string		LinuxGuestRecord	Xen saved domain
15544>20	search/256	(name
15545>>&1	string		x			(name %s)
15546
15547# Type: Xen, the virtual machine monitor
15548# From: Radek Vokal <rvokal@redhat.com>
155490	string		LinuxGuestRecord	Xen saved domain
15550#>2	regex		\(name\ [^)]*\)		%s
15551>20	search/256	(name			(name
15552>>&1	string		x			%s...)
15553
15554# Systemd journald files
15555# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/.
15556# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
15557
15558# check magic
155590	string	LPKSHHRH
15560# check that state is one of known values
15561>16		ubyte&252	0
15562# check that each half of three unique id128s is non-zero
15563>>24		ubequad		>0
15564>>>32		ubequad		>0
15565>>>>40		ubequad		>0
15566>>>>>48		ubequad		>0
15567>>>>>>56	ubequad		>0
15568>>>>>>>64	ubequad		>0	Journal file
15569!:mime application/octet-stream
15570# provide more info
15571>>>>>>>>184	leqdate		0	empty
15572>>>>>>>>16	ubyte		0	\b, offline
15573>>>>>>>>16	ubyte		1	\b, online
15574>>>>>>>>16	ubyte		2	\b, archived
15575>>>>>>>>8	ulelong&1	1	\b, sealed
15576>>>>>>>>12	ulelong&1	1	\b, compressed
15577
15578# BCache backing and cache devices
15579# From: Gabriel de Perthuis <g2p.code@gmail.com>
155800x1008		lequad		8
15581>0x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	BCache
15582>>0x1010	ulequad		0	cache device
15583>>0x1010	ulequad		1	backing device
15584>>0x1010	ulequad		3	cache device
15585>>0x1010	ulequad		4	backing device
15586>>0x1048	string		>0	\b, label "%.32s"
15587>>0x1028	ubelong		x	\b, uuid %08x
15588>>0x102c	ubeshort	x	\b-%04x
15589>>0x102e	ubeshort	x	\b-%04x
15590>>0x1030	ubeshort	x	\b-%04x
15591>>0x1032	ubelong		x	\b-%08x
15592>>0x1036	ubeshort	x	\b%04x
15593>>0x1038	ubelong		x	\b, set uuid %08x
15594>>0x103c	ubeshort	x	\b-%04x
15595>>0x103e	ubeshort	x	\b-%04x
15596>>0x1040	ubeshort	x	\b-%04x
15597>>0x1042	ubelong		x	\b-%08x
15598>>0x1046	ubeshort	x	\b%04x
15599
15600# Linux device tree:
15601# File format description can be found in the Linux kernel sources at
15602# Documentation/devicetree/booting-without-of.txt
15603# From Christoph Biedl
156040		belong		0xd00dfeed
15605# structure and strings must be within blob
15606>&(8.L)		byte		x
15607>>&(12.L)	byte		x
15608>>>20		belong		>1	Device Tree Blob version %d
15609>>>>4		belong		x	\b, size=%d
15610>>>>20		belong		>1
15611>>>>>28		belong		x	\b, boot CPU=%d
15612>>>>20		belong		>2
15613>>>>>32		belong		x	\b, string block size=%d
15614>>>>20		belong		>16
15615>>>>>36		belong		x	\b, DT structure block size=%d
15616
15617# glibc locale archive as defined in glibc locale/locarchive.h
156180		lelong		0xde020109	locale archive
15619>24		lelong		x		%d strings
15620
15621# Linux Software RAID (mdadm)
15622# Russell Coker <russell@coker.com.au>
156230	name	linuxraid
15624>16	belong	x		UUID=%8x:
15625>20	belong	x		\b%8x:
15626>24	belong	x		\b%8x:
15627>28	belong	x		\b%8x
15628>32	string	x		name=%s
15629>72	lelong	x		level=%d
15630>92	lelong	x		disks=%d
15631
156324096	lelong	0xa92b4efc	Linux Software RAID
15633>4100	lelong	x		version 1.2 (%d)
15634>4096	use	linuxraid
15635
156360	lelong	0xa92b4efc	Linux Software RAID
15637>4	lelong	x		version 1.1 (%d)
15638>0	use	linuxraid
15639
15640# Summary:     Database file for mlocate
15641# Description: A database file as used by mlocate, a fast implementation
15642#              of locate/updatedb. It uses merging to reuse the existing
15643#              database and avoid rereading most of the filesystem. It's
15644#              the default version of locate on Arch Linux (and others).
15645# File path:   /var/lib/mlocate/mlocate.db by default (but configurable)
15646# Site:        https://fedorahosted.org/mlocate/
15647# Format docs: http://linux.die.net/man/5/mlocate.db
15648# Type: mlocate database file
15649# URL:  https://fedorahosted.org/mlocate/
15650# From: Wander Nauta <info@wandernauta.nl>
156510		string		\0mlocate	mlocate database
15652>12		byte		x		\b, version %d
15653>13		byte		1		\b, require visibility
15654>16		string		x		\b, root %s
15655
15656# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
15657# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
15658# From: Pavel Emelyanov <xemul@parallels.com>
156590		lelong		0x45311224	iproute2 routes dump
156600		lelong		0x47361222	iproute2 addresses dump
15661
15662# Image and service files for CRIU tool.
15663# URL: http://criu.org
15664# From: Pavel Emelyanov <xemul@parallels.com>
156650		lelong		0x54564319	CRIU image file v1.1
156660		lelong		0x55105940	CRIU service file
156670		lelong		0x58313116	CRIU inventory
15668
15669# Kdump compressed dump files
15670# http://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
15671
156720		string		KDUMP          	Kdump compressed dump
15673>8		long		x		v%d
15674>12		string		>\0		\b, system %s
15675>77		string		>\0		\b, node %s
15676>142		string		>\0		\b, release %s
15677>207		string		>\0		\b, version %s
15678>272		string		>\0		\b, machine %s
15679>337		string		>\0		\b, domain %s
15680
15681#------------------------------------------------------------------------------
15682# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $
15683# lisp:  file(1) magic for lisp programs
15684#
15685# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
15686
15687# updated by Joerg Jenderek
15688# GRR: This lot is too weak
15689#0	string	;;
15690# windows INF files often begin with semicolon and use CRLF as line end
15691# lisp files are mainly created on unix system with LF as line end
15692#>2	search/4096	!\r		Lisp/Scheme program text
15693#>2	search/4096	\r		Windows INF file
15694
156950	search/4096	(setq\ 			Lisp/Scheme program text
15696!:mime	text/x-lisp
156970	search/4096	(defvar\ 		Lisp/Scheme program text
15698!:mime	text/x-lisp
156990	search/4096	(defparam\ 		Lisp/Scheme program text
15700!:mime	text/x-lisp
157010	search/4096	(defun\  		Lisp/Scheme program text
15702!:mime	text/x-lisp
157030	search/4096	(autoload\ 		Lisp/Scheme program text
15704!:mime	text/x-lisp
157050	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
15706!:mime	text/x-lisp
15707
15708# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
15709# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
15710# Update: Joerg Jenderek
15711# Emacs 18 - this is always correct, but not very magical.
157120	string	\012(
15713# look for emacs lisp keywords
15714# GRR: split regex because it is too long or get error like
15715# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
15716>&0	regex	\^(defun|defvar|defconst|defmacro|setq|fset)	Emacs v18 byte-compiled Lisp data
15717!:mime	application/x-elc
15718# https://searchcode.com/codesearch/view/2173420/
15719# not really pure text
15720!:apple	EMAxTEXT
15721!:ext elc
15722# remaining regex
15723>&0	regex	\^(put|provide|require|random)	Emacs v18 byte-compiled Lisp data
15724!:mime	application/x-elc
15725!:apple	EMAxTEXT
15726!:ext elc
15727# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;;
15728
15729# Emacs 19+ - ver. recognition added by Ian Springer
15730# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
15731# - Chris Chittleborough <cchittleborough@yahoo.com.au>
15732# Update: Joerg Jenderek
157330	string	;ELC
15734# version\0\0\0
15735>4	byte	>18			Emacs/XEmacs v%d byte-compiled Lisp data
15736# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
15737#>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
15738!:mime	application/x-elc
15739!:apple	EMAxTEXT
15740!:ext elc
15741
15742# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
157430	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program (pre 2004-03-27)
157440	string	(|SYSTEM|::|VERSION|\040'	CLISP byte-compiled Lisp program text
15745
157460	long	0x70768BD2		CLISP memory image data
157470	long	0xD28B7670		CLISP memory image data, other endian
15748
15749#.com and .bin for MIT scheme
157500	string	\372\372\372\372	MIT scheme (library?)
15751
15752# From: David Allouche <david@allouche.net>
157530	search/1	\<TeXmacs|	TeXmacs document text
15754!:mime	text/texmacs
15755
15756#------------------------------------------------------------------------------
15757# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
15758# llvm:  file(1) magic for LLVM byte-codes
15759# URL:  http://llvm.org/docs/BitCodeFormat.html
15760# From: Al Stone <ahs3@fc.hp.com>
15761
157620	string	llvm	LLVM byte-codes, uncompressed
157630	string	llvc0	LLVM byte-codes, null compression
157640	string	llvc1	LLVM byte-codes, gzip compression
157650	string	llvc2	LLVM byte-codes, bzip2 compression
15766
157670	lelong	0x0b17c0de	LLVM bitcode, wrapper
15768# Are these Mach-O ABI values?  They appear to be.
15769>16	lelong	0x01000007	x86_64
15770>16	lelong	0x00000007	i386
15771>16	lelong	0x00000012	ppc
15772>16	lelong	0x01000012	ppc64
15773>16	lelong 	0x0000000c	arm
15774
157750	string	BC\xc0\xde	LLVM IR bitcode
15776
15777#------------------------------------------------------------------------------
15778# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
15779# lua:  file(1) magic for Lua scripting language
15780# URL:  http://www.lua.org/
15781# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
15782
15783# Lua scripts
157840	search/1/w	#!\ /usr/bin/lua	Lua script text executable
15785!:mime	text/x-lua
157860	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
15787!:mime	text/x-lua
157880	search/1	#!/usr/bin/env\ lua	Lua script text executable
15789!:mime	text/x-lua
157900	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
15791!:mime	text/x-lua
15792
15793# Lua bytecode
157940	string		\033Lua			Lua bytecode,
15795>4	byte		0x50			version 5.0
15796>4	byte		0x51			version 5.1
15797>4	byte		0x52			version 5.2
15798
15799#------------------------------------------------------------------------------
15800# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
15801# luks:  file(1) magic for Linux Unified Key Setup
15802# URL:	http://luks.endorphin.org/spec
15803# From:	Anthon van der Neut <anthon@mnt.org>
15804
158050	string		LUKS\xba\xbe	LUKS encrypted file,
15806>6	beshort		x		ver %d
15807>8	string		x		[%s,
15808>40	string		x		%s,
15809>72	string		x		%s]
15810>168	string		x		UUID: %s
15811#------------------------------------------------------------------------------
15812# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $
15813# make:  file(1) magic for M4 scripts
15814#
158150	regex	\^dnl\ 		M4 macro processor script text
15816!:mime	text/x-m4
15817
15818#------------------------------------------------------------
15819# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $
15820# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
15821# Unfortunately the first, cafebabe, is shared with
15822# Java ByteCode, so they are both handled in the file "cafebabe".
15823# The "feedface" ones are handled herein.
15824#------------------------------------------------------------
15825# if set, it's for the 64-bit version of the architecture
15826# yes, this is separate from the low-order magic number bit
15827# it's also separate from the "64-bit libraries" bit in the
15828# upper 8 bits of the CPU subtype
15829
158300	name	mach-o-cpu
15831>0	belong&0x01000000	0
15832#
15833# 32-bit ABIs.
15834#
15835#				1	vax
15836>>0	belong&0x00ffffff	1
15837>>>4		belong&0x00ffffff	0	vax
15838>>>4		belong&0x00ffffff	1	vax11/780
15839>>>4		belong&0x00ffffff	2	vax11/785
15840>>>4		belong&0x00ffffff	3	vax11/750
15841>>>4		belong&0x00ffffff	4	vax11/730
15842>>>4		belong&0x00ffffff	5	uvaxI
15843>>>4		belong&0x00ffffff	6	uvaxII
15844>>>4		belong&0x00ffffff	7	vax8200
15845>>>4		belong&0x00ffffff	8	vax8500
15846>>>4		belong&0x00ffffff	9	vax8600
15847>>>4		belong&0x00ffffff	10	vax8650
15848>>>4		belong&0x00ffffff	11	vax8800
15849>>>4		belong&0x00ffffff	12	uvaxIII
15850>>>4		belong&0x00ffffff	>12	vax subarchitecture=%d
15851>>0	belong&0x00ffffff	2	romp
15852>>0	belong&0x00ffffff	3	architecture=3
15853>>0	belong&0x00ffffff	4	ns32032
15854>>0	belong&0x00ffffff	5	ns32332
15855>>0	belong&0x00ffffff	6	m68k
15856#				7	x86
15857>>0	belong&0x00ffffff	7
15858>>>4	belong&0x0000000f	3		i386
15859>>>4	belong&0x0000000f	4		i486
15860>>>>4	belong&0x00fffff0	0
15861>>>>4	belong&0x00fffff0	0x80		\bsx
15862>>>4	belong&0x0000000f	5		i586
15863>>>4	belong&0x0000000f	6
15864>>>>4	belong&0x00fffff0	0		p6
15865>>>>4	belong&0x00fffff0	0x10		pentium_pro
15866>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
15867>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
15868>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
15869>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
15870>>>>4	belong&0x00fffff0	>0x50		pentium_2_m0x%x
15871>>>4	belong&0x0000000f	7		celeron
15872>>>>4	belong&0x00fffff0	0x00		\b_m0x%x
15873>>>>4	belong&0x00fffff0	0x10		\b_m0x%x
15874>>>>4	belong&0x00fffff0	0x20		\b_m0x%x
15875>>>>4	belong&0x00fffff0	0x30		\b_m0x%x
15876>>>>4	belong&0x00fffff0	0x40		\b_m0x%x
15877>>>>4	belong&0x00fffff0	0x50		\b_m0x%x
15878>>>>4	belong&0x00fffff0	0x60
15879>>>>4	belong&0x00fffff0	0x70		\b_mobile
15880>>>>4	belong&0x00fffff0	>0x70		\b_m0x%x
15881>>>4	belong&0x0000000f	8		pentium_3
15882>>>>4	belong&0x00fffff0	0x00
15883>>>>4	belong&0x00fffff0	0x10		\b_m
15884>>>>4	belong&0x00fffff0	0x20		\b_xeon
15885>>>>4	belong&0x00fffff0	>0x20		\b_m0x%x
15886>>>4	belong&0x0000000f	9		pentiumM
15887>>>>4	belong&0x00fffff0	0x00
15888>>>>4	belong&0x00fffff0	>0x00		\b_m0x%x
15889>>>4	belong&0x0000000f	10		pentium_4
15890>>>>4	belong&0x00fffff0	0x00
15891>>>>4	belong&0x00fffff0	0x10		\b_m
15892>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
15893>>>4	belong&0x0000000f	11		itanium
15894>>>>4	belong&0x00fffff0	0x00
15895>>>>4	belong&0x00fffff0	0x10		\b_2
15896>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
15897>>>4	belong&0x0000000f	12		xeon
15898>>>>4	belong&0x00fffff0	0x00
15899>>>>4	belong&0x00fffff0	0x10		\b_mp
15900>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
15901>>>4	belong&0x0000000f	>12		ia32 family=%d
15902>>>>4	belong&0x00fffff0	0x00
15903>>>>4	belong&0x00fffff0	>0x00		model=%x
15904>>0	belong&0x00ffffff	8	mips
15905>>>4		belong&0x00ffffff	1	R2300
15906>>>4		belong&0x00ffffff	2	R2600
15907>>>4		belong&0x00ffffff	3	R2800
15908>>>4		belong&0x00ffffff	4	R2000a
15909>>>4		belong&0x00ffffff	5	R2000
15910>>>4		belong&0x00ffffff	6	R3000a
15911>>>4		belong&0x00ffffff	7	R3000
15912>>>4		belong&0x00ffffff	>7	subarchitecture=%d
15913>>0	belong&0x00ffffff	9	ns32532
15914>>0	belong&0x00ffffff	10	mc98000
15915>>0	belong&0x00ffffff	11	hppa
15916>>>4		belong&0x00ffffff	0	7100
15917>>>4		belong&0x00ffffff	1	7100LC
15918>>>4		belong&0x00ffffff	>1	subarchitecture=%d
15919>>0	belong&0x00ffffff	12	arm
15920>>>4		belong&0x00ffffff	0
15921>>>4		belong&0x00ffffff	1	subarchitecture=%d
15922>>>4		belong&0x00ffffff	2	subarchitecture=%d
15923>>>4		belong&0x00ffffff	3	subarchitecture=%d
15924>>>4		belong&0x00ffffff	4	subarchitecture=%d
15925>>>4		belong&0x00ffffff	5	\bv4t
15926>>>4		belong&0x00ffffff	6	\bv6
15927>>>4		belong&0x00ffffff	7	\bv5tej
15928>>>4		belong&0x00ffffff	8	\bxscale
15929>>>4		belong&0x00ffffff	9	\bv7
15930>>>4		belong&0x00ffffff	10	\bv7f
15931>>>4		belong&0x00ffffff	11	\bv7s
15932>>>4		belong&0x00ffffff	12	\bv7k
15933>>>4		belong&0x00ffffff	13	\bv8
15934>>>4		belong&0x00ffffff	14	\bv6m
15935>>>4		belong&0x00ffffff	15	\bv7m
15936>>>4		belong&0x00ffffff	16	\bv7em
15937>>>4		belong&0x00ffffff	>16	subarchitecture=%d
15938#				13	m88k
15939>>0	belong&0x00ffffff	13
15940>>>4		belong&0x00ffffff	0	mc88000
15941>>>4		belong&0x00ffffff	1	mc88100
15942>>>4		belong&0x00ffffff	2	mc88110
15943>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%d
15944>>0	belong&0x00ffffff	14	SPARC
15945>>0	belong&0x00ffffff	15	i860g
15946>>0	belong&0x00ffffff	16	alpha
15947>>0	belong&0x00ffffff	17	rs6000
15948>>0	belong&0x00ffffff	18	ppc
15949>>>4		belong&0x00ffffff	0
15950>>>4		belong&0x00ffffff	1	\b_601
15951>>>4		belong&0x00ffffff	2	\b_602
15952>>>4		belong&0x00ffffff	3	\b_603
15953>>>4		belong&0x00ffffff	4	\b_603e
15954>>>4		belong&0x00ffffff	5	\b_603ev
15955>>>4		belong&0x00ffffff	6	\b_604
15956>>>4		belong&0x00ffffff	7	\b_604e
15957>>>4		belong&0x00ffffff	8	\b_620
15958>>>4		belong&0x00ffffff	9	\b_650
15959>>>4		belong&0x00ffffff	10	\b_7400
15960>>>4		belong&0x00ffffff	11	\b_7450
15961>>>4		belong&0x00ffffff	100	\b_970
15962>>>4		belong&0x00ffffff	>100	subarchitecture=%d
15963>>0	belong&0x00ffffff	>18	architecture=%d
15964>0	belong&0x01000000	0x01000000
15965#
15966# 64-bit ABIs.
15967#
15968>>0	belong&0x00ffffff	0	64-bit architecture=%d
15969>>0	belong&0x00ffffff	1	64-bit architecture=%d
15970>>0	belong&0x00ffffff	2	64-bit architecture=%d
15971>>0	belong&0x00ffffff	3	64-bit architecture=%d
15972>>0	belong&0x00ffffff	4	64-bit architecture=%d
15973>>0	belong&0x00ffffff	5	64-bit architecture=%d
15974>>0	belong&0x00ffffff	6	64-bit architecture=%d
15975>>0	belong&0x00ffffff	7	x86_64
15976>>>4		belong&0x00ffffff	0	subarchitecture=%d
15977>>>4		belong&0x00ffffff	1	subarchitecture=%d
15978>>>4		belong&0x00ffffff	2	subarchitecture=%d
15979>>>4		belong&0x00ffffff	3
15980>>>4		belong&0x00ffffff	4	\b_arch1
15981>>>4		belong&0x00ffffff	8	\b_haswell
15982>>>4		belong&0x00ffffff	>4	subarchitecture=%d
15983>>0	belong&0x00ffffff	8	64-bit architecture=%d
15984>>0	belong&0x00ffffff	9	64-bit architecture=%d
15985>>0	belong&0x00ffffff	10	64-bit architecture=%d
15986>>0	belong&0x00ffffff	11	64-bit architecture=%d
15987>>0	belong&0x00ffffff	12	arm64
15988>>>4		belong&0x00ffffff	0
15989>>>4		belong&0x00ffffff	1	\bv8
15990>>0	belong&0x00ffffff	13	64-bit architecture=%d
15991>>0	belong&0x00ffffff	14	64-bit architecture=%d
15992>>0	belong&0x00ffffff	15	64-bit architecture=%d
15993>>0	belong&0x00ffffff	16	64-bit architecture=%d
15994>>0	belong&0x00ffffff	17	64-bit architecture=%d
15995>>0	belong&0x00ffffff	18	ppc64
15996>>>4		belong&0x00ffffff	0
15997>>>4		belong&0x00ffffff	1		\b_601
15998>>>4		belong&0x00ffffff	2		\b_602
15999>>>4		belong&0x00ffffff	3		\b_603
16000>>>4		belong&0x00ffffff	4		\b_603e
16001>>>4		belong&0x00ffffff	5		\b_603ev
16002>>>4		belong&0x00ffffff	6		\b_604
16003>>>4		belong&0x00ffffff	7		\b_604e
16004>>>4		belong&0x00ffffff	8		\b_620
16005>>>4		belong&0x00ffffff	9		\b_650
16006>>>4		belong&0x00ffffff	10		\b_7400
16007>>>4		belong&0x00ffffff	11		\b_7450
16008>>>4		belong&0x00ffffff	100		\b_970
16009>>>4		belong&0x00ffffff	>100		subarchitecture=%d
16010>>0	belong&0x00ffffff	>18	64-bit architecture=%d
16011
16012
160130	name		mach-o-be
16014>0	byte		0xcf		64-bit
16015>4	use		mach-o-cpu
16016>12	belong		1		object
16017>12	belong		2		executable
16018>12	belong		3		fixed virtual memory shared library
16019>12	belong		4		core
16020>12	belong		5		preload executable
16021>12	belong		6		dynamically linked shared library
16022>12	belong		7		dynamic linker
16023>12	belong		8		bundle
16024>12	belong		9		dynamically linked shared library stub
16025>12	belong		10		dSYM companion file
16026>12	belong		11		kext bundle
16027>12	belong		>11
16028>>12	belong		x		filetype=%d
16029>24	belong		>0		\b, flags:<
16030>>24	belong		&0x0000001	\bNOUNDEFS
16031>>24	belong		&0x0000002	\b|INCRLINK
16032>>24	belong		&0x0000004	\b|DYLDLINK
16033>>24	belong		&0x0000008	\b|BINDATLOAD
16034>>24	belong		&0x0000010	\b|PREBOUND
16035>>24	belong		&0x0000020	\b|SPLIT_SEGS
16036>>24	belong		&0x0000040	\b|LAZY_INIT
16037>>24	belong		&0x0000080	\b|TWOLEVEL
16038>>24	belong		&0x0000100	\b|FORCE_FLAT
16039>>24	belong		&0x0000200	\b|NOMULTIDEFS
16040>>24	belong		&0x0000400	\b|NOFIXPREBINDING
16041>>24	belong		&0x0000800	\b|PREBINDABLE
16042>>24	belong		&0x0001000	\b|ALLMODSBOUND
16043>>24	belong		&0x0002000	\b|SUBSECTIONS_VIA_SYMBOLS
16044>>24	belong		&0x0004000	\b|CANONICAL
16045>>24	belong		&0x0008000	\b|WEAK_DEFINES
16046>>24	belong		&0x0010000	\b|BINDS_TO_WEAK
16047>>24	belong		&0x0020000	\b|ALLOW_STACK_EXECUTION
16048>>24	belong		&0x0040000	\b|ROOT_SAFE
16049>>24	belong		&0x0080000	\b|SETUID_SAFE
16050>>24	belong		&0x0100000	\b|NO_REEXPORTED_DYLIBS
16051>>24	belong		&0x0200000	\b|PIE
16052>>24	belong		&0x0400000	\b|DEAD_STRIPPABLE_DYLIB
16053>>24	belong		&0x0800000	\b|HAS_TLV_DESCRIPTORS
16054>>24	belong		&0x1000000	\b|NO_HEAP_EXECUTION
16055>>24	belong		&0x2000000	\b|APP_EXTENSION_SAFE
16056>>24	belong		x		\b>
16057
16058#
160590	lelong&0xfffffffe	0xfeedface	Mach-O
16060!:strength +1
16061!:mime application/x-mach-binary
16062>0	use	\^mach-o-be
16063
160640	belong&0xfffffffe	0xfeedface	Mach-O
16065!:strength +1
16066!:mime application/x-mach-binary
16067>0	use	mach-o-be
16068
16069#------------------------------------------------------------------------------
16070# $File: macintosh,v 1.27 2017/03/17 21:35:28 christos Exp $
16071# macintosh description
16072#
16073# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
16074# Daniel Quinlan, quinlan@yggdrasil.com
1607511	string	must\ be\ converted\ with\ BinHex	BinHex binary text
16076!:mime	application/mac-binhex40
16077>41	string	x					\b, version %.3s
16078
16079# Stuffit archives are the de facto standard of compression for Macintosh
16080# files obtained from most archives. (franklsm@tuns.ca)
160810	string		SIT!			StuffIt Archive (data)
16082!:mime	application/x-stuffit
16083!:apple	SIT!SIT!
16084>2	string		x			: %s
160850	string		SITD			StuffIt Deluxe (data)
16086>2	string		x			: %s
160870	string		Seg			StuffIt Deluxe Segment (data)
16088>2	string		x			: %s
16089
16090# Newer StuffIt archives (grant@netbsd.org)
160910	string		StuffIt			StuffIt Archive
16092!:mime	application/x-stuffit
16093!:apple	SIT!SIT!
16094#>162	string		>0			: %s
16095
16096# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
16097# GRR: Too weak
16098#0	string		APPL			Macintosh Application (data)
16099#>2	string		x			\b: %s
16100
16101# Macintosh System files (franklsm@tuns.ca)
16102# GRR: Too weak
16103#0	string		zsys			Macintosh System File (data)
16104#0	string		FNDR			Macintosh Finder (data)
16105#0	string		libr			Macintosh Library (data)
16106#>2	string		x			: %s
16107#0	string		shlb			Macintosh Shared Library (data)
16108#>2	string		x			: %s
16109#0	string		cdev			Macintosh Control Panel (data)
16110#>2	string		x			: %s
16111#0	string		INIT			Macintosh Extension (data)
16112#>2	string		x			: %s
16113#0	string		FFIL			Macintosh Truetype Font (data)
16114#>2	string		x			: %s
16115#0	string		LWFN			Macintosh Postscript Font (data)
16116#>2	string		x			: %s
16117
16118# Additional Macintosh Files (franklsm@tuns.ca)
16119# GRR: Too weak
16120#0	string		PACT			Macintosh Compact Pro Archive (data)
16121#>2	string		x			: %s
16122#0	string		ttro			Macintosh TeachText File (data)
16123#>2	string		x			: %s
16124#0	string		TEXT			Macintosh TeachText File (data)
16125#>2	string		x			: %s
16126#0	string		PDF			Macintosh PDF File (data)
16127#>2	string		x			: %s
16128
16129# MacBinary format (Eric Fischer, enf@pobox.com)
16130#
16131# Unfortunately MacBinary doesn't really have a magic number prior
16132# to the MacBinary III format.  The checksum is really the way to
16133# do it, but the magic file format isn't up to the challenge.
16134#
16135# 0	byte		0
16136# 1	byte				# filename length
16137# 2	string				# filename
16138# 65    string				# file type
16139# 69	string				# file creator
16140# 73	byte				# Finder flags
16141# 74	byte		0
16142# 75	beshort				# vertical posn in window
16143# 77	beshort				# horiz posn in window
16144# 79	beshort				# window or folder ID
16145# 81    byte				# protected?
16146# 82	byte		0
16147# 83	belong				# length of data segment
16148# 87	belong				# length of resource segment
16149# 91	belong				# file creation date
16150# 95	belong				# file modification date
16151# 99	beshort				# length of comment after resource
16152# 101	byte				# new Finder flags
16153# 102	string		mBIN		# (only in MacBinary III)
16154# 106	byte				# char. code of file name
16155# 107	byte				# still more Finder flags
16156# 116	belong				# total file length
16157# 120	beshort				# length of add'l header
16158# 122	byte		129		# for MacBinary II
16159# 122	byte		130		# for MacBinary III
16160# 123	byte		129		# minimum version that can read fmt
16161# 124	beshort				# checksum
16162#
16163# This attempts to use the version numbers as a magic number, requiring
16164# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
16165# be 0x81.  This works for the files I have, but maybe not for everyone's.
16166
16167# Unfortunately, this magic is quite weak - MPi
16168#122	beshort&0xFCFF	0x8081		Macintosh MacBinary data
16169
16170# MacBinary I doesn't have the version number field at all, but MacBinary II
16171# has been in use since 1987 so I hope there aren't many really old files
16172# floating around that this will miss.  The original spec calls for using
16173# the nulls in 0, 74, and 82 as the magic number.
16174#
16175# Another possibility, that would also work for MacBinary I, is to use
16176# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
16177# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
16178# and that 74 will be 0.  So something like
16179#
16180# 71 	belong&0x80804EFF 0x00000000 	Macintosh MacBinary data
16181#
16182# >73	byte&0x01	0x01		\b, inited
16183# >73	byte&0x02	0x02		\b, changed
16184# >73	byte&0x04	0x04		\b, busy
16185# >73	byte&0x08	0x08		\b, bozo
16186# >73	byte&0x10	0x10		\b, system
16187# >73	byte&0x10	0x20		\b, bundle
16188# >73	byte&0x10	0x40		\b, invisible
16189# >73	byte&0x10	0x80		\b, locked
16190
16191#>65	string		x		\b, type "%4.4s"
16192
16193#>65	string		8BIM		(PhotoShop)
16194#>65	string		ALB3		(PageMaker 3)
16195#>65	string		ALB4		(PageMaker 4)
16196#>65	string		ALT3		(PageMaker 3)
16197#>65	string		APPL		(application)
16198#>65	string		AWWP		(AppleWorks word processor)
16199#>65	string		CIRC		(simulated circuit)
16200#>65	string		DRWG		(MacDraw)
16201#>65	string		EPSF		(Encapsulated PostScript)
16202#>65	string		FFIL		(font suitcase)
16203#>65	string		FKEY		(function key)
16204#>65	string		FNDR		(Macintosh Finder)
16205#>65	string		GIFf		(GIF image)
16206#>65	string		Gzip		(GNU gzip)
16207#>65	string		INIT		(system extension)
16208#>65	string		LIB\ 		(library)
16209#>65	string		LWFN		(PostScript font)
16210#>65	string		MSBC		(Microsoft BASIC)
16211#>65	string		PACT		(Compact Pro archive)
16212#>65	string		PDF\ 		(Portable Document Format)
16213#>65	string		PICT		(picture)
16214#>65	string		PNTG		(MacPaint picture)
16215#>65	string		PREF		(preferences)
16216#>65	string		PROJ		(Think C project)
16217#>65	string		QPRJ		(Think Pascal project)
16218#>65	string		SCFL		(Defender scores)
16219#>65	string		SCRN		(startup screen)
16220#>65	string		SITD		(StuffIt Deluxe)
16221#>65	string		SPn3		(SuperPaint)
16222#>65	string		STAK		(HyperCard stack)
16223#>65	string		Seg\ 		(StuffIt segment)
16224#>65	string		TARF		(Unix tar archive)
16225#>65	string		TEXT		(ASCII)
16226#>65	string		TIFF		(TIFF image)
16227#>65	string		TOVF		(Eudora table of contents)
16228#>65	string		WDBN		(Microsoft Word word processor)
16229#>65	string		WORD		(MacWrite word processor)
16230#>65	string		XLS\ 		(Microsoft Excel)
16231#>65	string		ZIVM		(compress (.Z))
16232#>65	string		ZSYS		(Pre-System 7 system file)
16233#>65	string		acf3		(Aldus FreeHand)
16234#>65	string		cdev		(control panel)
16235#>65	string		dfil		(Desk Accessory suitcase)
16236#>65	string		libr		(library)
16237#>65	string		nX^d		(WriteNow word processor)
16238#>65	string		nX^w		(WriteNow dictionary)
16239#>65	string		rsrc		(resource)
16240#>65	string		scbk		(Scrapbook)
16241#>65	string		shlb		(shared library)
16242#>65	string		ttro		(SimpleText read-only)
16243#>65	string		zsys		(system file)
16244
16245#>69	string		x		\b, creator "%4.4s"
16246
16247# Somewhere, Apple has a repository of registered Creator IDs.  These are
16248# just the ones that I happened to have files from and was able to identify.
16249
16250#>69	string		8BIM		(Adobe Photoshop)
16251#>69	string		ALD3		(PageMaker 3)
16252#>69	string		ALD4		(PageMaker 4)
16253#>69	string		ALFA		(Alpha editor)
16254#>69	string		APLS		(Apple Scanner)
16255#>69	string		APSC		(Apple Scanner)
16256#>69	string		BRKL		(Brickles)
16257#>69	string		BTFT		(BitFont)
16258#>69	string		CCL2 		(Common Lisp 2)
16259#>69	string		CCL\ 		(Common Lisp)
16260#>69	string		CDmo		(The Talking Moose)
16261#>69	string		CPCT		(Compact Pro)
16262#>69	string		CSOm		(Eudora)
16263#>69	string		DMOV		(Font/DA Mover)
16264#>69	string		DSIM		(DigSim)
16265#>69	string		EDIT		(Macintosh Edit)
16266#>69	string		ERIK		(Macintosh Finder)
16267#>69	string		EXTR		(self-extracting archive)
16268#>69	string		Gzip		(GNU gzip)
16269#>69	string		KAHL		(Think C)
16270#>69	string		LWFU		(LaserWriter Utility)
16271#>69	string		LZIV		(compress)
16272#>69	string		MACA		(MacWrite)
16273#>69	string		MACS		(Macintosh operating system)
16274#>69	string		MAcK		(MacKnowledge terminal emulator)
16275#>69	string		MLND		(Defender)
16276#>69	string		MPNT		(MacPaint)
16277#>69	string		MSBB		(Microsoft BASIC (binary))
16278#>69	string		MSWD		(Microsoft Word)
16279#>69	string		NCSA		(NCSA Telnet)
16280#>69	string		PJMM		(Think Pascal)
16281#>69	string		PSAL		(Hunt the Wumpus)
16282#>69	string		PSI2		(Apple File Exchange)
16283#>69	string		R*ch		(BBEdit)
16284#>69	string		RMKR		(Resource Maker)
16285#>69	string		RSED		(Resource Editor)
16286#>69	string		Rich		(BBEdit)
16287#>69	string		SIT!		(StuffIt)
16288#>69	string		SPNT		(SuperPaint)
16289#>69	string		Unix		(NeXT Mac filesystem)
16290#>69	string		VIM!		(Vim editor)
16291#>69	string		WILD		(HyperCard)
16292#>69	string		XCEL		(Microsoft Excel)
16293#>69	string		aCa2		(Fontographer)
16294#>69	string		aca3		(Aldus FreeHand)
16295#>69	string		dosa		(Macintosh MS-DOS file system)
16296#>69	string		movr		(Font/DA Mover)
16297#>69	string		nX^n		(WriteNow)
16298#>69	string		pdos		(Apple ProDOS file system)
16299#>69	string		scbk		(Scrapbook)
16300#>69	string		ttxt		(SimpleText)
16301#>69	string		ufox		(Foreign File Access)
16302
16303# Just in case...
16304
16305102	string		mBIN		MacBinary III data with surprising version number
16306
16307# sas magic from Bruce Foster (bef@nwu.edu)
16308#
16309#0	string		SAS		SAS
16310#>8	string		x		%s
163110	string		SAS		SAS
16312>24	string		DATA		data file
16313>24	string		CATALOG		catalog
16314>24	string		INDEX		data file index
16315>24	string		VIEW		data view
16316# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
16317#
163180x54    string          SAS             SAS 7+
16319>0x9C   string          DATA            data file
16320>0x9C   string          CATALOG         catalog
16321>0x9C   string          INDEX           data file index
16322>0x9C   string          VIEW            data view
16323
16324# spss magic for SPSS system and portable files,
16325#	 from Bruce Foster (bef@nwu.edu).
16326
163270	long		0xc1e2c3c9	SPSS Portable File
16328>40	string 		x		%s
16329
163300	string		$FL2		SPSS System File
16331>24	string		x		%s
16332
163330	string		$FL3		SPSS System File
16334>24	string		x		%s
16335
16336# Macintosh filesystem data
16337# From "Tom N Harris" <telliamed@mac.com>
16338# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
16339# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
16340# entries depend on the data arithmetic added after v.35
16341# There's also some Pascal strings in here, ditto...
16342
16343# The boot block signature, according to IM:Files, is
16344# "for HFS volumes, this field always contains the value 0x4C4B."
16345# But if this is true for MFS or HFS+ volumes, I don't know.
16346# Alternatively, the boot block is supposed to be zeroed if it's
16347# unused, so a simply >0 should suffice.
16348
163490x400	beshort			0xD2D7		Macintosh MFS data
16350>0	beshort			0x4C4B		(bootable)
16351>0x40a	beshort			&0x8000		(locked)
16352>0x402	beldate-0x7C25B080	x		created: %s,
16353>0x406	beldate-0x7C25B080	>0		last backup: %s,
16354>0x414	belong			x		block size: %d,
16355>0x412	beshort			x		number of blocks: %d,
16356>0x424	pstring			x		volume name: %s
16357
16358# *.hfs updated by Joerg Jenderek
16359# http://en.wikipedia.org/wiki/Hierarchical_File_System
16360# "BD" gives many false positives
163610x400	beshort			0x4244
16362# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
16363# first block of volume bit map (always 3)
16364>0x40e	ubeshort		0x0003
16365# maximal length of volume name is 27
16366>>0x424		ubyte			<28	Macintosh HFS data
16367!:mime	application/x-apple-diskimage
16368#!:apple	hfsdINIT
16369#!:apple	MACSdisk
16370# http://www.macdisk.com/macsigen.php
16371#!:apple	ddskdevi
16372!:apple	????devi
16373# https://en.wikipedia.org/wiki/Apple_Disk_Image
16374!:ext hfs/dmg
16375>>>0		beshort			0x4C4B	(bootable)
16376#>>>0		beshort			0x0000	(not bootable)
16377>>>0x40a	beshort			&0x8000	(locked)
16378>>>0x40a	beshort			^0x0100	(mounted)
16379>>>0x40a	beshort			&0x0200	(spared blocks)
16380>>>0x40a	beshort			&0x0800	(unclean)
16381>>>0x47C	beshort			0x482B	(Embedded HFS+ Volume)
16382# http://www.epochconverter.com/
16383# 0x7C245F00 seconds	~ 2082758400	~ 01 Jan 2036 00:00:00	~ 66 years to 1970
16384# 0x7C25B080 seconds	~ 2082844800	~ 02 Jan 2036 00:00:00
16385# construct not working
16386#>>>0x402	beldate-0x7C25B080	x	created: %s,
16387#>>>0x406	beldate-0x7C25B080	x	last modified: %s,
16388#>>>0x440	beldate-0x7C25B080	>0	last backup: %s,
16389# found block sizes 200h,1200h,2800h
16390>>>0x414	belong			x	block size: %d,
16391>>>0x412	beshort			x	number of blocks: %d,
16392>>>0x424	pstring			x	volume name: %s
16393
163940x400	beshort			0x482B		Macintosh HFS Extended
16395>&0	beshort			x		version %d data
16396>0	beshort			0x4C4B		(bootable)
16397>0x404	belong			^0x00000100	(mounted)
16398>&2	belong			&0x00000200	(spared blocks)
16399>&2	belong			&0x00000800	(unclean)
16400>&2	belong			&0x00008000	(locked)
16401>&6	string			x		last mounted by: '%.4s',
16402# really, that should be treated as a belong and we print a string
16403# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
16404>&14	beldate-0x7C25B080	x		created: %s,
16405# only the creation date is local time, all other timestamps in HFS+ are UTC.
16406>&18	bedate-0x7C25B080	x		last modified: %s,
16407>&22	bedate-0x7C25B080	>0		last backup: %s,
16408>&26	bedate-0x7C25B080	>0		last checked: %s,
16409>&38	belong			x		block size: %d,
16410>&42	belong			x		number of blocks: %d,
16411>&46	belong			x		free blocks: %d
16412
16413## AFAIK, only the signature is different
16414# same as Apple Partition Map
16415# GRR: This magic is too weak, it is just "TS"
16416#0x200		beshort		0x5453		Apple Old Partition data
16417#>0x2		beshort		x		block size: %d,
16418#>0x230		string		x		first type: %s,
16419#>0x210		string		x		name: %s,
16420#>0x254		belong		x		number of blocks: %d,
16421#>0x400		beshort		0x504D
16422#>>0x430		string		x		second type: %s,
16423#>>0x410		string		x		name: %s,
16424#>>0x454		belong		x		number of blocks: %d,
16425#>>0x800		beshort		0x504D
16426#>>>0x830	string		x		third type: %s,
16427#>>>0x810	string		x		name: %s,
16428#>>>0x854	belong		x		number of blocks: %d,
16429#>>>0xa00	beshort		0x504D
16430#>>>>0xa30	string		x		fourth type: %s,
16431#>>>>0xa10	string		x		name: %s,
16432#>>>>0xa54	belong		x		number of blocks: %d
16433
16434# From: Remi Mommsen <mommsen@slac.stanford.edu>
164350		string		BOMStore	Mac OS X bill of materials (BOM) file
16436
16437# From: Adam Buchbinder <adam.buchbinder@gmail.com>
16438# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
16439# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
16440# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
16441# don't know what they mean.
164420	belong	0x100
16443>(0x4.L+24)	beshort	x
16444>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
16445>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
16446>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
16447>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
16448
16449#------------------------------------------------------------------------------
16450# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
16451# MacOS files
16452#
16453
164540	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file
16455
16456#------------------------------------------------------------------------------
16457# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
16458# magic:  file(1) magic for magic files
16459#
164600	string/t		#\ Magic	magic text file for file(1) cmd
164610	lelong		0xF11E041C	magic binary file for file(1) cmd
16462>4	lelong		x		(version %d) (little endian)
164630	belong		0xF11E041C	magic binary file for file(1) cmd
16464>4	belong		x		(version %d) (big endian)
16465#------------------------------------------------------------------------------
16466# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $
16467# mail.news:  file(1) magic for mail and news
16468#
16469# Unfortunately, saved netnews also has From line added in some news software.
16470#0	string		From 		mail text
164710	string/t		Relay-Version: 	old news text
16472!:mime	message/rfc822
164730	string/t		#!\ rnews	batched news text
16474!:mime	message/rfc822
164750	string/t		N#!\ rnews	mailed, batched news text
16476!:mime	message/rfc822
164770	string/t		Forward\ to 	mail forwarding text
16478!:mime	message/rfc822
164790	string/t		Pipe\ to 	mail piping text
16480!:mime	message/rfc822
164810	string/tc		delivered-to:	SMTP mail text
16482!:mime	message/rfc822
164830	string/tc		return-path:	SMTP mail text
16484!:mime	message/rfc822
164850	string/t		Path:		news text
16486!:mime	message/news
164870	string/t		Xref:		news text
16488!:mime	message/news
164890	string/t		From:		news or mail text
16490!:mime	message/rfc822
164910	string/t		Article 	saved news text
16492!:mime	message/news
164930	string/t		BABYL		Emacs RMAIL text
164940	string/t		Received:	RFC 822 mail text
16495!:mime	message/rfc822
164960	string/t		MIME-Version:	MIME entity text
16497#0	string/t		Content-	MIME entity text
16498
16499# TNEF files...
165000	lelong		0x223E9F78	Transport Neutral Encapsulation Format
16501!:mime	application/vnd.ms-tnef
16502
16503# From: Kevin Sullivan <ksulliva@psc.edu>
165040	string		*mbx*		MBX mail folder
16505
16506# From: Simon Matter <simon.matter@invoca.ch>
165070	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
165080	string		\241\002\213\015twoskip\ file\0\0\0\0	Cyrus twoskip DB
16509
16510# JAM(mbp) Fidonet message area databases
16511# JHR file
165120	string	JAM\0			JAM message area header file
16513>12	leshort >0			(%d messages)
16514
16515# Squish Fidonet message area databases
16516# SQD file (requires at least one message in the area)
16517# XXX: Weak magic
16518#256	leshort	0xAFAE4453		Squish message area data file
16519#>4	leshort	>0			(%d messages)
16520
16521#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
16522
16523# Cyrus: file(1) magic for compiled Cyrus sieve scripts
16524# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
16525# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
16526# From: Philipp Hahn <hahn@univention.de>
16527
16528# Compiled Cyrus sieve script
165290       string CyrSBytecode     Cyrus sieve bytecode data,
16530>12     belong =1       version 1, big-endian
16531>12     lelong =1       version 1, little-endian
16532>12     belong x        version %d, network-endian
16533#------------------------------------------------------------------------------
16534# $File: make,v 1.3 2016/12/10 14:21:29 christos Exp $
16535# make:  file(1) magic for makefiles
16536#
16537# URL: https://en.wikipedia.org/wiki/Make_(software)
165380	regex/100l	\^CFLAGS	makefile script text
16539!:mime	text/x-makefile
165400	regex/100l	\^VPATH		makefile script text
16541!:mime	text/x-makefile
165420	regex/100l	\^LDFLAGS	makefile script text
16543!:mime	text/x-makefile
165440	regex/100l	\^all:		makefile script text
16545!:mime	text/x-makefile
165460	regex/100l	\^\\.PRECIOUS	makefile script text
16547!:mime	text/x-makefile
16548# Update: Joerg Jenderek
16549# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
16550# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
16551# by additional escaping point character
165520	regex/100l	\^\\.BEGIN	BSD makefile script text with "%s"
16553!:mime	text/x-makefile
16554!:ext	/mk
16555# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
16556# and NSIS script with "!include" by additional escaping point character
165570	regex/100l	\^\\.include	BSD makefile script text with "%s"
16558!:mime	text/x-makefile
16559!:ext	/mk
165600	regex/100l	\^SUBDIRS	automake makefile script text
16561!:mime	text/x-makefile
16562
16563
16564#------------------------------------------------------------------------------
16565# $File: map,v 1.4 2015/08/10 05:18:27 christos Exp $
16566# map:  file(1) magic for Map data
16567#
16568
16569# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
165708	string	.FIT		FIT Map data
16571>15	byte	0
16572>>35	belong	x		\b, unit id %d
16573>>39	lelong	x		\b, serial %u
16574# http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
16575# 20 years after unix epoch
16576# TZ=GMT date -d '1989-12-31 0:00' +%s
16577>>43	leldate+631065600	x	\b, %s
16578
16579>>47	leshort x		\b, manufacturer %d
16580>>47	leshort	1		\b (garmin)
16581>>49	leshort x		\b, product %d
16582>>53	byte	x		\b, type %d
16583>>53	byte	1		\b (Device)
16584>>53	byte	2		\b (Settings)
16585>>53	byte	3		\b (Sports/Cycling)
16586>>53	byte	4		\b (Activity)
16587>>53	byte	8		\b (Elevations)
16588>>53	byte	10		\b (Totals)
16589
16590# TOM TOM GPS watches ttbin files:
16591# http://github.com/ryanbinns/ttwatch/tree/master/ttbin
16592# From: Daniel Lenski
165930	byte	0x20
16594>1	leshort	0x0007
16595>>0x76	byte	0x20
16596>>>0x77	leshort	0x0075		TomTom activity file, v7
16597>>>>8	leldate	x		(%s,
16598>>>>3	byte    x		device firmware %d.
16599>>>>4	byte	x		\b%d.
16600>>>>5	byte	x		\b%d,
16601>>>>6	leshort	x		product ID %04d)
16602
16603
16604#------------------------------------------------------------------------------
16605# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
16606# maple:  file(1) magic for maple files
16607# "H. Nanosecond" <aldomel@ix.netcom.com>
16608# Maple V release 4, a multi-purpose math program
16609#
16610
16611# maple library .lib
166120	string	\000MVR4\nI	MapleVr4 library
16613
16614# .ind
16615# no magic for these :-(
16616# they are compiled indexes for maple files
16617
16618# .hdb
166190	string	\000\004\000\000	Maple help database
16620
16621# .mhp
16622# this has the form <PACKAGE=name>
166230	string	\<PACKAGE=	Maple help file
166240	string	\<HELP\ NAME=	Maple help file
166250	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
16626#0	string	#\ Newton	Maple help file, old style
166270	string	#\ daub	Maple help file, old style
16628#0	string	#===========	Maple help file, old style
16629
16630# .mws
166310	string	\000\000\001\044\000\221	Maple worksheet
16632#this is anomalous
166330	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
16634# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
16635# that is {VERSION major_version miunor_version computer_type version_string}
166360	string	{VERSION\ 	Maple worksheet
16637>9	string	>\0	version %.1s.
16638>>11	string	>\0	%.1s
16639
16640# .mps
166410	string	\0\0\001$	Maple something
16642# from byte 4 it is either 'nul E' or 'soh R'
16643# I think 'nul E' means a file that was saved as  a different name
16644# a sort of revision marking
16645# 'soh R' means new
16646>4	string	\000\105	An old revision
16647>4	string	\001\122	The latest save
16648
16649# .mpl
16650# some of these are the same as .mps above
16651#0000000 000 000 001 044 000 105 same as .mps
16652#0000000 000 000 001 044 001 122 same as .mps
16653
166540	string	#\n##\ <SHAREFILE=	Maple something
166550	string	\n#\n##\ <SHAREFILE=	Maple something
166560	string	##\ <SHAREFILE=	Maple something
166570	string	#\r##\ <SHAREFILE=	Maple something
166580	string	\r#\r##\ <SHAREFILE=	Maple something
166590	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
16660#--------------------------------------------
16661# marc21: file(1) magic for MARC 21 Format
16662#
16663# Kevin Ford (kefo@loc.gov)
16664#
16665# MARC21 formats are for the representation and communication
16666# of bibliographic and related information in machine-readable
16667# form.  For more info, see http://www.loc.gov/marc/
16668
16669
16670# leader position 20-21 must be 45
16671# and 22-23 also 00 so far, but we check that later.
1667220	string		45
16673>0	search/2048	\x1e
16674
16675# leader starts with 5 digits, followed by codes specific to MARC format
16676>>0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
16677!:mime	application/marc
16678>>0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
16679!:mime	application/marc
16680>>0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
16681!:mime	application/marc
16682>>0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
16683!:mime	application/marc
16684>>0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
16685!:mime	application/marc
16686
16687# leader position 22-23, should be "00" but is it?
16688>>0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
16689!:mime	application/marc
16690
16691#------------------------------------------------------------------------------
16692# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
16693# mathcad:  file(1) magic for Mathcad documents
16694# URL:	http://www.mathsoft.com/
16695# From:	Josh Triplett <josh@freedesktop.org>
16696
166970	string	.MCAD\t		Mathcad document
16698
16699#------------------------------------------------------------------------------
16700# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
16701# mathematica:  file(1) magic for mathematica files
16702# "H. Nanosecond" <aldomel@ix.netcom.com>
16703# Mathematica a multi-purpose math program
16704# versions 2.2 and 3.0
16705
16706#mathematica .mb
167070	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
16708!:ext mb
167090	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
16710!:ext mb
16711
16712# .ma
16713# multiple possibilites:
16714
167150	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
16716#>41	string	>\0	%s
16717!:ext mb
16718
16719#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
16720
16721#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
16722#>675	string	>\0	%s #doesn't work well
16723
16724# there may be 'cr' instread of 'nl' in some does this matter?
16725
16726# generic:
167270	string	(*^\r\r::[\011	Mathematica notebook version 2.x
16728!:ext mb
167290	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
16730!:ext mb
167310	string	(*^\015			Mathematica notebook version 2.x
16732!:ext mb
167330	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
16734!:ext mb
167350	string	(*^\r::[\011	Mathematica notebook version 2.x
16736!:ext mb
167370	string	(*^\r\n::[\011	Mathematica notebook version 2.x
16738!:ext mb
167390	string	(*^\n\n::[\011	Mathematica notebook version 2.x
16740!:ext mb
167410	string	(*^\n::[\011	Mathematica notebook version 2.x
16742!:ext mb
16743
16744
16745# Mathematica .mx files
16746
16747#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
167480	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
16749#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
16750# >71... is optional
16751>88	string	>\0	from %s
16752
16753
16754# Mathematica files PBF:
16755# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
167560	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
16757
16758# .ml files  These are menu resources I think
16759# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
16760# how to put that into a magic rule?
167614	string	\ A~	MAthematica .ml file
16762
16763# .nb files
16764#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
167650	string	(***********************	Mathematica 3.0 notebook
16766
16767# other (* matches it is a comment start in these langs
16768# GRR: Too weak; also matches other languages e.g. ML
16769#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text
16770
16771#########################
16772# MatLab v5
167730       string  MATLAB  Matlab v5 mat-file
16774>126    short   0x494d  (big endian)
16775>>124   beshort x       version 0x%04x
16776>126    short   0x4d49  (little endian)
16777>>124   leshort x       version 0x%04x
16778
16779
16780#------------------------------------------------------------------------------
16781# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
16782# matroska:  file(1) magic for Matroska files
16783#
16784# See http://www.matroska.org/
16785#
16786
16787# EBML id:
167880		belong		0x1a45dfa3
16789# DocType id:
16790>4		search/4096 	\x42\x82
16791# DocType contents:
16792>>&1		string		webm		WebM
16793!:mime  video/webm
16794>>&1		string		matroska	Matroska data
16795!:mime  video/x-matroska
16796
16797#------------------------------------------------------------------------------
16798# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
16799# Mavroyanopoulos Nikos <nmav@hellug.gr>
16800# mcrypt:   file(1) magic for mcrypt 2.2.x;
168010	string		\0m\3		mcrypt 2.5 encrypted data,
16802>4	string		>\0		algorithm: %s,
16803>>&1	leshort		>0		keysize: %d bytes,
16804>>>&0	string		>\0		mode: %s,
16805
168060	string		\0m\2		mcrypt 2.2 encrypted data,
16807>3	byte		0		algorithm: blowfish-448,
16808>3	byte		1		algorithm: DES,
16809>3	byte		2		algorithm: 3DES,
16810>3	byte		3		algorithm: 3-WAY,
16811>3	byte		4		algorithm: GOST,
16812>3	byte		6		algorithm: SAFER-SK64,
16813>3	byte		7		algorithm: SAFER-SK128,
16814>3	byte		8		algorithm: CAST-128,
16815>3	byte		9		algorithm: xTEA,
16816>3	byte		10		algorithm: TWOFISH-128,
16817>3	byte		11		algorithm: RC2,
16818>3	byte		12		algorithm: TWOFISH-192,
16819>3	byte		13		algorithm: TWOFISH-256,
16820>3	byte		14		algorithm: blowfish-128,
16821>3	byte		15		algorithm: blowfish-192,
16822>3	byte		16		algorithm: blowfish-256,
16823>3	byte		100		algorithm: RC6,
16824>3	byte		101		algorithm: IDEA,
16825>4	byte		0		mode: CBC,
16826>4	byte		1		mode: ECB,
16827>4	byte		2		mode: CFB,
16828>4	byte		3		mode: OFB,
16829>4	byte		4		mode: nOFB,
16830>5	byte		0		keymode: 8bit
16831>5	byte		1		keymode: 4bit
16832>5	byte		2		keymode: SHA-1 hash
16833>5	byte		3		keymode: MD5 hash
16834
16835#------------------------------------------------------------------------------
16836# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $
16837# mercurial:  file(1) magic for Mercurial changeset bundles
16838# http://www.selenic.com/mercurial/wiki/
16839#
16840# Jesse Glick (jesse.glick@sun.com)
16841#
16842
168430	string		HG10		Mercurial changeset bundle
16844>4	string		UN		(uncompressed)
16845>4	string		GZ		(gzip compressed)
16846>4	string		BZ		(bzip2 compressed)
16847
16848#------------------------------------------------------------------------------
16849# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $
16850# metastore:  file(1) magic for metastore files
16851# From: Thomas Wissen
16852# see http://david.hardeman.nu/software.php#metastore
168530	string		MeTaSt00r3	Metastore data file,
16854>10	bequad		x		version %0llx
16855
16856#------------------------------------------------------------------------------
16857# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
16858# rinex:  file(1) magic for RINEX files
16859# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
16860# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
16861# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
1686260	string		RINEX
16863>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
16864>>&32	string		x		\b, date %15.15s
16865>>5	string		x		\b, version %6.6s
16866!:mime	rinex/broadcast
16867>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
16868>>&32	string		x		\b, date %15.15s
16869>>5	string		x		\b, version %6.6s
16870!:mime	rinex/observation
16871>80	search/256	XXRINEXC	RINEX Data, Clock
16872>>&32	string		x		\b, date %15.15s
16873>>5	string		x		\b, version %6.6s
16874!:mime	rinex/clock
16875>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
16876>>&32	string		x		\b, date %15.15s
16877>>5	string		x		\b, version %6.6s
16878!:mime	rinex/navigation
16879>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
16880>>&32	string		x		\b, date %15.15s
16881>>5	string		x		\b, version %6.6s
16882!:mime	rinex/navigation
16883>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
16884>>&32	string		x		\b, date %15.15s
16885>>5	string		x		\b, version %6.6s
16886!:mime	rinex/navigation
16887>80	search/256	XXRINEXM	RINEX Data, Meteorological
16888>>&32	string		x		\b, date %15.15s
16889>>5	string		x		\b, version %6.6s
16890!:mime	rinex/meteorological
16891>80	search/256	XXRINEXN	RINEX Data, Navigation
16892>>&32	string		x		\b, date %15.15s
16893>>5	string		x		\b, version %6.6s
16894!:mime	rinex/navigation
16895>80	search/256	XXRINEXO	RINEX Data, Observation
16896>>&32	string		x		\b, date %15.15s
16897>>5	string		x		\b, version %6.6s
16898!:mime	rinex/observation
16899
16900# https://en.wikipedia.org/wiki/GRIB
169010	string	GRIB
16902>7	byte	=1	Gridded binary (GRIB) version 1
16903>7	byte	=2	Gridded binary (GRIB) version 2
16904
16905#------------------------------------------------------------------------------
16906# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $
16907# Micro Focus COBOL data files.
16908
16909# http://documentation.microfocus.com/help/index.jsp?topic=\
16910# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
16911# http://www.cobolproducts.com/datafile/data-viewer.html
16912# https://github.com/miracle2k/mfcobol-export
16913
169140 string \x30\x00\x00\x7C
16915>36 string \x00\x3E Micro Focus File with Header (DAT)
16916!:mime application/octet-stream
16917
169180 string \x30\x7E\x00\x00
16919>36 string \x00\x3E Micro Focus File with Header (DAT)
16920!:mime application/octet-stream
16921
1692239 string \x02
16923>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX)
16924!:mime application/octet-stream
16925
16926#------------------------------------------------------------------------------
16927# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
16928# mime:  file(1) magic for MIME encoded files
16929#
169300	string/t		Content-Type:\040
16931>14	string		>\0		%s
169320	string/t		Content-Type:
16933>13	string		>\0		%s
16934
16935#------------------------------------------------------------------------------
16936# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
16937# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
16938# and DEC Ultrix
16939#
169400	beshort	0x0160		MIPSEB ECOFF executable
16941>20	beshort	0407		(impure)
16942>20	beshort	0410		(swapped)
16943>20	beshort	0413		(paged)
16944>8	belong	>0		not stripped
16945>8	belong	0		stripped
16946>22	byte	x		- version %d
16947>23	byte	x		\b.%d
16948#
169490	beshort	0x0162		MIPSEL-BE ECOFF executable
16950>20	beshort	0407		(impure)
16951>20	beshort	0410		(swapped)
16952>20	beshort	0413		(paged)
16953>8	belong	>0		not stripped
16954>8	belong	0		stripped
16955>23	byte	x		- version %d
16956>22	byte	x		\b.%d
16957#
169580	beshort	0x6001		MIPSEB-LE ECOFF executable
16959>20	beshort	03401		(impure)
16960>20	beshort	04001		(swapped)
16961>20	beshort	05401		(paged)
16962>8	belong	>0		not stripped
16963>8	belong	0		stripped
16964>23	byte	x		- version %d
16965>22	byte	x		\b.%d
16966#
169670	beshort	0x6201		MIPSEL ECOFF executable
16968>20	beshort	03401		(impure)
16969>20	beshort	04001		(swapped)
16970>20	beshort	05401		(paged)
16971>8	belong	>0		not stripped
16972>8	belong	0		stripped
16973>23	byte	x		- version %d
16974>22	byte	x		\b.%d
16975#
16976# MIPS 2 additions
16977#
169780	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
16979>20	beshort	0407		(impure)
16980>20	beshort	0410		(swapped)
16981>20	beshort	0413		(paged)
16982>8	belong	>0		not stripped
16983>8	belong	0		stripped
16984>22	byte	x		- version %d
16985>23	byte	x		\b.%d
16986#
169870	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
16988>20	beshort	0407		(impure)
16989>20	beshort	0410		(swapped)
16990>20	beshort	0413		(paged)
16991>8	belong	>0		not stripped
16992>8	belong	0		stripped
16993>22	byte	x		- version %d
16994>23	byte	x		\b.%d
16995#
169960	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
16997>20	beshort	03401		(impure)
16998>20	beshort	04001		(swapped)
16999>20	beshort	05401		(paged)
17000>8	belong	>0		not stripped
17001>8	belong	0		stripped
17002>23	byte	x		- version %d
17003>22	byte	x		\b.%d
17004#
170050	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
17006>20	beshort	03401		(impure)
17007>20	beshort	04001		(swapped)
17008>20	beshort	05401		(paged)
17009>8	belong	>0		not stripped
17010>8	belong	0		stripped
17011>23	byte	x		- version %d
17012>22	byte	x		\b.%d
17013#
17014# MIPS 3 additions
17015#
170160	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
17017>20	beshort	0407		(impure)
17018>20	beshort	0410		(swapped)
17019>20	beshort	0413		(paged)
17020>8	belong	>0		not stripped
17021>8	belong	0		stripped
17022>22	byte	x		- version %d
17023>23	byte	x		\b.%d
17024#
170250	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
17026>20	beshort	0407		(impure)
17027>20	beshort	0410		(swapped)
17028>20	beshort	0413		(paged)
17029>8	belong	>0		not stripped
17030>8	belong	0		stripped
17031>22	byte	x		- version %d
17032>23	byte	x		\b.%d
17033#
170340	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
17035>20	beshort	03401		(impure)
17036>20	beshort	04001		(swapped)
17037>20	beshort	05401		(paged)
17038>8	belong	>0		not stripped
17039>8	belong	0		stripped
17040>23	byte	x		- version %d
17041>22	byte	x		\b.%d
17042#
170430	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
17044>20	beshort	03401		(impure)
17045>20	beshort	04001		(swapped)
17046>20	beshort	05401		(paged)
17047>8	belong	>0		not stripped
17048>8	belong	0		stripped
17049>23	byte	x		- version %d
17050>22	byte	x		\b.%d
17051#
170520	beshort	0x180		MIPSEB Ucode
170530	beshort	0x182		MIPSEL-BE Ucode
17054
17055#------------------------------------------------------------------------------
17056# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
17057# mirage:  file(1) magic for Mirage executables
17058#
17059# XXX - byte order?
17060#
170610	long	31415		Mirage Assembler m.out executable
17062
17063#-----------------------------------------------------------------------------
17064# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $
17065# misctools:  file(1) magic for miscellaneous UNIX tools.
17066#
170670	search/1	%%!!			X-Post-It-Note text
170680	string/c	BEGIN:VCALENDAR		vCalendar calendar file
17069!:mime	text/calendar
17070# updated by Joerg Jenderek at Apr 2015
17071# Extension: .vcf
17072# http://en.wikipedia.org/wiki/VCard
170730	string/c	BEGIN:VCARD		vCard visiting card
17074# deprecated
17075#!:mime	text/x-vcard
17076!:mime	text/vcard
17077# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
17078>12	search/14000/c	VERSION:
17079# VERSION 2.1 , 3.0 or 4.0
17080>>&0	string		x			\b, version %-.3s
17081
17082# Summary: Libtool library file
17083# Extension: .la
17084# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
170850	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file
17086
17087# Summary: Libtool object file
17088# Extension: .lo
17089# Submitted by: Abel Cheung <abelcheung@gmail.com>
170900	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file
17091
17092# From: Daniel Novotny <dnovotny@redhat.com>
17093# Update: Joerg Jenderek
17094# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
17095# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
17096#
17097# "Windows Minidump" by TrID
17098# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
170990	string		MDMP					Mini DuMP crash report
17100# http://filext.com/file-extension/DMP
17101!:mime	application/x-dmp
17102!:ext	dmp/mdmp
17103# The high-order word is an internal value that is implementation specific.
17104# The low-order word is MINIDUMP_VERSION 0xA793
17105>4	ulelong&0x0000FFFF	!0xA793				\b, version 0x%4.4x
17106# NumberOfStreams 8,9,10,13
17107>8	ulelong			x				\b, %d streams
17108# StreamDirectoryRva 0x20
17109>12	ulelong			!0x20				\b, 0x%8.8x RVA
17110# CheckSum 0
17111>16	ulelong			!0				\b, CheckSum 0x%8.8x
17112# Reserved or TimeDateStamp
17113>20	ledate			x				\b, %s
17114# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
17115# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
17116>24	ulelong			x				\b, 0x%x type
17117# >24	ulelong			>0				\b; include
17118# >>24	ulelong			&0x00000001			\b data sections,
17119# >>24	ulelong			&0x00000020			\b list of unloaded modules,
17120# >>24	ulelong			&0x00000100			\b process and thread information,
17121# >>24	ulelong			&0x00000800			\b memory information,
17122
17123# Summary: abook addressbook file
17124# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
171250	string	#\x20abook\x20addressbook\x20file abook address book
17126!:mime application/x-abook-addressbook
17127
17128#------------------------------------------------------------------------------
17129# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
17130# mkid:  file(1) magic for mkid(1) databases
17131#
17132# ID is the binary tags database produced by mkid(1).
17133#
17134# XXX - byte order?
17135#
171360	string		\311\304	ID tags data
17137>2	short		>0		version %d
17138
17139#------------------------------------------------------------------------------
17140# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
17141# mlssa: file(1) magic for MLSSA datafiles
17142#
171430		lelong		0xffffabcd	MLSSA datafile,
17144>4		leshort		x		algorithm %d,
17145>10		lelong		x		%d samples
17146
17147#------------------------------------------------------------------------------
17148# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
17149# mmdf:  file(1) magic for MMDF mail files
17150#
171510	string	\001\001\001\001	MMDF mailbox
17152
17153#------------------------------------------------------------------------------
17154# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $
17155# modem:  file(1) magic for modem programs
17156#
17157# From: Florian La Roche <florian@knorke.saar.de>
171581	string		PC\ Research,\ Inc	Digifax-G3-File
17159>29	byte		1			\b, fine resolution
17160>29	byte		0			\b, normal resolution
17161
17162# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
17163# Modified by: Joerg Jenderek
17164# URL: https://de.wikipedia.org/wiki/Fax
17165# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
17166# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
171670	short		0x0100
17168# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
17169>2	search/9	\0\0
17170# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
17171>2	default		x
17172# skip IRCAM file (VAX big-endian)	./audio
17173>>0	belong		!0x0001a364
17174# skip GEM Image data			./images
17175>>>2	beshort		!0x0008
17176# look for first keyword of Panorama database *.pan
17177>>>>11	search/262	\x06DESIGN
17178# skip Panorama database
17179>>>>11	default		x
17180# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
17181>>>>>27118	search/1864	DreamWorld
17182>>>>>27118	default		x
17183# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
17184>>>>>>8		ubequad		!0x2e01010454010203
17185# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
17186>>>>>>>8	ubequad		!0x5dee74ad1aa56394	raw G3 (Group 3) FAX, byte-padded
17187# version 5.25 labeled the entry above "raw G3 data, byte-padded"
17188!:mime	image/g3fax
17189#!:apple	????TIFF
17190!:ext	g3
17191# unusual image starting with black pixel
17192#0	short		0x1300		raw G3 (Group 3) FAX
171930	short		0x1400
17194# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
17195>2	search/9	\0\0
17196# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
17197>2	default		x		raw G3 (Group 3) FAX
17198# version 5.25 labeled the above entry as "raw G3 data"
17199!:mime	image/g3fax
17200!:ext	g3
17201# unusual image with black pixel near beginning
17202#0	short		0x1900		raw G3 (Group 3) FAX
17203
17204#
17205# Magic data for vgetty voice formats
17206# (Martin Seine & Marc Eberhard)
17207
17208#
17209# raw modem data version 1
17210#
172110    string    RMD1      raw modem data
17212>4   string    >\0       (%s /
17213>20  short     >0        compression type 0x%04x)
17214
17215#
17216# portable voice format 1
17217#
172180    string    PVF1\n         portable voice format
17219>5   string    >\0       (binary %s)
17220
17221#
17222# portable voice format 2
17223#
172240    string    PVF2\n         portable voice format
17225>5   string >\0          (ascii %s)
17226
17227# From: Bernd Nuernberger <bernd.nuernberger@web.de>
17228# Brooktrout G3 fax data incl. 128 byte header
17229# Common suffixes: 3??, BRK, BRT, BTR
172300	leshort		0x01bb
17231>2	leshort		0x0100		Brooktrout 301 fax image,
17232>>9	leshort		x		%d x
17233>>0x2d	leshort		x		%d
17234>>6	leshort		200		\b, fine resolution
17235>>6	leshort		100		\b, normal resolution
17236>>11	byte		1		\b, G3 compression
17237>>11	byte		2		\b, G32D compression
17238
17239#------------------------------------------------------------------------------
17240# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
17241# motorola:  file(1) magic for Motorola 68K and 88K binaries
17242#
17243# 68K
17244#
172450	beshort		0520		mc68k COFF
17246>18	beshort		^00000020	object
17247>18	beshort		&00000020	executable
17248>12	belong		>0		not stripped
17249>168	string		.lowmem		Apple toolbox
17250>20	beshort		0407		(impure)
17251>20	beshort		0410		(pure)
17252>20	beshort		0413		(demand paged)
17253>20	beshort		0421		(standalone)
172540	beshort		0521		mc68k executable (shared)
17255>12	belong		>0		not stripped
172560	beshort		0522		mc68k executable (shared demand paged)
17257>12	belong		>0		not stripped
17258#
17259# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
17260#
172610	beshort		0554		68K BCS executable
17262#
17263# 88K
17264#
17265# Motorola/88Open BCS
17266#
172670	beshort		0555		88K BCS executable
17268#
17269# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
172700   string      S0          Motorola S-Record; binary data in text format
17271
17272# ATARI ST relocatable PRG
17273#
17274# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
17275# (according to Roland Waldi, Oct 21, 1987)
17276# besides the magic 0x601a, the text segment size is checked to be
17277# not larger than 1 MB (which is a lot on ST).
17278# The additional 0x601b distinction I took from Doug Lee's magic.
172790	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
17280>2	belong			x		(txt=%d,
17281>6	belong			x		dat=%d,
17282>10	belong			x		bss=%d,
17283>14	belong			x		sym=%d)
172840	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
17285>2	belong			x		(txt=%d,
17286>6	belong			x		dat=%d,
17287>10	belong			x		bss=%d,
17288>14	belong			x		sym=%d)
17289
17290# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
172910       beshort         0x601A          Atari 68xxx executable,
17292>2      belong          x               text len %u,
17293>6      belong          x               data len %u,
17294>10     belong          x               BSS len %u,
17295>14     belong          x               symboltab len %u,
17296>18     belong          0
17297>22     belong          &0x01           fastload flag,
17298>22     belong          &0x02           may be loaded to alternate RAM,
17299>22     belong          &0x04           malloc may be from alternate RAM,
17300>22     belong          x               flags: 0x%X,
17301>26     beshort         0               no relocation tab
17302>26     beshort         !0              + relocation tab
17303>30     string          SFX             [Self-Extracting LZH SFX archive]
17304>38     string          SFX             [Self-Extracting LZH SFX archive]
17305>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
17306
173070       beshort         0x0064          Atari 68xxx CPX file
17308>8      beshort         x               (version %04x)
17309
17310#------------------------------------------------------------------------------
17311# $File: mozilla,v 1.7 2017/03/17 21:35:28 christos Exp $
17312# mozilla:  file(1) magic for Mozilla XUL fastload files
17313# (XUL.mfasl and XPC.mfasl)
17314# URL:	http://www.mozilla.org/
17315# From:	Josh Triplett <josh@freedesktop.org>
17316
173170	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
173180	string	mozLz4a				Mozilla lz4 compressed bookmark data
17319
17320#------------------------------------------------------------------------------
17321# $File: msdos,v 1.118 2017/05/20 19:55:27 christos Exp $
17322# msdos:  file(1) magic for MS-DOS files
17323#
17324
17325# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
17326# updated by Joerg Jenderek at Oct 2008,Apr 2011
173270	string/t	@
17328>1	string/cW	\ echo\ off	DOS batch file text
17329!:mime	text/x-msdos-batch
17330>1	string/cW	echo\ off	DOS batch file text
17331!:mime	text/x-msdos-batch
17332>1	string/cW	rem		DOS batch file text
17333!:mime	text/x-msdos-batch
17334>1	string/cW	set\ 		DOS batch file text
17335!:mime	text/x-msdos-batch
17336
17337
17338# OS/2 batch files are REXX. the second regex is a bit generic, oh well
17339# the matched commands seem to be common in REXX and uncommon elsewhere
17340100	search/0xffff   rxfuncadd
17341>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
17342100	search/0xffff   say
17343>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
17344
17345# updated by Joerg Jenderek at Oct 2015
17346# https://de.wikipedia.org/wiki/Common_Object_File_Format
17347# http://www.delorie.com/djgpp/doc/coff/filhdr.html
17348# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
17349#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
17350#>4	ledate		x	stamp %s
173510	leshort		0x166	MS Windows COFF MIPS R4000 object file
17352#>4	ledate		x	stamp %s
173530	leshort		0x184	MS Windows COFF Alpha object file
17354#>4	ledate		x	stamp %s
173550	leshort		0x268	MS Windows COFF Motorola 68000 object file
17356#>4	ledate		x	stamp %s
173570	leshort		0x1f0	MS Windows COFF PowerPC object file
17358#>4	ledate		x	stamp %s
173590	leshort		0x290	MS Windows COFF PA-RISC object file
17360#>4	ledate		x	stamp %s
17361
17362# Tests for various EXE types.
17363#
17364# Many of the compressed formats were extraced from IDARC 1.23 source code.
17365#
173660	string/b	MZ
17367# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
17368>0x18	leshort <0x40 MS-DOS executable
17369!:mime	application/x-dosexec
17370# These traditional tests usually work but not always.  When test quality support is
17371# implemented these can be turned on.
17372#>>0x18	leshort	0x1c	(Borland compiler)
17373#>>0x18	leshort	0x1e	(MS compiler)
17374
17375# If the relocation table is 0x40 or more bytes into the file, it's definitely
17376# not a DOS EXE.
17377>0x18  leshort >0x3f
17378
17379# Maybe it's a PE?
17380>>(0x3c.l) string PE\0\0 PE
17381!:mime	application/x-dosexec
17382>>>(0x3c.l+24)	leshort		0x010b	\b32 executable
17383>>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
17384>>>(0x3c.l+24)	leshort		0x0107	ROM image
17385>>>(0x3c.l+24)	default		x	Unknown PE signature
17386>>>>&0 		leshort		x	0x%x
17387>>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
17388>>>(0x3c.l+92)	leshort		1	(native)
17389>>>(0x3c.l+92)	leshort		2	(GUI)
17390>>>(0x3c.l+92)	leshort		3	(console)
17391>>>(0x3c.l+92)	leshort		7	(POSIX)
17392>>>(0x3c.l+92)	leshort		9	(Windows CE)
17393>>>(0x3c.l+92)	leshort		10	(EFI application)
17394>>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
17395>>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
17396>>>(0x3c.l+92)	leshort		13	(EFI ROM)
17397>>>(0x3c.l+92)	leshort		14	(XBOX)
17398>>>(0x3c.l+92)	leshort		15	(Windows boot application)
17399>>>(0x3c.l+92)	default		x	(Unknown subsystem
17400>>>>&0		leshort		x	0x%x)
17401>>>(0x3c.l+4)	leshort		0x14c	Intel 80386
17402>>>(0x3c.l+4)	leshort		0x166	MIPS R4000
17403>>>(0x3c.l+4)	leshort		0x168	MIPS R10000
17404>>>(0x3c.l+4)	leshort		0x184	Alpha
17405>>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
17406>>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
17407>>>(0x3c.l+4)	leshort		0x1c0	ARM
17408>>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
17409>>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
17410>>>(0x3c.l+4)	leshort		0x1f0	PowerPC
17411>>>(0x3c.l+4)	leshort		0x200	Intel Itanium
17412>>>(0x3c.l+4)	leshort		0x266	MIPS16
17413>>>(0x3c.l+4)	leshort		0x268	Motorola 68000
17414>>>(0x3c.l+4)	leshort		0x290	PA-RISC
17415>>>(0x3c.l+4)	leshort		0x366	MIPSIV
17416>>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
17417>>>(0x3c.l+4)	leshort		0xebc	EFI byte code
17418>>>(0x3c.l+4)	leshort		0x8664	x86-64
17419>>>(0x3c.l+4)	leshort		0xc0ee	MSIL
17420>>>(0x3c.l+4)	default		x	Unknown processor type
17421>>>>&0		leshort		x	0x%x
17422>>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
17423>>>(0x3c.l+22)	leshort&0x1000	>0	system file
17424>>>(0x3c.l+24)	leshort		0x010b
17425>>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
17426>>>(0x3c.l+24)	leshort		0x020b
17427>>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
17428
17429# hooray, there's a DOS extender using the PE format, with a valid PE
17430# executable inside (which just prints a message and exits if run in win)
17431>>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
17432>>>(8.s*16)		string		!32STUB	\b, for MS Windows
17433>>>(0x3c.l+0xf8)	string		UPX0 \b, UPX compressed
17434>>>(0x3c.l+0xf8)	search/0x140	PEC2 \b, PECompact2 compressed
17435>>>(0x3c.l+0xf8)	search/0x140	UPX2
17436>>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
17437>>>(0x3c.l+0xf8)	search/0x140	.idata
17438>>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
17439>>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
17440>>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
17441>>>(0x3c.l+0xf8)	search/0x140	.rsrc
17442>>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
17443>>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
17444>>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
17445>>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
17446>>>(0x3c.l+0xf8)	search/0x140	.data
17447>>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
17448>>>(0x3c.l+0xf8)	search/0x140	.petite\0 \b, Petite compressed
17449>>>>(0x3c.l+0xf7)	byte		x
17450>>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
17451>>>(0x3c.l+0xf8)	search/0x140	.WISE \b, WISE installer self-extracting archive
17452>>>(0x3c.l+0xf8)	search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
17453>>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
17454>>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
17455>>>0x30			string		Inno \b, InnoSetup self-extracting archive
17456
17457# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
17458# must be one of the unusual subformats.
17459>>(0x3c.l) string !PE\0\0 MS-DOS executable
17460!:mime	application/x-dosexec
17461
17462>>(0x3c.l)		string		NE \b, NE
17463!:mime	application/x-dosexec
17464>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
17465>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
17466>>>(0x3c.l+0x36)	byte		3 for MS-DOS
17467>>>(0x3c.l+0x36)	byte		4 for Windows 386
17468>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
17469>>>(0x3c.l+0x36)	default		x
17470>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
17471>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
17472>>>(0x3c.l+0x0c)	leshort&0x8003	0x8002 (DLL)
17473>>>(0x3c.l+0x0c)	leshort&0x8003	0x8001 (driver)
17474>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
17475>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
17476
17477>>(0x3c.l)		string		LX\0\0 \b, LX
17478!:mime	application/x-dosexec
17479>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
17480>>>(0x3c.l+0x0a)	leshort		1 for OS/2
17481>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
17482>>>(0x3c.l+0x0a)	leshort		3 for DOS
17483>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
17484>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
17485>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
17486>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
17487>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
17488>>>(0x3c.l+0x08)	leshort		1 i80286
17489>>>(0x3c.l+0x08)	leshort		2 i80386
17490>>>(0x3c.l+0x08)	leshort		3 i80486
17491>>>(8.s*16)		string		emx \b, emx
17492>>>>&1			string		x %s
17493>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
17494
17495# MS Windows system file, supposedly a collection of LE executables
17496>>(0x3c.l)		string		W3 \b, W3 for MS Windows
17497!:mime	application/x-dosexec
17498
17499>>(0x3c.l)		string		LE\0\0 \b, LE executable
17500!:mime	application/x-dosexec
17501>>>(0x3c.l+0x0a)	leshort		1
17502# some DOS extenders use LE files with OS/2 header
17503>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
17504>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
17505>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
17506>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
17507>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
17508>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
17509>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
17510# this is a wild guess; hopefully it is a specific signature
17511>>>>&0x24		lelong		<0x50
17512>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
17513>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
17514# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
17515#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
17516# fails with DOS-Extenders.
17517>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
17518>>>(0x3c.l+0x0a)	leshort		3 for DOS
17519>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
17520>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
17521>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
17522
17523# looks like ASCII, probably some embedded copyright message.
17524# and definitely not NE/LE/LX/PE
17525>>0x3c		lelong	>0x20000000
17526>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
17527!:mime	application/x-dosexec
17528# header data too small for extended executable
17529>2		long	!0
17530>>0x18		leshort <0x40
17531>>>(4.s*512)	leshort !0x014c
17532
17533>>>>&(2.s-514)	string	!LE
17534>>>>>&-2	string	!BW \b, MZ for MS-DOS
17535!:mime	application/x-dosexec
17536>>>>&(2.s-514)	string	LE \b, LE
17537>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
17538# educated guess since indirection is still not capable enough for complex offset
17539# calculations (next embedded executable would be at &(&2*512+&0-2)
17540# I suspect there are only LE executables in these multi-exe files
17541>>>>&(2.s-514)	string	BW
17542>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
17543>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
17544
17545# This sequence skips to the first COFF segment, usually .text
17546>(4.s*512)	leshort		0x014c \b, COFF
17547!:mime	application/x-dosexec
17548>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
17549>>(8.s*16)	string		emx
17550>>>&1		string		x for DOS, Win or OS/2, emx %s
17551>>&(&0x42.l-3)	byte		x
17552>>>&0x26	string		UPX \b, UPX compressed
17553# and yet another guess: small .text, and after large .data is unusal, could be 32lite
17554>>&0x2c		search/0xa0	.text
17555>>>&0x0b	lelong		<0x2000
17556>>>>&0		lelong		>0x6000 \b, 32lite compressed
17557
17558>(8.s*16) string $WdX \b, WDos/X DOS extender
17559
17560# By now an executable type should have been printed out.  The executable
17561# may be a self-uncompressing archive, so look for evidence of that and
17562# print it out.
17563#
17564# Some signatures below from Greg Roelofs, newt@uchicago.edu.
17565#
17566>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
17567>0xe7	string	LH/2\ 	Self-Extract \b, %s
17568>0x1c	string	UC2X	\b, UCEXE compressed
17569>0x1c	string	WWP\ 	\b, WWPACK compressed
17570>0x1c	string	RJSX 	\b, ARJ self-extracting archive
17571>0x1c	string	diet 	\b, diet compressed
17572>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
17573>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
17574>0x1c	string	tz 	\b, TinyProg compressed
17575>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
17576!:mime	application/zip
17577# Yes, this really is "Copr", not "Corp."
17578>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
17579!:mime	application/zip
17580# winarj stores a message in the stub instead of the sig in the MZ header
17581>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
17582>0x20	string AIN
17583>>0x23	string 2	\b, AIN 2.x compressed
17584>>0x23	string <2	\b, AIN 1.x compressed
17585>>0x23	string >2	\b, AIN 1.x compressed
17586>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
17587!:mime	application/x-lha
17588>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
17589!:mime	application/x-lha
17590>0x24	string	\ $ARX \b, ARX self-extracting archive
17591>0x24	string	\ $LHarc \b, LHarc self-extracting archive
17592>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
17593>0x40	string aPKG \b, aPackage self-extracting archive
17594>0x64	string	W\ Collis\0\0 \b, Compack compressed
17595>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
17596>>&0xf4 search/0x140 \x0\x40\x1\x0
17597>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
17598>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
17599>0x17888 string Rar! \b, RAR self-extracting archive
17600
17601# Skip to the end of the EXE.  This will usually work fine in the PE case
17602# because the MZ image is hardcoded into the toolchain and almost certainly
17603# won't match any of these signatures.
17604>(4.s*512)	long	x
17605>>&(2.s-517)	byte	x
17606>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
17607>>>&0	string		Rar! \b, RAR self-extracting archive
17608>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
17609>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
17610>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
17611>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
17612>>>&7	search/400	**ACE** \b, ACE self-extracting archive
17613>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
17614
17615# a few unknown ZIP sfxes, no idea if they are needed or if they are
17616# already captured by the generic patterns above
17617>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
17618# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
17619#
17620
17621# TELVOX Teleinformatica CODEC self-extractor for OS/2:
17622>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
17623>>49824 leshort		=1			\b, 1 file
17624>>49824 leshort		>1			\b, %u files
17625
17626# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
17627# and http://www.freedos.org/software/?prog=kpdos
17628# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
176290	string/b	KCF		FreeDOS KEYBoard Layout collection
17630# only version=0x100 found
17631>3	uleshort	x		\b, version 0x%x
17632# length of string containing author,info and special characters
17633>6	ubyte		>0
17634#>>6	pstring		x		\b, name=%s
17635>>7	string		>\0		\b, author=%-.14s
17636>>7	search/254	\xff		\b, info=
17637#>>>&0	string		x		\b%-s
17638>>>&0	string		x		\b%-.15s
17639# for FreeDOS *.KL files
176400	string/b	KLF		FreeDOS KEYBoard Layout file
17641# only version=0x100 or 0x101 found
17642>3	uleshort	x		\b, version 0x%x
17643# stringlength
17644>5	ubyte		>0
17645>>8	string		x		\b, name=%-.2s
176460	string	\xffKEYB\ \ \ \0\0\0\0
17647>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
17648
17649# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
17650# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
176510	ulequad&0x07a0ffffffff		0xffffffff
17652>0	use				msdos-driver
176530       name    			msdos-driver		DOS executable (
17654#!:mime	application/octet-stream
17655!:mime	application/x-dosdriver
17656# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
17657!:ext	sys/dev/bin
17658>40	search/7			UPX!			\bUPX compressed
17659# DOS device driver attributes
17660>4	uleshort&0x8000			0x0000			\bblock device driver
17661# character device
17662>4	uleshort&0x8000			0x8000			\b
17663>>4	uleshort&0x0008			0x0008			\bclock
17664# fast video output by int 29h
17665>>4	uleshort&0x0010			0x0010			\bfast
17666# standard input/output device
17667>>4	uleshort&0x0003			>0			\bstandard
17668>>>4	uleshort&0x0001			0x0001			\binput
17669>>>4	uleshort&0x0003			0x0003			\b/
17670>>>4	uleshort&0x0002			0x0002			\boutput
17671>>4	uleshort&0x8000			0x8000			\bcharacter device driver
17672>0	ubyte				x
17673# upx compressed device driver has garbage instead of real in name field of header
17674>>40	search/7			UPX!
17675>>40	default				x
17676# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
17677>>>12		ubyte			>0x2E			\b
17678>>>>10		ubyte			>0x20
17679>>>>>10		ubyte			!0x2E
17680>>>>>>10	ubyte			!0x2A			\b%c
17681>>>>11		ubyte			>0x20
17682>>>>>11		ubyte			!0x2E			\b%c
17683>>>>12		ubyte			>0x20
17684>>>>>12		ubyte			!0x39
17685>>>>>>12	ubyte			!0x2E			\b%c
17686>>>13		ubyte			>0x20
17687>>>>13		ubyte			!0x2E			\b%c
17688>>>>14		ubyte			>0x20
17689>>>>>14		ubyte			!0x2E			\b%c
17690>>>>15		ubyte			>0x20
17691>>>>>15		ubyte			!0x2E			\b%c
17692>>>>16		ubyte			>0x20
17693>>>>>16		ubyte			!0x2E
17694>>>>>>16	ubyte			<0xCB			\b%c
17695>>>>17		ubyte			>0x20
17696>>>>>17		ubyte			!0x2E
17697>>>>>>17	ubyte			<0x90			\b%c
17698# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
17699>>>12		ubyte			<0x2F
17700# they have their real name at offset 22
17701# also block device drivers like DUMBDRV.SYS
17702>>>>22		string			>\056			%-.6s
17703>4	uleshort&0x8000			0x0000
17704# 32 bit sector addressing ( > 32 MB) for block devices
17705>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
17706# support by driver functions 13h, 17h, 18h
17707>4	uleshort&0x0040			0x0040			\b,IOCTL-
17708# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
17709>4	uleshort&0x0800			0x0800			\b,close media-
17710# output until busy support by int 10h for character device driver
17711>4	uleshort&0x8000			0x8000
17712>>4	uleshort&0x2000			0x2000			\b,until busy-
17713# direct read/write support by driver functions 03h,0Ch
17714>4	uleshort&0x4000			0x4000			\b,control strings-
17715>4	uleshort&0x8000			0x8000
17716>>4	uleshort&0x6840			>0			\bsupport
17717>4	uleshort&0x8000			0x0000
17718>>4	uleshort&0x4842			>0			\bsupport
17719>0	ubyte				x			\b)
17720# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
177210	ulequad				0x0513c00000000012
17722>0	use				msdos-driver
17723# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
177240	ulequad				0x32f28000ffff0016
17725>0	use				msdos-driver
177260	ulequad				0x007f00000000ffff
17727>0	use				msdos-driver
177280	ulequad				0x001600000000ffff
17729>0	use				msdos-driver
17730# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
177310	ulequad				0x0bf708c2ffffffff
17732>0	use				msdos-driver
177330	ulequad				0x07bd08c2ffffffff
17734>0	use				msdos-driver
17735
17736# updated by Joerg Jenderek
17737# GRR: line below too general as it catches also
17738# rt.lib DYADISKS.PIC and many more
17739# start with assembler instruction MOV
177400	ubyte		0x8c
17741# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
17742>4	string			!O====
17743# skip some unknown basic binaries like RocketRnger.SHR
17744>>5	string			!MAIN
17745# skip "GPG symmetrically encrypted data" ./gnu
17746# skip "PGP symmetric key encrypted data" ./pgp
17747# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
17748>>>4	ubyte			>13	DOS executable (COM, 0x8C-variant)
17749# the remaining files should be DOS *.COM executables
17750# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
17751# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
17752# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
17753# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
17754# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
17755# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
17756# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
17757# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
17758!:mime	application/x-dosexec
17759!:ext com
17760
17761# updated by Joerg Jenderek at Oct 2008
177620	ulelong		0xffff10eb	DR-DOS executable (COM)
17763# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
177640	ubeshort&0xeb8d	>0xeb00
17765# DR-DOS STACKER.COM SCREATE.SYS missed
17766
177670       name    msdos-com
17768>0  byte        x               DOS executable (COM)
17769>6	string		SFX\ of\ LHarc	\b, %s
17770>0x1FE leshort	0xAA55		    \b, boot code
17771>85	string		UPX		        \b, UPX compressed
17772>4	string		\ $ARX		    \b, ARX self-extracting archive
17773>4	string		\ $LHarc	    \b, LHarc self-extracting archive
17774>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
17775
17776# JMP 8bit
177770	        byte	0xeb
17778# allow forward jumps only
17779>1          byte    >-1
17780# that offset must be accessible
17781>>(1.b+2)   byte    x
17782>>>0        use msdos-com
17783
17784# JMP 16bit
177850           byte    0xe9
17786# forward jumps
17787>1          short   >-1
17788# that offset must be accessible
17789>>(1.s+3)   byte    x
17790>>>0        use msdos-com
17791# negative offset, must not lead into PSP
17792>1          short   <-259
17793# that offset must be accessible
17794>>(1,s+65539)   byte    x
17795>>>0        use msdos-com
17796
17797# updated by Joerg Jenderek at Oct 2008,2015
17798# following line is too general
177990	ubyte		0xb8
17800# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
17801>0	string		!\xb8\xc0\x07\x8e
17802# modified by Joerg Jenderek
17803# syslinux COM32 or COM32R executable
17804>>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
17805# http://www.syslinux.org/wiki/index.php/Comboot_API
17806# Since version 5.00 c32 modules switched from the COM32 object format to ELF
17807!:mime	application/x-c32-comboot-syslinux-exec
17808!:ext c32
17809# http://syslinux.zytor.com/comboot.php
17810# older syslinux version ( <4 )
17811# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
17812# start with assembler instructions mov eax,21cd4cffh
17813>>>1	lelong		0x21CD4CFf	\b)
17814# syslinux:doc/comboot.txt
17815# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
17816# eax,21cd4cfeh) as a magic number.
17817# syslinux version (4.x)
17818# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
17819>>>1	lelong		0x21CD4CFe	\b, relocatable)
17820# remaining are DOS COM executables starting with assembler instruction MOV
17821# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
17822# MS-DOS SYS.COM RESTART.COM
17823# SYSLINUX.COM (version 1.40 - 2.13)
17824# GFXBOOT.COM (version 3.75)
17825# COPYBS.COM POWEROFF.COM INT18.COM
17826>>1	default	x			COM executable for DOS
17827!:mime	application/x-dosexec
17828#!:mime	application/x-ms-dos-executable
17829#!:mime	application/x-msdos-program
17830!:ext com
17831
178320	string/b	\x81\xfc
17833>4	string	\x77\x02\xcd\x20\xb9
17834>>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
17835252	string Must\ have\ DOS\ version DR-DOS executable (COM)
17836# added by Joerg Jenderek at Oct 2008
17837# GRR search is not working
17838#34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
1783934	string	UPX!			FREE-DOS executable (COM), UPX compressed
1784035	string	UPX!			FREE-DOS executable (COM), UPX compressed
17841# GRR search is not working
17842#2	search/28	\xcd\x21	COM executable for MS-DOS
17843#WHICHFAT.cOM
178442	string	\xcd\x21		COM executable for DOS
17845#DELTREE.cOM DELTREE2.cOM
178464	string	\xcd\x21		COM executable for DOS
17847#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
178485	string	\xcd\x21		COM executable for DOS
17849#DELTMP.COm HASFAT32.cOM
178507	string	\xcd\x21
17851>0	byte	!0xb8			COM executable for DOS
17852#COMP.cOM MORE.COm
1785310	string	\xcd\x21
17854>5	string	!\xcd\x21		COM executable for DOS
17855#comecho.com
1785613	string	\xcd\x21		COM executable for DOS
17857#HELP.COm EDIT.coM
1785818	string	\xcd\x21		COM executable for MS-DOS
17859#NWRPLTRM.COm
1786023	string	\xcd\x21		COM executable for MS-DOS
17861#LOADFIX.cOm LOADFIX.cOm
1786230	string	\xcd\x21		COM executable for MS-DOS
17863#syslinux.com 3.11
1786470	string	\xcd\x21		COM executable for DOS
17865# many compressed/converted COMs start with a copy loop instead of a jump
178660x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
178670x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
17868>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
178690x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
17870# FIXME: missing diet .com compression
17871
17872# miscellaneous formats
178730	string/b	LZ		MS-DOS executable (built-in)
17874#0	byte		0xf0		MS-DOS program library data
17875#
17876
17877# AAF files:
17878# <stuartc@rd.bbc.co.uk> Stuart Cunningham
178790	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
17880>30	byte	9		(512B sectors)
17881>30	byte	12		(4kB sectors)
178820	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
17883>30	byte	9		(512B sectors)
17884>30	byte	12		(4kB sectors)
17885
17886# Popular applications
178872080	string	Microsoft\ Word\ 6.0\ Document	%s
17888!:mime	application/msword
178892080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
17890!:mime	application/msword
17891# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
178922112	string	MSWordDoc			Microsoft Word document data
17893!:mime	application/msword
17894#
178950	belong	0x31be0000			Microsoft Word Document
17896!:mime	application/msword
17897#
178980	string/b	PO^Q`				Microsoft Word 6.0 Document
17899!:mime	application/msword
17900#
179014   long        0
17902>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
17903!:mime	application/msword
17904!:ext   mcw
17905>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
17906!:mime	application/msword
17907!:ext   mcw
17908>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
17909!:mime	application/msword
17910!:ext   mcw
17911>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
17912!:mime	application/msword
17913!:ext   mcw
17914
179150	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
17916!:mime	application/msword
17917!:ext   doc
17918512	string/b	\354\245\301			Microsoft Word Document
17919!:mime	application/msword
17920
17921#
179220	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
17923!:mime application/msword
17924#
179252080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
17926!:mime	application/vnd.ms-excel
17927#
179280	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
17929!:mime application/msword
17930
179312080	string	Foglio\ di\ lavoro\ Microsoft\ Exce	%s
17932!:mime	application/vnd.ms-excel
17933#
17934# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
179352114	string	Biff5		Microsoft Excel 5.0 Worksheet
17936!:mime	application/vnd.ms-excel
17937# Italian MS-Excel
179382121	string	Biff5		Microsoft Excel 5.0 Worksheet
17939!:mime	application/vnd.ms-excel
179400	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
17941!:mime	application/vnd.ms-excel
17942#
17943# Update: Joerg Jenderek
17944# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
17945# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
17946# Note: newer Lotus versions >2 use longer BOF record
17947# record type (BeginningOfFile=0000h) + length (001Ah)
179480	belong	0x00001a00
17949# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
17950#>18	uleshort&0x73E0	0
17951# Lotus Multi Byte Character Set (LMBCS=1-31)
17952>20	ubyte		>0
17953>>20	ubyte		<32	Lotus 1-2-3
17954#!:mime	application/x-123
17955!:mime	application/vnd.lotus-1-2-3
17956!:apple	????L123
17957# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
17958>>>4	uleshort	0x1000	WorKsheet, version 3
17959!:ext	wk3
17960# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
17961>>>4	uleshort	0x1002	WorKsheet, version 4
17962# also worksheet template 4 (.wt4)
17963!:ext	wk4/wt4
17964# no example or documentation for wk5
17965#>>4	uleshort	0x????	WorKsheet, version 4
17966#!:ext	wk5
17967# only MacrotoScript.123 example
17968>>>4	uleshort	0x1003	WorKsheet, version 97
17969# also worksheet template Smartmaster (.12M)?
17970!:ext	123
17971# only Set_Y2K.123 example
17972>>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
17973!:ext	123
17974# no example for this version
17975>>>4	uleshort	0x8001	FoRMatting data
17976!:ext	frm
17977# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
17978# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
17979>>>4	uleshort	0x8007	ForMatting data, version 3
17980!:ext	fm3
17981>>>4	default		x	unknown
17982# file revision sub code 0004h for worksheets
17983>>>>6	uleshort	=0x0004	worksheet
17984!:ext	wXX
17985>>>>6	uleshort	!0x0004	formatting data
17986!:ext	fXX
17987# main revision number
17988>>>>4	uleshort	x	\b, revision 0x%x
17989>>>6	uleshort	=0x0004	\b, cell range
17990# active cellcoord range (start row, page,column ; end row, page, column)
17991# start values normally 0~1st sheet A1
17992>>>>8	ulelong		!0
17993>>>>>10	ubyte		>0	\b%d*
17994>>>>>8	uleshort	x	\b%d,
17995>>>>>11	ubyte		x	\b%d-
17996# end page mostly 0
17997>>>>14	ubyte		>0	\b%d*
17998# end raw, column normally not 0
17999>>>>12	uleshort	x	\b%d,
18000>>>>15	ubyte		x	\b%d
18001# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
18002>>>>20	ubyte		>1	\b, character set 0x%x
18003# flags
18004>>>>21	ubyte		x	\b, flags 0x%x
18005>>>6	uleshort	!0x0004
18006# record type (FONTNAME=00AEh)
18007>>>>30	search/29	\0\xAE
18008# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
18009>>>>>&4	string		>\0	\b, 1st font "%s"
18010#
18011# Update: Joerg Jenderek
18012# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
18013# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
18014# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
18015# record type (BeginningOfFile=0000h) + length (0002h)
180160	belong	0x00000200
18017# GRR: line above is too general as it catches also MS Windows CURsor
18018# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
18019!:strength -1
18020# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
18021>7	ubyte		0
18022# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
18023>>6	ubyte		>0	Lotus
18024# !:mime	application/x-123
18025!:mime	application/vnd.lotus-1-2-3
18026!:apple	????L123
18027# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
18028# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
18029>>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
18030!:ext	cnf
18031>>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
18032!:ext	cnf
18033>>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
18034!:ext	cnf
18035>>>4	uleshort	0x0802	Symphony CoNFiguration
18036!:ext	cnf
18037>>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
18038!:ext	cnf
18039>>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
18040!:ext	cnf
18041>>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
18042!:ext	cnf
18043>>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
18044!:ext	cnf
18045# (version 5.26) labeled the entry as "Lotus 123"
18046# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
18047>>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
18048# extension "wks" also for Microsoft Works document
18049!:ext	wks
18050# (version 5.26) labeled the entry as "Lotus 123"
18051# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
18052>>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
18053!:ext	wrk/wr1
18054# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
18055# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
18056>>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
18057# Symphony (.wr1)
18058!:ext	wk1/wr1
18059# no example for this japan version
18060>>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
18061!:ext	wj1
18062# no example or documentation for wk2
18063#>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
18064#!:ext	wk2
18065# undocumented japan version
18066>>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
18067!:ext	wj3
18068# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
18069>>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
18070# japan version 2.4J (fj3)
18071!:ext	fmt/fj3
18072# no example for this version
18073>>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
18074!:ext	frm
18075# (version 5.26) labeled the entry as "Lotus 1-2-3"
18076>>>4	default		x	unknown worksheet or configuration
18077!:ext	cnf
18078>>>>4	uleshort	x	\b, revision 0x%x
18079# 2nd record for most worksheets describes cells range
18080>>>6		use	lotus-cells
18081# 3nd record for most japan worksheets describes cells range
18082>>>(8.s+10)	use	lotus-cells
18083#	check and then display Lotus worksheet cells range
180840	name		lotus-cells
18085# look for type (RANGE=0006h) + length (0008h) at record begin
18086>0	ubelong	0x06000800	\b, cell range
18087# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
18088>>4	ulong		!0
18089>>>4	uleshort	x	\b%d,
18090>>>6	uleshort	x	\b%d-
18091# end of cell range
18092>>8	uleshort	x	\b%d,
18093>>10	uleshort	x	\b%d
18094# EndOfLotus123
180950	string/b		WordPro\0	Lotus WordPro
18096!:mime	application/vnd.lotus-wordpro
180970	string/b		WordPro\r\373	Lotus WordPro
18098!:mime	application/vnd.lotus-wordpro
18099
18100
18101# Summary: Script used by InstallScield to uninstall applications
18102# Extension: .isu
18103# Submitted by: unknown
18104# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
181050		string		\x71\xa8\x00\x00\x01\x02
18106>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
18107
18108# Winamp .avs
18109#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
181100	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
18111
18112# Windows Metafont .WMF
181130	string/b	\327\315\306\232	ms-windows metafont .wmf
181140	string/b	\002\000\011\000	ms-windows metafont .wmf
181150	string/b	\001\000\011\000	ms-windows metafont .wmf
18116
18117#tz3 files whatever that is (MS Works files)
181180	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
181190	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
181200	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
18121
18122# PGP sig files .sig
18123#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
181240 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
181250 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
181260 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
181270 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
181280 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
181290 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
18130
18131# windows zips files .dmf
181320	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
18133
18134
18135#ico files
181360	string/b	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for MS Windows
18137
18138# Windows icons
18139# Update: Joerg Jenderek
18140# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
18141# Note: similiar to Windows CURsor. container for BMP (only DIB part) or PNG
181420   belong  0x00000100
18143>9  byte    0
18144>>0 byte    x
18145>>0 use     cur-ico-dir
18146>9  ubyte   0xff
18147>>0 byte    x
18148>>0 use     cur-ico-dir
18149#	displays number of icons and information for icon or cursor
181500	name		cur-ico-dir
18151# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
18152# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
18153>18		ulelong		&0x00000006
18154# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
18155>>(18.l)	ulelong		x		MS Windows
18156>>>0		ubelong		0x00000100	icon resource
18157#!:mime		image/vnd.microsoft.icon
18158!:mime		image/x-icon
18159!:ext		ico
18160>>>>4 		uleshort	x		- %d icon
18161# plural s
18162>>>>4 		uleshort	>1		\bs
18163# 1st icon
18164>>>>0x06	use		ico-entry
18165# 2nd icon
18166>>>>4 		uleshort	>1
18167>>>>>0x16	use		ico-entry
18168>>>0		ubelong		0x00000200	cursor resource
18169#!:mime		image/x-cur
18170!:mime		image/x-win-bitmap
18171!:ext		cur
18172>>>>4 		uleshort	x		- %d icon
18173>>>>4 		uleshort	>1		\bs
18174# 1st cursor
18175>>>>0x06	use		cur-entry
18176#>>>>0x16	use		cur-entry
18177#	display information of one cursor entry
181780	name		cur-entry
18179>0	use		cur-ico-entry
18180>4	uleshort	x	\b, hotspot @%dx
18181>6	uleshort	x	\b%d
18182#	display information of one icon entry
181830	name		ico-entry
18184>0			use	cur-ico-entry
18185# normally 0 1 but also found 14
18186>4	uleshort	>1	\b, %d planes
18187# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
18188>6	uleshort	>1	\b, %d bits/pixel
18189#	display shared information of cursor or icon entry
181900		name		cur-ico-entry
18191>0		byte		=0		\b, 256x
18192>0		byte		!0		\b, %dx
18193>1		byte        	=0		\b256
18194>1		byte        	!0		\b%d
18195# number of colors in palette
18196>2		ubyte		!0		\b, %d colors
18197# reserved 0 FFh
18198#>3		ubyte        	x		\b, reserved %x
18199#>8		ulelong		x		\b, image size %d
18200# offset of PNG or DIB image
18201#>12		ulelong		x		\b, offset 0x%x
18202# PNG header (\x89PNG)
18203>(12.l)		ubelong		=0x89504e47
18204>>&-4		indirect	x	\b with
18205# DIB image
18206>(12.l)		ubelong		!0x89504e47
18207#>>&-4		use     	dib-image
18208
18209# Windows non-animated cursors
18210# Update: Joerg Jenderek
18211# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
18212# Note: similiar to Windows ICOn. container for BMP ( only DIB part)
18213# GRR: line below is too general as it catches also Lotus 1-2-3 files
182140   belong  0x00000200
18215>9  byte    0
18216>>0 use     cur-ico-dir
18217>9  ubyte   0xff
18218>>0 use     cur-ico-dir
18219
18220# .chr files
182210	string/b	PK\010\010BGI	Borland font
18222>4	string	>\0	%s
18223# then there is a copyright notice
18224
18225
18226# .bgi files
182270	string/b	pk\010\010BGI	Borland device
18228>4	string	>\0	%s
18229# then there is a copyright notice
18230
18231
18232# Windows Recycle Bin record file (named INFO2)
18233# By Abel Cheung (abelcheung AT gmail dot com)
18234# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
18235# Since Vista uses another structure, INFO2 structure probably won't change
18236# anymore. Detailed analysis in:
18237# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
182380	lelong		0x00000004
18239>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
18240
182410	lelong		0x00000005
18242>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
18243
18244# From Doug Lee via a FreeBSD pr
182459	string		GERBILDOC	First Choice document
182469	string		GERBILDB	First Choice database
182479	string		GERBILCLIP	First Choice database
182480	string		GERBIL		First Choice device file
182499	string		RABBITGRAPH	RabbitGraph file
182500	string		DCU1		Borland Delphi .DCU file
182510	string		=!<spell>	MKS Spell hash list (old format)
182520	string		=!<spell2>	MKS Spell hash list
18253# Too simple - MPi
18254#0	string		AH		Halo(TM) bitmapped font file
182550	lelong		0x08086b70	TurboC BGI file
182560	lelong		0x08084b50	TurboC Font file
18257
18258# Debian#712046: The magic below identifies "Delphi compiled form data".
18259# An additional source of information is available at:
18260# http://www.woodmann.com/fravia/dafix_t1.htm
182610	string		TPF0
18262>4	pstring		>\0		Delphi compiled form '%s'
18263
18264# tests for DBase files moved, updated and merged to database
18265
182660	string		PMCC		Windows 3.x .GRP file
182671	string		RDC-meg		MegaDots
18268>8	byte		>0x2F		version %c
18269>9	byte		>0x2F		\b.%c file
182700	lelong		0x4C
18271>4	lelong		0x00021401	Windows shortcut file
18272
18273# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
18274# only for windows versions equal or greater 3.0
182750x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
18276!:mime	application/x-dosexec
18277#>2	string	 	>\0		\b, Title:%.30s
18278>0x24	string		>\0		\b for %.63s
18279>0x65	string		>\0		\b, directory=%.64s
18280>0xA5	string		>\0		\b, parameters=%.64s
18281#>0x181	leshort	x	\b, offset %x
18282#>0x183	leshort	x	\b, offsetdata %x
18283#>0x185	leshort	x	\b, section length %x
18284>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
18285>>&0x5e		ubyte	>0
18286>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
18287#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
18288>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
18289>>&0xF0		ubyte	>0
18290>>>&-1		string	<Terminal		\b, font=%.32s
18291#>>>&-1		string	=Terminal		\b, font=%.32s
18292>>>&-1		string	>Terminal		\b, font=%.32s
18293>>&0x110	ubyte	>0
18294>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
18295#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
18296>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
18297#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
18298#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
18299>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
18300#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
18301>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
18302#>>&06		string	x			\b:%s
18303>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
18304#>>&06		string	x			\b:%s
18305
18306# DOS EPS Binary File Header
18307# From: Ed Sznyter <ews@Black.Market.NET>
183080	belong		0xC5D0D3C6	DOS EPS Binary File
18309!:mime	image/x-eps
18310>4	long		>0		Postscript starts at byte %d
18311>>8	long		>0		length %d
18312>>>12	long		>0		Metafile starts at byte %d
18313>>>>16	long		>0		length %d
18314>>>20	long		>0		TIFF starts at byte %d
18315>>>>24	long		>0		length %d
18316
18317# TNEF magic From "Joomy" <joomy@se-ed.net>
18318# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
183190	leshort		0x223e9f78	TNEF
18320!:mime	application/vnd.ms-tnef
18321
18322# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
18323# of http://www.davep.org/norton-guides/ng2h-105.tgz
18324# http://en.wikipedia.org/wiki/Norton_Guides
183250	string		NG\0\001
18326# only value 0x100 found at offset 2
18327>2	ulelong		0x00000100	Norton Guide
18328# Title[40]
18329>>8	string		>\0		"%-.40s"
18330#>>6	uleshort	x		\b, MenuCount=%u
18331# szCredits[5][66]
18332>>48	string		>\0		\b, %-.66s
18333>>114	string		>\0		%-.66s
18334
18335# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
18336# of http://www.4dos.info/
18337# pointer,HelpID[8]=4DHnnnmm
183380	ulelong	0x48443408		4DOS help file
18339>4	string	x			\b, version %-4.4s
18340
18341# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
183420	ulequad	0x3a000000024e4c	MS Advisor help file
18343
18344# HtmlHelp files (.chm)
183450	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
18346
18347# GFA-BASIC (Wolfram Kleff)
183482	string/b	GFA-BASIC3	GFA-BASIC 3 data
18349
18350#------------------------------------------------------------------------------
18351# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
18352# Microsoft Cabinet files
183530	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
18354!:mime application/vnd.ms-cab-compressed
18355>8	lelong		x		\b, %u bytes
18356>28	leshort		1		\b, 1 file
18357>28	leshort		>1		\b, %u files
18358
18359# InstallShield Cabinet files
183600	string/b	ISc(		InstallShield Cabinet archive data
18361>5	byte&0xf0	=0x60		version 6,
18362>5	byte&0xf0	!0x60		version 4/5,
18363>(12.l+40)	lelong	x		%u files
18364
18365# Windows CE package files
183660	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
18367>20	lelong		0		\b, architecture-independent
18368>20	lelong		103		\b, Hitachi SH3
18369>20	lelong		104		\b, Hitachi SH4
18370>20	lelong		0xA11		\b, StrongARM
18371>20	lelong		4000		\b, MIPS R4000
18372>20	lelong		10003		\b, Hitachi SH3
18373>20	lelong		10004		\b, Hitachi SH3E
18374>20	lelong		10005		\b, Hitachi SH4
18375>20	lelong		70001		\b, ARM 7TDMI
18376>52	leshort		1		\b, 1 file
18377>52	leshort		>1		\b, %u files
18378>56	leshort		1		\b, 1 registry entry
18379>56	leshort		>1		\b, %u registry entries
18380
18381
18382# Windows Enhanced Metafile (EMF)
18383# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
18384# for further information.
183850	ulelong 1
18386>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
18387>>44	ulelong x		version 0x%x
18388
18389# from http://filext.com by Derek M Jones <derek@knosof.co.uk>
18390# False positive with PPT (also currently this string is too long)
18391#0	string/b	\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06	Microsoft Installer
183920	string/b	\320\317\021\340\241\261\032\341	Microsoft Office Document
18393#>48	byte	0x1B					Excel Document
18394#!:mime application/vnd.ms-excel
18395>546	string	bjbj			Microsoft Word Document
18396!:mime	application/msword
18397>546	string	jbjb			Microsoft Word Document
18398!:mime	application/msword
18399
184000	string/b	\224\246\056		Microsoft Word Document
18401!:mime	application/msword
18402
18403512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	Microsoft Word Document
18404!:mime	application/msword
18405
18406# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
18407# Magic type for Dell's BIOS .hdr files
18408# Dell's .hdr
184090	string/b $RBU
18410>23	string Dell			%s system BIOS
18411>5	byte   2
18412>>48	byte   x			version %d.
18413>>49	byte   x			\b%d.
18414>>50	byte   x			\b%d
18415>5	byte   <2
18416>>48	string x			version %.3s
18417
18418# Type: Microsoft DirectDraw Surface
18419# URL:	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
18420# From: Morten Hustveit <morten@debian.org>
184210	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
18422>16	lelong	>0			%d x
18423>12	lelong	>0			%d,
18424>84	string	x			%.4s
18425
18426# Type: Microsoft Document Imaging Format (.mdi)
18427# URL:	http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
18428# From: Daniele Sempione <scrows@oziosi.org>
18429# Too weak (EP)
18430#0	short	0x5045			Microsoft Document Imaging Format
18431
18432# MS eBook format (.lit)
184330	string/b	ITOLITLS		Microsoft Reader eBook Data
18434>8	lelong	x			\b, version %u
18435!:mime					application/x-ms-reader
18436
18437# Windows CE Binary Image Data Format
18438# From: Dr. Jesus <j@hug.gs>
184390	string/b	B000FF\n	Windows Embedded CE binary image
18440
18441# Windows Imaging (WIM) Image
184420	string/b	MSWIM\000\000\000	Windows imaging (WIM) image
184430	string/b	WLPWM\000\000\000	Windows imaging (WIM) image, wimlib pipable format
18444
18445# The second byte of these signatures is a file version; I don't know what,
18446# if anything, produced files with version numbers 0-2.
18447# From: John Elliott <johne@seasip.demon.co.uk>
184480	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
184490	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
184500	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
184510	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
18452
184530	string	MIOPEN		Mallard BASIC Jetsam data
184540	string	Jetsam0		Mallard BASIC Jetsam index data
18455
18456# DOS backup 2.0 to 3.2
18457
18458# backupid.@@@
18459
18460# plausibility check for date
184610x3	ushort	>1979
18462>0x5	ubyte-1 <31
18463>>0x6	ubyte-1 <12
18464# actually 121 nul bytes
18465>>>0x7	string	\0\0\0\0\0\0\0\0
18466>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
18467!:ext @@@
18468>>>>0x0 ubyte	0xff	\b, last disk
18469
18470# backed up file
18471
18472# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
18473# by looking for trailing nul of maximal file name string
184740x52	ubyte	0
18475# test for flag byte: FFh~complete file, 00h~split file
18476# FFh -127 =	-1 -127 =	-128
18477# 00h -127 =	 0 -127 =	-127
18478>0	byte-127	<-126
18479# plausibility check for file name length
18480>>0x53	ubyte-1	<78
18481# looking for terminating nul of file name string
18482>>>(0x53.b+4)	ubyte	0
18483# looking if last char of string is valid DOS file name
18484>>>>(0x53.b+3)	ubyte	>0x1F
18485# actually 44 nul bytes
18486# but sometimes garbage according to Ralf Quint. So can not be used as test
18487#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
18488# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
18489# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
18490>>>>>5	ubyte&0x8C	0x0C
18491# ./msdos (version 5.30) labeled the entry as
18492# "DOS 2.0 backed up file %s, split file, sequence %d" or
18493# "DOS 2.0 backed up file %s, complete file"
18494>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
18495#>>>>>>0	ubyte	0xff	complete
18496>>>>>>0	ubyte	0
18497>>>>>>>1 uleshort	x	sequence %d of
18498# full file name with path but without drive letter and colon stored from 0x05 til 0x52
18499>>>>>>0x5	string	x	file %s
18500# backup name is original filename
18501#!:ext	*
18502# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
18503# file: line 1169: Bad magic entry '  *'
18504# after header original file content
18505>>>>>>128	indirect x	\b;
18506
18507
18508# DOS backup 3.3 to 5.x
18509
18510# CONTROL.nnn files
185110	string	\x8bBACKUP\x20
18512# actually 128 nul bytes
18513>0xa	string	\0\0\0\0\0\0\0\0
18514>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
18515>>0x8a	ubyte	0xff	\b, last disk
18516
18517# NB: The BACKUP.nnn files consist of the files backed up,
18518# concatenated.
18519
18520#------------------------------------------------------------------------------
18521# $File: msooxml,v 1.5 2014/08/05 07:38:45 christos Exp $
18522# msooxml:  file(1) magic for Microsoft Office XML
18523# From: Ralf Brown <ralf.brown@gmail.com>
18524
18525# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
18526#   archive.  The first member file is normally "[Content_Types].xml".
18527#   but some libreoffice generated files put this later. Perhaps skip
18528#   the "[Content_Types].xml" test?
18529# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
18530#   file of ePub or OpenDocument, we'll have to scan for a filename
18531#   which can distinguish between the three types
18532
18533# start by checking for ZIP local file header signature
185340		string		PK\003\004
18535!:strength +10
18536# make sure the first file is correct
18537>0x1E		regex		\\[Content_Types\\]\\.xml|_rels/\\.rels
18538# skip to the second local file header
18539# since some documents include a 520-byte extra field following the file
18540# header, we need to scan for the next header
18541>>(18.l+49)	search/2000	PK\003\004
18542# now skip to the *third* local file header; again, we need to scan due to a
18543# 520-byte extra field following the file header
18544>>>&26		search/1000	PK\003\004
18545# and check the subdirectory name to determine which type of OOXML
18546# file we have.  Correct the mimetype with the registered ones:
18547# http://technet.microsoft.com/en-us/library/cc179224.aspx
18548>>>>&26		string		word/		Microsoft Word 2007+
18549!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
18550>>>>&26		string		ppt/		Microsoft PowerPoint 2007+
18551!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
18552>>>>&26		string		xl/		Microsoft Excel 2007+
18553!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
18554>>>>&26		default		x		Microsoft OOXML
18555
18556#------------------------------------------------------------------------------
18557# $File: msvc,v 1.8 2017/03/17 22:20:22 christos Exp $
18558# msvc:  file(1) magic for msvc
18559# "H. Nanosecond" <aldomel@ix.netcom.com>
18560# Microsoft visual C
18561#
18562# I have version 1.0
18563
18564# .aps
185650	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
18566
18567# .ide
18568#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
185690	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
18570
18571# .res
185720	string	\000\000\000\000\040\000\000\000\377	MSVC .res
185730	string	\377\003\000\377\001\000\020\020\350	MSVC .res
185740	string	\377\003\000\377\001\000\060\020\350	MSVC .res
18575
18576#.lib
185770	string	\360\015\000\000	Microsoft Visual C library
185780	string	\360\075\000\000	Microsoft Visual C library
185790	string	\360\175\000\000	Microsoft Visual C library
18580
18581#.pch
185820	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
18583
18584# Summary: Symbol Table / Debug info used by Microsoft compilers
18585# URL: https://en.wikipedia.org/wiki/Program_database
18586# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
18587# Update: Joerg Jenderek
18588# Note:	test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
18589#	info does only applies partly for older files like msvbvm50.pdb about year 2001
185900	string	Microsoft\ C/C++\040
18591# "Microsoft Program DataBase" by TrID
18592>24	search/14	\r\n\x1A	MSVC program database
18593!:mime	application/x-ms-pdb
18594!:ext	pdb
18595# "MSF 7.00" "program database 2.00" for msvbvm50.pdb
18596>>16	regex	\([0-9.]+\)	ver %s
18597#>>>0x38	search/128123456	/LinkInfo	\b with linkinfo
18598# "MSF 7.00" variant
18599>>0x1e	leshort	0
18600# PageSize 400h 1000h
18601>>>0x20	lelong	x	\b, %d
18602# Page Count
18603>>>0x28	lelong	x	\b*%d bytes
18604# "program database 2.00"  variant
18605>>0x1e	leshort	!0
18606# PageSize 400h
18607>>>0x2c	lelong	x	\b, %d
18608# Page Count for msoo-dll.pdb 4379h
18609>>>0x32	leshort	x	\b*%d bytes
18610
18611#.sbr
186120	string	\000\002\000\007\000	MSVC .sbr
18613>5	string 	>\0	%s
18614
18615#.bsc
186160	string	\002\000\002\001	MSVC .bsc
18617
18618#.wsp
186190	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
18620# these seem to start with the version and contain menus
18621
18622#------------------------------------------------------------------------------
18623# msx:  file(1) magic for the MSX Home Computer
18624# v1.3
18625# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
18626
18627############## MSX Music file formats ##############
18628
18629# Gigamix MGSDRV music file
186300	string/b		MGS	MSX Gigamix MGSDRV3 music file,
18631>6	ubeshort	0x0D0A
18632>>3	byte		x	\bv%c
18633>>4	byte		x	\b.%c
18634>>5	byte		x	\b%c
18635>>8	string		>\0	\b, title: %s
18636
186371	string/b		mgs2\ 	MSX Gigamix MGSDRV2 music file
18638>6	uleshort	0x80
18639>>0x2E	uleshort	0
18640>>>0x30	string		>\0	\b, title: %s
18641
18642# KSS music file
186430	string/b		KSCC	KSS music file v1.03
18644>0xE	byte		0
18645>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
18646>>0xF	byte&0x02	2	\b, soundchip(s): SN76489
18647>>>0xF	byte&0x04	4	stereo
18648>>0xF	byte&0x01	1	\b, YM2413
18649>>0xF	byte&0x08	8	\b, Y8950
18650
186510	string/b		KSSX	KSS music file v1.20
18652>0xE	byte&0xEF	0
18653>>0xF	byte&0x40	0x00	\b, 60Hz
18654>>0xF	byte&0x40	0x40	\b, 50Hz
18655>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
18656>>0xF	byte&0x02	0x02	\b, soundchips: SN76489
18657>>>0xF	byte&0x04	0x04	stereo
18658>>0xF	byte&0x01	0x01	\b,
18659>>>0xF	byte&0x18	0x00	\bYM2413
18660>>>0xF	byte&0x18	0x08	\bYM2413, Y8950
18661>>>0xF	byte&0x18	0x18	\bYM2413+Y8950 pseudostereo
18662>>0xF	byte&0x18	0x10	\b, Majyutsushi DAC
18663
18664# Moonblaster for Moonsound
186650	string/b		MBMS
18666>4	byte		0x10	MSX Moonblaster for MoonSound music
18667
18668# Music Player K-kaz
186690	string/b		MPK	MSX Music Player K-kaz song
18670>6	ubeshort	0x0D0A
18671>>3	byte		x	v%c
18672>>4	byte		x	\b.%c
18673>>5	byte		x	\b%c
18674
18675# I don't know why these don't work
18676#0	search/0xFFFF	\r\n.FM9
18677#>0	search/0xFFFF	\r\n#FORMAT	MSX Music Player K-kaz source MML file
18678#0	search/0xFFFF	\r\nFM1\ \=
18679#>0	search/0xFFFF	\r\nPSG1\=
18680#>>0	search/0xFFFF	\r\nSCC1\=		MSX MuSiCa MML source file
18681
18682# OPX Music file
186830x35	beshort		0x0d0a
18684>0x7B	beshort		0x0d0a
18685>>0x7D	byte		0x1a
18686>>>0x87	uleshort	0		MSX OPX Music file
18687>>>>0x86	byte		0		v1.5
18688>>>>>0	string		>\32		\b, title: %s
18689>>>>0x86	byte		1		v2.4
18690>>>>>0	string		>\32		\b, title: %s
18691
18692# SCMD music file
186930x8B	string/b		SCMD
18694>0xCE	uleshort	0	MSX SCMD Music file
18695#>>-2	uleshort	0x6a71	; The file must end with this value. How to code this here?
18696>>0x8F	string		>\0		\b, title: %s
18697
186980	search/0xFFFF	\r\n@title
18699>&0	search/0xFFFF	\r\n@m=[	MSX SCMD source MML file
18700
18701
18702############## MSX image file formats ##############
18703
18704# MSX raw VRAM dump
187050	ubyte		0xFE
18706>1	uleshort	0
18707>>5	uleshort	0
18708>>>3	uleshort	0x37FF		MSX SC2/GRP raw image
18709>>>3	uleshort	0x6A00		MSX Graph Saurus SR5 raw image
18710>>>3	uleshort	>0x769E
18711>>>>3	uleshort	<0x8000		MSX GE5/GE6 raw image
18712>>>>>3	uleshort	0x7FFF		\b, with sprite patterns
18713>>>3	uleshort	0xD3FF		MSX screen 7-12 raw image
18714>>>3	uleshort	0xD400		MSX Graph Saurus SR7/SR8/SRS raw image
18715
18716# Graph Saurus compressed images
187170	ubyte		0xFD
18718>1	uleshort	0
18719>>5	uleshort	0
18720>>>3	uleshort	>0x013D		MSX Graph Saurus compressed image
18721
18722# MSX G9B image file
187230	string/b		G9B
18724>1	uleshort	11
18725>>3	uleshort	>10
18726>>>5	ubyte		>0		MSX G9B image, depth=%d
18727>>>>8	uleshort	x		\b, %dx
18728>>>>10	uleshort	x		\b%d
18729>>>>5	ubyte		<9
18730>>>>>6	ubyte		0
18731>>>>>>7	ubyte		x		\b, codec=%d RGB color palettes
18732>>>>>6	ubyte		64		\b, codec=RGB fixed color
18733>>>>>6	ubyte		128		\b, codec=YJK
18734>>>>>6	ubyte		192		\b, codec=YUV
18735>>>>5	ubyte		>8		codec=RGB fixed color
18736>>>>12	ubyte		0		\b, raw
18737>>>>12	ubyte		1		\b, bitbuster compression
18738
18739############## Other MSX file formats ##############
18740
18741# MSX internal ROMs
187420		ubeshort	0xF3C3
18743>2		uleshort	<0x4000
18744>>8		ubyte		0xC3
18745>>>9		uleshort	<0x4000
18746>>>>0x0B	ubeshort	0x00C3
18747>>>>>0x0D	uleshort	<0x4000
18748>>>>>>0x0F	ubeshort	0x00C3
18749>>>>>>>0x11	uleshort	<0x4000
18750>>>>>>>>0x13	ubeshort	0x00C3
18751>>>>>>>>>0x15	uleshort	<0x4000
18752>>>>>>>>>>0x50	ubyte		0xC3
18753>>>>>>>>>>>0x51	uleshort	<0x4000
18754>>>>>>>>>>>>(9.s)	ubyte	0xC3
18755>>>>>>>>>>>>>&0	uleshort	>0x4000
18756>>>>>>>>>>>>>>&0	ubyte	0xC3		MSX BIOS+BASIC
18757>>>>>>>>>>>>>>>0x002D	ubyte+1	<3		\b. version=MSX%d
18758>>>>>>>>>>>>>>>0x002D	ubyte	2		\b, version=MSX2+
18759>>>>>>>>>>>>>>>0x002D	ubyte	3		\b, version=MSX Turbo-R
18760>>>>>>>>>>>>>>>0x002D	ubyte	>3		\b, version=Unknown MSX %d version
18761>>>>>>>>>>>>>>>0x0006	ubyte	x		\b, VDP.DR=0x%2x
18762>>>>>>>>>>>>>>>0x0007	ubyte	x		\b, VDP.DW=0x%2x
18763>>>>>>>>>>>>>>>0x002B	ubyte&0xF	0		\b, charset=Japanese
18764>>>>>>>>>>>>>>>0x002B	ubyte&0xF	1		\b, charset=International
18765>>>>>>>>>>>>>>>0x002B	ubyte&0xF	2		\b, charset=Korean
18766>>>>>>>>>>>>>>>0x002B	ubyte&0xF	>2		\b, charset=Unknown id:%d
18767>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x00		\b, date format=Y-M-D
18768>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x10		\b, date format=M-D-Y
18769>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x20		\b, date format=D-M-Y
18770>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x00		\b, vfreq=60Hz
18771>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x80		\b, vfreq=50Hz
18772>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	0		\b, keyboard=Japanese
18773>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	1		\b, keyboard=International
18774>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	2		\b, keyboard=French
18775>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	3		\b, keyboard=UK
18776>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	4		\b, keyboard=German
18777>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	5		\b, keyboard=Unknown id:%d
18778>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	6		\b, keyboard=Spanish
18779>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	>6		\b, keyboard=Unknown id:%d
18780>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x00		\b, basic=Japanese
18781>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x10		\b, basic=International
18782>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	>0x10		\b, basic=Unknown id:%d
18783>>>>>>>>>>>>>>>0x002E	ubyte&1		1		\b, built-in MIDI
18784
18785
187860		string/b		CD
18787>2		uleshort	>0x10
18788>>2		uleshort	<0x4000
18789>>>4		uleshort	<0x4000
18790>>>>6		uleshort	<0x4000
18791>>>>>8		ubyte		0xC3
18792>>>>>>9		uleshort	<0x4000
18793>>>>>>>0x10	ubyte		0xC3
18794>>>>>>>>0x11	uleshort	<0x4000
18795>>>>>>>>>0x14	ubyte		0xC3
18796>>>>>>>>>>0x15	uleshort	<0x4000		MSX2/2+/TR SubROM
18797
187980		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
18799>0x5F0		ubequad		0x8282828244380000
18800>>0x150		ubyte		0x38
18801>>>0x170	string		\20\20\20
18802>>>>0x1E32	string		())
18803>>>>>0x2130	ubequad		0xA5A5594924231807
18804>>>>>0x2138	ubequad		0x4A4A3424488830C0	MSX Kanji Font
18805
18806
18807
18808# MSX extension ROMs
188090	string/b		AB
18810>2	uleshort	0x0010			MSX ROM
18811>>2	uleshort	x			\b, init=0x%4x
18812>>4	uleshort	>0			\b, stahdl=0x%4x
18813>>6	uleshort	>0			\b, devhdl=0x%4x
18814>>8	uleshort	>0			\b, bas=0x%4x
18815>2	uleshort	0x4010			MSX ROM
18816>>2	uleshort	x			\b, init=0x%04x
18817>>4	uleshort	>0			\b, stahdl=0x%04x
18818>>6	uleshort	>0			\b, devhdl=0x%04x
18819>>8	uleshort	>0			\b, bas=0x%04x
18820>2	uleshort	0x8010			MSX ROM
18821>>2	uleshort	x			\b, init=0x%04x
18822>>4	uleshort	>0			\b, stahdl=0x%04x
18823>>6	uleshort	>0			\b, devhdl=0x%04x
18824>>8	uleshort	>0			\b, bas=0x%04x
188250	string/b		AB\0\0
18826>6	uleshort	0
18827>>4	uleshort	>0x400F			MSX-BASIC extension ROM
18828>>>4	uleshort	>0			\b, stahdl=0x%04x
18829>>>6	uleshort	>0			\b, devhdl=0x%04x
18830>>>0x1C		string		OPLL			\b, MSX-Music
18831>>>>0x18	string		PAC2			\b (external)
18832>>>>0x18	string		APRL			\b (internal)
18833
188340	string/b		AB\0\0\0\0
18835>6	uleshort	>0x400F			MSX device BIOS
18836>>6	uleshort	>0			\b, devhdl=0x%04x
18837
18838
188390	string/b		AB
18840#>2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
18841#>3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
18842#>3	string		@3\x80IA862		Golvellius MSX1 ROM
18843>2	uleshort	>15
18844>>2	uleshort	<0xC000
18845>>>8	string		\0\0\0\0\0\0\0\0
18846>>>>(2.s&0x3FFF)	uleshort	>0		MSX ROM
18847>>>>>0x10	string		YZ\0\0\0\0		Konami Game Master 2 MSX ROM
18848>>>>>0x10	string		CD			\b, Konami RC-
18849>>>>>>0x12	ubyte		x			\b%d
18850>>>>>>0x13	ubyte/16	x			\b%d
18851>>>>>>0x13	ubyte&0xF	x			\b%d
18852>>>>>0x10	string		EF			\b, Konami RC-
18853>>>>>>0x12	ubyte		x			\b%d
18854>>>>>>0x13	ubyte/16	x			\b%d
18855>>>>>>0x13	ubyte&0xF	x			\b%d
18856>>>>>2	uleshort	x			\b, init=0x%04x
18857>>>>>4	uleshort	>0			\b, stahdl=0x%04x
18858>>>>>6	uleshort	>0			\b, devhdl=0x%04x
18859>>>>>8	uleshort	>0			\b, bas=0x%04x
18860>>>2	uleshort	0
18861>>>>4	uleshort	0
18862>>>>>6	uleshort	0
18863>>>>>>8	uleshort	>0			MSX BASIC program in ROM, bas=0x%04x
18864
188650x4000	string/b		AB
18866>0x4002	uleshort	>0x400F
18867>>0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
18868>>>0x4002	uleshort	x			\b, init=0x%04x
18869>>>0x4004	uleshort	>0			\b, stahdl=0x%04x
18870>>>0x4006	uleshort	>0			\b, devhdl=0x%04x
18871>>>0x4008	uleshort	>0			\b, bas=0x%04x
18872
188730x8000	string/b		AB
18874>0x8002	uleshort	>0x400F
18875>>0x800A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
18876>>>0x8002	uleshort	x			\b, init=0x%04x
18877>>>0x8004	uleshort	>0			\b, stahdl=0x%04x
18878>>>0x8006	uleshort	>0			\b, devhdl=0x%04x
18879>>>0x8008	uleshort	>0			\b, bas=0x%04x
18880
18881
188820x3C000	string/b		AB
18883>0x3C008	string		\0\0\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
18884>>0x3C002	uleshort	x			\b, init=0x%04x
18885>>0x3C004	uleshort	>0			\b, stahdl=0x%04x
18886>>0x3C006	uleshort	>0			\b, devhdl=0x%04x
18887>>0x3C008	uleshort	>0			\b, bas=0x%04x
18888
18889# MSX BIN file
18890#0	byte		0xFE
18891#>1	uleshort	>0x8000
18892#>>3	uleshort	>0x8004
18893#>>>5	uleshort	>0x8000			MSX BIN file
18894
18895# MSX-BASIC file
188960	byte		0xFF
18897>3	uleshort	0x000A
18898>>1	uleshort	>0x8000			MSX-BASIC program
18899
18900# MSX .CAS file
189010	string/b	\x1F\xA6\xDE\xBA\xCC\x13\x7D\x74	MSX cassette archive
18902
18903# Mega-Assembler file
189040	byte		0xFE
18905>1	uleshort	0x0001
18906>>5	uleshort	0xffff
18907>>>6	byte		0x0A		MSX Mega-Assembler source
18908
18909# Execrom Patchfile
189100	string		ExecROM\ patchfile\x1A	MSX ExecROM patchfile
18911>0x12	ubyte/16	x		v%d
18912>0x12	ubyte&0xF	x		\b.%d
18913>0x13	ubyte		x		\b, contains %d patches
18914
18915# Konami's King's Valley-2 custom stage (ELG file)
189164	uleshort	0x0900
18917>0xF	byte		1
18918>>0x14	byte		0
18919>>>0x1E	string		\040\040\040
18920>>>>0x23	byte	1
18921>>>>>0x25	byte	0
18922>>>>>>0x15	string	>\x30
18923>>>>>>>0x15	string	<\x5A		Konami King's Valley-2 custom stage, title: "%-8.8s"
18924>>>>>>>>0x1D	byte	<32	\b, theme: %d
18925
18926# Metal Gear 1 savegame
18927#0x4F	string	\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
18928#>>0x60	string	\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
18929#>>>0x7B	string	\0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00	Metal Gear 1 savegame
18930
18931# ------------------------------------------------------------------------
18932# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
18933# mup: file(1) magic for Mup (Music Publisher) input file.
18934#
18935# From: Abel Cheung <abel (@) oaka.org>
18936#
18937# NOTE: This header is mainly proposed in the Arkkra mailing list,
18938# and is not a mandatory header because of old mup input file
18939# compatibility. Noteedit also use mup format, but is not forcing
18940# user to use any header as well.
18941#
189420		search/1	//!Mup		Mup music publication program input text
18943>6		string		-Arkkra		(Arkkra)
18944>>13		string		-
18945>>>16		string		.
18946>>>>14		string		x		\b, need V%.4s
18947>>>15		string		.
18948>>>>14		string		x		\b, need V%.3s
18949>6		string		-
18950>>9		string		.
18951>>>7		string		x		\b, need V%.4s
18952>>8		string		.
18953>>>7		string		x		\b, need V%.3s
18954#------------------------------------------------------------------------------
18955# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
18956# music:  file (1) magic for music formats
18957
18958# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
18959# and Bagpipe Writer by Doug Wickstrom
18960#
189610	string		Bagpipe		Bagpipe
18962>8	string		Reader		Reader
18963>>15	string		>\0		(version %.3s)
18964>8	string		Music\ Writer	Music Writer
18965>>20	string		:
18966>>>21	string		>\0		(version %.3s)
18967>>21	string		Gold		Gold
18968>>>25	string		:
18969>>>>26	string		>\0		(version %.3s)
18970
18971
18972#------------------------------------------------------------------------------
18973# nasa:	file(1) magic
18974
18975# From: Barry Carter <carter.barry@gmail.com>
189760	string	DAF/SPK				NASA SPICE file (binary format)
189770	string	DAFETF\ NAIF\ DAF\ ENCODED	NASA SPICE file (transfer format)
18978
18979#-----------------------------------------------------------------------------
18980# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
18981# natinst:  file(1) magic for National Instruments Code Files
18982
18983#
18984# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
18985# version 1
18986# Many formats still missing, we use, for the moment LabVIEW
18987# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
18988#
189890       string          RSRC            National Instruments,
18990# Check if it's a LabVIEW File
18991>8      string          LV              LabVIEW File,
18992# Check which kind of file it is
18993>>10    string          SB              Code Resource File, data
18994>>10    string          IN              Virtual Instrument Program, data
18995>>10    string          AR              VI Library, data
18996# This is for Menu Libraries
18997>8      string          LMNULBVW        Portable File Names, data
18998# This is for General Resources
18999>8      string          rsc             Resources File, data
19000# This is for VXI Package
190010       string          VMAP            National Instruments, VXI File, data
19002
19003#------------------------------------------------------------------------------
19004# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
19005# ncr:  file(1) magic for NCR Tower objects
19006#
19007# contributed by
19008# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
19009# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
19010#
190110	beshort		000610	Tower/XP rel 2 object
19012>12	   belong		>0	not stripped
19013>20	   beshort		0407	executable
19014>20	   beshort		0410	pure executable
19015>22	   beshort		>0	- version %d
190160	beshort		000615	Tower/XP rel 2 object
19017>12	   belong		>0	not stripped
19018>20	   beshort		0407	executable
19019>20	   beshort		0410	pure executable
19020>22	   beshort		>0	- version %d
190210	beshort		000620	Tower/XP rel 3 object
19022>12	   belong		>0	not stripped
19023>20	   beshort		0407	executable
19024>20	   beshort		0410	pure executable
19025>22	   beshort		>0	- version %d
190260	beshort		000625	Tower/XP rel 3 object
19027>12	   belong		>0	not stripped
19028>20	   beshort		0407	executable
19029>20	   beshort		0410	pure executable
19030>22	   beshort		>0	- version %d
190310	beshort		000630	Tower32/600/400 68020 object
19032>12	   belong		>0	not stripped
19033>20	   beshort		0407	executable
19034>20	   beshort		0410	pure executable
19035>22	   beshort		>0	- version %d
190360	beshort		000640	Tower32/800 68020
19037>18	   beshort		&020000	w/68881 object
19038>18	   beshort		&040000	compatible object
19039>18	   beshort		&060000	object
19040>20	   beshort		0407	executable
19041>20	   beshort		0413	pure executable
19042>12	   belong		>0	not stripped
19043>22	   beshort		>0	- version %d
190440	beshort		000645	Tower32/800 68010
19045>18	   beshort		&040000	compatible object
19046>18	   beshort		&060000 object
19047>20	   beshort		0407	executable
19048>20	   beshort		0413	pure executable
19049>12	   belong		>0	not stripped
19050>22	   beshort		>0	- version %d
19051
19052#------------------------------------------------------------
19053# $File: neko,v 1.1 2009/11/10 20:36:10 christos Exp $
19054
19055# From: Mikhail Gusarov <dottedmag@dottedmag.net>
19056# NekoVM (http://nekovm.org/) bytecode
190570	string		NEKO	NekoVM bytecode
19058>4	lelong		x	(%d global symbols,
19059>8	lelong		x	%d global fields,
19060>12	lelong		x	%d bytecode ops)
19061!:mime	application/x-nekovm-bytecode
19062
19063
19064#------------------------------------------------------------------------------
19065# $File: netbsd,v 1.24 2017/03/17 21:35:28 christos Exp $
19066# netbsd:  file(1) magic for NetBSD objects
19067#
19068# All new-style magic numbers are in network byte order.
19069# The old-style magic numbers are indistinguishable from the same magic
19070# numbers used in other systems, and are handled, for all those systems,
19071# in aout.
19072#
19073
190740	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
19075>0	byte			&0x80
19076>>20	lelong			<4096		shared library
19077>>20	lelong			=4096		dynamically linked executable
19078>>20	lelong			>4096		dynamically linked executable
19079>0	byte			^0x80		executable
19080>16	lelong			>0		not stripped
190810	belong&0377777777	041400410	a.out NetBSD/i386 pure
19082>0	byte			&0x80		dynamically linked executable
19083>0	byte			^0x80		executable
19084>16	lelong			>0		not stripped
190850	belong&0377777777	041400407	a.out NetBSD/i386
19086>0	byte			&0x80		dynamically linked executable
19087>0	byte			^0x80
19088>>0	byte			&0x40		position independent
19089>>20	lelong			!0		executable
19090>>20	lelong			=0		object file
19091>16	lelong			>0		not stripped
190920	belong&0377777777	041400507	a.out NetBSD/i386 core
19093>12	string			>\0		from '%s'
19094>32	lelong			!0		(signal %d)
19095
190960	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
19097>0	byte			&0x80
19098>>20	belong			<8192		shared library
19099>>20	belong			=8192		dynamically linked executable
19100>>20	belong			>8192		dynamically linked executable
19101>0	byte			^0x80		executable
19102>16	belong			>0		not stripped
191030	belong&0377777777	041600410	a.out NetBSD/m68k pure
19104>0	byte			&0x80		dynamically linked executable
19105>0	byte			^0x80		executable
19106>16	belong			>0		not stripped
191070	belong&0377777777	041600407	a.out NetBSD/m68k
19108>0	byte			&0x80		dynamically linked executable
19109>0	byte			^0x80
19110>>0	byte			&0x40		position independent
19111>>20	belong			!0		executable
19112>>20	belong			=0		object file
19113>16	belong			>0		not stripped
191140	belong&0377777777	041600507	a.out NetBSD/m68k core
19115>12	string			>\0		from '%s'
19116>32	belong			!0		(signal %d)
19117
191180	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
19119>0	byte			&0x80
19120>>20	belong			<4096		shared library
19121>>20	belong			=4096		dynamically linked executable
19122>>20	belong			>4096		dynamically linked executable
19123>0	byte			^0x80		executable
19124>16	belong			>0		not stripped
191250	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
19126>0	byte			&0x80		dynamically linked executable
19127>0	byte			^0x80		executable
19128>16	belong			>0		not stripped
191290	belong&0377777777	042000407	a.out NetBSD/m68k4k
19130>0	byte			&0x80		dynamically linked executable
19131>0	byte			^0x80
19132>>0	byte			&0x40		position independent
19133>>20	belong			!0		executable
19134>>20	belong			=0		object file
19135>16	belong			>0		not stripped
191360	belong&0377777777	042000507	a.out NetBSD/m68k4k core
19137>12	string			>\0		from '%s'
19138>32	belong			!0		(signal %d)
19139
191400	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
19141>0	byte			&0x80
19142>>20	lelong			<4096		shared library
19143>>20	lelong			=4096		dynamically linked executable
19144>>20	lelong			>4096		dynamically linked executable
19145>0	byte			^0x80		executable
19146>16	lelong			>0		not stripped
191470	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
19148>0	byte			&0x80		dynamically linked executable
19149>0	byte			^0x80		executable
19150>16	lelong			>0		not stripped
191510	belong&0377777777	042200407	a.out NetBSD/ns32532
19152>0	byte			&0x80		dynamically linked executable
19153>0	byte			^0x80
19154>>0	byte			&0x40		position independent
19155>>20	lelong			!0		executable
19156>>20	lelong			=0		object file
19157>16	lelong			>0		not stripped
191580	belong&0377777777	042200507	a.out NetBSD/ns32532 core
19159>12	string			>\0		from '%s'
19160>32	lelong			!0		(signal %d)
19161
191620	belong&0377777777	045200507	a.out NetBSD/powerpc core
19163>12	string			>\0		from '%s'
19164
191650	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
19166>0	byte			&0x80
19167>>20	belong			<8192		shared library
19168>>20	belong			=8192		dynamically linked executable
19169>>20	belong			>8192		dynamically linked executable
19170>0	byte			^0x80		executable
19171>16	belong			>0		not stripped
191720	belong&0377777777	042400410	a.out NetBSD/SPARC pure
19173>0	byte			&0x80		dynamically linked executable
19174>0	byte			^0x80		executable
19175>16	belong			>0		not stripped
191760	belong&0377777777	042400407	a.out NetBSD/SPARC
19177>0	byte			&0x80		dynamically linked executable
19178>0	byte			^0x80
19179>>0	byte			&0x40		position independent
19180>>20	belong			!0		executable
19181>>20	belong			=0		object file
19182>16	belong			>0		not stripped
191830	belong&0377777777	042400507	a.out NetBSD/SPARC core
19184>12	string			>\0		from '%s'
19185>32	belong			!0		(signal %d)
19186
191870	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
19188>0	byte			&0x80
19189>>20	lelong			<4096		shared library
19190>>20	lelong			=4096		dynamically linked executable
19191>>20	lelong			>4096		dynamically linked executable
19192>0	byte			^0x80		executable
19193>16	lelong			>0		not stripped
191940	belong&0377777777	042600410	a.out NetBSD/pmax pure
19195>0	byte			&0x80		dynamically linked executable
19196>0	byte			^0x80		executable
19197>16	lelong			>0		not stripped
191980	belong&0377777777	042600407	a.out NetBSD/pmax
19199>0	byte			&0x80		dynamically linked executable
19200>0	byte			^0x80
19201>>0	byte			&0x40		position independent
19202>>20	lelong			!0		executable
19203>>20	lelong			=0		object file
19204>16	lelong			>0		not stripped
192050	belong&0377777777	042600507	a.out NetBSD/pmax core
19206>12	string			>\0		from '%s'
19207>32	lelong			!0		(signal %d)
19208
192090	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
19210>0	byte			&0x80
19211>>20	lelong			<4096		shared library
19212>>20	lelong			=4096		dynamically linked executable
19213>>20	lelong			>4096		dynamically linked executable
19214>0	byte			^0x80		executable
19215>16	lelong			>0		not stripped
192160	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
19217>0	byte			&0x80		dynamically linked executable
19218>0	byte			^0x80		executable
19219>16	lelong			>0		not stripped
192200	belong&0377777777	043000407	a.out NetBSD/vax 1k
19221>0	byte			&0x80		dynamically linked executable
19222>0	byte			^0x80
19223>>0	byte			&0x40		position independent
19224>>20	lelong			!0		executable
19225>>20	lelong			=0		object file
19226>16	lelong			>0		not stripped
192270	belong&0377777777	043000507	a.out NetBSD/vax 1k core
19228>12	string			>\0		from '%s'
19229>32	lelong			!0		(signal %d)
19230
192310	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
19232>0	byte			&0x80
19233>>20	lelong			<4096		shared library
19234>>20	lelong			=4096		dynamically linked executable
19235>>20	lelong			>4096		dynamically linked executable
19236>0	byte			^0x80		executable
19237>16	lelong			>0		not stripped
192380	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
19239>0	byte			&0x80		dynamically linked executable
19240>0	byte			^0x80		executable
19241>16	lelong			>0		not stripped
192420	belong&0377777777	045400407	a.out NetBSD/vax 4k
19243>0	byte			&0x80		dynamically linked executable
19244>0	byte			^0x80
19245>>0	byte			&0x40		position independent
19246>>20	lelong			!0		executable
19247>>20	lelong			=0		object file
19248>16	lelong			>0		not stripped
192490	belong&0377777777	045400507	a.out NetBSD/vax 4k core
19250>12	string			>\0		from '%s'
19251>32	lelong			!0		(signal %d)
19252
19253# NetBSD/alpha does not support (and has never supported) a.out objects,
19254# so no rules are provided for them.  NetBSD/alpha ELF objects are
19255# dealt with in "elf".
192560	lelong		0x00070185		ECOFF NetBSD/alpha binary
19257>10	leshort		0x0001			not stripped
19258>10	leshort		0x0000			stripped
192590	belong&0377777777	043200507	a.out NetBSD/alpha core
19260>12	string			>\0		from '%s'
19261>32	lelong			!0		(signal %d)
19262
192630	belong&0377777777	043400413	a.out NetBSD/mips demand paged
19264>0	byte			&0x80
19265>>20	belong			<8192		shared library
19266>>20	belong			=8192		dynamically linked executable
19267>>20	belong			>8192		dynamically linked executable
19268>0	byte			^0x80		executable
19269>16	belong			>0		not stripped
192700	belong&0377777777	043400410	a.out NetBSD/mips pure
19271>0	byte			&0x80		dynamically linked executable
19272>0	byte			^0x80		executable
19273>16	belong			>0		not stripped
192740	belong&0377777777	043400407	a.out NetBSD/mips
19275>0	byte			&0x80		dynamically linked executable
19276>0	byte			^0x80
19277>>0	byte			&0x40		position independent
19278>>20	belong			!0		executable
19279>>20	belong			=0		object file
19280>16	belong			>0		not stripped
192810	belong&0377777777	043400507	a.out NetBSD/mips core
19282>12	string			>\0		from '%s'
19283>32	belong			!0		(signal %d)
19284
192850	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
19286>0	byte			&0x80
19287>>20	lelong			<4096		shared library
19288>>20	lelong			=4096		dynamically linked executable
19289>>20	lelong			>4096		dynamically linked executable
19290>0	byte			^0x80		executable
19291>16	lelong			>0		not stripped
192920	belong&0377777777	043600410	a.out NetBSD/arm32 pure
19293>0	byte			&0x80		dynamically linked executable
19294>0	byte			^0x80		executable
19295>16	lelong			>0		not stripped
192960	belong&0377777777	043600407	a.out NetBSD/arm32
19297>0	byte			&0x80		dynamically linked executable
19298>0	byte			^0x80
19299>>0	byte			&0x40		position independent
19300>>20	lelong			!0		executable
19301>>20	lelong			=0		object file
19302>16	lelong			>0		not stripped
19303# NetBSD/arm26 has always used ELF objects, but it shares a core file
19304# format with NetBSD/arm32.
193050	belong&0377777777	043600507	a.out NetBSD/arm core
19306>12	string			>\0		from '%s'
19307>32	lelong			!0		(signal %d)
19308
19309# Kernel core dump format
193100	belong&0x0000ffff 0x00008fca	NetBSD kernel core file
19311>0	belong&0x03ff0000 0x00000000	\b, Unknown
19312>0	belong&0x03ff0000 0x00010000	\b, sun 68010/68020
19313>0	belong&0x03ff0000 0x00020000	\b, sun 68020
19314>0	belong&0x03ff0000 0x00640000	\b, 386 PC
19315>0	belong&0x03ff0000 0x00860000	\b, i386 BSD
19316>0	belong&0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
19317>0	belong&0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
19318>0	belong&0x03ff0000 0x00890000	\b, ns32532 BSD
19319>0	belong&0x03ff0000 0x008a0000	\b, SPARC/32 BSD
19320>0	belong&0x03ff0000 0x008b0000	\b, pmax BSD
19321>0	belong&0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
19322>0	belong&0x03ff0000 0x008d0000	\b, alpha BSD
19323>0	belong&0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
19324>0	belong&0x03ff0000 0x008f0000	\b, arm6 BSD
19325>0	belong&0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
19326>0	belong&0x03ff0000 0x00910000	\b, sh3 BSD
19327>0	belong&0x03ff0000 0x00950000	\b, ppc BSD (Big Endian)
19328>0	belong&0x03ff0000 0x00960000	\b, vax BSD (4K pages)
19329>0	belong&0x03ff0000 0x00970000	\b, mips1 BSD
19330>0	belong&0x03ff0000 0x00980000	\b, mips2 BSD
19331>0	belong&0x03ff0000 0x00990000	\b, m88k BSD
19332>0	belong&0x03ff0000 0x00920000	\b, parisc BSD
19333>0	belong&0x03ff0000 0x009b0000	\b, sh5/64 BSD
19334>0	belong&0x03ff0000 0x009c0000	\b, SPARC/64 BSD
19335>0	belong&0x03ff0000 0x009d0000	\b, amd64 BSD
19336>0	belong&0x03ff0000 0x009e0000	\b, sh5/32 BSD
19337>0	belong&0x03ff0000 0x009f0000	\b, ia64 BSD
19338>0	belong&0x03ff0000 0x00b70000	\b, aarch64 BSD
19339>0	belong&0x03ff0000 0x00b80000	\b, or1k BSD
19340>0	belong&0x03ff0000 0x00b90000	\b, Risk-V BSD
19341>0	belong&0x03ff0000 0x00c80000	\b, hp200 BSD
19342>0	belong&0x03ff0000 0x012c0000	\b, hp300 BSD
19343>0	belong&0x03ff0000 0x020b0000	\b, hp800 HP-UX
19344>0	belong&0x03ff0000 0x020c0000	\b, hp200/hp300 HP-UX
19345>0	belong&0xfc000000 0x04000000	\b, CPU
19346>0	belong&0xfc000000 0x08000000	\b, DATA
19347>0	belong&0xfc000000 0x10000000	\b, STACK
19348>4	leshort	x			\b, (headersize = %d
19349>6	leshort	x			\b, segmentsize = %d
19350>6	lelong	x			\b, segments = %d)
19351
19352# little endian only for now.
193530	name		ktrace
19354>4	leshort		7
19355>>6	leshort		<3		NetBSD ktrace file version %d
19356>>>12	string		x		from %s
19357>>>56	string		x		\b, emulation %s
19358>>>8	lelong		<65536		\b, pid=%d
19359
1936056	string		netbsd
19361>0	use		ktrace
1936256	string		linux
19363>0	use		ktrace
1936456	string		sunos
19365>0	use		ktrace
1936656	string		hpux
19367>0	use		ktrace
19368
19369#------------------------------------------------------------------------------
19370# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
19371# netscape:  file(1) magic for Netscape files
19372# "H. Nanosecond" <aldomel@ix.netcom.com>
19373# version 3 and 4 I think
19374#
19375
19376# Netscape Address book  .nab
193770	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
19378
19379# Netscape Communicator address book
193800   string   \000\017\102\111 Netscape Communicator address book
19381
19382# .snm Caches
193830	string		#\ Netscape\ folder\ cache	Netscape folder cache
193840	string	\000\036\204\220\000	Netscape folder cache
19385# .n2p
19386# Net 2 Phone
19387#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
193880	string	SX961999	Net2phone
19389
19390#
19391#This is files ending in .art, FIXME add more rules
193920	string	JG\004\016\0\0\0\0	AOL ART image
193930	string	JG\003\016\0\0\0\0	AOL ART image
19394
19395#------------------------------------------------------------------------------
19396# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
19397# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
19398# From: Mads Martin Joergensen <mmj@suse.de>
19399
194000	string	NetWare\ Loadable\ Module	NetWare Loadable Module
19401
19402#------------------------------------------------------------------------------
19403# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
19404# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
19405#
194060	string		StartFontMetrics	ASCII font metrics
194070	string		StartFont	ASCII font bits
194080	belong		0x137A2944	NeWS bitmap font
194090	belong		0x137A2947	NeWS font family
194100	belong		0x137A2950	scalable OpenFont binary
194110	belong		0x137A2951	encrypted scalable OpenFont binary
194128	belong		0x137A2B45	X11/NeWS bitmap font
194138	belong		0x137A2B48	X11/NeWS font family
19414
19415#------------------------------------------------------------------------------
19416# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $
19417# nitpicker:  file(1) magic for Flowfiles.
19418# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
194190	string	NPFF	NItpicker Flow File
19420>4	byte	x	V%d.
19421>5	byte	x	%d
19422>6	bedate	x	started: %s
19423>10	bedate	x	stopped: %s
19424>14	belong	x	Bytes: %u
19425>18	belong	x	Bytes1: %u
19426>22	belong	x	Flows: %u
19427>26	belong	x	Pkts: %u
19428
19429#------------------------------------------------------------------------------
19430# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
19431# OASIS
19432# Summary: OASIS stream file
19433# Long description: Open Artwork System Interchange Standard
19434# File extension: .oas
19435# Full name:	Ben Cowley (bcowley@broadcom.com)
19436#		Philip Dixon (pdixon@broadcom.com)
19437# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
19438#		(see page 3)
194390	string	%SEMI-OASIS\r\n		OASIS Stream file
19440
19441#------------------------------------------------------------------------------
19442# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
19443# ocaml: file(1) magic for Objective Caml files.
194440	string	Caml1999	OCaml
19445>8	string	X		exec file
19446>8	string	I		interface file (.cmi)
19447>8	string	O		object file (.cmo)
19448>8	string	A		library file (.cma)
19449>8	string	Y		native object file (.cmx)
19450>8	string	Z		native library file (.cmxa)
19451>8	string	M		abstract syntax tree implementation file
19452>8	string	N		abstract syntax tree interface file
19453>9	string	>\0		(Version %3.3s)
19454
19455#------------------------------------------------------------------------------
19456# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
19457# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
194580	string		Octave-1-L	Octave binary data (little endian)
194590	string		Octave-1-B	Octave binary data (big endian)
19460
19461#------------------------------------------------------------------------------
19462# $File: ole2compounddocs,v 1.4 2009/09/19 16:28:11 christos Exp $
19463# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
19464# storage (http://en.wikipedia.org/wiki/Structured_Storage)
19465# Additional tests for OLE 2 Compound Documents should be under this recipe.
19466
194670   string  \320\317\021\340\241\261\032\341      OLE 2 Compound Document
19468# - Microstation V8 DGN files (www.bentley.com)
19469#   Last update on 10/23/2006 by Lester Hightower
19470> 0x480  string  D\000g\000n\000~\000H                : Microstation V8 DGN
19471# - Visio documents
19472#   Last update on 10/23/2006 by Lester Hightower
19473> 0x480  string  V\000i\000s\000i\000o\000D\000o\000c : Visio Document
19474
19475#------------------------------------------------------------------------------
19476# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
19477# olf:  file(1) magic for OLF executables
19478#
19479# We have to check the byte order flag to see what byte order all the
19480# other stuff in the header is in.
19481#
19482# MIPS R3000 may also be for MIPS R2000.
19483# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
19484#
19485# Created by Erik Theisen <etheisen@openbsd.org>
19486# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
194870	string		\177OLF		OLF
19488>4	byte		0		invalid class
19489>4	byte		1		32-bit
19490>4	byte		2		64-bit
19491>7	byte		0		invalid os
19492>7	byte		1		OpenBSD
19493>7	byte		2		NetBSD
19494>7	byte		3		FreeBSD
19495>7	byte		4		4.4BSD
19496>7	byte		5		Linux
19497>7	byte		6		SVR4
19498>7	byte		7		esix
19499>7	byte		8		Solaris
19500>7	byte		9		Irix
19501>7	byte		10		SCO
19502>7	byte		11		Dell
19503>7	byte		12		NCR
19504>5	byte		0		invalid byte order
19505>5	byte		1		LSB
19506>>16	leshort		0		no file type,
19507>>16	leshort		1		relocatable,
19508>>16	leshort		2		executable,
19509>>16	leshort		3		shared object,
19510# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
19511# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
19512>>16	leshort		4		core file
19513>>>(0x38+0xcc) string	>\0		of '%s'
19514>>>(0x38+0x10) lelong	>0		(signal %d),
19515>>16	leshort		&0xff00		processor-specific,
19516>>18	leshort		0		no machine,
19517>>18	leshort		1		AT&T WE32100 - invalid byte order,
19518>>18	leshort		2		SPARC - invalid byte order,
19519>>18	leshort		3		Intel 80386,
19520>>18	leshort		4		Motorola 68000 - invalid byte order,
19521>>18	leshort		5		Motorola 88000 - invalid byte order,
19522>>18	leshort		6		Intel 80486,
19523>>18	leshort		7		Intel 80860,
19524>>18	leshort		8		MIPS R3000_BE - invalid byte order,
19525>>18	leshort		9		Amdahl - invalid byte order,
19526>>18	leshort		10		MIPS R3000_LE,
19527>>18	leshort		11		RS6000 - invalid byte order,
19528>>18	leshort		15		PA-RISC - invalid byte order,
19529>>18	leshort		16		nCUBE,
19530>>18	leshort		17		VPP500,
19531>>18	leshort		18		SPARC32PLUS,
19532>>18	leshort		20		PowerPC,
19533>>18	leshort		0x9026		Alpha,
19534>>20	lelong		0		invalid version
19535>>20	lelong		1		version 1
19536>>36	lelong		1		MathCoPro/FPU/MAU Required
19537>8	string		>\0		(%s)
19538>5	byte		2		MSB
19539>>16	beshort		0		no file type,
19540>>16	beshort		1		relocatable,
19541>>16	beshort		2		executable,
19542>>16	beshort		3		shared object,
19543>>16	beshort		4		core file,
19544>>>(0x38+0xcc) string	>\0		of '%s'
19545>>>(0x38+0x10) belong	>0		(signal %d),
19546>>16	beshort		&0xff00		processor-specific,
19547>>18	beshort		0		no machine,
19548>>18	beshort		1		AT&T WE32100,
19549>>18	beshort		2		SPARC,
19550>>18	beshort		3		Intel 80386 - invalid byte order,
19551>>18	beshort		4		Motorola 68000,
19552>>18	beshort		5		Motorola 88000,
19553>>18	beshort		6		Intel 80486 - invalid byte order,
19554>>18	beshort		7		Intel 80860,
19555>>18	beshort		8		MIPS R3000_BE,
19556>>18	beshort		9		Amdahl,
19557>>18	beshort		10		MIPS R3000_LE - invalid byte order,
19558>>18	beshort		11		RS6000,
19559>>18	beshort		15		PA-RISC,
19560>>18	beshort		16		nCUBE,
19561>>18	beshort		17		VPP500,
19562>>18	beshort		18		SPARC32PLUS,
19563>>18	beshort		20		PowerPC or cisco 4500,
19564>>18	beshort		21		cisco 7500,
19565>>18	beshort		24		cisco SVIP,
19566>>18	beshort		25		cisco 7200,
19567>>18	beshort		36		cisco 12000,
19568>>18	beshort		0x9026		Alpha,
19569>>20	belong		0		invalid version
19570>>20	belong		1		version 1
19571>>36	belong		1		MathCoPro/FPU/MAU Required
19572
19573#------------------------------------------------------------------------------
19574# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
19575# os2:  file(1) magic for OS/2 files
19576#
19577
19578# Provided 1998/08/22 by
19579# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
195801	search/100	InternetShortcut	MS Windows 95 Internet shortcut text
19581>17	search/100	URL= 			(URL=<
19582>>&0	string		x			\b%s>)
19583
19584# OS/2 URL objects
19585# Provided 1998/08/22 by
19586# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
19587#0	string	http:			OS/2 URL object text
19588#>5	string	>\			(WWW) <http:%s>
19589#0	string	mailto:			OS/2 URL object text
19590#>7	string	>\			(email) <%s>
19591#0	string	news:			OS/2 URL object text
19592#>5	string	>\			(Usenet) <%s>
19593#0	string	ftp:			OS/2 URL object text
19594#>4	string	>\			(FTP) <ftp:%s>
19595#0	string	file:			OS/2 URL object text
19596#>5	string	>\			(Local file) <%s>
19597
19598# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
19599# Carl Hauser (chauser.parc@xerox.com) and
19600# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
19601# list the following header format in inf02a.doc:
19602#
19603#  int16 ID;           // ID magic word (5348h = "HS")
19604#  int8  unknown1;     // unknown purpose, could be third letter of ID
19605#  int8  flags;        // probably a flag word...
19606#                      //  bit 0: set if INF style file
19607#                      //  bit 4: set if HLP style file
19608#                      // patching this byte allows reading HLP files
19609#                      // using the VIEW command, while help files
19610#                      // seem to work with INF settings here as well.
19611#  int16 hdrsize;      // total size of header
19612#  int16 unknown2;     // unknown purpose
19613#
196140   string  HSP\x01\x9b\x00 OS/2 INF
19615>107 string >0                      (%s)
196160   string  HSP\x10\x9b\x00     OS/2 HLP
19617>107 string >0                      (%s)
19618
19619# OS/2 INI (this is a guess)
196200  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
19621
19622#------------------------------------------------------------------------------
19623# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
19624# os400:  file(1) magic for IBM OS/400 files
19625#
19626# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
19627# In spite of its quite variable format (due to internal memory page
19628# length differences between CISC and RISC versions of the OS) the
19629# SAVF structure hasn't suitable offsets to identify the catalog
19630# header in the first descriptor where there are some useful infos,
19631# so we must search in a somewhat large area for a particular string
19632# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
19633# descriptor space) preceded by a two byte constant.
19634#
196351090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
19636>&212	 byte		0x01			 \b, created with SAVOBJ
19637>&212	 byte		0x02			 \b, created with SAVLIB
19638>&212	 byte		0x07			 \b, created with SAVCFG
19639>&212	 byte		0x08			 \b, created with SAVSECDTA
19640>&212	 byte		0x0A			 \b, created with SAVSECDTA
19641>&212	 byte		0x0B			 \b, created with SAVDLO
19642>&212	 byte		0x0D			 \b, created with SAVLICPGM
19643>&212	 byte		0x11			 \b, created with SAVCHGOBJ
19644>&213	 byte		0x44			 \b, at least V5R4 to open
19645>&213	 byte		0x43			 \b, at least V5R3 to open
19646>&213	 byte		0x42			 \b, at least V5R2 to open
19647>&213	 byte		0x41			 \b, at least V5R1 to open
19648>&213	 byte		0x40			 \b, at least V4R5 to open
19649>&213	 byte		0x3F			 \b, at least V4R4 to open
19650>&213	 byte		0x3E			 \b, at least V4R3 to open
19651>&213	 byte		0x3C			 \b, at least V4R2 to open
19652>&213	 byte		0x3D			 \b, at least V4R1M4 to open
19653>&213	 byte		0x3B			 \b, at least V4R1 to open
19654>&213	 byte		0x3A			 \b, at least V3R7 to open
19655>&213	 byte		0x35			 \b, at least V3R6 to open
19656>&213	 byte		0x36			 \b, at least V3R2 to open
19657>&213	 byte		0x34			 \b, at least V3R1 to open
19658>&213	 byte		0x31			 \b, at least V3R0M5 to open
19659>&213	 byte		0x30			 \b, at least V2R3 to open
19660
19661#------------------------------------------------------------------------------
19662# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
19663#
19664# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
19665#
19666# Redistribution and use in source and binary forms, with or without
19667# modification, are permitted provided that the following conditions
19668# are met:
19669# 1. Redistributions of source code must retain the above copyright
19670#    notice, this list of conditions and the following disclaimer.
19671# 2. Redistributions in binary form must reproduce the above copyright
19672#    notice, this list of conditions and the following disclaimer in the
19673#    documentation and/or other materials provided with the distribution.
19674#
19675# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19676# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19677# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19678# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
19679# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19680# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
19681# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
19682# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
19683# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
19684# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
19685#
19686#
19687#
19688# OS9/6809 module descriptions:
19689#
196900	beshort		0x87CD	OS9/6809 module:
19691#
19692>6	byte&0x0f	0x00	non-executable
19693>6	byte&0x0f	0x01	machine language
19694>6	byte&0x0f	0x02	BASIC I-code
19695>6	byte&0x0f	0x03	Pascal P-code
19696>6	byte&0x0f	0x04	C I-code
19697>6	byte&0x0f	0x05	COBOL I-code
19698>6	byte&0x0f	0x06	Fortran I-code
19699#
19700>6	byte&0xf0	0x10	program executable
19701>6	byte&0xf0	0x20	subroutine
19702>6	byte&0xf0	0x30	multi-module
19703>6	byte&0xf0	0x40	data module
19704#
19705>6	byte&0xf0	0xC0	system module
19706>6	byte&0xf0	0xD0	file manager
19707>6	byte&0xf0	0xE0	device driver
19708>6	byte&0xf0	0xF0	device descriptor
19709#
19710# OS9/m68k stuff (to be continued)
19711#
197120	beshort		0x4AFC	OS9/68K module:
19713#
19714# attr
19715>0x14	byte&0x80	0x80	re-entrant
19716>0x14	byte&0x40	0x40	ghost
19717>0x14	byte&0x20	0x20	system-state
19718#
19719# lang:
19720#
19721>0x13	byte		1	machine language
19722>0x13	byte		2	BASIC I-code
19723>0x13	byte		3	Pascal P-code
19724>0x13	byte		4	C I-code
19725>0x13	byte		5	COBOL I-code
19726>0x13	byte		6	Fortran I-code
19727#
19728#
19729# type:
19730#
19731>0x12	byte		1	program executable
19732>0x12	byte		2	subroutine
19733>0x12	byte		3	multi-module
19734>0x12	byte		4	data module
19735>0x12	byte		11	trap library
19736>0x12	byte		12	system module
19737>0x12	byte		13	file manager
19738>0x12	byte		14	device driver
19739>0x12	byte		15	device descriptor
19740
19741#------------------------------------------------------------------------------
19742# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
19743#
19744# Mach magic number info
19745#
197460	long		0xefbe	OSF/Rose object
19747# I386 magic number info
19748#
197490	short		0565	i386 COFF object
19750
19751#------------------------------------------------------------------------------
19752# $File: palm,v 1.13 2014/03/30 21:40:08 christos Exp $
19753# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
19754#
19755# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
19756
19757# These are weak, byte 59 is not guaranteed to be 0 and there are
19758# 8 character identifiers at byte 60, one I found for appl is BIGb.
19759# What are the possibilities and where is this documented?
19760
19761# The common header format for PalmOS .pdb/.prc files is
19762# {
19763#         char            name[ 32 ];
19764#         Word            attributes;
19765#         Word            version;
19766#         DWord           creationDate;
19767#         DWord           modificationDate;
19768#         DWord           lastBackupDate;
19769#         DWord           modificationNumber;
19770#         DWord           appInfoID;
19771#         DWord           sortInfoID;
19772#         char            type[4];
19773#         char            creator[4];
19774#         DWord           uniqueIDSeed;
19775#         RecordListType  recordList;
19776# };
19777#
19778# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
19779# or Unix/POSIX time + 2082844800.
19780
197810		name		aportisdoc
19782# date is supposed to be big-endian seconds since 1 Jan 1904, but many
19783# files contain the timestamp in little-endian or a completely
19784# nonsensical value...
19785#>36		bedate-2082844800	>0	\b, created %s
19786# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
19787>(78.L)		beshort		=1		\b, uncompressed
19788# compressed
19789>(78.L)		beshort		>1
19790>>(78.L+4)	belong		x		\b, %d bytes uncompressed
19791
19792# appl
19793#60		string		appl		PalmOS application
19794#>0		string		>\0		"%s"
19795
19796# HACK
19797#60		string		HACK		HackMaster hack
19798#>0		string		>\0		"%s"
19799
19800# iSiloX e-book
1980160		string		SDocSilX	iSiloX E-book
19802>0		string		>\0		"%s"
19803
19804# Mobipocket (www.mobipocket.com), donated by Carl Witty
19805# expanded by Ralf Brown
1980660		string	 	BOOKMOBI	Mobipocket E-book
19807# MobiPocket stores a full title, pointed at by the belong at offset
19808# 0x54 in its header at (78.L), with length given by the belong at
19809# offset 0x58.
19810# there's no guarantee that the title string is null-terminated, but
19811# we currently can't specify a variable-length string where the length
19812# field is not at the start of the string; in practice, the data
19813# following the string always seems to start with a zero byte
19814>(78.L)		belong		x
19815>>&(&0x50.L-4)	string		>\0		"%s"
19816>0		use		aportisdoc
19817>>(78.L+0x68)	belong		>0		\b, version %d
19818>>(78.L+0x1C)	belong		!0		\b, codepage %d
19819>>(78.L+0x0C)	beshort	 	>0		\b, encrypted (type %d)
19820
19821# AportisDoc/PalmDOC
1982260		string		TEXtREAd	AportisDoc/PalmDOC E-book
19823>0		string		>\0		"%s"
19824>0		use		aportisdoc
19825
19826# Variety of PalmOS document types
19827# Michael-John Turner <mj@debian.org>
19828# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
1982960	string			BVokBDIC	BDicty PalmOS document
19830>0	string			>\0		"%s"
1983160	string			DB99DBOS	DB PalmOS document
19832>0	string			>\0		"%s"
1983360	string			vIMGView	FireViewer/ImageViewer PalmOS document
19834>0	string			>\0		"%s"
1983560	string			PmDBPmDB	HanDBase PalmOS document
19836>0	string			>\0		"%s"
1983760	string			InfoINDB	InfoView PalmOS document
19838>0	string			>\0		"%s"
1983960	string			ToGoToGo	iSilo PalmOS document
19840>0	string			>\0		"%s"
1984160	string			JfDbJBas	JFile PalmOS document
19842>0	string			>\0		"%s"
1984360	string			JfDbJFil	JFile Pro PalmOS document
19844>0	string			>\0		"%s"
1984560	string			DATALSdb	List PalmOS document
19846>0	string			>\0		"%s"
1984760	string			Mdb1Mdb1	MobileDB PalmOS document
19848>0	string			>\0		"%s"
1984960	string			PNRdPPrs	PeanutPress PalmOS document
19850>0	string			>\0		"%s"
1985160	string			DataPlkr	Plucker PalmOS document
19852>0	string			>\0		"%s"
1985360	string			DataSprd	QuickSheet PalmOS document
19854>0	string			>\0		"%s"
1985560	string			SM01SMem	SuperMemo PalmOS document
19856>0	string			>\0		"%s"
1985760	string			TEXtTlDc	TealDoc PalmOS document
19858>0	string			>\0		"%s"
1985960	string			InfoTlIf	TealInfo PalmOS document
19860>0	string			>\0		"%s"
1986160	string			DataTlMl	TealMeal PalmOS document
19862>0	string			>\0		"%s"
1986360	string			DataTlPt	TealPaint PalmOS document
19864>0	string			>\0		"%s"
1986560	string			dataTDBP	ThinkDB PalmOS document
19866>0	string			>\0		"%s"
1986760	string			TdatTide	Tides PalmOS document
19868>0	string			>\0		"%s"
1986960	string			ToRaTRPW	TomeRaider PalmOS document
19870>0	string			>\0		"%s"
19871
19872# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
19873# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
19874#   annotations.
19875# For other versions, just outputs version.
19876#
1987760		string		zTXT		A GutenPalm zTXT e-book
19878>0		string		>\0		"%s"
19879>(0x4E.L)	byte		0
19880>>(0x4E.L+1)	byte		x		(v0.%02d)
19881>(0x4E.L)	byte		1
19882>>(0x4E.L+1)	byte		x		(v1.%02d)
19883>>>(0x4E.L+10)	beshort		>0
19884>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
19885>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
19886>>>(0x4E.L+14)	beshort		>0
19887>>>>(0x4E.L+14) beshort		<2		- 1 annotation
19888>>>>(0x4E.L+14) beshort		>1		- %d annotations
19889>(0x4E.L)	byte		>1		(v%d.
19890>>(0x4E.L+1)	byte		x		%02d)
19891
19892# Palm OS .prc file types
1989360		string		libr
19894# flags, only bit 0 or bit 6
19895# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
19896# http://web.mit.edu/tytso/www/pilot/prc-format.html
19897>0x20		beshort&0xffbe	0
19898>>0		string		>\0		Palm OS dynamic library data "%s"
1989960		string		ptch		Palm OS operating system patch data
19900>0		string		>\0		"%s"
19901
19902# Mobipocket (www.mobipocket.com), donated by Carl Witty
1990360	string			BOOKMOBI	Mobipocket E-book
19904>0	string			>\0		"%s"
19905
19906#------------------------------------------------------------------------------
19907# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
19908#
19909# Parix COFF executables
19910# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
19911#
199120	beshort&0xfff	0xACE	PARIX
19913>0	byte&0xf0	0x80	T800
19914>0	byte&0xf0	0x90	T9000
19915>19	byte&0x02	0x02	executable
19916>19	byte&0x02	0x00	object
19917>19	byte&0x0c	0x00	not stripped
19918#------------------------------------------------------------------------------
19919# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $
19920# parrot: file(1) magic for Parrot Virtual Machine
19921# URL:	http://www.lua.org/
19922# From: Lubomir Rintel <lkundrak@v3.sk>
19923
19924# Compiled Parrot byte code
199250	string	\376PBC\r\n\032\n	Parrot bytecode
19926>64	byte	x			%d.
19927>72	byte	x			\b%d,
19928>8	byte	>0			%d byte words,
19929>16	byte	0			little-endian,
19930>16	byte	1			big-endian,
19931>32	byte	0			IEEE-754 8 byte double floats,
19932>32	byte	1			x86 12 byte long double floats,
19933>32	byte	2			IEEE-754 16 byte long double floats,
19934>32	byte	3			MIPS 16 byte long double floats,
19935>32	byte	4			AIX 16 byte long double floats,
19936>32	byte	5			4-byte floats,
19937>40	byte	x			Parrot %d.
19938>48	byte	x			\b%d.
19939>56	byte	x			\b%d
19940#------------------------------------------------------------------------------
19941# $File: pascal,v 1.2 2014/07/14 14:21:33 rrt Exp $
19942# pascal:  file(1) magic for Pascal source
19943#
199440	search/8192	(input,		Pascal source text
19945!:mime	text/x-pascal
19946#0	regex		\^program	Pascal source text
19947#!:mime	text/x-pascal
19948#0	regex           	\^record		Pascal source text
19949#!:mime	text/x-pascal
19950
19951#------------------------------------------------------------------------------
19952# $File: pbf,v 1.2 2017/01/18 16:16:21 christos Exp $
19953# file(1) magic(5) data for OpenStreetMap
19954
19955# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
19956# http://wiki.openstreetmap.org/wiki/PBF_Format
19957# From: Markus Heidelberg <markus.heidelberg@web.de>
199580	belong&0xfffffff0	0
19959>4	beshort			0x0A09
19960>>6	string			OSMHeader	OpenStreetMap Protocolbuffer Binary Format
19961
19962#------------------------------------------------------------------------------
19963# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
19964# pbm:  file(1) magic for Portable Bitmap files
19965#
19966# XXX - byte order?
19967#
199680	short	0x2a17	"compact bitmap" format (Poskanzer)
19969#------------------------------------------------------------------------------
19970# pc88:  file(1) magic for the NEC Home Computer
19971# v1.0
19972# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
19973
19974# PC88 2D disk image
199750x20		ulelong&0xFFFFFEFF	0x2A0
19976>0x10		string		\0\0\0\0\0\0\0\0\0\0
19977>>0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
19978>>>0x1A		ubyte&0xEF	0
19979>>>>0x1B	ubyte&0x8F	0
19980>>>>>0x1B	ubyte&70	<0x40
19981>>>>>>0x1C	ulelong	>0x21
19982>>>>>>>0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
19983>>>>>>>>0x1B	ubyte	0	\b, media=2D
19984>>>>>>>>0x1B	ubyte	0x10	\b, media=2DD
19985>>>>>>>>0x1B	ubyte	0x20	\b, media=2HD
19986>>>>>>>>0x1B	ubyte	0x30	\b, media=1D
19987>>>>>>>>0x1B	ubyte	0x40	\b, media=1DD
19988>>>>>>>>0x1A	ubyte	0x10	\b, write-protected
19989
19990
19991
19992
19993#------------------------------------------------------------------------------
19994# pc98:  file(1) magic for the MSX Home Computer
19995# v1.0
19996# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
19997
19998# Maki-chan v1 Graphic format
19999# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so
20000# http://www.jisyo.com/viewer/faq/maki_tech.htm
200010	string/b		MAKI01 	Maki-chan v1.
20002>6	ubyte|0x20	x		\b%c image
20003>8	ubelong		>0x40404040	\b, system ID:
20004>>8	byte		x		%c
20005>>9	byte		x		\b%c
20006>>10	byte		x		\b%c
20007>>11	byte		x		\b%c
20008>44	ubeshort	x		\b, %dx
20009>46	ubeshort	x		\b%d
20010>38	ubeshort&2	0		\b, 16 paletted RGB colors
20011>38	ubeshort&2	2		\b, 8 fixed RGB colors
20012>38	ubeshort&1	1		\b, 2:1 dot aspect ratio
20013
20014# Maki-chan v2 Graphic format
20015# http://www.jisyo.com/viewer/faq/mag_tech.htm
20016# http://mooncore.eu/bunny/txt/makichan.htm
20017# http://metanest.jp/mag/mag.xhtml
200180	string/b		MAKI02\ \ 	Maki-chan v2 image,
20019>8	byte		x		system ID: %c
20020>9	byte		x		\b%c
20021>10	byte		x		\b%c
20022>11	byte		x		\b%c,
20023>13	search/0x200	\x1A
20024#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing:
20025#1) When offset1(ubeshort) !=0x0344:
20026# 1.1) And  offset3(ubyte).b7=0:
20027# - b0=pixel aspect ratio: 1=2:1   (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1)
20028# - b1=number of colors: 0=16 colors, 1=8 colors
20029# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data
20030# 1.2) And  offset3(ubyte).B7=1:
20031# - b0=256 paletted colors
20032# - b1=256 fixed colors using the MSX SCR8 palette
20033#2) When offset1(ubeshort) =0x0344:
20034# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored
20035>>&1	ubeshort	0x0344		256x212, 19268 fixed YJK colors
20036>>&1	ubeshort	!0x0344
20037>>>&5	uleshort+1	x		%dx
20038>>>&7	uleshort+1	x		\b%d,
20039>>>&0	ubyte&0x86	0x00		16 paletted RGB colors
20040>>>&0	ubyte&0x86	0x02		8 paletted RGB colors
20041>>>&0	ubyte&0x86	0x04		16 fixed RGB colors
20042>>>&0	ubyte&0x86	0x06		8 fixed RGB colors
20043>>>&0	ubyte&0x81	0x80		256 paletted RGB colors
20044>>>&0	ubyte&0x81	0x81		256 fixed MSX-SCR8 colors
20045>>>&0	ubyte&0x01	1		\b, 2:1 dot aspect ratio
20046
20047# XLD4 (Q4) picture
2004811	string/b	MAJYO		XLD4(Q4) picture
20049
20050# Yanagisawa Pi picture
20051#0	string		Pi\x1A\0	Yanagisawa Pi picture
20052#>3	search/0x200	\x04
200530	string		Pi
20054>2	search/0x200	\x1A
20055>>&0	ubyte		0
20056>>>&3	ubyte		4		Yanagisawa Pi 16 color picture,
20057>>>&4	byte		x		system ID: %c
20058>>>&5	byte		x		\b%c
20059>>>&6	byte		x		\b%c
20060>>>&7	byte		x		\b%c,
20061>>>&10	ubeshort	x		%dx
20062>>>&12	ubeshort	x		\b%d
20063>>>&3	ubyte		8		Yanagisawa Pi 256 color picture
20064>>>&4	byte		x		system ID: %c
20065>>>&5	byte		x		\b%c
20066>>>&6	byte		x		\b%c
20067>>>&7	byte		x		\b%c,
20068>>>&10	ubeshort	x		%dx
20069>>>&12	ubeshort	x		\b%d
20070
20071#------------------------------------------------------------------------------
20072# $File: pdf,v 1.8 2015/01/11 18:19:18 christos Exp $
20073# pdf:  file(1) magic for Portable Document Format
20074#
20075
200760	string		%PDF-		PDF document
20077!:mime	application/pdf
20078>5	byte		x		\b, version %c
20079>7	byte		x		\b.%c
20080
200810	string		\012%PDF-	PDF document
20082!:mime	application/pdf
20083>6	byte		x		\b, version %c
20084>8	byte		x		\b.%c
20085
20086# From: Nick Schmalenberger <nick@schmalenberger.us>
20087# Forms Data Format
200880       string          %FDF-           FDF document
20089!:mime application/vnd.fdf
20090>5      byte            x               \b, version %c
20091>7      byte            x               \b.%c
20092
20093#------------------------------------------------------------------------------
20094# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
20095# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
20096#
200970	lelong		0101555		PDP-11 single precision APL workspace
200980	lelong		0101554		PDP-11 double precision APL workspace
20099#
20100# PDP-11 a.out
20101#
201020	leshort		0407		PDP-11 executable
20103>8	leshort		>0		not stripped
20104>15	byte		>0		- version %d
20105
20106# updated by Joerg Jenderek at Mar 2013
20107# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
201080	leshort		0401
20109# skip *.PNF with WinDirPathOffset 58h
20110>68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
20111# skip *.PNF with high byte of InfVersionDatumCount zero
20112#>>15	byte		!0		PDP-11 UNIX/RT ldp
201130	leshort		0405		PDP-11 old overlay
20114
201150	leshort		0410		PDP-11 pure executable
20116>8	leshort		>0		not stripped
20117>15	byte		>0		- version %d
20118
201190	leshort		0411		PDP-11 separate I&D executable
20120>8	leshort		>0		not stripped
20121>15	byte		>0		- version %d
20122
201230	leshort		0437		PDP-11 kernel overlay
20124
20125# These last three are derived from 2.11BSD file(1)
201260	leshort		0413		PDP-11 demand-paged pure executable
20127>8	leshort		>0		not stripped
20128
201290	leshort		0430		PDP-11 overlaid pure executable
20130>8	leshort		>0		not stripped
20131
201320	leshort		0431		PDP-11 overlaid separate executable
20133>8	leshort		>0		not stripped
20134#------------------------------------------------------------------------------
20135# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
20136# perl:  file(1) magic for Larry Wall's perl language.
20137#
20138# The `eval' lines recognizes an outrageously clever hack.
20139# Keith Waclena <keith@cerberus.uchicago.edu>
20140# Send additions to <perl5-porters@perl.org>
201410	search/1024	eval\ "exec\ perl		Perl script text
20142!:mime	text/x-perl
201430	search/1024	eval\ "exec\ /bin/perl		Perl script text
20144!:mime	text/x-perl
201450	search/1024	eval\ "exec\ /usr/bin/perl	Perl script text
20146!:mime	text/x-perl
201470	search/1024	eval\ "exec\ /usr/local/bin/perl	Perl script text
20148!:mime	text/x-perl
201490	search/1024	eval\ 'exec\ perl		Perl script text
20150!:mime	text/x-perl
201510	search/1024	eval\ 'exec\ /bin/perl		Perl script text
20152!:mime	text/x-perl
201530	search/1024	eval\ 'exec\ /usr/bin/perl	Perl script text
20154!:mime	text/x-perl
201550	search/1024	eval\ 'exec\ /usr/local/bin/perl	Perl script text
20156!:mime	text/x-perl
201570	search/1024	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
20158!:mime	text/x-perl
201590	string	#!/usr/bin/env\ perl	Perl script text executable
20160!:mime	text/x-perl
201610	string	#!\ /usr/bin/env\ perl	Perl script text executable
20162!:mime	text/x-perl
201630	string	#!
20164>0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
20165!:mime	text/x-perl
20166
20167# by Dmitry V. Levin and Alexey Tourbin
20168# check the first line
201690	search/8192	package
20170>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
20171!:strength + 40
20172# not 'p', check other lines
201730	search/8192	!p
20174>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
20175>>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
20176!:strength + 75
20177
20178# Perl POD documents
20179# From: Tom Hukins <tom@eborcom.com>
201800	search/1024/W	\=pod\n		Perl POD document text
201810	search/1024/W	\n\=pod\n	Perl POD document text
201820	search/1024/W	\=head1\ 	Perl POD document text
201830	search/1024/W	\n\=head1\ 	Perl POD document text
201840	search/1024/W	\=head2\ 	Perl POD document text
201850	search/1024/W	\n\=head2\ 	Perl POD document text
201860	search/1024/W	\=encoding\ 	Perl POD document text
201870	search/1024/W	\n\=encoding\ 	Perl POD document text
20188
20189
20190# Perl Storable data files.
201910	string	perl-store	perl Storable (v0.6) data
20192>4	byte	>0	(net-order %d)
20193>>4	byte	&01	(network-ordered)
20194>>4	byte	=3	(major 1)
20195>>4	byte	=2	(major 1)
20196
201970	string	pst0	perl Storable (v0.7) data
20198>4	byte	>0
20199>>4	byte	&01	(network-ordered)
20200>>4	byte	=5	(major 2)
20201>>4	byte	=4	(major 2)
20202>>5	byte	>0	(minor %d)
20203
20204# This is Debian #742949 by Zefram <zefram@fysh.org>:
20205# -----------------------------------------------------------
20206# The Perl module Hash::SharedMem
20207# <https://metacpan.org/release/Hash-SharedMem> defines a file format
20208# for a key/value store.  Details of the file format are in the "DESIGN"
20209# file in the module distribution.  Magic:
202100	bequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, big-endian
20211>8	bequad	<0x1000000
20212>>15	byte	>2	\b, line size 2^%d byte
20213>>14	byte	>2	\b, page size 2^%d byte
20214>>13	byte	&1
20215>>>13	byte	>1	\b, max fanout %d
202160	lequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, little-endian
20217>8	lequad	<0x1000000
20218>>8	byte	>2	\b, line size 2^%d byte
20219>>9	byte	>2	\b, page size 2^%d byte
20220>>10	byte	&1
20221>>>10	byte	>1	\b, max fanout %d
202220	bequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, big-endian
20223>8	bequad	<0x1000000
20224>>15	byte	>2	\b, line size 2^%d byte
20225>>14	byte	>2	\b, page size 2^%d byte
20226>>13	byte	&1
20227>>>13	byte	>1	\b, max fanout %d
202280	lequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, little-endian
20229>8	lequad	<0x1000000
20230>>8	byte	>2	\b, line size 2^%d byte
20231>>9	byte	>2	\b, page size 2^%d byte
20232>>10	byte	&1
20233>>>10	byte	>1	\b, max fanout %d
20234
20235#------------------------------------------------------------------------------
20236# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
20237# pgf: file(1) magic for Progressive Graphics File (PGF)
20238#
20239# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
20240# 2013 by Philipp Hahn <pmhahn debian org>
202410 string PGF Progressive Graphics image data,
20242!:mime image/x-pgf
20243>3	string	2	version %s,
20244>3	string	4	version %s,
20245>3	string	5	version %s,
20246>3	string	6	version %s,
20247#	PGFPreHeader
20248#>>4	lelong	x	header size %d,
20249#	PGFHeader
20250>>8	lelong	x	%d x
20251>>12	lelong	x	%d,
20252>>16	byte	x	%d levels,
20253>>17	byte	x	compression level %d,
20254>>18	byte	x	%d bpp,
20255>>19	byte	x	%d channels,
20256>>20	clear	x
20257>>20	byte	0	bitmap,
20258>>20	byte	1	gray scale,
20259>>20	byte	2	indexed color,
20260>>20	byte	3	RGB color,
20261>>20	byte	4	CYMK color,
20262>>20	byte	5	HSL color,
20263>>20	byte	6	HSB color,
20264>>20	byte	7	multi-channel,
20265>>20	byte	8	duo tone,
20266>>20	byte	9	LAB color,
20267>>20	byte	10	gray scale 16,
20268>>20	byte	11	RGB color 48,
20269>>20	byte	12	LAB color 48,
20270>>20	byte	13	CYMK color 64,
20271>>20	byte	14	deep multi-channel,
20272>>20	byte	15	duo tone 16,
20273>>20	byte	17	RGBA color,
20274>>20	byte	18	gray scale 32,
20275>>20	byte	19	RGB color 12,
20276>>20	byte	20	RGB color 16,
20277>>20	byte	255	unknown format,
20278>>20	default	x	format
20279>>>20	byte	x	\b %d,
20280>>21	byte	x	%d bpc
20281#	PGFPostHeader
20282#	Level-Sizes
20283#>>(4.l+4)	lelong x level 0 size: %d
20284#>>(4.l+8)	lelong x level 1 size: %d
20285#>>(4.l+12)	lelong x level 2 size: %d
20286
20287#------------------------------------------------------------------------------
20288# $File: pgp,v 1.14 2017/03/17 21:35:28 christos Exp $
20289# pgp:  file(1) magic for Pretty Good Privacy
20290# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
20291#
202920       beshort         0x9900                  PGP key public ring
20293!:mime	application/x-pgp-keyring
202940       beshort         0x9501                  PGP key security ring
20295!:mime	application/x-pgp-keyring
202960       beshort         0x9500                  PGP key security ring
20297!:mime	application/x-pgp-keyring
202980	beshort		0xa600			PGP encrypted data
20299#!:mime	application/pgp-encrypted
20300#0	string		-----BEGIN\040PGP	text/PGP armored data
20301!:mime	text/PGP # encoding: armored data
20302#>15	string	PUBLIC\040KEY\040BLOCK-	public key block
20303#>15	string	MESSAGE-		message
20304#>15	string	SIGNED\040MESSAGE-	signed message
20305#>15	string	PGP\040SIGNATURE-	signature
20306
203072	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
20308!:mime	application/pgp-keys
20309>10	search/100	\n\n
20310>>&0	use		pgp
203110	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
20312!:mime	application/pgp
20313>10	search/100	\n\n
20314>>&0	use		pgp
203150	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
20316!:mime	application/pgp-signature
20317>10	search/100	\n\n
20318>>&0	use		pgp
20319
20320# Decode the type of the packet based on it's base64 encoding.
20321# Idea from Mark Martinec
20322# The specification is in RFC 4880, section 4.2 and 4.3:
20323# http://tools.ietf.org/html/rfc4880#section-4.2
20324
203250	name		pgp
20326>0	byte		0x67		Reserved (old)
20327>0	byte		0x68		Public-Key Encrypted Session Key (old)
20328>0	byte		0x69		Signature (old)
20329>0	byte		0x6a		Symmetric-Key Encrypted Session Key (old)
20330>0	byte		0x6b		One-Pass Signature (old)
20331>0	byte		0x6c		Secret-Key (old)
20332>0	byte		0x6d		Public-Key (old)
20333>0	byte		0x6e		Secret-Subkey (old)
20334>0	byte		0x6f		Compressed Data (old)
20335>0	byte		0x70		Symmetrically Encrypted Data (old)
20336>0	byte		0x71		Marker (old)
20337>0	byte		0x72		Literal Data (old)
20338>0	byte		0x73		Trust (old)
20339>0	byte		0x74		User ID (old)
20340>0	byte		0x75		Public-Subkey (old)
20341>0	byte		0x76		Unused (old)
20342>0	byte		0x77
20343>>1	byte&0xc0	0x00		Reserved
20344>>1	byte&0xc0	0x40		Public-Key Encrypted Session Key
20345>>1	byte&0xc0	0x80		Signature
20346>>1	byte&0xc0	0xc0		Symmetric-Key Encrypted Session Key
20347>0	byte		0x78
20348>>1	byte&0xc0	0x00		One-Pass Signature
20349>>1	byte&0xc0	0x40		Secret-Key
20350>>1	byte&0xc0	0x80		Public-Key
20351>>1	byte&0xc0	0xc0		Secret-Subkey
20352>0	byte		0x79
20353>>1	byte&0xc0	0x00		Compressed Data
20354>>1	byte&0xc0	0x40		Symmetrically Encrypted Data
20355>>1	byte&0xc0	0x80		Marker
20356>>1	byte&0xc0	0xc0		Literal Data
20357>0	byte		0x7a
20358>>1	byte&0xc0	0x00		Trust
20359>>1	byte&0xc0	0x40		User ID
20360>>1	byte&0xc0	0x80		Public-Subkey
20361>>1	byte&0xc0	0xc0		Unused [z%x]
20362>0	byte		0x30
20363>>1	byte&0xc0	0x00		Unused [0%x]
20364>>1	byte&0xc0	0x40		User Attribute
20365>>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data
20366>>1	byte&0xc0	0xc0		Modification Detection Code
20367
20368# magic signatures to detect PGP crypto material (from stef)
20369# detects and extracts metadata from:
20370#  - symmetric encrypted packet header
20371#  - RSA (e=65537) secret (sub-)keys
20372
20373# 1024b RSA encrypted data
20374
203750	string	\x84\x8c\x03		PGP RSA encrypted session key -
20376>3	lelong	x			keyid: %X
20377>7	lelong	x			%X
20378>11	byte	0x01			RSA (Encrypt or Sign) 1024b
20379>11	byte	0x02			RSA Encrypt-Only 1024b
20380>12	string	\x04\x00
20381>12	string	\x03\xff
20382>12	string	\x03\xfe
20383>12	string	\x03\xfd
20384>12	string	\x03\xfc
20385>12	string	\x03\xfb
20386>12	string	\x03\xfa
20387>12	string	\x03\xf9
20388>142	byte	0xd2			.
20389
20390# 2048b RSA encrypted data
20391
203920	string	\x85\x01\x0c\x03	PGP RSA encrypted session key -
20393>4	lelong	x			keyid: %X
20394>8	lelong	x			%X
20395>12	byte	0x01			RSA (Encrypt or Sign) 2048b
20396>12	byte	0x02			RSA Encrypt-Only 2048b
20397>13	string	\x08\x00
20398>13	string	\x07\xff
20399>13	string	\x07\xfe
20400>13	string	\x07\xfd
20401>13	string	\x07\xfc
20402>13	string	\x07\xfb
20403>13	string	\x07\xfa
20404>13	string	\x07\xf9
20405>271	byte	0xd2			.
20406
20407# 3072b RSA encrypted data
20408
204090	string	\x85\x01\x8c\x03	PGP RSA encrypted session key -
20410>4	lelong	x			keyid: %X
20411>8	lelong	x			%X
20412>12	byte	0x01			RSA (Encrypt or Sign) 3072b
20413>12	byte	0x02			RSA Encrypt-Only 3072b
20414>13	string	\x0c\x00
20415>13	string	\x0b\xff
20416>13	string	\x0b\xfe
20417>13	string	\x0b\xfd
20418>13	string	\x0b\xfc
20419>13	string	\x0b\xfb
20420>13	string	\x0b\xfa
20421>13	string	\x0b\xf9
20422>399	byte	0xd2			.
20423
20424# 3072b RSA encrypted data
20425
204260	string	\x85\x02\x0c\x03	PGP RSA encrypted session key -
20427>4	lelong	x			keyid: %X
20428>8	lelong	x			%X
20429>12	byte	0x01			RSA (Encrypt or Sign) 4096b
20430>12	byte	0x02			RSA Encrypt-Only 4096b
20431>13	string	\x10\x00
20432>13	string	\x0f\xff
20433>13	string	\x0f\xfe
20434>13	string	\x0f\xfd
20435>13	string	\x0f\xfc
20436>13	string	\x0f\xfb
20437>13	string	\x0f\xfa
20438>13	string	\x0f\xf9
20439>527	byte	0xd2			.
20440
20441# 4096b RSA encrypted data
20442
204430	string	\x85\x04\x0c\x03	PGP RSA encrypted session key -
20444>4	lelong	x			keyid: %X
20445>8	lelong	x			%X
20446>12	byte	0x01			RSA (Encrypt or Sign) 8129b
20447>12	byte	0x02			RSA Encrypt-Only 8129b
20448>13	string	\x20\x00
20449>13	string	\x1f\xff
20450>13	string	\x1f\xfe
20451>13	string	\x1f\xfd
20452>13	string	\x1f\xfc
20453>13	string	\x1f\xfb
20454>13	string	\x1f\xfa
20455>13	string	\x1f\xf9
20456>1039	byte	0xd2			.
20457
20458# crypto algo mapper
20459
204600	name	crypto
20461>0	byte	0x00			Plaintext or unencrypted data
20462>0	byte	0x01			IDEA
20463>0	byte	0x02			TripleDES
20464>0	byte	0x03			CAST5 (128 bit key)
20465>0	byte	0x04			Blowfish (128 bit key, 16 rounds)
20466>0	byte	0x07			AES with 128-bit key
20467>0	byte	0x08			AES with 192-bit key
20468>0	byte	0x09			AES with 256-bit key
20469>0	byte	0x0a			Twofish with 256-bit key
20470
20471# hash algo mapper
20472
204730	name	hash
20474>0	byte	0x01			MD5
20475>0	byte	0x02			SHA-1
20476>0	byte	0x03			RIPE-MD/160
20477>0	byte	0x08			SHA256
20478>0	byte	0x09			SHA384
20479>0	byte	0x0a			SHA512
20480>0	byte	0x0b			SHA224
20481
20482# display public key algorithms as human readable text
204830	name	key_algo
20484>0	byte	0x01			RSA (Encrypt or Sign)
20485# keep old look of version 5.28 without parentheses
20486>0	byte	0x02			RSA Encrypt-Only
20487>0	byte	0x03			RSA (Sign-Only)
20488>0	byte	16			ElGamal (Encrypt-Only)
20489>0	byte	17			DSA
20490>0	byte	18			Elliptic Curve
20491>0	byte	19			ECDSA
20492>0	byte	20			ElGamal (Encrypt or Sign)
20493>0	byte	21			Diffie-Hellman
20494>0	default	x
20495>>0	ubyte	<22			unknown (pub %d)
20496# this should never happen
20497>>0	ubyte	>21			invalid (%d)
20498
20499# pgp symmetric encrypted data
20500
205010	byte	0x8c			PGP symmetric key encrypted data -
20502>1	byte	0x0d
20503>1	byte	0x0c
20504>2	byte	0x04
20505>3	use	crypto
20506>4	byte	0x01			salted -
20507>>5	use	hash
20508>>14	byte	0xd2			.
20509>>14	byte	0xc9			.
20510>4	byte	0x03			salted & iterated -
20511>>5	use	hash
20512>>15	byte	0xd2			.
20513>>15	byte	0xc9			.
20514
20515# encrypted keymaterial needs s2k & can be checksummed/hashed
20516
205170	name	chkcrypto
20518>0	use	crypto
20519>1	byte	0x00			Simple S2K
20520>1	byte	0x01			Salted S2K
20521>1	byte	0x03			Salted&Iterated S2K
20522>2	use	hash
20523
20524# all PGP keys start with this prolog
20525# containing version, creation date, and purpose
20526
205270	name	keyprolog
20528>0	byte	0x04
20529>1	beldate	x			created on %s -
20530>5	byte	0x01			RSA (Encrypt or Sign)
20531>5	byte	0x02			RSA Encrypt-Only
20532
20533# end of secret keys known signature
20534# contains e=65537 and the prolog to
20535# the encrypted parameters
20536
205370	name	keyend
20538>0	string	\x00\x11\x01\x00\x01	e=65537
20539>5	use	crypto
20540>5	byte	0xff			checksummed
20541>>6	use	chkcrypto
20542>5	byte	0xfe			hashed
20543>>6	use	chkcrypto
20544
20545# PGP secret keys contain also the public parts
20546# these vary by bitsize of the key
20547
205480	name	x1024
20549>0	use	keyprolog
20550>6	string	\x03\xfe
20551>6	string	\x03\xff
20552>6	string	\x04\x00
20553>136	use	keyend
20554
205550	name	x2048
20556>0	use	keyprolog
20557>6	string	\x80\x00
20558>6	string	\x07\xfe
20559>6	string	\x07\xff
20560>264	use	keyend
20561
205620	name	x3072
20563>0	use	keyprolog
20564>6	string	\x0b\xfe
20565>6	string	\x0b\xff
20566>6	string	\x0c\x00
20567>392	use	keyend
20568
205690	name	x4096
20570>0	use	keyprolog
20571>6	string	\x10\x00
20572>6	string	\x0f\xfe
20573>6	string	\x0f\xff
20574>520	use	keyend
20575
20576# \x00|\x1f[\xfe\xff]).{1024})'
205770	name	x8192
20578>0	use	keyprolog
20579>6	string	\x20\x00
20580>6	string	\x1f\xfe
20581>6	string	\x1f\xff
20582>1032	use	keyend
20583
20584# depending on the size of the pkt
20585# we branch into the proper key size
20586# signatures defined as x{keysize}
20587
20588>0	name	pgpkey
20589>0	string	\x01\xd8	1024b
20590>>2	use	x1024
20591>0	string	\x01\xeb	1024b
20592>>2	use	x1024
20593>0	string	\x01\xfb	1024b
20594>>2	use	x1024
20595>0	string	\x01\xfd	1024b
20596>>2	use	x1024
20597>0	string	\x01\xf3	1024b
20598>>2	use	x1024
20599>0	string	\x01\xee	1024b
20600>>2	use	x1024
20601>0	string	\x01\xfe	1024b
20602>>2	use	x1024
20603>0	string	\x01\xf4	1024b
20604>>2	use	x1024
20605>0	string	\x02\x0d	1024b
20606>>2	use	x1024
20607>0	string	\x02\x03	1024b
20608>>2	use	x1024
20609>0	string	\x02\x05	1024b
20610>>2	use	x1024
20611>0	string	\x02\x15	1024b
20612>>2	use	x1024
20613>0	string	\x02\x00	1024b
20614>>2	use	x1024
20615>0	string	\x02\x10	1024b
20616>>2	use	x1024
20617>0	string	\x02\x04	1024b
20618>>2	use	x1024
20619>0	string	\x02\x06	1024b
20620>>2	use	x1024
20621>0	string	\x02\x16	1024b
20622>>2	use	x1024
20623>0	string	\x03\x98	2048b
20624>>2	use	x2048
20625>0	string	\x03\xab	2048b
20626>>2	use	x2048
20627>0	string	\x03\xbb	2048b
20628>>2	use	x2048
20629>0	string	\x03\xbd	2048b
20630>>2	use	x2048
20631>0	string	\x03\xcd	2048b
20632>>2	use	x2048
20633>0	string	\x03\xb3	2048b
20634>>2	use	x2048
20635>0	string	\x03\xc3	2048b
20636>>2	use	x2048
20637>0	string	\x03\xc5	2048b
20638>>2	use	x2048
20639>0	string	\x03\xd5	2048b
20640>>2	use	x2048
20641>0	string	\x03\xae	2048b
20642>>2	use	x2048
20643>0	string	\x03\xbe	2048b
20644>>2	use	x2048
20645>0	string	\x03\xc0	2048b
20646>>2	use	x2048
20647>0	string	\x03\xd0	2048b
20648>>2	use	x2048
20649>0	string	\x03\xb4	2048b
20650>>2	use	x2048
20651>0	string	\x03\xc4	2048b
20652>>2	use	x2048
20653>0	string	\x03\xc6	2048b
20654>>2	use	x2048
20655>0	string	\x03\xd6	2048b
20656>>2	use	x2048
20657>0	string	\x05X		3072b
20658>>2	use	x3072
20659>0	string	\x05k		3072b
20660>>2	use	x3072
20661>0	string	\x05{		3072b
20662>>2	use	x3072
20663>0	string	\x05}		3072b
20664>>2	use	x3072
20665>0	string	\x05\x8d	3072b
20666>>2	use	x3072
20667>0	string	\x05s		3072b
20668>>2	use	x3072
20669>0	string	\x05\x83	3072b
20670>>2	use	x3072
20671>0	string	\x05\x85	3072b
20672>>2	use	x3072
20673>0	string	\x05\x95	3072b
20674>>2	use	x3072
20675>0	string	\x05n		3072b
20676>>2	use	x3072
20677>0	string	\x05\x7e	3072b
20678>>2	use	x3072
20679>0	string	\x05\x80	3072b
20680>>2	use	x3072
20681>0	string	\x05\x90	3072b
20682>>2	use	x3072
20683>0	string	\x05t		3072b
20684>>2	use	x3072
20685>0	string	\x05\x84	3072b
20686>>2	use	x3072
20687>0	string	\x05\x86	3072b
20688>>2	use	x3072
20689>0	string	\x05\x96	3072b
20690>>2	use	x3072
20691>0	string	\x07[		4096b
20692>>2	use	x4096
20693>0	string	\x07\x18	4096b
20694>>2	use	x4096
20695>0	string	\x07+		4096b
20696>>2	use	x4096
20697>0	string	\x07;		4096b
20698>>2	use	x4096
20699>0	string	\x07=		4096b
20700>>2	use	x4096
20701>0	string	\x07M		4096b
20702>>2	use	x4096
20703>0	string	\x073		4096b
20704>>2	use	x4096
20705>0	string	\x07C		4096b
20706>>2	use	x4096
20707>0	string	\x07E		4096b
20708>>2	use	x4096
20709>0	string	\x07U		4096b
20710>>2	use	x4096
20711>0	string	\x07.		4096b
20712>>2	use	x4096
20713>0	string	\x07>		4096b
20714>>2	use	x4096
20715>0	string	\x07@		4096b
20716>>2	use	x4096
20717>0	string	\x07P		4096b
20718>>2	use	x4096
20719>0	string	\x074		4096b
20720>>2	use	x4096
20721>0	string	\x07D		4096b
20722>>2	use	x4096
20723>0	string	\x07F		4096b
20724>>2	use	x4096
20725>0	string	\x07V		4096b
20726>>2	use	x4096
20727>0	string	\x0e[		8192b
20728>>2	use	x8192
20729>0	string	\x0e\x18	8192b
20730>>2	use	x8192
20731>0	string	\x0e+		8192b
20732>>2	use	x8192
20733>0	string	\x0e;		8192b
20734>>2	use	x8192
20735>0	string	\x0e=		8192b
20736>>2	use	x8192
20737>0	string	\x0eM		8192b
20738>>2	use	x8192
20739>0	string	\x0e3		8192b
20740>>2	use	x8192
20741>0	string	\x0eC		8192b
20742>>2	use	x8192
20743>0	string	\x0eE		8192b
20744>>2	use	x8192
20745>0	string	\x0eU		8192b
20746>>2	use	x8192
20747>0	string	\x0e.		8192b
20748>>2	use	x8192
20749>0	string	\x0e>		8192b
20750>>2	use	x8192
20751>0	string	\x0e@		8192b
20752>>2	use	x8192
20753>0	string	\x0eP		8192b
20754>>2	use	x8192
20755>0	string	\x0e4		8192b
20756>>2	use	x8192
20757>0	string	\x0eD		8192b
20758>>2	use	x8192
20759>0	string	\x0eF		8192b
20760>>2	use	x8192
20761>0	string	\x0eV		8192b
20762>>2	use	x8192
20763
20764# PGP RSA (e=65537) secret (sub-)key header
20765
207660	byte	0x95			PGP	Secret Key -
20767>1	use	pgpkey
207680	byte	0x97			PGP	Secret Sub-key -
20769>1	use	pgpkey
207700	byte	0x9d
20771# Update: Joerg Jenderek
20772# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
20773# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
20774>1	ubeshort	>0
20775#>1	ubeshort	x		\b, body length 0x%x
20776# next packet type often 88h,89h~(tag 2)~Signature Packet
20777#>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
20778# skip Dragon.SHR DEMO.INIT by looking for positive version
20779>>3	ubyte		>0
20780# skip BUISSON.13 GUITAR1 by looking for low version number
20781>>>3	ubyte		<5		PGP Secret Sub-key
20782# sub-key are normally part of secret key. So it does not occur as standalone file
20783#!:ext	bin
20784# version 2,3~old 4~new . Comment following line for version 5.28 look
20785>>>>3	ubyte		x		(v%d)
20786>>>>3	ubyte		x		-
20787# old versions 2 or 3 but no real example found
20788>>>>3	ubyte		<4
20789# 2 byte for key bits in version 5.28 look
20790>>>>>11		ubeshort	x	%db
20791>>>>>4		beldate		x	created on %s -
20792# old versions use 2 additional bytes after time stamp
20793#>>>>>8		ubeshort	x	0x%x
20794# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
20795>>>>>10	  	use		key_algo
20796>>>>>(11.S/8)	ubequad		x
20797# look after first key
20798>>>>>>&5	use		keyend
20799# new version
20800>>>>3	ubyte		>3
20801>>>>>9		ubeshort	x	%db
20802>>>>>4		beldate		x	created on %s -
20803# display key algorithm
20804>>>>>8		use		key_algo
20805>>>>>(9.S/8)	ubequad		x
20806# look after first key for something like s2k
20807>>>>>>&3	use		keyend
20808
20809#------------------------------------------------------------------------------
20810# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
20811# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
20812#
208130       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
20814!:mime	application/x-svr4-package
20815
20816#------------------------------------------------------------------------------
20817# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
20818# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
20819# From: "Stefan A. Haubenthal" <polluks@web.de>
20820#
208210	belong		0x00000107	Plan 9 executable, Motorola 68k
208220	belong		0x000001EB	Plan 9 executable, Intel 386
208230	belong		0x00000247	Plan 9 executable, Intel 960
208240	belong		0x000002AB	Plan 9 executable, SPARC
208250	belong		0x00000407	Plan 9 executable, MIPS R3000
208260	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
208270	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
208280	belong		0x000005AB	Plan 9 executable, AMD 29000
208290	belong		0x00000647	Plan 9 executable, ARM 7-something
208300	belong		0x000006EB	Plan 9 executable, PowerPC
208310	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
208320	belong		0x0000084B	Plan 9 executable, DEC Alpha
20833
20834#------------------------------------------------------------------------------
20835# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
20836# plus5:  file(1) magic for Plus Five's UNIX MUMPS
20837#
20838# XXX - byte order?  Paging Hokey....
20839#
208400	short		0x259		mumps avl global
20841>2	byte		>0		(V%d)
20842>6	byte		>0		with %d byte name
20843>7	byte		>0		and %d byte data cells
208440	short		0x25a		mumps blt global
20845>2	byte		>0		(V%d)
20846>8	short		>0		- %d byte blocks
20847>15	byte		0x00		- P/D format
20848>15	byte		0x01		- P/K/D format
20849>15	byte		0x02		- K/D format
20850>15	byte		>0x02		- Bad Flags
20851
20852#------------------------------------------------------------------------------
20853# $File: polyml,v 1.1 2016/02/26 15:52:45 christos Exp $
20854# polyml:  file(1) magic for PolyML
20855#
20856# PolyML
20857# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
20858# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
20859
20860# [0]: http://www.polyml.org/
20861# [1]: https://github.com/polyml/polyml/blob/master/\
20862#	libpolyml/savestate.cpp#L146-L147
20863# [2]: https://github.com/polyml/polyml/blob/master/\
20864#	libpolyml/savestate.cpp#L1262-L1263
20865
20866# Type: Poly/ML saved data
20867# From: Matthew Fernandez <matthew.fernandez@gmail.com>
20868
208690	string	POLYSAVE	Poly/ML saved state
20870>8	long	x		version %u
20871
208720	string  POLYMODU	Poly/ML saved module
20873>8	long	x		version %u
20874
20875#------------------------------------------------------------------------------
20876# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $
20877# printer:  file(1) magic for printer-formatted files
20878#
20879
20880# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
208810	string		%!		PostScript document text
20882!:mime	application/postscript
20883!:apple	ASPSTEXT
20884>2	string		PS-Adobe-	conforming
20885>>11	string		>\0		DSC level %.3s
20886>>>15	string		EPS		\b, type %s
20887>>>15	string		Query		\b, type %s
20888>>>15	string		ExitServer	\b, type %s
20889>>>15   search/1000		%%LanguageLevel:\040
20890>>>>&0	string		>\0		\b, Level %s
20891# Some PCs have the annoying habit of adding a ^D as a document separator
208920	string		\004%!		PostScript document text
20893!:mime	application/postscript
20894!:apple	ASPSTEXT
20895>3	string		PS-Adobe-	conforming
20896>>12	string		>\0		DSC level %.3s
20897>>>16	string		EPS		\b, type %s
20898>>>16	string		Query		\b, type %s
20899>>>16	string		ExitServer	\b, type %s
20900>>>16   search/1000		%%LanguageLevel:\040
20901>>>>&0	string		>\0		\b, Level %s
209020	string		\033%-12345X%!PS	PostScript document
20903
20904# DOS EPS Binary File Header
20905# From: Ed Sznyter <ews@Black.Market.NET>
209060       belong          0xC5D0D3C6      DOS EPS Binary File
20907>4      long            >0              Postscript starts at byte %d
20908>>8     long            >0              length %d
20909>>>12   long            >0              Metafile starts at byte %d
20910>>>>16  long            >0              length %d
20911>>>20   long            >0              TIFF starts at byte %d
20912>>>>24  long            >0              length %d
20913
20914# Summary: Adobe's PostScript Printer Description File
20915# Extension: .ppd
20916# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
20917# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
20918#
209190	string		*PPD-Adobe:\x20	PPD file
20920>&0	string		x		\b, version %s
20921
20922# HP Printer Job Language
209230	string		\033%-12345X@PJL	HP Printer Job Language data
20924# HP Printer Job Language
20925# The header found on Win95 HP plot files is the "Silliest Thing possible"
20926# (TM)
20927# Every driver puts the language at some random position, with random case
20928# (LANGUAGE and Language)
20929# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
20930# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
20931#
209320	string		\033%-12345X@PJL	HP Printer Job Language data
20933>&0	string		>\0			%s
20934>>&0	string		>\0			%s
20935>>>&0	string		>\0			%s
20936>>>>&0	string		>\0			%s
20937#>15	string		\ ENTER\ LANGUAGE\ =
20938#>31	string		PostScript		PostScript
20939
20940# From: Stefan Thurner <thurners@nicsys.de>
209410	string		\033%-12345X@PJL
20942>&0	search/10000	%!			PJL encapsulated PostScript document text
20943
20944# Rick Richardson <rickrich@gmail.com>
20945
20946# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
20947# For Oki Data Printers - HIPERC
20948# For Konica Minolta Printers - LAVAFLOW
20949# For Samsung Printers - QPDL
20950# For HP Printers - ZJS stands for Zenographics ZJStream
209510	string		\033%-12345X@PJL	HP Printer Job Language data
20952>0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
20953>0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
20954>0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
20955>0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
20956>0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
20957>0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS
20958
20959
20960# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
209610	string		\033E\033	HP PCL printer data
20962>3	string		\&l0A		- default page size
20963>3	string		\&l1A		- US executive page size
20964>3	string		\&l2A		- US letter page size
20965>3	string		\&l3A		- US legal page size
20966>3	string		\&l26A		- A4 page size
20967>3	string		\&l80A		- Monarch envelope size
20968>3	string		\&l81A		- No. 10 envelope size
20969>3	string		\&l90A		- Intl. DL envelope size
20970>3	string		\&l91A		- Intl. C5 envelope size
20971>3	string		\&l100A		- Intl. B5 envelope size
20972>3	string		\&l-81A		- No. 10 envelope size (landscape)
20973>3	string		\&l-90A		- Intl. DL envelope size (landscape)
20974
20975# IMAGEN printer-ready files:
209760	string	@document(		Imagen printer
20977# this only works if "language xxx" is first item in Imagen header.
20978>10	string	language\ impress	(imPRESS data)
20979>10	string	language\ daisy		(daisywheel text)
20980>10	string	language\ diablo	(daisywheel text)
20981>10	string	language\ printer	(line printer emulation)
20982>10	string	language\ tektronix	(Tektronix 4014 emulation)
20983# Add any other languages that your Imagen uses - remember
20984# to keep the word `text' if the file is human-readable.
20985# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
20986#
20987# Now magic for IMAGEN font files...
209880	string		Rast		RST-format raster font data
20989>45	string		>0		face %s
20990# From Jukka Ukkonen
209910	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
20992
20993# From <mike@flyn.org>
20994# These are the /etc/magic entries to decode data sent to an Epson printer.
209950       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
20996
20997
20998#------------------------------------------------------------------------------
20999# zenographics:  file(1) magic for Zenographics ZjStream printer data
21000# Rick Richardson <rickrich@gmail.com>
210010	string		JZJZ
21002>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
210030	string		ZJZJ
21004>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
21005
21006
21007#------------------------------------------------------------------------------
21008# Oak Technologies printer stream
21009# Rick Richardson <rickrich@gmail.com>
210100       string          OAK
21011>0x07	byte		0
21012>0x0b	byte		0	Oak Technologies printer stream
21013
21014# This would otherwise be recognized as PostScript - nick@debian.org
210150	string		%!VMF 		SunClock's Vector Map Format data
21016
21017#------------------------------------------------------------------------------
21018# HP LaserJet 1000 series downloadable firmware file
210190	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware
21020
21021# From: Paolo <oopla@users.sf.net>
21022# Epson ESC/Page, ESC/PageColor
210230	string	\x1b\x01@EJL	Epson ESC/Page language printer data
21024
21025#------------------------------------------------------------------------------
21026# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
21027# project:  file(1) magic for Project management
21028#
21029# Magic strings for ftnchek project files. Alexander Mai
210300	string	FTNCHEK_\ P	project file for ftnchek
21031>10	string	1		version 2.7
21032>10	string	2		version 2.8 to 2.10
21033>10	string	3		version 2.11 or later
21034
21035#------------------------------------------------------------------------------
21036# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
21037# psdbms:  file(1) magic for psdatabase
21038#
21039# Update: Joerg Jenderek
21040# GRR: line below too general as it catches also some Panorama database *.pan ,
21041# AppleWorks word processor
210420	belong&0xff00ffff	0x56000000
21043# assume version starts with digit
21044>1	regex/s			=^[0-9]		ps database
21045>>1	string	>\0	version %s
21046# kernel name
21047>>4	string	>\0	from kernel %s
21048
21049#------------------------------------------------------------------------------
21050# $File: psl,v 1.2 2016/07/14 17:34:27 christos Exp $
21051# psl:  file(1) magic for Public Suffix List representations
21052# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
21053# URL: https://publicsuffix.org
21054# see also: http://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166
21055
210560	search/512	\n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data
21057
210580	string	.DAFSA@PSL_
21059>15	string	\n	Public Suffix List data (optimized)
21060>>11	byte	>0x2f
21061>>>11	byte	<0x3a   (Version %c)
21062
21063#------------------------------------------------------------------------------
21064# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
21065# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
21066#
21067# http://pulsar.sourceforge.net
21068# mailto:rok.papez@lugos.si
21069#
21070
210710	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
21072>4	ubelong	x		Version: %d.
21073>8	ubelong	x		\b%d
21074
21075
21076#------------------------------------------------------------------------------
21077# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $
21078# pwsafe: file(1) magic for passwordsafe file
21079#
21080# Password Safe
21081# http://passwordsafe.sourceforge.net/
21082# file format specs
21083# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
21084# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
21085# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
21086# V2 and V1 have no easy identifier that I can find
21087# .psafe3
210880	string	PWS3	Password Safe V3 database
21089
21090#------------------------------------------------------------------------------
21091# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
21092# pyramid:  file(1) magic for Pyramids
21093#
21094# XXX - byte order?
21095#
210960	long		0x50900107	Pyramid 90x family executable
210970	long		0x50900108	Pyramid 90x family pure executable
21098>16	long		>0		not stripped
210990	long		0x5090010b	Pyramid 90x family demand paged pure executable
21100>16	long		>0		not stripped
21101
21102#------------------------------------------------------------------------------
21103# $File: python,v 1.31 2017/04/11 14:59:28 christos Exp $
21104# python:  file(1) magic for python
21105#
21106# Outlook puts """ too for urgent messages
21107# From: David Necas <yeti@physics.muni.cz>
21108# often the module starts with a multiline string
211090	string/t	"""	Python script text executable
21110# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
21111# that Py_UnicodeFlag is off for Python 2)
21112# two bytes of magic followed by "\r\n" in little endian order
211130	belong		0x994e0d0a	python 1.5/1.6 byte-compiled
211140	belong		0x87c60d0a	python 2.0 byte-compiled
211150	belong		0x2aeb0d0a	python 2.1 byte-compiled
211160	belong		0x2ded0d0a	python 2.2 byte-compiled
211170	belong		0x3bf20d0a	python 2.3 byte-compiled
211180	belong		0x6df20d0a	python 2.4 byte-compiled
211190	belong		0xb3f20d0a	python 2.5 byte-compiled
211200	belong		0xd1f20d0a	python 2.6 byte-compiled
211210	belong		0x03f30d0a	python 2.7 byte-compiled
211220	belong		0x3b0c0d0a	python 3.0 byte-compiled
211230	belong		0x4f0c0d0a	python 3.1 byte-compiled
211240	belong		0x6c0c0d0a	python 3.2 byte-compiled
211250	belong		0x9e0c0d0a	python 3.3 byte-compiled
211260	belong		0xee0c0d0a	python 3.4 byte-compiled
211270	belong		0x160d0d0a	python 3.5 byte-compiled
21128
211290	search/1/w	#!\ /usr/bin/python	Python script text executable
21130!:strength + 15
21131!:mime text/x-python
211320	search/1/w	#!\ /usr/local/bin/python	Python script text executable
21133!:strength + 15
21134!:mime text/x-python
211350	search/1	#!/usr/bin/env\ python	Python script text executable
21136!:strength + 15
21137!:mime text/x-python
211380	search/10	#!\ /usr/bin/env\ python	Python script text executable
21139!:strength + 15
21140!:mime text/x-python
21141
21142
21143# from module.submodule import func1, func2
211440	regex		\^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$	Python script text executable
21145!:strength + 15
21146!:mime text/x-python
21147
21148# def __init__ (self, ...):
211490	search/4096	def\ __init__
21150>&0	search/64 self	Python script text executable
21151!:strength + 15
21152!:mime text/x-python
21153
21154# comments
21155#0	search/4096	'''
21156#>&0	regex	.*'''$	Python script text executable
21157#!:mime text/x-python
21158
21159#0	search/4096	"""
21160#>&0	regex	.*"""$	Python script text executable
21161#!:mime text/x-python
21162
21163# try:
21164# except: or finally:
21165# block
211660	search/4096	try:
21167>&0	regex	\^[\040\t\f\r\n]*except.*:	Python script text executable
21168!:strength + 15
21169!:mime text/x-python
21170>&0	search/4096	finally:	Python script text executable
21171!:mime text/x-python
21172
21173# def name(args, args):
211740	regex	 \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
21175>&0	regex	\ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
21176!:mime text/x-python
21177!:strength + 15
21178
21179#------------------------------------------------------------------------------
21180# $File: qt,v 1.2 2014/12/16 19:49:29 christos Exp $
21181# qt:  file(1) magic for Qt
21182
21183# http://doc.qt.io/qt-5/resources.html
211840	string		\<!DOCTYPE\040RCC\>	Qt Resource Collection file
21185
21186# https://qt.gitorious.org/qt/qtbase/source/\
21187# 5367fa356233da4c0f28172a8f817791525f5457:\
21188# src/tools/rcc/rcc.cpp#L840
211890	string		qres\0\0		Qt Binary Resource file
211900	search/1024	The\040Resource\040Compiler\040for\040Qt	Qt C-code resource file
21191
21192# https://qt.gitorious.org/qt/qtbase/source/\
21193# 5367fa356233da4c0f28172a8f817791525f5457:\
21194# src/corelib/kernel/qtranslator.cpp#L62
211950	string		\x3c\xb8\x64\x18\xca\xef\x9c\x95
21196>8	string		\xcd\x21\x1c\xbf\x60\xa1\xbd\xdd	Qt Translation file
21197
21198#------------------------------------------------------------------------------
21199# $File: revision,v 1.9 2013/02/06 14:18:52 christos Exp $
21200# file(1) magic for revision control files
21201# From Hendrik Scholz <hendrik@scholz.net>
212020	string/t	/1\ :pserver:	cvs password text file
21203
21204# Conary changesets
21205# From: Jonathan Smith <smithj@rpath.com>
212060	belong	0xea3f81bb	Conary changeset data
21207
21208# Type: Git bundles (git-bundle)
21209# From: Josh Triplett <josh@freedesktop.org>
212100	string	#\ v2\ git\ bundle\n	Git bundle
21211
21212# Type: Git pack
21213# From: Adam Buchbinder <adam.buchbinder@gmail.com>
21214# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
21215# those have a little-endian offset immediately following the magic 'PACK',
21216# the first byte of which is never 0, while the first byte of the Git pack
21217# version, since it's a tiny number stored in big-endian format, is always 0.
212180	string	PACK\0		Git pack
21219>4	belong	>0		\b, version %d
21220>>8	belong	>0		\b, %d objects
21221
21222# Type: Git pack index
21223# From: Adam Buchbinder <adam.buchbinder@gmail.com>
212240	string	\377tOc		Git pack index
21225>4	belong	=2		\b, version 2
21226
21227# Type: Git index file
21228# From: Frederic Briare <fbriere@fbriere.net>
212290	string	DIRC		Git index
21230>4	belong	>0		\b, version %d
21231>>8	belong	>0		\b, %d entries
21232
21233# Type:	Mercurial bundles
21234# From:	Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
212350	string	HG10		Mercurial bundle,
21236>4	string	UN		uncompressed
21237>4	string	BZ		bzip2 compressed
21238
21239# Type:	Subversion (SVN) dumps
21240# From:	Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
212410	string	SVN-fs-dump-format-version:	Subversion dumpfile
21242>28	string	>\0				(version: %s)
21243
21244# Type:	Bazaar revision bundles and merge requests
21245# URL:	http://www.bazaar-vcs.org/
21246# From:	Jelmer Vernooij <jelmer@samba.org>
212470	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
212480	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive
21249
21250#------------------------------------------------------------------------------
21251# $File: riff,v 1.32 2017/03/17 21:35:28 christos Exp $
21252# riff:  file(1) magic for RIFF format
21253# See
21254#
21255#	http://www.seanet.com/users/matts/riffmci/riffmci.htm
21256#
21257
21258# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
212590   name    riff-wave
21260>0	leshort		1		\b, Microsoft PCM
21261>>14	leshort		>0
21262>>>14	leshort		<1024	\b, %d bit
21263>0	leshort		2		\b, Microsoft ADPCM
21264>0	leshort		6		\b, ITU G.711 A-law
21265>0	leshort		7		\b, ITU G.711 mu-law
21266>0	leshort		8		\b, Microsoft DTS
21267>0	leshort		17		\b, IMA ADPCM
21268>0	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
21269>0	leshort		49		\b, GSM 6.10
21270>0	leshort		64		\b, ITU G.721 ADPCM
21271>0	leshort		80		\b, MPEG
21272>0	leshort		85		\b, MPEG Layer 3
21273>0	leshort		0x2001		\b, DTS
21274>2	leshort		=1		\b, mono
21275>2	leshort		=2		\b, stereo
21276>2	leshort		>2
21277>>2	leshort		<128	\b, %d channels
21278>4	lelong		>0
21279>>4	lelong		<1000000	%d Hz
21280
21281# try to find "fmt "
212820   name    riff-walk
21283>0  string  fmt\x20
21284>>4 lelong  <0x80
21285>>>8 use    riff-wave
21286>0  string  LIST
21287>>&(4.l+4)  use riff-walk
21288>0  string  DISP
21289>>&(4.l+4)  use riff-walk
21290>0  string  bext
21291>>&(4.l+4)  use riff-walk
21292>0  string  Fake
21293>>&(4.l+4)  use riff-walk
21294>0  string  fact
21295>>&(4.l+4)  use riff-walk
21296>0  string  VP8
21297>>11		byte		0x9d
21298>>>12		byte		0x01
21299>>>>13		byte		0x2a	\b, VP8 encoding
21300>>>>>14		leshort&0x3fff	x	\b, %d
21301>>>>>16		leshort&0x3fff	x	\bx%d, Scaling:
21302>>>>>14		leshort&0xc000	0x0000	\b [none]
21303>>>>>14		leshort&0xc000	0x1000	\b [5/4]
21304>>>>>14		leshort&0xc000	0x2000	\b [5/3]
21305>>>>>14		leshort&0xc000	0x3000	\b [2]
21306>>>>>14		leshort&0xc000	0x0000	\bx[none]
21307>>>>>14		leshort&0xc000	0x1000	\bx[5/4]
21308>>>>>14		leshort&0xc000	0x2000	\bx[5/3]
21309>>>>>14		leshort&0xc000	0x3000	\bx[2]
21310>>>>>15		byte&0x80	=0x00	\b, YUV color
21311>>>>>15		byte&0x80	=0x80	\b, bad color specification
21312>>>>>15		byte&0x40	=0x40	\b, no clamping required
21313>>>>>15		byte&0x40	=0x00	\b, decoders should clamp
21314#>0  string  x		we got %s
21315#>>&(4.l+4)  use riff-walk
21316
21317# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
21318#
213190	string		RIFF		RIFF (little-endian) data
21320# RIFF Palette format
21321>8	string		PAL		\b, palette
21322>>16	leshort		x		\b, version %d
21323>>18	leshort		x		\b, %d entries
21324# RIFF Device Independent Bitmap format
21325>8	string		RDIB		\b, device-independent bitmap
21326>>16	string		BM
21327>>>30	leshort		12		\b, OS/2 1.x format
21328>>>>34	leshort		x		\b, %d x
21329>>>>36	leshort		x		%d
21330>>>30	leshort		64		\b, OS/2 2.x format
21331>>>>34	leshort		x		\b, %d x
21332>>>>36	leshort		x		%d
21333>>>30	leshort		40		\b, Windows 3.x format
21334>>>>34	lelong		x		\b, %d x
21335>>>>38	lelong		x		%d x
21336>>>>44	leshort		x		%d
21337# RIFF MIDI format
21338>8	string		RMID		\b, MIDI
21339# RIFF Multimedia Movie File format
21340>8	string		RMMP		\b, multimedia movie
21341# RIFF wrapper for MP3
21342>8	string		RMP3		\b, MPEG Layer 3 audio
21343# Microsoft WAVE format (*.wav)
21344>8	string		WAVE		\b, WAVE audio
21345!:mime	audio/x-wav
21346>>12    string  >\0
21347>>>12   use     riff-walk
21348# Corel Draw Picture
21349>8	string		CDRA		\b, Corel Draw Picture
21350!:mime	image/x-coreldraw
21351>8	string		CDR6		\b, Corel Draw Picture, version 6
21352!:mime	image/x-coreldraw
21353>8	string		NUNDROOT	\b, Steinberg CuBase
21354# AVI == Audio Video Interleave
21355>8	string		AVI\040		\b, AVI
21356!:mime	video/x-msvideo
21357>>12    string          LIST
21358>>>20   string          hdrlavih
21359>>>>&36 lelong          x               \b, %u x
21360>>>>&40 lelong          x               %u,
21361>>>>&4  lelong          >1000000        <1 fps,
21362>>>>&4  lelong          1000000         1.00 fps,
21363>>>>&4  lelong          500000          2.00 fps,
21364>>>>&4  lelong          333333          3.00 fps,
21365>>>>&4  lelong          250000          4.00 fps,
21366>>>>&4  lelong          200000          5.00 fps,
21367>>>>&4  lelong          166667          6.00 fps,
21368>>>>&4  lelong          142857          7.00 fps,
21369>>>>&4  lelong          125000          8.00 fps,
21370>>>>&4  lelong          111111          9.00 fps,
21371>>>>&4  lelong          100000          10.00 fps,
21372# ]9.9,10.1[
21373>>>>&4  lelong          <101010
21374>>>>>&-4        lelong  >99010
21375>>>>>>&-4       lelong  !100000         ~10 fps,
21376>>>>&4  lelong          83333           12.00 fps,
21377# ]11.9,12.1[
21378>>>>&4  lelong          <84034
21379>>>>>&-4        lelong  >82645
21380>>>>>>&-4       lelong  !83333          ~12 fps,
21381>>>>&4  lelong          66667           15.00 fps,
21382# ]14.9,15.1[
21383>>>>&4  lelong          <67114
21384>>>>>&-4        lelong  >66225
21385>>>>>>&-4       lelong  !66667          ~15 fps,
21386>>>>&4  lelong          50000           20.00 fps,
21387>>>>&4  lelong          41708           23.98 fps,
21388>>>>&4  lelong          41667           24.00 fps,
21389# ]23.9,24.1[
21390>>>>&4  lelong          <41841
21391>>>>>&-4        lelong  >41494
21392>>>>>>&-4       lelong  !41708
21393>>>>>>>&-4      lelong  !41667          ~24 fps,
21394>>>>&4  lelong          40000           25.00 fps,
21395# ]24.9,25.1[
21396>>>>&4  lelong          <40161
21397>>>>>&-4        lelong  >39841
21398>>>>>>&-4       lelong  !40000          ~25 fps,
21399>>>>&4  lelong          33367           29.97 fps,
21400>>>>&4  lelong          33333           30.00 fps,
21401# ]29.9,30.1[
21402>>>>&4  lelong          <33445
21403>>>>>&-4        lelong  >33223
21404>>>>>>&-4       lelong  !33367
21405>>>>>>>&-4      lelong  !33333          ~30 fps,
21406>>>>&4  lelong          <32224          >30 fps,
21407##>>>>&4  lelong          x               (%lu)
21408##>>>>&20 lelong          x               %lu frames,
21409# Note: The tests below assume that the AVI has 1 or 2 streams,
21410#       "vids" optionally followed by "auds".
21411#       (Should cover 99.9% of all AVIs.)
21412# assuming avih length = 56
21413>>>88   string  LIST
21414>>>>96  string  strlstrh
21415>>>>>108        string  vids    video:
21416>>>>>>&0        lelong  0               uncompressed
21417# skip past vids strh
21418>>>>>>(104.l+108)       string  strf
21419>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
21420>>>>>>>(104.l+132)      string/c        cvid    Cinepak
21421>>>>>>>(104.l+132)      string/c        i263    Intel I.263
21422>>>>>>>(104.l+132)      string/c        iv32    Indeo 3.2
21423>>>>>>>(104.l+132)      string/c        iv41    Indeo 4.1
21424>>>>>>>(104.l+132)      string/c        iv50    Indeo 5.0
21425>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
21426>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
21427>>>>>>>(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
21428>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
21429>>>>>>>(104.l+132)      string/c        div3    DivX 3
21430>>>>>>>>112             string/c        div3    Low-Motion
21431>>>>>>>>112             string/c        div4    Fast-Motion
21432>>>>>>>(104.l+132)      string/c        divx    DivX 4
21433>>>>>>>(104.l+132)      string/c        dx50    DivX 5
21434>>>>>>>(104.l+132)      string/c        xvid    XviD
21435>>>>>>>(104.l+132)	string/c	h264	H.264
21436>>>>>>>(104.l+132)      string/c        wmv3    Windows Media Video 9
21437>>>>>>>(104.l+132)      string/c        h264    X.264 or H.264
21438>>>>>>>(104.l+132)      lelong  0
21439##>>>>>>>(104.l+132)      string  x       (%.4s)
21440# skip past first (video) LIST
21441>>>>(92.l+96)   string  LIST
21442>>>>>(92.l+104) string  strlstrh
21443>>>>>>(92.l+116)        string          auds    \b, audio:
21444# auds strh length = 56:
21445>>>>>>>(92.l+172)       string          strf
21446>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
21447>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
21448>>>>>>>>(92.l+180)      leshort 0x0006  aLaw
21449>>>>>>>>(92.l+180)      leshort 0x0007  uLaw
21450>>>>>>>>(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
21451>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
21452>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
21453>>>>>>>>(92.l+180)      leshort 0x0161  DivX
21454##>>>>>>>>(92.l+180)      leshort x       (0x%.4x)
21455>>>>>>>>(92.l+182)      leshort 1       (mono,
21456>>>>>>>>(92.l+182)      leshort 2       (stereo,
21457>>>>>>>>(92.l+182)      leshort >2      (%d channels,
21458>>>>>>>>(92.l+184)      lelong  x       %d Hz)
21459# auds strh length = 64:
21460>>>>>>>(92.l+180)       string          strf
21461>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
21462>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
21463>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
21464>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
21465>>>>>>>>(92.l+188)      leshort 0x0161  DivX
21466##>>>>>>>>(92.l+188)      leshort x       (0x%.4x)
21467>>>>>>>>(92.l+190)      leshort 1       (mono,
21468>>>>>>>>(92.l+190)      leshort 2       (stereo,
21469>>>>>>>>(92.l+190)      leshort >2      (%d channels,
21470>>>>>>>>(92.l+192)      lelong  x       %d Hz)
21471# Animated Cursor format
21472>8	string		ACON		\b, animated cursor
21473# SoundFont 2 <mpruett@sgi.com>
21474>8	string		sfbk		SoundFont/Bank
21475# MPEG-1 wrapped in a RIFF, apparently
21476>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
21477>8	string		4XMV		\b, 4X Movie file
21478# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
21479>8	string		AMV\040		\b, AMV
21480>8      string          WEBP            \b, Web/P image
21481!:mime	image/webp
21482>>12	use		riff-walk
21483
21484#
21485# XXX - some of the below may only appear in little-endian form.
21486#
21487# Also "MV93" appears to be for one form of Macromedia Director
21488# files, and "GDMF" appears to be another multimedia format.
21489#
214900	string		RIFX		RIFF (big-endian) data
21491# RIFF Palette format
21492>8	string		PAL		\b, palette
21493>>16	beshort		x		\b, version %d
21494>>18	beshort		x		\b, %d entries
21495# RIFF Device Independent Bitmap format
21496>8	string		RDIB		\b, device-independent bitmap
21497>>16	string		BM
21498>>>30	beshort		12		\b, OS/2 1.x format
21499>>>>34	beshort		x		\b, %d x
21500>>>>36	beshort		x		%d
21501>>>30	beshort		64		\b, OS/2 2.x format
21502>>>>34	beshort		x		\b, %d x
21503>>>>36	beshort		x		%d
21504>>>30	beshort		40		\b, Windows 3.x format
21505>>>>34	belong		x		\b, %d x
21506>>>>38	belong		x		%d x
21507>>>>44	beshort		x		%d
21508# RIFF MIDI format
21509>8	string		RMID		\b, MIDI
21510# RIFF Multimedia Movie File format
21511>8	string		RMMP		\b, multimedia movie
21512# Microsoft WAVE format (*.wav)
21513>8	string		WAVE		\b, WAVE audio
21514>>20	leshort		1		\b, Microsoft PCM
21515>>>34	leshort		>0		\b, %d bit
21516>>22	beshort		=1		\b, mono
21517>>22	beshort		=2		\b, stereo
21518>>22	beshort		>2		\b, %d channels
21519>>24	belong		>0		%d Hz
21520# Corel Draw Picture
21521>8	string		CDRA		\b, Corel Draw Picture
21522>8	string		CDR6		\b, Corel Draw Picture, version 6
21523# AVI == Audio Video Interleave
21524>8	string		AVI\040		\b, AVI
21525# Animated Cursor format
21526>8	string		ACON		\b, animated cursor
21527# Notation Interchange File Format (big-endian only)
21528>8	string		NIFF		\b, Notation Interchange File Format
21529# SoundFont 2 <mpruett@sgi.com>
21530>8	string		sfbk		SoundFont/Bank
21531
21532#------------------------------------------------------------------------------
21533# Sony Wave64
21534# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
21535# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
215360	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
21537# 128 bit + total file size (64 bits) so 24 bytes
21538# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
21539>24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
21540!:mime	audio/x-w64
21541# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
21542>>40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
21543>>>&10	leshort		=1		\b, mono
21544>>>&10	leshort		=2		\b, stereo
21545>>>&10	leshort		>2		\b, %d channels
21546>>>&12	lelong		>0		%d Hz
21547
21548#------------------------------------------------------------------------------
21549# MBWF/RF64
21550# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
215510	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
21552!:mime	audio/x-wav
21553>40	search/256	fmt\x20		\b
21554>>&6	leshort		=1		\b, mono
21555>>&6	leshort		=2		\b, stereo
21556>>&6	leshort		>2		\b, %d channels
21557>>&8	lelong		>0		%d Hz
21558
21559#------------------------------------------------------------------------------
21560# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
21561#
21562# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
21563#
215640	belong		0xedabeedb	RPM
21565!:mime	application/x-rpm
21566>4	byte		x		v%d
21567>5	byte		x		\b.%d
21568>6	beshort		1		src
21569>6	beshort		0		bin
21570>>8	beshort		1		i386/x86_64
21571>>8	beshort		2		Alpha/Sparc64
21572>>8	beshort		3		Sparc
21573>>8	beshort		4		MIPS
21574>>8	beshort		5		PowerPC
21575>>8	beshort		6		68000
21576>>8	beshort		7		SGI
21577>>8	beshort		8		RS6000
21578>>8	beshort		9		IA64
21579>>8	beshort		10		Sparc64
21580>>8	beshort		11		MIPSel
21581>>8	beshort		12		ARM
21582>>8	beshort		13		MiNT
21583>>8	beshort		14		S/390
21584>>8	beshort		15		S/390x
21585>>8	beshort		16		PowerPC64
21586>>8	beshort		17		SuperH
21587>>8	beshort		18		Xtensa
21588>>8	beshort		255		noarch
21589>>10	string		x		%s
21590
21591#delta RPM    Daniel Novotny (dnovotny@redhat.com)
215920	string		drpm		Delta RPM
21593!:mime  application/x-rpm
21594>12	string 	x	%s
21595>>8	beshort		11		MIPSel
21596>>8	beshort		12		ARM
21597>>8	beshort		13		MiNT
21598>>8	beshort		14		S/390
21599>>8	beshort		15		S/390x
21600>>8	beshort		16		PowerPC64
21601>>8	beshort		17		SuperH
21602>>8	beshort		18		Xtensa
21603>>10	string		x		%s
21604
21605#------------------------------------------------------------------------------
21606# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
21607# rtf:	file(1) magic for Rich Text Format (RTF)
21608#
21609# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
21610#
216110	string		{\\rtf		Rich Text Format data,
21612!:mime	text/rtf
21613>5	string		1		version 1,
21614>>6	string		\\ansi		ANSI
21615>>6	string		\\mac		Apple Macintosh
21616>>6	string		\\pc		IBM PC, code page 437
21617>>6	string		\\pca		IBM PS/2, code page 850
21618>>6	default		x		unknown character set
21619>5	default		x		unknown version
21620
21621#------------------------------------------------------------------------------
21622# $File: ruby,v 1.6 2016/07/27 09:46:29 rrt Exp $
21623# ruby:  file(1) magic for Ruby scripting language
21624# URL:  http://www.ruby-lang.org/
21625# From: Reuben Thomas <rrt@sc3d.org>
21626
21627# Ruby scripts
216280	search/1/w	#!\ /usr/bin/ruby	Ruby script text executable
21629!:strength + 15
21630!:mime text/x-ruby
216310	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
21632!:strength + 15
21633!:mime text/x-ruby
216340	search/1	#!/usr/bin/env\ ruby	Ruby script text executable
21635!:strength + 15
21636!:mime text/x-ruby
216370	search/1	#!\ /usr/bin/env\ ruby	Ruby script text executable
21638!:strength + 15
21639!:mime text/x-ruby
21640
21641# What looks like ruby, but does not have a shebang
21642# (modules and such)
21643# From: Lubomir Rintel <lkundrak@v3.sk>
216440	regex		\^[\ \t]*require[\ \t]'[A-Za-z_/]+'
21645>0	regex		include\ [A-Z]|def\ [a-z]|\ do$
21646>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby script text
21647!:mime	text/x-ruby
216480	regex		\^[\ \t]*(class|module)[\ \t][A-Z]
21649>0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
21650>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby module source text
21651!:mime	text/x-ruby
21652
21653#------------------------------------------------------------------------------
21654# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
21655# sc:  file(1) magic for "sc" spreadsheet
21656#
2165738	string		Spreadsheet	sc spreadsheet file
21658!:mime	application/x-sc
21659
21660#------------------------------------------------------------------------------
21661# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
21662# sccs:  file(1) magic for SCCS archives
21663#
21664# SCCS archive structure:
21665# \001h01207
21666# \001s 00276/00000/00000
21667# \001d D 1.1 87/09/23 08:09:20 ian 1 0
21668# \001c date and time created 87/09/23 08:09:20 by ian
21669# \001e
21670# \001u
21671# \001U
21672# ... etc.
21673# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
21674# *Sigh*. And these both came from various parts of the USG.
21675# Maybe we should just switch everybody from SCCS to RCS!
21676# Further, you can't just say '\001h0', because the five-digit number
21677# is a checksum that could (presumably) have any leading digit,
21678# and we don't have regular expression matching yet.
21679# Hence the following official kludge:
216808	string		\001s\ 			SCCS archive data
21681
21682#------------------------------------------------------------------------------
21683# $File: scientific,v 1.12 2017/03/17 22:20:22 christos Exp $
21684# scientific:  file(1) magic for scientific formats
21685#
21686# From: Joe Krahn <krahn@niehs.nih.gov>
21687
21688########################################################
21689# CCP4 data and plot files:
216900	string		MTZ\040		MTZ reflection file
21691
2169292	string		PLOT%%84	Plot84 plotting file
21693>52	byte		1		, Little-endian
21694>55	byte		1		, Big-endian
21695
21696########################################################
21697# Electron density MAP/MASK formats
21698
216990	string		EZD_MAP	NEWEZD Electron Density Map
21700109	string		MAP\040(  Old EZD Electron Density Map
21701
217020	string/c	:-)\040Origin	BRIX Electron Density Map
21703>170	string		>0	, Sigma:%.12s
21704#>4	string		>0	%.178s
21705#>4	addr		x	%.178s
21706
217077	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
217089	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map
21709
21710208	string		MAP\040	CCP4 Electron Density Map
21711# Assumes same stamp for float and double (normal case)
21712>212	byte		17	\b, Big-endian
21713>212	byte		34	\b, VAX format
21714>212	byte		68	\b, Little-endian
21715>212	byte		85	\b, Convex native
21716
21717############################################################
21718# X-Ray Area Detector images
217190	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
21720>796	lelong	<20		Little-endian, IP #%d,
21721>>768	lelong	>0		Size=%dx
21722>>772	lelong	>0		\b%d
21723>796	belong	<20		Big-endian, IP #%d,
21724>>768	belong	>0		Size=%dx
21725>>772	belong	>0		\b%d
21726
217270	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
21728>796	lelong	<20		Little-endian, IP #%d,
21729>>768	lelong	>0		Size=%dx
21730>>772	lelong	>0		\b%d
21731>796	belong	<20		Big-endian, IP #%d,
21732>>768	belong	>0		Size=%dx
21733>>772	belong	>0		\b%d
21734
21735
217361028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
21737>1072	ulong	>1		Compressed(%d),
21738>1100	ulong	>1		%d headers,
21739>1104	ulong	>0		%d x
21740>1108	ulong	>0		%d,
21741>1120	ulong	>0		%d bits/pixel
21742
21743# Type: GEDCOM genealogical (family history) data
21744# From: Giuseppe Bilotta
217450       search/1/c	0\ HEAD         GEDCOM genealogy text
21746>&0     search		1\ GEDC
21747>>&0    search		2\ VERS         version
21748>>>&1   string		>\0		%s
21749# From: Phil Endecott <phil05@chezphil.org>
217500	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
217510	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
217520	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
217530	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data
21754
21755# PDB: Protein Data Bank files
21756# Adam Buchbinder <adam.buchbinder@gmail.com>
21757#
21758# http://www.wwpdb.org/documentation/format32/sect2.html
21759# http://www.ch.ic.ac.uk/chemime/
21760#
21761# The PDB file format is fixed-field, 80 columns. From the spec:
21762#
21763# COLS        DATA
21764#  1 -  6      "HEADER"
21765#  11 - 50     String(40)
21766#  51 - 59     Date
21767#  63 - 66     IDcode
21768#
21769# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
21770# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
21771# uppercase letters. However, examples have been seen without the date string,
21772# e.g., the example on the chemime site.
217730	string	HEADER\ \ \ \040
21774>&0	regex/1l	\^.{40}
21775>>&0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
21776>>>&0	regex/1ls	[A-Z0-9]{4}.{14}$
21777>>>>&0	regex/1l	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
21778!:mime	chemical/x-pdb
21779>>>>0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s
21780
21781# Type:	GDSII Stream file
217820	belong	0x00060002	GDSII Stream file
21783>4	byte	0x00
21784>>5	byte	x		version %d.0
21785>4	byte	>0x00		version %d
21786>>5	byte	x		\b.%d
21787
21788# Type: LXT (interLaced eXtensible Trace)
21789# chrysn <chrysn@fsfe.org>
217900	beshort	0x0138	interLaced eXtensible Trace (LXT) file
21791>2	beshort	>0	(Version %u)
21792
21793#------------------------------------------------------------------------------
21794# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
217950	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
217960	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
217970	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
21798
217990	string \0volume_key	volume_key escrow packet
21800# Type:	SE Linux policy modules *.pp reference policy
21801#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
21802# URL:	http://doc.coker.com.au/computers/selinux-magic
21803# From:	Russell Coker <russell@coker.com.au>
21804
218050		lelong	0xf97cff8f	SE Linux modular policy
21806>4		lelong	x		version %d,
21807>8		lelong	x		%d sections,
21808>>(12.l)	lelong	0xf97cff8d
21809>>>(12.l+27)	lelong	x		mod version %d,
21810>>>(12.l+31)	lelong	0		Not MLS,
21811>>>(12.l+31)	lelong	1		MLS,
21812>>>(12.l+23)	lelong	2
21813>>>>(12.l+47)	string	>\0		module name %s
21814>>>(12.l+23)	lelong	1		base
21815
218161	string	policy_module(	SE Linux policy module source
218172	string	policy_module(	SE Linux policy module source
21818
218190	string	##\ <summary>	SE Linux policy interface source
21820
21821#0	search	gen_context(	SE Linux policy file contexts
21822
21823#0	search	gen_sens(	SE Linux policy MLS constraints source
21824
21825#------------------------------------------------------------------------------
21826# $File: sendmail,v 1.9 2017/03/17 21:35:28 christos Exp $
21827# sendmail:  file(1) magic for sendmail config files
21828#
21829# XXX - byte order?
21830#
21831# Update: Joerg Jenderek
21832# GRR: this test is too general as it catches also
21833# READ.ME.FIRST.AWP Sendmail frozen configuration
21834# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
21835# Email_23_f217153422.ts Sendmail frozen configuration
21836# - version \330jK\354
218370	byte	046
21838# http://www.sendmail.com/sm/open_source/docs/older_release_notes/
21839# freezed configuration file (dbm format?) created from sendmal.cf with -bz
21840# by older sendmail. til version 8.6 support for frozen configuration files is removed
21841# valid version numbers look like "7.14.4" and should be simliar to output of commands
21842# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
21843>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
21844# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
21845!:ext fc
21846>>16	string	>\0			- version %s
218470	short	0x271c
21848# look for valid version number
21849>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
21850!:ext fc
21851>>16	string	>\0			- version %s
21852
21853#------------------------------------------------------------------------------
21854# sendmail:  file(1) magic for sendmail m4(1) files
21855#
21856# From Hendrik Scholz <hendrik@scholz.net>
21857# i.e. files in /usr/share/sendmail/cf/
21858#
218590   string  divert(-1)\n    sendmail m4 text file
21860
21861
21862#------------------------------------------------------------------------------
21863# $File: sequent,v 1.13 2017/03/17 21:35:28 christos Exp $
21864# sequent:  file(1) magic for Sequent machines
21865#
21866# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
21867# For Sequent's multiprocessor systems (incomplete).
218680	lelong	0x00ea        	BALANCE NS32000 .o
21869>16	lelong	>0		not stripped
21870>124	lelong	>0		version %d
218710	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
21872>16	lelong  >0            	not stripped
21873>124	lelong	>0		version %d
218740	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
21875>16	lelong  >0            	not stripped
21876>124	lelong	>0		version %d
218770	lelong	0x30ea        	BALANCE NS32000 standalone executable
21878>16	lelong  >0          	not stripped
21879>124	lelong	>0		version %d
21880#
21881# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
21882# Symmetry magic nums will not be reached if DOS COM comes before them;
21883# byte 0xeb is matched before these get a chance.
218840	leshort	0x12eb		SYMMETRY i386 .o
21885>16	lelong	>0		not stripped
21886>124	lelong	>0		version %d
218870	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
21888>16	lelong	>0		not stripped
21889>124	lelong	>0		version %d
218900	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
21891>16	lelong	>0		not stripped
21892>124	lelong	>0		version %d
21893# http://en.wikipedia.org/wiki/Sequent_Computer_Systems
21894# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
21895#0	leshort	0x42eb		SYMMETRY i386 standalone executable
218960	leshort	0x42eb
21897# skip unlike negative version
21898>124	lelong	>-1
21899# assuming version 28867614 is very low probable
21900>>124	lelong	!28867614	SYMMETRY i386 standalone executable
21901>>>16	lelong	>0		not stripped
21902>>>124	lelong	>0		version %d
21903
21904#------------------------------------------------------------------------------
21905# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $
21906# sereal: file(1) magic the Sereal binary serialization format
21907#
21908# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
21909#
21910# See the specification of the format at
21911# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
21912#
21913# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
21914# doing (byte&0xF0)>>4 here, but unfortunately that's not
21915# supported. So when we print out a message about an unknown format
21916# we'll print out e.g. 0x30 instead of the more human-readable
21917# 0x30>>4.
21918#
21919# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
21920# Sereal.git repository for test Sereal data.
219210	name		sereal
21922>4	byte&0x0F	x		(version %d,
21923>4	byte&0xF0	0x00		uncompressed)
21924>4	byte&0xF0	0x10		compressed with non-incremental Snappy)
21925>4	byte&0xF0	0x20		compressed with incremental Snappy)
21926>4	byte&0xF0	>0x20		unknown subformat, flag: %d>>4)
21927
219280	string/b	\=srl		Sereal data packet
21929!:mime application/sereal
21930>&0	use		sereal
219310	string/b	\=\xF3rl	Sereal data packet
21932!:mime application/sereal
21933>&0	use		sereal
219340	string/b	\=\xC3\xB3rl	Sereal data packet, UTF-8 encoded
21935!:mime application/sereal
21936>&0	use		sereal
21937
21938
21939#------------------------------------------------------------------------------
21940# $File: sgi,v 1.22 2015/08/29 07:10:35 christos Exp $
21941# sgi:  file(1) magic for Silicon Graphics operating systems and applications
21942#
21943# Executable images are handled either in aout (for old-style a.out
21944# files for 68K; they are indistinguishable from other big-endian 32-bit
21945# a.out files) or in mips (for MIPS ECOFF and Ucode files)
21946#
21947
21948# kbd file definitions
219490	string	kbd!map		kbd map file
21950>8	byte	>0		Ver %d:
21951>10	short	>0		with %d table(s)
21952
219530	beshort	0x8765		disk quotas file
21954
219550	beshort	0x0506		IRIS Showcase file
21956>2	byte	0x49		-
21957>3	byte	x		- version %d
219580	beshort	0x0226		IRIS Showcase template
21959>2	byte	0x63		-
21960>3	byte	x		- version %d
219610	belong	0x5343464d	IRIS Showcase file
21962>4	byte	x		- version %d
219630	belong	0x5443464d	IRIS Showcase template
21964>4	byte	x		- version %d
219650	belong	0xdeadbabe	IRIX Parallel Arena
21966>8	belong	>0		- version %d
21967
21968# core files
21969#
21970# 32bit core file
219710	belong	0xdeadadb0	IRIX core dump
21972>4	belong	1		of
21973>16	string	>\0		'%s'
21974# 64bit core file
219750	belong	0xdeadad40	IRIX 64-bit core dump
21976>4	belong	1		of
21977>16	string	>\0		'%s'
21978# N32bit core file
219790       belong	0xbabec0bb	IRIX N32 core dump
21980>4      belong	1               of
21981>16     string	>\0             '%s'
21982# New style crash dump file
219830	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
21984>36	string	>\0					'%s'
21985
21986# Trusted IRIX info
219870	string	SGIAUDIT	SGI Audit file
21988>8	byte	x		- version %d
21989>9	byte	x		\b.%d
21990#
219910	string	WNGZWZSC	Wingz compiled script
219920	string	WNGZWZSS	Wingz spreadsheet
219930	string	WNGZWZHP	Wingz help file
21994#
219950	string	#Inventor\040V	IRIS Inventor 1.0 file
219960	string	#Inventor\040V2	Open Inventor 2.0 file
21997# GLF is OpenGL stream encoding
219980	string	glfHeadMagic();		GLF_TEXT
219994	belong	0x7d000000		GLF_BINARY_LSB_FIRST
22000!:strength -30
220014	belong	0x0000007d		GLF_BINARY_MSB_FIRST
22002!:strength -30
22003# GLS is OpenGL stream encoding; GLS is the successor of GLF
220040	string	glsBeginGLS(		GLS_TEXT
220054	belong	0x10000000		GLS_BINARY_LSB_FIRST
22006!:strength -30
220074	belong	0x00000010		GLS_BINARY_MSB_FIRST
22008!:strength -30
22009
22010#
22011#
22012# Performance Co-Pilot file types
220130	string	PmNs				PCP compiled namespace (V.0)
220140	string	PmN				PCP compiled namespace
22015>3	string	>\0				(V.%1.1s)
22016#3	lelong	0x84500526			PCP archive
220173	belong	0x84500526			PCP archive
22018>7	byte	x				(V.%d)
22019#>20	lelong	-2				temporal index
22020#>20	lelong	-1				metadata
22021#>20	lelong	0				log volume #0
22022#>20	lelong	>0				log volume #%d
22023>20	belong	-2				temporal index
22024>20	belong	-1				metadata
22025>20	belong	0				log volume #0
22026>20	belong	>0				log volume #%d
22027>24	string	>\0				host: %s
220280	string	PCPFolio			PCP
22029>9	string	Version:			Archive Folio
22030>18	string	>\0				(V.%s)
220310	string	#pmchart			PCP pmchart view
22032>9	string	Version
22033>17	string	>\0				(V%-3.3s)
220340	string	#kmchart			PCP kmchart view
22035>9	string	Version
22036>17	string	>\0				(V.%s)
220370	string	pmview				PCP pmview config
22038>7	string	Version
22039>15	string	>\0				(V%-3.3s)
220400	string	#pmlogger			PCP pmlogger config
22041>10	string	Version
22042>18	string	>\0				(V%1.1s)
220430	string	#pmdahotproc			PCP pmdahotproc config
22044>13	string	Version
22045>21	string	>\0				(V%-3.3s)
220460	string	PcPh				PCP Help
22047>4	string	1				Index
22048>4	string	2				Text
22049>5	string	>\0				(V.%1.1s)
220500	string	#pmieconf-rules			PCP pmieconf rules
22051>16	string	>\0				(V.%1.1s)
220523	string	pmieconf-pmie			PCP pmie config
22053>17	string	>\0				(V.%1.1s)
22054
22055# SpeedShop data files
220560	lelong	0x13130303			SpeedShop data file
22057
22058# mdbm files
220590	lelong	0x01023962			mdbm file, version 0 (obsolete)
220600	string	mdbm				mdbm file,
22061>5	byte	x				version %d,
22062>6	byte	x				2^%d pages,
22063>7	byte	x				pagesize 2^%d,
22064>17	byte	x				hash %d,
22065>11	byte	x				dataformat %d
22066
22067# Alias Maya files
220680	string/t	//Maya\040ASCII	Alias Maya Ascii File,
22069>13	string	>\0	version %s
220708	string	MAYAFOR4	Alias Maya Binary File,
22071>32	string	>\0	version %s scene
220728	string	MayaFOR4	Alias Maya Binary File,
22073>32	string	>\0	version %s scene
220748	string	CIMG		Alias Maya Image File
220758	string	DEEP		Alias Maya Image File
22076
22077#------------------------------------------------------------------------------
22078# $File: sgml,v 1.36 2016/12/01 15:40:52 christos Exp $
22079# Type:	SVG Vectorial Graphics
22080# From:	Noel Torres <tecnico@ejerciciosresueltos.com>
220810	string		\<?xml\ version="
22082>15	string		>\0
22083>>19	search/4096	\<svg			SVG Scalable Vector Graphics image
22084!:mime	image/svg+xml
22085>>19	search/4096	\<gnc-v2		GnuCash file
22086!:mime	application/x-gnucash
220870	string		\<svg			SVG Scalable Vector Graphics image
22088!:mime	image/svg
22089
22090# Sitemap file
220910	string/t		\<?xml\ version="
22092>15	string		>\0
22093>>19	search/4096	\<urlset		XML Sitemap document text
22094!:mime	application/xml-sitemap
22095
22096# OpenStreetMap XML (.osm)
22097# http://wiki.openstreetmap.org/wiki/OSM_XML
22098# From: Markus Heidelberg <markus.heidelberg@web.de>
220990	string		\<?xml\ version="
22100>15	string		>\0
22101>>19	search/4096	\<osm			OpenStreetMap XML data
22102
22103# xhtml
221040	string/t		\<?xml\ version="
22105>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
22106>>15	string		>\0	(version %.3s)
22107!:mime	text/html
221080	string/t		\<?xml\ version='
22109>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
22110>>15	string		>\0	(version %.3s)
22111!:mime	text/html
221120	string/t		\<?xml\ version="
22113>19	search/4096/cWbt	\<html	broken XHTML document text
22114>>15	string		>\0	(version %.3s)
22115!:mime	text/html
22116
22117#------------------------------------------------------------------------------
22118# sgml:  file(1) magic for Standard Generalized Markup Language
22119# HyperText Markup Language (HTML) is an SGML document type,
22120# from Daniel Quinlan (quinlan@yggdrasil.com)
22121# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
221220	search/4096/cWt	\<!doctype\ html	HTML document text
22123!:mime	text/html
22124!:strength + 5
22125
22126# SVG document
22127# https://www.w3.org/TR/SVG/single-page.html
221280	search/4096/cWbt	\<!doctype\ svg	SVG XML document
22129!:mime  image/svg+xml
22130!:strength + 5
22131
221320	search/4096/cwt	\<head\>		HTML document text
22133!:mime	text/html
22134!:strength + 5
221350	search/4096/cWt	\<head\ 		HTML document text
22136!:mime	text/html
22137!:strength + 5
221380	search/4096/cwt	\<title\>		HTML document text
22139!:mime	text/html
22140!:strength + 5
221410	search/4096/cWt	\<title\ 		HTML document text
22142!:mime	text/html
22143!:strength + 5
221440	search/4096/cwt	\<html\>		HTML document text
22145!:mime	text/html
22146!:strength + 5
221470	search/4096/cWt	\<html\ 		HTML document text
22148!:mime	text/html
22149!:strength + 5
221500	search/4096/cwt	\<script\> 		HTML document text
22151!:mime	text/html
22152!:strength + 5
221530	search/4096/cWt	\<script\ 		HTML document text
22154!:mime	text/html
22155!:strength + 5
221560	search/4096/cwt	\<style\> 		HTML document text
22157!:mime	text/html
22158!:strength + 5
221590	search/4096/cWt	\<style\  		HTML document text
22160!:mime	text/html
22161!:strength + 5
221620	search/4096/cwt	\<table\>		HTML document text
22163!:mime	text/html
22164!:strength + 5
221650	search/4096/cWt	\<table\ 		HTML document text
22166!:mime	text/html
22167!:strength + 5
22168
221690	search/4096/cwt	\<a\ href=		HTML document text
22170!:mime	text/html
22171!:strength + 5
22172
22173# Extensible markup language (XML), a subset of SGML
22174# from Marc Prud'hommeaux (marc@apocalypse.org)
221750	search/1/cwt	\<?xml			XML document text
22176!:mime	text/xml
22177!:strength + 5
221780	string/t		\<?xml\ version\ "	XML
22179!:mime	text/xml
22180!:strength + 5
221810	string/t		\<?xml\ version="	XML
22182!:mime	text/xml
22183!:strength + 5
22184>15	string/t	>\0			%.3s document text
22185>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
22186>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
221870	string		\<?xml\ version='	XML
22188!:mime	text/xml
22189!:strength + 5
22190>15	string/t	>\0			%.3s document text
22191>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
22192>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
221930	search/1/wt	\<?XML			broken XML document text
22194!:mime	text/xml
22195!:strength - 10
22196
22197
22198# SGML, mostly from rph@sq
221990	search/4096/cwt	\<!doctype		exported SGML document text
222000	search/4096/cwt	\<!subdoc		exported SGML subdocument text
222010	search/4096/cwt	\<!--			exported SGML document text
22202!:strength - 10
22203
22204# Web browser cookie files
22205# (Mozilla, Galeon, Netscape 4, Konqueror..)
22206# Ulf Harnhammar <ulfh@update.uu.se>
222070	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
222080	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
222090	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
22210
22211#------------------------------------------------------------------------
22212# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
22213# file(1) magic for sharc files
22214#
22215# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
22216# FutureGroove Music (dsp@futuregroove.de)
22217
22218#------------------------------------------------------------------------
22219#0	string			Draw		RiscOS Drawfile
22220#0	string			PACK		RiscOS PackdDir archive
22221
22222#------------------------------------------------------------------------
22223# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
22224
22225#0	string			=!		Assembler source
22226#0	string			Analog		ADi asm listing file
222270	string			.SYSTEM		SHARC architecture file
222280	string			.system		SHARC architecture file
22229
222300	leshort			0x521C		SHARC COFF binary
22231>2	leshort			>1		, %d sections
22232>>12	lelong			>0		, not stripped
22233
22234#------------------------------------------------------------------------------
22235# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $
22236# sinclair:  file(1) sinclair QL
22237
22238# additions to /etc/magic by Thomas M. Ott (ThMO)
22239
22240# Sinclair QL floppy disk formats (ThMO)
222410	string	=QL5		QL disk dump data,
22242>3	string	=A		720 KB,
22243>3	string	=B		1.44 MB,
22244>3	string	=C		3.2 MB,
22245>4	string	>\0		label:%.10s
22246
22247# Sinclair QL OS dump (ThMO)
222480		belong	=0x30000
22249>49124		belong	<47104
22250>>49128		belong	<47104
22251>>>49132	belong	<47104
22252>>>>49136	belong	<47104	QL OS dump data,
22253>>>>>49148	string	>\0	type %.3s,
22254>>>>>49142	string	>\0	version %.4s
22255
22256# Sinclair QL firmware executables (ThMO)
222570	string	NqNqNq`\004	QL firmware executable (BCPL)
22258
22259# Sinclair QL libraries (was ThMO)
222600	beshort	0xFB01		QDOS object
22261>2	pstring	x		'%s'
22262
22263# Sinclair QL executables (was ThMO)
222644	belong	0x4AFB		QDOS executable
22265>9	pstring	x		'%s'
22266
22267# Sinclair QL ROM (ThMO)
222680	belong	=0x4AFB0001	QL plugin-ROM data,
22269>9	pstring	=\0		un-named
22270>9	pstring	>\0		named: %s
22271# Type: SiSU Markup Language
22272# URL:  http://www.sisudoc.org/
22273# From: Ralph Amissah <ralph.amissah@gmail.com>
22274
222750	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
22276>5	regex	[0-9.]+				%s
22277
222780	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
22279>5	regex	[0-9.]+				%s
22280
222810	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
22282>5	regex	[0-9.]+				%s
22283
222840	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
22285>5	regex	[0-9.]+				%s
22286
222870	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
22288>5	regex	[0-9.]+				%s
22289
22290#------------------------------------------------------------------------------
22291# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
22292# Sketch Drawings: http://sketch.sourceforge.net/
22293# From: Edwin Mons <e@ik.nu>
222940	search/1	##Sketch	Sketch document text
22295
22296#-----------------------------------------------
22297# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
22298# GNU Smalltalk image, starting at version 1.6.2
22299# From: catull_us@yahoo.com
22300#
223010	string	GSTIm\0\0	GNU SmallTalk
22302# little-endian
22303>7	byte&1	=0		LE image version
22304>>10	byte	x		%d.
22305>>9	byte	x		\b%d.
22306>>8	byte	x		\b%d
22307#>>12	lelong	x		, data: %ld
22308#>>16	lelong	x		, table: %ld
22309#>>20	lelong	x		, memory: %ld
22310# big-endian
22311>7	byte&1	=1		BE image version
22312>>8	byte	x		%d.
22313>>9	byte	x		\b%d.
22314>>10	byte	x		\b%d
22315#>>12	belong	x		, data: %ld
22316#>>16	belong	x		, table: %ld
22317#>>20	belong	x		, memory: %ld
22318
22319
22320
22321#------------------------------------------------------------------------------
22322# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
22323# smile:  file(1) magic for Smile serialization
22324#
22325# The Smile serialization format uses a 4-byte header:
22326#
22327#   Constant byte #0: 0x3A (ASCII ':')
22328#   Constant byte #1: 0x29 (ASCII ')')
22329#   Constant byte #2: 0x0A (ASCII linefeed, '\n')
22330#   Variable byte #3, consisting of bits:
22331#     Bits 4-7 (4 MSB): 4-bit version number
22332#     Bits 3: Reserved
22333#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
22334#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
22335#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
22336#
22337# Reference: http://wiki.fasterxml.com/SmileFormatSpec
22338# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
22339
22340# Detection
223410	string		:)\n	Smile binary data
22342
22343# Versioning
22344>3	byte&0xF0	x		version %d:
22345
22346# Properties
22347>3	byte&0x04	0x04		binary raw,
22348>3	byte&0x04	0x00		binary encoded,
22349>3	byte&0x02	0x02		shared String values enabled,
22350>3	byte&0x02	0x00		shared String values disabled,
22351>3	byte&0x01	0x01		shared field names enabled
22352>3	byte&0x01	0x00		shared field names disabled
22353
22354
22355#------------------------------------------------------------------------------
22356# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $
22357# sniffer:  file(1) magic for packet capture files
22358#
22359# From: guy@alum.mit.edu (Guy Harris)
22360#
22361
22362#
22363# Microsoft Network Monitor 1.x capture files.
22364#
223650	string		RTSS		NetMon capture file
22366>5	byte		x		- version %d
22367>4	byte		x		\b.%d
22368>6	leshort		0		(Unknown)
22369>6	leshort		1		(Ethernet)
22370>6	leshort		2		(Token Ring)
22371>6	leshort		3		(FDDI)
22372>6	leshort		4		(ATM)
22373>6	leshort		>4		(type %d)
22374
22375#
22376# Microsoft Network Monitor 2.x capture files.
22377#
223780	string		GMBU		NetMon capture file
22379>5	byte		x		- version %d
22380>4	byte		x		\b.%d
22381>6	leshort		0		(Unknown)
22382>6	leshort		1		(Ethernet)
22383>6	leshort		2		(Token Ring)
22384>6	leshort		3		(FDDI)
22385>6	leshort		4		(ATM)
22386>6	leshort		5		(IP-over-IEEE 1394)
22387>6	leshort		6		(802.11)
22388>6	leshort		7		(Raw IP)
22389>6	leshort		8		(Raw IP)
22390>6	leshort		9		(Raw IP)
22391>6	leshort		>9		(type %d)
22392
22393#
22394# Network General Sniffer capture files.
22395# Sorry, make that "Network Associates Sniffer capture files."
22396# Sorry, make that "Network General old DOS Sniffer capture files."
22397#
223980	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
22399>33	byte		2		(compressed)
22400>23	leshort		x		- version %d
22401>25	leshort		x		\b.%d
22402>32	byte		0		(Token Ring)
22403>32	byte		1		(Ethernet)
22404>32	byte		2		(ARCNET)
22405>32	byte		3		(StarLAN)
22406>32	byte		4		(PC Network broadband)
22407>32	byte		5		(LocalTalk)
22408>32	byte		6		(Znet)
22409>32	byte		7		(Internetwork Analyzer)
22410>32	byte		9		(FDDI)
22411>32	byte		10		(ATM)
22412
22413#
22414# Cinco Networks NetXRay capture files.
22415# Sorry, make that "Network General Sniffer Basic capture files."
22416# Sorry, make that "Network Associates Sniffer Basic capture files."
22417# Sorry, make that "Network Associates Sniffer Basic, and Windows
22418# Sniffer Pro", capture files."
22419# Sorry, make that "Network General Sniffer capture files."
22420# Sorry, make that "NetScout Sniffer capture files."
22421#
224220	string		XCP\0		NetXRay capture file
22423>4	string		>\0		- version %s
22424>44	leshort		0		(Ethernet)
22425>44	leshort		1		(Token Ring)
22426>44	leshort		2		(FDDI)
22427>44	leshort		3		(WAN)
22428>44	leshort		8		(ATM)
22429>44	leshort		9		(802.11)
22430
22431#
22432# "libpcap" capture files.
22433# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
22434# the main program that uses that format, but there are other programs
22435# that use "libpcap", or that use the same capture file format.)
22436#
224370	name		pcap-be
22438>4	beshort		x		- version %d
22439>6	beshort		x		\b.%d
22440>20	belong		0		(No link-layer encapsulation
22441>20	belong		1		(Ethernet
22442>20	belong		2		(3Mb Ethernet
22443>20	belong		3		(AX.25
22444>20	belong		4		(ProNET
22445>20	belong		5		(CHAOS
22446>20	belong		6		(Token Ring
22447>20	belong		7		(BSD ARCNET
22448>20	belong		8		(SLIP
22449>20	belong		9		(PPP
22450>20	belong		10		(FDDI
22451>20	belong		11		(RFC 1483 ATM
22452>20	belong		12		(raw IP
22453>20	belong		13		(BSD/OS SLIP
22454>20	belong		14		(BSD/OS PPP
22455>20	belong		19		(Linux ATM Classical IP
22456>20	belong		50		(PPP or Cisco HDLC
22457>20	belong		51		(PPP-over-Ethernet
22458>20	belong		99		(Symantec Enterprise Firewall
22459>20	belong		100		(RFC 1483 ATM
22460>20	belong		101		(raw IP
22461>20	belong		102		(BSD/OS SLIP
22462>20	belong		103		(BSD/OS PPP
22463>20	belong		104		(BSD/OS Cisco HDLC
22464>20	belong		105		(802.11
22465>20	belong		106		(Linux Classical IP over ATM
22466>20	belong		107		(Frame Relay
22467>20	belong		108		(OpenBSD loopback
22468>20	belong		109		(OpenBSD IPsec encrypted
22469>20	belong		112		(Cisco HDLC
22470>20	belong		113		(Linux "cooked"
22471>20	belong		114		(LocalTalk
22472>20	belong		117		(OpenBSD PFLOG
22473>20	belong		119		(802.11 with Prism header
22474>20	belong		122		(RFC 2625 IP over Fibre Channel
22475>20	belong		123		(SunATM
22476>20	belong		127		(802.11 with radiotap header
22477>20	belong		129		(Linux ARCNET
22478>20	belong		138		(Apple IP over IEEE 1394
22479>20	belong		139		(MTP2 with pseudo-header
22480>20	belong		140		(MTP2
22481>20	belong		141		(MTP3
22482>20	belong		142		(SCCP
22483>20	belong		143		(DOCSIS
22484>20	belong		144		(IrDA
22485>20	belong		147		(Private use 0
22486>20	belong		148		(Private use 1
22487>20	belong		149		(Private use 2
22488>20	belong		150		(Private use 3
22489>20	belong		151		(Private use 4
22490>20	belong		152		(Private use 5
22491>20	belong		153		(Private use 6
22492>20	belong		154		(Private use 7
22493>20	belong		155		(Private use 8
22494>20	belong		156		(Private use 9
22495>20	belong		157		(Private use 10
22496>20	belong		158		(Private use 11
22497>20	belong		159		(Private use 12
22498>20	belong		160		(Private use 13
22499>20	belong		161		(Private use 14
22500>20	belong		162		(Private use 15
22501>20	belong		163		(802.11 with AVS header
22502>20	belong		165		(BACnet MS/TP
22503>20	belong		166		(PPPD
22504>20	belong		169		(GPRS LLC
22505>20	belong		177		(Linux LAPD
22506>20	belong		187		(Bluetooth HCI H4
22507>20	belong		189		(Linux USB
22508>20	belong		192		(PPI
22509>20	belong		195		(802.15.4
22510>20	belong		196		(SITA
22511>20	belong		197		(Endace ERF
22512>20	belong		201		(Bluetooth HCI H4 with pseudo-header
22513>20	belong		202		(AX.25 with KISS header
22514>20	belong		203		(LAPD
22515>20	belong		204		(PPP with direction pseudo-header
22516>20	belong		205		(Cisco HDLC with direction pseudo-header
22517>20	belong		206		(Frame Relay with direction pseudo-header
22518>20	belong		209		(Linux IPMB
22519>20	belong		215		(802.15.4 with non-ASK PHY header
22520>20	belong		220		(Memory-mapped Linux USB
22521>20	belong		224		(Fibre Channel FC-2
22522>20	belong		225		(Fibre Channel FC-2 with frame delimiters
22523>20	belong		226		(Solaris IPNET
22524>20	belong		227		(SocketCAN
22525>20	belong		228		(Raw IPv4
22526>20	belong		229		(Raw IPv6
22527>20	belong		230		(802.15.4 without FCS
22528>20	belong		231		(D-Bus messages
22529>20	belong		235		(DVB-CI
22530>20	belong		236		(MUX27010
22531>20	belong		237		(STANAG 5066 D_PDUs
22532>20	belong		239		(Linux netlink NFLOG messages
22533>20	belong		240		(Hilscher netAnalyzer
22534>20	belong		241		(Hilscher netAnalyzer with delimiters
22535>20	belong		242		(IP-over-Infiniband
22536>20	belong		243		(MPEG-2 Transport Stream packets
22537>20	belong		244		(ng4t ng40
22538>20	belong		245		(NFC LLCP
22539>20	belong		247		(Infiniband
22540>20	belong		248		(SCTP
22541>16	belong		x		\b, capture length %d)
22542
225430	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
22544!:mime	application/vnd.tcpdump.pcap
22545>0	use	pcap-be
225460	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
22547!:mime	application/vnd.tcpdump.pcap
22548>0	use	\^pcap-be
22549
22550#
22551# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
22552# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
22553# the main program that uses that format, but there are other programs
22554# that use "libpcap", or that use the same capture file format.)
22555#
225560	ubelong		0xa1b2cd34	extended tcpdump capture file (big-endian)
22557>0	use	pcap-be
225580	ulelong		0xa1b2cd34	extended tcpdump capture file (little-endian)
22559>0	use	\^pcap-be
22560
22561#
22562# "pcap-ng" capture files.
22563# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
22564# Pcap-ng files can contain multiple sections. Printing the endianness,
22565# snaplen, or other information from the first SHB may be misleading.
22566#
225670	ubelong		0x0a0d0d0a
22568>8	ubelong		0x1a2b3c4d	pcap-ng capture file
22569>>12	beshort		x		- version %d
22570>>14	beshort		x		\b.%d
225710	ulelong		0x0a0d0d0a
22572>8	ulelong		0x1a2b3c4d	pcap-ng capture file
22573>>12	leshort		x		- version %d
22574>>14	leshort		x		\b.%d
22575
22576#
22577# AIX "iptrace" capture files.
22578#
225790	string		iptrace\ 1.0	"iptrace" capture file
225800	string		iptrace\ 2.0	"iptrace" capture file
22581
22582#
22583# Novell LANalyzer capture files.
22584#
225850	leshort		0x1001		LANalyzer capture file
225860	leshort		0x1007		LANalyzer capture file
22587
22588#
22589# HP-UX "nettl" capture files.
22590#
225910	string		\x54\x52\x00\x64\x00	"nettl" capture file
22592
22593#
22594# RADCOM WAN/LAN Analyzer capture files.
22595#
225960	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
22597
22598#
22599# NetStumbler log files.  Not really packets, per se, but about as
22600# close as you can get.  These are log files from NetStumbler, a
22601# Windows program, that scans for 802.11b networks.
22602#
226030	string		NetS		NetStumbler log file
22604>8	lelong		x		\b, %d stations found
22605
22606#
22607# *Peek tagged capture files.
22608#
226090	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
22610
22611#
22612# Visual Networks traffic capture files.
22613#
226140	string		\x05VNF		Visual Networks traffic capture file
22615
22616#
22617# Network Instruments Observer capture files.
22618#
226190	string		ObserverPktBuffe	Network Instruments Observer capture file
22620
22621#
22622# Files from Accellent Group's 5View products.
22623#
226240	string		\xaa\xaa\xaa\xaa	5View capture file
22625
22626#------------------------------------------------------------------------------
22627# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
22628# softquad:  file(1) magic for SoftQuad Publishing Software
22629#
22630# Author/Editor and RulesBuilder
22631#
22632# XXX - byte order?
22633#
226340	string		\<!SQ\ DTD>	Compiled SGML rules file
22635>9	string		>\0		 Type %s
226360	string		\<!SQ\ A/E>	A/E SGML Document binary
22637>9	string		>\0		 Type %s
226380	string		\<!SQ\ STS>	A/E SGML binary styles file
22639>9	string		>\0		 Type %s
226400	short		0xc0de		Compiled PSI (v1) data
226410	short		0xc0da		Compiled PSI (v2) data
22642>3	string		>\0		(%s)
22643# Binary sqtroff font/desc files...
226440	short		0125252		SoftQuad DESC or font file binary
22645>2	short		>0		- version %d
22646# Bitmaps...
226470	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
22648#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
22649# sqtroff intermediate language (replacement for ditroff int. lang.)
226500	string		X\ 		SoftQuad troff Context intermediate
22651>2	string		495		for AT&T 495 laser printer
22652>2	string		hp		for Hewlett-Packard LaserJet
22653>2	string		impr		for IMAGEN imPRESS
22654>2	string		ps		for PostScript
22655
22656# From: Michael Piefel <piefel@debian.org>
22657# sqtroff intermediate language (replacement for ditroff int. lang.)
226580	string		X\ 495		SoftQuad troff Context intermediate for AT&T 495 laser printer
226590	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
226600	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
226610	string		X\ ps		SoftQuad troff Context intermediate for PostScript
22662
22663#------------------------------------------------------------------------------
22664# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
22665# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
22666#
22667# Cloyce D. Spradling <cloyce@headgear.org>
22668
226690	string	spec			SPEC
22670>4	string	.cpu			CPU
22671>>8	string	<:			\b%.4s
22672>>12	string	.			raw result text
22673
2267417	string	version=SPECjbb		SPECjbb
22675>32	string	<:			\b%.4s
22676>>37	string	<:			v%.4s raw result text
22677
226780	string	BEGIN\040SPECWEB	SPECweb
22679>13	string	<:			\b%.2s
22680>>15	string	_SSL			\b_SSL
22681>>>20	string	<:			v%.4s raw result text
22682>>16	string	<:			v%.4s raw result text
22683
22684#------------------------------------------------------------------------------
22685# $File: spectrum,v 1.7 2010/09/20 18:55:20 rrt Exp $
22686# spectrum:  file(1) magic for Spectrum emulator files.
22687#
22688# John Elliott <jce@seasip.demon.co.uk>
22689
22690#
22691# Spectrum +3DOS header
22692#
226930       string          PLUS3DOS\032    Spectrum +3 data
22694>15     byte            0               - BASIC program
22695>15     byte            1               - number array
22696>15     byte            2               - character array
22697>15     byte            3               - memory block
22698>>16    belong          0x001B0040      (screen)
22699>15     byte            4               - Tasword document
22700>15     string          TAPEFILE        - ZXT tapefile
22701#
22702# Tape file. This assumes the .TAP starts with a Spectrum-format header,
22703# which nearly all will.
22704#
22705# Update: Sanity-check string contents to be printable.
22706#  -Adam Buchbinder <adam.buchbinder@gmail.com>
22707#
227080       string          \023\000\000
22709>4      string          >\0
22710>>4     string          <\177           Spectrum .TAP data "%-10.10s"
22711>>>3    byte            0               - BASIC program
22712>>>3    byte            1               - number array
22713>>>3    byte            2               - character array
22714>>>3    byte            3               - memory block
22715>>>>14  belong          0x001B0040      (screen)
22716
22717# The following three blocks are from pak21-spectrum@srcf.ucam.org
22718# TZX tape images
227190      string          ZXTape!\x1a     Spectrum .TZX data
22720>8     byte            x               version %d
22721>9     byte            x               \b.%d
22722
22723# RZX input recording files
227240      string          RZX!            Spectrum .RZX data
22725>4     byte            x               version %d
22726>5     byte            x               \b.%d
22727
22728# Floppy disk images
227290      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
227300      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
227310      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
227320      string          SINCLAIR        Spectrum .SCL Betadisk image
22733
22734# Hard disk images
227350      string          RS-IDE\x1a      Spectrum .HDF hard disk image
22736>7     byte            x               \b, version 0x%02x
22737
22738#------------------------------------------------------------------------------
22739# $File: sql,v 1.21 2017/03/17 21:35:28 christos Exp $
22740# sql:  file(1) magic for SQL files
22741#
22742# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
22743# Recognize some MySQL files.
22744# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
22745# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
22746#
227470	beshort			0xfe01		MySQL table definition file
22748>2	byte			x		Version %d
22749>3	byte			0		\b, type UNKNOWN
22750>3	byte			1		\b, type DIAM_ISAM
22751>3	byte			2		\b, type HASH
22752>3	byte			3		\b, type MISAM
22753>3	byte			4		\b, type PISAM
22754>3	byte			5		\b, type RMS_ISAM
22755>3	byte			6		\b, type HEAP
22756>3	byte			7		\b, type ISAM
22757>3	byte			8		\b, type MRG_ISAM
22758>3	byte			9		\b, type MYISAM
22759>3	byte			10		\b, type MRG_MYISAM
22760>3	byte			11		\b, type BERKELEY_DB
22761>3	byte			12		\b, type INNODB
22762>3	byte			13		\b, type GEMINI
22763>3	byte			14		\b, type NDBCLUSTER
22764>3	byte			15		\b, type EXAMPLE_DB
22765>3	byte			16		\b, type CSV_DB
22766>3	byte			17		\b, type FEDERATED_DB
22767>3	byte			18		\b, type BLACKHOLE_DB
22768>3	byte			19		\b, type PARTITION_DB
22769>3	byte			20		\b, type BINLOG
22770>3	byte			21		\b, type SOLID
22771>3	byte			22		\b, type PBXT
22772>3	byte			23		\b, type TABLE_FUNCTION
22773>3	byte			24		\b, type MEMCACHE
22774>3	byte			25		\b, type FALCON
22775>3	byte			26		\b, type MARIA
22776>3	byte			27		\b, type PERFORMANCE_SCHEMA
22777>3	byte			127		\b, type DEFAULT
22778>0x0033	ulong			x		\b, MySQL version %d
227790	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
22780>3	byte			x		Version %d
227810	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
22782>3	byte			x		Version %d
227830	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
22784>3	byte			x		Version %d
22785>14	beshort			x		\b, %d key parts
22786>16	beshort			x		\b, %d unique key parts
22787>18	byte			x		\b, %d keys
22788>28	bequad			x		\b, %lld records
22789>36	bequad			x		\b, %lld deleted records
227900	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
22791>3	byte			x		Version %d
227920	belong&0xffffff00	0xfefe0900	MySQL Maria index file
22793>3	byte			x		Version %d
227940	belong&0xffffff00	0xfefe0a00	MySQL Maria compressed data file
22795>3	byte			x		Version %d
227960	belong&0xffffff00	0xfefe0c00
22797>4	string			MACF		MySQL Maria control file
22798>>3	byte			x		Version %d
227990	string			\376bin	MySQL replication log,
22800>9	long			x		server id %d
22801>8	byte			1
22802>>13	long			69		\b, MySQL V3.2.3
22803>>>19	string			x		\b, server version %s
22804>>13	long			75		\b, MySQL V4.0.2-V4.1
22805>>>25	string			x		\b, server version %s
22806>8	byte			15		MySQL V5+,
22807>>25	string			x		server version %s
22808>4	string			MARIALOG	MySQL Maria transaction log file
22809>>3	byte			x		Version %d
22810
22811#------------------------------------------------------------------------------
22812# iRiver H Series database file
22813# From Ken Guest <ken@linux.ie>
22814# As observed from iRivNavi.iDB and unencoded firmware
22815#
228160   string		iRivDB	iRiver Database file
22817>11  string	>\0	Version %s
22818>39  string		iHP-100	[H Series]
22819
22820#------------------------------------------------------------------------------
22821# SQLite database files
22822# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
22823#
22824# Version 1 used GDBM internally; its files cannot be distinguished
22825# from other GDBM files.
22826#
22827# Version 2 used this format:
228280	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
22829
22830# Version 3 of SQLite allows applications to embed their own "user version"
22831# number in the database at offset 60.  Later, SQLite added an "application id"
22832# at offset 68 that is preferred over "user version" for indicating the
22833# associated application.
22834#
228350   string  SQLite\ format\ 3	SQLite 3.x database
22836!:mime	application/x-sqlite3
22837# seldom found extension sqlite3 like in SyncData.sqlite3
22838# db
22839# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
22840# Unfortunately extension sqlite also used for other databases starting with string
22841# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
22842# and with string "ZV-zlib" in like extra.sqlite
22843!:ext sqlite/sqlite3/db/dbe
22844>60 belong  =0x5f4d544e  (Monotone source repository)
22845>68 belong  =0x0f055112  (Fossil checkout)
22846>68 belong  =0x0f055113  (Fossil global configuration)
22847>68 belong  =0x0f055111  (Fossil repository)
22848>68 belong  =0x42654462  (Bentley Systems BeSQLite Database)
22849>68 belong  =0x42654c6e  (Bentley Systems Localization File)
22850>68 belong  =0x47504b47  (OGC GeoPackage file)
22851>68 default x
22852>>68 belong  !0          \b, application id %u
22853>>60 belong  !0          \b, user version %d
22854>96 belong  x            \b, last written using SQLite version %d
22855
22856
22857# SQLite Write-Ahead Log from SQLite version >= 3.7.0
22858# http://www.sqlite.org/fileformat.html#walformat
228590	belong&0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
22860!:ext sqlite-wal/db-wal
22861>4	belong	x	version %d
22862
22863# SQLite Rollback Journal
22864# http://www.sqlite.org/fileformat.html#rollbackjournal
228650	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal
22866
22867# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
22868# https://github.com/PredatH0r/ChanSort
228690	string		PSDB\0			Panasonic channel list DataBase
22870!:ext db/bin
22871#!:mime	application/x-db-svl-panasonic
22872>126	string		SQLite\ format\ 3
22873#!:mime	application/x-panasonic-sqlite3
22874>>&-15	indirect	x			\b; contains
22875
22876# H2 Database from http://www.h2database.com/
228770	string		--\ H2\ 0.5/B\ --\ \n	H2 Database file
22878# Type:	OpenSSH key files
22879# From:	Nicolas Collignon <tsointsoin@gmail.com>
22880
228810	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
22882>28	string	>\0			version %s
228830	string	-----BEGIN\ OPENSSH\ PRIVATE\ KEY-----	OpenSSH private key
22884
228850	string	ssh-dss\ 		OpenSSH DSA public key
228860	string	ssh-rsa\ 		OpenSSH RSA public key
228870	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
228880	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
228890	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
228900	string	ssh-ed25519		OpenSSH ED25519 public key
22891
22892#------------------------------------------------------------------------------
22893# $File: ssl,v 1.4 2017/01/22 21:14:25 christos Exp $
22894# ssl:  file(1) magic for SSL file formats
22895
22896# Type: OpenSSL certificates/key files
22897# From: Nicolas Collignon <tsointsoin@gmail.com>
22898
228990	string	-----BEGIN\040CERTIFICATE-----	PEM certificate
229000	string	-----BEGIN\040CERTIFICATE\040REQ	PEM certificate request
229010	string	-----BEGIN\040RSA\040PRIVATE	PEM RSA private key
229020	string	-----BEGIN\040DSA\040PRIVATE	PEM DSA private key
229030	string	-----BEGIN\040EC\040PRIVATE	PEM EC private key
229040	string	-----BEGIN\040ECDSA\040PRIVATE	PEM ECDSA private key
22905
22906# From Luc Gommans
22907# OpenSSL enc file (recognized by a magic string preceding the password's salt)
229080	string	Salted__	openssl enc'd data with salted password
22909# Using the -a or -base64 option, OpenSSL will base64-encode the data.
229100	string U2FsdGVkX19	openssl enc'd data with salted password, base64 encoded
22911
22912#------------------------------------------------------------------------------
22913# $File: sun,v 1.27 2014/04/30 21:41:02 christos Exp $
22914# sun:  file(1) magic for Sun machines
22915#
22916# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
22917# releases.  (5.x uses ELF.)  Entries for executables without an
22918# architecture type, used before the 68020-based Sun-3's came out,
22919# are in aout, as they're indistinguishable from other big-endian
22920# 32-bit a.out files.
22921#
229220	belong&077777777	0600413		a.out SunOS SPARC demand paged
22923>0	byte		&0x80
22924>>20	belong		<4096		shared library
22925>>20	belong		=4096		dynamically linked executable
22926>>20	belong		>4096		dynamically linked executable
22927>0	byte		^0x80		executable
22928>16	belong		>0		not stripped
22929
229300	belong&077777777	0600410		a.out SunOS SPARC pure
22931>0	byte		&0x80		dynamically linked executable
22932>0	byte		^0x80		executable
22933>16	belong		>0		not stripped
22934
229350	belong&077777777	0600407		a.out SunOS SPARC
22936>0	byte		&0x80		dynamically linked executable
22937>0	byte		^0x80		executable
22938>16	belong		>0		not stripped
22939
229400	belong&077777777	0400413		a.out SunOS mc68020 demand paged
22941>0	byte		&0x80
22942>>20	belong		<4096		shared library
22943>>20	belong		=4096		dynamically linked executable
22944>>20	belong		>4096		dynamically linked executable
22945>0	byte		^0x80		executable
22946>16	belong		>0		not stripped
22947
229480	belong&077777777	0400410		a.out SunOS mc68020 pure
22949>0	byte		&0x80		dynamically linked executable
22950>0	byte		^0x80		executable
22951>16	belong		>0		not stripped
22952
229530	belong&077777777	0400407		a.out SunOS mc68020
22954>0	byte		&0x80		dynamically linked executable
22955>0	byte		^0x80		executable
22956>16	belong		>0		not stripped
22957
229580	belong&077777777	0200413		a.out SunOS mc68010 demand paged
22959>0	byte		&0x80
22960>>20	belong		<4096		shared library
22961>>20	belong		=4096		dynamically linked executable
22962>>20	belong		>4096		dynamically linked executable
22963>0	byte		^0x80		executable
22964>16	belong		>0		not stripped
22965
229660	belong&077777777	0200410		a.out SunOS mc68010 pure
22967>0	byte		&0x80		dynamically linked executable
22968>0	byte		^0x80		executable
22969>16	belong		>0		not stripped
22970
229710	belong&077777777	0200407		a.out SunOS mc68010
22972>0	byte		&0x80		dynamically linked executable
22973>0	byte		^0x80		executable
22974>16	belong		>0		not stripped
22975
22976#
22977# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
22978# binary executed in compatibility mode under SunOS 5.x".
22979#
229800	belong		0x080456	SunOS core file
22981>4	belong		432		(SPARC)
22982>>132	string		>\0		from '%s'
22983>>116	belong		=3		(quit)
22984>>116	belong		=4		(illegal instruction)
22985>>116	belong		=5		(trace trap)
22986>>116	belong		=6		(abort)
22987>>116	belong		=7		(emulator trap)
22988>>116	belong		=8		(arithmetic exception)
22989>>116	belong		=9		(kill)
22990>>116	belong		=10		(bus error)
22991>>116	belong		=11		(segmentation violation)
22992>>116	belong		=12		(bad argument to system call)
22993>>116	belong		=29		(resource lost)
22994>>120	belong		x		(T=%dK,
22995>>124	belong		x		D=%dK,
22996>>128	belong		x		S=%dK)
22997>4	belong		826		(68K)
22998>>128	string		>\0		from '%s'
22999>4	belong		456		(SPARC 4.x BCP)
23000>>152	string		>\0		from '%s'
23001# Sun SunPC
230020	long		0xfa33c08e	SunPC 4.0 Hard Disk
230030	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
23004# Sun snoop (see RFC 1761, which describes the capture file format,
23005# RFC 3827, which describes some additional datalink types, and
23006# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
23007# which is the IANA registry of Snoop datalink types)
23008#
230090	string		snoop		Snoop capture file
23010>8	belong		>0		- version %d
23011>12	belong		0		(IEEE 802.3)
23012>12	belong		1		(IEEE 802.4)
23013>12	belong		2		(IEEE 802.5)
23014>12	belong		3		(IEEE 802.6)
23015>12	belong		4		(Ethernet)
23016>12	belong		5		(HDLC)
23017>12	belong		6		(Character synchronous)
23018>12	belong		7		(IBM channel-to-channel adapter)
23019>12	belong		8		(FDDI)
23020>12	belong		9		(Other)
23021>12	belong		10		(type %d)
23022>12	belong		11		(type %d)
23023>12	belong		12		(type %d)
23024>12	belong		13		(type %d)
23025>12	belong		14		(type %d)
23026>12	belong		15		(type %d)
23027>12	belong		16		(Fibre Channel)
23028>12	belong		17		(ATM)
23029>12	belong		18		(ATM Classical IP)
23030>12	belong		19		(type %d)
23031>12	belong		20		(type %d)
23032>12	belong		21		(type %d)
23033>12	belong		22		(type %d)
23034>12	belong		23		(type %d)
23035>12	belong		24		(type %d)
23036>12	belong		25		(type %d)
23037>12	belong		26		(IP over Infiniband)
23038>12	belong		>26		(type %d)
23039
23040#---------------------------------------------------------------------------
23041# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
23042# lead Sun/Cobalt developer) who agrees that they are good and worthy of
23043# inclusion.
23044
23045# Boot ROM images for Sun/Cobalt Linux server appliances
230460       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
23047>38     string x        V%.4s
23048
23049# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
23050# at the very end where file(1) can't get it.
230510       string CRfs     COBALT boot rom data (Flat boot rom or file system)
23052
23053#------------------------------------------------------------------------------
23054# msx:  file(1) magic for the SymbOS operating system
23055# http://www.symbos.de
23056# Fabio R. Schmidlin <frs@pop.com.br>
23057
23058# SymbOS EXE file
230590x30	string		SymExe		SymbOS executable
23060>0x36	ubyte		x		v%c
23061>0x37	ubyte		x		\b.%c
23062>0xF	string		x		\b, name: %s
23063
23064# SymbOS DOX document
230650	string		INFOq\0		SymbOS DOX document
23066
23067# Symbos driver
230680	string		SMD1		SymbOS driver
23069>19	byte		x		\b, name: %c
23070>20	byte		x		\b%c
23071>21	byte		x		\b%c
23072>22	byte		x		\b%c
23073>23	byte		x		\b%c
23074>24	byte		x		\b%c
23075>25	byte		x		\b%c
23076>26	byte		x		\b%c
23077>27	byte		x		\b%c
23078>28	byte		x		\b%c
23079>29	byte		x		\b%c
23080>30	byte		x		\b%c
23081>31	byte		x		\b%c
23082
23083# Symbos video
230840	string		SymVid		SymbOS video
23085>6	ubyte		x		v%c
23086>7	ubyte		x		\b.%c
23087
23088# Soundtrakker 128 ST2 music
230890	byte		0
23090>0xC	string		\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00	Soundtrakker 128 ST2 music,
23091>>1	string		x		name: %s
23092
23093
23094
23095#------------------------------------------------------------------------
23096# $File: sysex,v 1.9 2017/03/17 21:35:28 christos Exp $
23097# sysex: file(1) magic for MIDI sysex files
23098#
23099# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
23100# where real SYStem EXclusive messages at offset 1 are limited to seven bits
23101# http://en.wikipedia.org/wiki/MIDI
231020	ubeshort&0xFF80		0xF000		SysEx File -
23103
23104# North American Group
23105>1	byte			0x01		Sequential
23106>1	byte			0x02		IDP
23107>1	byte			0x03		OctavePlateau
23108>1	byte			0x04		Moog
23109>1	byte			0x05		Passport
23110>1	byte			0x06		Lexicon
23111>1	byte			0x07		Kurzweil/Future Retro
23112>>3	byte			0x77		777
23113>>4	byte			0x00		Bank
23114>>4	byte			0x01		Song
23115>>5	byte			0x0f		16
23116>>5	byte			0x0e		15
23117>>5	byte			0x0d		14
23118>>5	byte			0x0c		13
23119>>5	byte			0x0b		12
23120>>5	byte			0x0a		11
23121>>5	byte			0x09		10
23122>>5	byte			0x08		9
23123>>5	byte			0x07		8
23124>>5	byte			0x06		7
23125>>5	byte			0x05		6
23126>>5	byte			0x04		5
23127>>5	byte			0x03		4
23128>>5	byte			0x02		3
23129>>5	byte			0x01		2
23130>>5	byte			0x00		1
23131>>5	byte			0x10		(ALL)
23132>>2	byte			x			\b, Channel %d
23133>1	byte			0x08		Fender
23134>1	byte			0x09		Gulbransen
23135>1	byte			0x0a		AKG
23136>1	byte			0x0b		Voyce
23137>1	byte			0x0c		Waveframe
23138>1	byte			0x0d		ADA
23139>1	byte			0x0e		Garfield
23140>1	byte			0x0f		Ensoniq
23141>1	byte			0x10		Oberheim
23142>>2	byte			0x06		Matrix 6 series
23143>>3	byte			0x0A		Dump (All)
23144>>3	byte			0x01		Dump (Bank)
23145>>4 belong			0x0002040E		Matrix 1000
23146>>>11 byte			<2			User bank %d
23147>>>11 byte			>1			Preset bank %d
23148>1	byte			0x11		Apple
23149>1	byte			0x12		GreyMatter
23150>1	byte			0x14		PalmTree
23151>1	byte			0x15		JLCooper
23152>1	byte			0x16		Lowrey
23153>1	byte			0x17		AdamsSmith
23154>1	byte			0x18		E-mu
23155>1	byte			0x19		Harmony
23156>1	byte			0x1a		ART
23157>1	byte			0x1b		Baldwin
23158>1	byte			0x1c		Eventide
23159>1	byte			0x1d		Inventronics
23160>1	byte			0x1f		Clarity
23161
23162# European Group
23163>1	byte			0x21		SIEL
23164>1	byte			0x22		Synthaxe
23165>1	byte			0x24		Hohner
23166>1	byte			0x25		Twister
23167>1	byte			0x26		Solton
23168>1	byte			0x27		Jellinghaus
23169>1	byte			0x28		Southworth
23170>1	byte			0x29		PPG
23171>1	byte			0x2a		JEN
23172>1	byte			0x2b		SSL
23173>1	byte			0x2c		AudioVertrieb
23174
23175>1	byte			0x2f		ELKA
23176>>3	byte			0x09		EK-44
23177
23178>1	byte			0x30		Dynacord
23179>1	byte			0x31		Jomox
23180>1	byte			0x33		Clavia
23181>1	byte			0x39		Soundcraft
23182# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
23183>1	byte			0x3e		Waldorf
23184>>2	byte			0x00		microWave
23185>>2	byte			0x0E		microwave2 / XT
23186>>2	byte			0x0F		Q / Q+
23187>>3	byte			=0			(default id)
23188>>3 byte			>0			(
23189>>>3 byte			<0x7F		\bdevice %d)
23190>>>3 byte			=0x7F		\bbroadcast id)
23191>>3	byte			0x7f		Microwave I
23192>>>4	byte			0x00		SNDR (Sound Request)
23193>>>4	byte			0x10		SNDD (Sound Dump)
23194>>>4	byte			0x20		SNDP (Sound Parameter Change)
23195>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
23196>>>4	byte			0x70		BOOT (Sound Reserved)
23197>>>4	byte			0x01		MULR (Multi Request)
23198>>>4	byte			0x11		MULD (Multi Dump)
23199>>>4	byte			0x21		MULP (Multi Parameter Change)
23200>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
23201>>>4	byte			0x71		OS (Multi Reserved)
23202>>>4	byte			0x02		DRMR (Drum Map Request)
23203>>>4	byte			0x12		DRMD (Drum Map Dump)
23204>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
23205>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
23206>>>4	byte			0x72		BIN (Drum Map Reserved)
23207>>>4	byte			0x03		PATR (Sequencer Pattern Request)
23208>>>4	byte			0x13		PATD (Sequencer Pattern Dump)
23209>>>4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
23210>>>4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
23211>>>4	byte			0x73		AFM (Sequencer Pattern Reserved)
23212>>>4	byte			0x04		GLBR (Global Parameter Request)
23213>>>4	byte			0x14		GLBD (Global Parameter Dump)
23214>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
23215>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
23216>>>4	byte			0x07		MODR (Mode Parameter Request)
23217>>>4	byte			0x17		MODD (Mode Parameter Dump)
23218>>>4	byte			0x27		MODP (Mode Parameter Parameter Change)
23219>>>4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
23220>>2	byte			0x10		microQ
23221>>>4	byte			0x00		SNDR (Sound Request)
23222>>>4	byte			0x10		SNDD (Sound Dump)
23223>>>4	byte			0x20		SNDP (Sound Parameter Change)
23224>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
23225>>>4	byte			0x70		(Sound Reserved)
23226>>>4	byte			0x01		MULR (Multi Request)
23227>>>4	byte			0x11		MULD (Multi Dump)
23228>>>4	byte			0x21		MULP (Multi Parameter Change)
23229>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
23230>>>4	byte			0x71		OS (Multi Reserved)
23231>>>4	byte			0x02		DRMR (Drum Map Request)
23232>>>4	byte			0x12		DRMD (Drum Map Dump)
23233>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
23234>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
23235>>>4	byte			0x72		BIN (Drum Map Reserved)
23236>>>4	byte			0x04		GLBR (Global Parameter Request)
23237>>>4	byte			0x14		GLBD (Global Parameter Dump)
23238>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
23239>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
23240>>2	byte			0x11		rackAttack
23241>>>4	byte			0x00		SNDR (Sound Parameter Request)
23242>>>4	byte			0x10		SNDD (Sound Parameter Dump)
23243>>>4	byte			0x20		SNDP (Sound Parameter Parameter Change)
23244>>>4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
23245>>>4	byte			0x01		PRGR (Program Parameter Request)
23246>>>4	byte			0x11		PRGD (Program Parameter Dump)
23247>>>4	byte			0x21		PRGP (Program Parameter Parameter Change)
23248>>>4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
23249>>>4	byte			0x71		OS (Program Parameter Reserved)
23250>>>4	byte			0x03		PATR (Pattern Parameter Request)
23251>>>4	byte			0x13		PATD (Pattern Parameter Dump)
23252>>>4	byte			0x23		PATP (Pattern Parameter Parameter Change)
23253>>>4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
23254>>>4	byte			0x04		GLBR (Global Parameter Request)
23255>>>4	byte			0x14		GLBD (Global Parameter Dump)
23256>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
23257>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
23258>>>4	byte			0x05		EFXR (FX Parameter Request)
23259>>>4	byte			0x15		EFXD (FX Parameter Dump)
23260>>>4	byte			0x25		EFXP (FX Parameter Parameter Change)
23261>>>4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
23262>>>4	byte			0x07		MODR (Mode Command Request)
23263>>>4	byte			0x17		MODD (Mode Command Dump)
23264>>>4	byte			0x27		MODP (Mode Command Parameter Change)
23265>>>4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
23266>>2	byte			0x03		Wave
23267>>>4	byte			0x00		SBPR (Soundprogram)
23268>>>4	byte			0x01		SAPR (Performance)
23269>>>4	byte			0x02		SWAVE (Wave)
23270>>>4	byte			0x03		SWTBL (Wave control table)
23271>>>4	byte			0x04		SVT (Velocity Curve)
23272>>>4	byte			0x05		STT (Tuning Table)
23273>>>4	byte			0x06		SGLB (Global Parameters)
23274>>>4	byte			0x07		SARRMAP (Performance Program Change Map)
23275>>>4	byte			0x08		SBPRMAP (Sound Program Change Map)
23276>>>4	byte			0x09		SBPRPAR (Sound Parameter)
23277>>>4	byte			0x0A		SARRPAR (Performance Parameter)
23278>>>4	byte			0x0B		SINSPAR (Instrument/External Parameter)
23279>>>4	byte			0x0F		SBULK (Bulk Switch on/off)
23280
23281# Japanese Group
23282>1	byte			0x40		Kawai
23283>>3	byte			0x20		K1
23284>>3	byte			0x22		K4
23285
23286>1	byte			0x41		Roland
23287>>3	byte			0x14		D-50
23288>>3	byte			0x2b		U-220
23289>>3	byte			0x02		TR-707
23290
23291>1	byte			0x42		Korg
23292>>3	byte			0x19		M1
23293
23294>1	byte			0x43		Yamaha
23295>1	byte			0x44		Casio
23296>1	byte			0x46		Kamiya
23297>1	byte			0x47		Akai
23298>1	byte			0x48		Victor
23299>1	byte			0x49		Mesosha
23300>1	byte			0x4b		Fujitsu
23301>1	byte			0x4c		Sony
23302>1	byte			0x4e		Teac
23303>1	byte			0x50		Matsushita
23304>1	byte			0x51		Fostex
23305>1	byte			0x52		Zoom
23306>1	byte			0x54		Matsushita
23307>1	byte			0x57		Acoustic tech. lab.
23308# http://www.midi.org/techspecs/manid.php
23309>1	belong&0xffffff00	0x00007400	Ta Horng
23310>1	belong&0xffffff00	0x00007500	e-Tek
23311>1	belong&0xffffff00	0x00007600	E-Voice
23312>1	belong&0xffffff00	0x00007700	Midisoft
23313>1	belong&0xffffff00	0x00007800	Q-Sound
23314>1	belong&0xffffff00	0x00007900	Westrex
23315>1	belong&0xffffff00	0x00007a00	Nvidia*
23316>1	belong&0xffffff00	0x00007b00	ESS
23317>1	belong&0xffffff00	0x00007c00	Mediatrix
23318>1	belong&0xffffff00	0x00007d00	Brooktree
23319>1	belong&0xffffff00	0x00007e00	Otari
23320>1	belong&0xffffff00	0x00007f00	Key Electronics
23321>1	belong&0xffffff00	0x00010000	Shure
23322>1	belong&0xffffff00	0x00010100	AuraSound
23323>1	belong&0xffffff00	0x00010200	Crystal
23324>1	belong&0xffffff00	0x00010300	Rockwell
23325>1	belong&0xffffff00	0x00010400	Silicon Graphics
23326>1	belong&0xffffff00	0x00010500	Midiman
23327>1	belong&0xffffff00	0x00010600	PreSonus
23328>1	belong&0xffffff00	0x00010800	Topaz
23329>1	belong&0xffffff00	0x00010900	Cast Lightning
23330>1	belong&0xffffff00	0x00010a00	Microsoft
23331>1	belong&0xffffff00	0x00010b00	Sonic Foundry
23332>1	belong&0xffffff00	0x00010c00	Line 6
23333>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
23334>1	belong&0xffffff00	0x00010e00	Van Koerving
23335>1	belong&0xffffff00	0x00010f00	Altech Systems
23336>1	belong&0xffffff00	0x00011000	S & S Research
23337>1	belong&0xffffff00	0x00011100	VLSI Technology
23338>1	belong&0xffffff00	0x00011200	Chromatic
23339>1	belong&0xffffff00	0x00011300	Sapphire
23340>1	belong&0xffffff00	0x00011400	IDRC
23341>1	belong&0xffffff00	0x00011500	Justonic Tuning
23342>1	belong&0xffffff00	0x00011600	TorComp
23343>1	belong&0xffffff00	0x00011700	Newtek Inc.
23344>1	belong&0xffffff00	0x00011800	Sound Sculpture
23345>1	belong&0xffffff00	0x00011900	Walker Technical
23346>1	belong&0xffffff00	0x00011a00	Digital Harmony
23347>1	belong&0xffffff00	0x00011b00	InVision
23348>1	belong&0xffffff00	0x00011c00	T-Square
23349>1	belong&0xffffff00	0x00011d00	Nemesys
23350>1	belong&0xffffff00	0x00011e00	DBX
23351>1	belong&0xffffff00	0x00011f00	Syndyne
23352>1	belong&0xffffff00	0x00012000	Bitheadz
23353>1	belong&0xffffff00	0x00012100	Cakewalk
23354>1	belong&0xffffff00	0x00012200	Staccato
23355>1	belong&0xffffff00	0x00012300	National Semicon.
23356>1	belong&0xffffff00	0x00012400	Boom Theory
23357>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
23358>1	belong&0xffffff00	0x00012600	Antares
23359>1	belong&0xffffff00	0x00012700	Angel Software
23360>1	belong&0xffffff00	0x00012800	St Louis Music
23361>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
23362>1	belong&0xffffff00	0x00012a00	Ashley Audio
23363>1	belong&0xffffff00	0x00012b00	Vari-Lite
23364>1	belong&0xffffff00	0x00012c00	Summit Audio
23365>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
23366>1	belong&0xffffff00	0x00012e00	SeaSound
23367>1	belong&0xffffff00	0x00012f00	U.S. Robotics
23368>1	belong&0xffffff00	0x00013000	Aurisis
23369>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
23370>1	belong&0xffffff00	0x00013200	FM7 Inc.
23371>1	belong&0xffffff00	0x00013300	Swivel Systems
23372>1	belong&0xffffff00	0x00013400	Hyperactive
23373>1	belong&0xffffff00	0x00013500	MidiLite
23374>1	belong&0xffffff00	0x00013600	Radical
23375>1	belong&0xffffff00	0x00013700	Roger Linn
23376>1	belong&0xffffff00	0x00013800	Helicon
23377>1	belong&0xffffff00	0x00013900	Event
23378>1	belong&0xffffff00	0x00013a00	Sonic Network
23379>1	belong&0xffffff00	0x00013b00	Realtime Music
23380>1	belong&0xffffff00	0x00013c00	Apogee Digital
23381
23382>1	belong&0xffffff00	0x00202b00	Medeli Electronics
23383>1	belong&0xffffff00	0x00202c00	Charlie Lab
23384>1	belong&0xffffff00	0x00202d00	Blue Chip Music
23385>1	belong&0xffffff00	0x00202e00	BEE OH Corp
23386>1	belong&0xffffff00	0x00202f00	LG Semicon America
23387>1	belong&0xffffff00	0x00203000	TESI
23388>1	belong&0xffffff00	0x00203100	EMAGIC
23389>1	belong&0xffffff00	0x00203200	Behringer
23390>1	belong&0xffffff00	0x00203300	Access Music
23391>1	belong&0xffffff00	0x00203400	Synoptic
23392>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
23393>1	belong&0xffffff00	0x00203600	Terratec
23394>1	belong&0xffffff00	0x00203700	Proel SpA
23395>1	belong&0xffffff00	0x00203800	IBK MIDI
23396>1	belong&0xffffff00	0x00203900	IRCAM
23397>1	belong&0xffffff00	0x00203a00	Propellerhead Software
23398>1	belong&0xffffff00	0x00203b00	Red Sound Systems
23399>1	belong&0xffffff00	0x00203c00	Electron ESI AB
23400>1	belong&0xffffff00	0x00203d00	Sintefex Audio
23401>1	belong&0xffffff00	0x00203e00	Music and More
23402>1	belong&0xffffff00	0x00203f00	Amsaro
23403>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
23404>1	belong&0xffffff00	0x00204100	Touched by Sound
23405>1	belong&0xffffff00	0x00204200	DSP Arts
23406>1	belong&0xffffff00	0x00204300	Phil Rees Music
23407>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
23408>1	belong&0xffffff00	0x00204500	Soundart
23409>1	belong&0xffffff00	0x00204600	C-Mexx Software
23410>1	belong&0xffffff00	0x00204700	Klavis Tech.
23411>1	belong&0xffffff00	0x00204800	Noteheads AB
23412
234130	string			T707		Roland TR-707 Data
23414#------------------------------------------------------------------------------
23415# file:  file(1) magic for Tcl scripting language
23416# URL:  http://www.tcl.tk/
23417# From: gustaf neumann
23418
23419# Tcl scripts
234200	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
23421!:mime	text/x-tcl
234220	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
23423!:mime	text/x-tcl
234240	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
23425!:mime	text/x-tcl
234260	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
23427!:mime	text/x-tcl
234280	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
23429!:mime	text/x-tcl
234300	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
23431!:mime	text/x-tcl
234320	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
23433!:mime	text/x-tcl
234340	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
23435!:mime	text/x-tcl
23436
23437# check the first line
234380	search/1	package\ req
23439>0	regex		\^package[\ \t]+req	Tcl script
23440# not 'p', check other lines
234410	search/1	!p
23442>0	regex		\^package[\ \t]+req	Tcl script
23443
23444#------------------------------------------------------------------------------
23445# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
23446# teapot:  file(1) magic for "teapot" spreadsheet
23447#
234480       string          #!teapot\012xdr      teapot work sheet (XDR format)
23449
23450#------------------------------------------------------------------------------
23451# $File: terminfo,v 1.9 2017/04/28 16:28:58 christos Exp $
23452# terminfo:  file(1) magic for terminfo
23453#
23454# URL: http://invisible-island.net/ncurses/man/term.5.html
23455# URL: http://invisible-island.net/ncurses/man/scr_dump.5.html
23456#
23457# Workaround for Targa image type by Joerg Jenderek
23458# GRR: line below too general as it catches also
23459# Targa image type 1 with 26 long identification field
23460# and HELP.DSK
234610	string		\032\001
23462# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
23463>16	ubyte		>32
23464# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1"
23465>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled terminfo entry "%-s"
23466!:mime	application/x-terminfo
23467# no extension
23468#!:ext
23469#
23470# While the compiled terminfo uses little-endian format irregardless of
23471# platform, SystemV screen dumps do not.  They came later, and that detail was
23472# overlooked.
23473#
23474# AIX and HPUX use the SVr4 big-endian format
23475# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
234760	beshort		0433 		SVr2 curses screen image, big-endian
234770	beshort		0434		SVr3 curses screen image, big-endian
234780	beshort		0435		SVr4 curses screen image, big-endian
23479#
234800	leshort		0433		SVr2 curses screen image, little-endian
234810	leshort		0434		SVr3 curses screen image, little-endian
234820	leshort		0435		SVr4 curses screen image, little-endian
23483#
23484# Rather than SVr4, Solaris "xcurses" writes this header:
234850	regex		\^MAX=[0-9]+,[0-9]+$
23486>1	regex		\^BEG=[0-9]+,[0-9]+$
23487>2	regex		\^SCROLL=[0-9]+,[0-9]+$
23488>3	regex		\^VMIN=[0-9]+$
23489>4	regex		\^VTIME=[0-9]+$
23490>5	regex		\^FLAGS=0x[[:xdigit:]]+$
23491>6	regex		\^FG=[0-9],[0-9]+$
23492>7	regex		\^BG=[0-9]+,[0-9]+,	Solaris xcurses screen image
23493#
23494# ncurses5 (and before) did not use a magic number, making screen dumps "data".
23495# ncurses6 (2015) uses this format, ignoring byte-order
234960	string	\210\210\210\210ncurses	ncurses6 screen image
23497#
23498# PDCurses added this in 2005
234990	string		PDC\001		PDCurses screen image
23500
23501#------------------------------------------------------------------------------
23502# $File: tex,v 1.20 2014/03/16 02:53:03 christos Exp $
23503# tex:  file(1) magic for TeX files
23504#
23505# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
23506#
23507# From <conklin@talisman.kaleida.com>
23508
23509# Although we may know the offset of certain text fields in TeX DVI
23510# and font files, we can't use them reliably because they are not
23511# zero terminated. [but we do anyway, christos]
235120	string		\367\002	TeX DVI file
23513!:mime	application/x-dvi
23514>16	string		>\0		(%s)
235150	string		\367\203	TeX generic font data
235160	string		\367\131	TeX packed font data
23517>3	string		>\0		(%s)
235180	string		\367\312	TeX virtual font data
235190	search/1	This\ is\ TeX,	TeX transcript text
235200	search/1	This\ is\ METAFONT,	METAFONT transcript text
23521
23522# There is no way to detect TeX Font Metric (*.tfm) files without
23523# breaking them apart and reading the data.  The following patterns
23524# match most *.tfm files generated by METAFONT or afm2tfm.
235252	string		\000\021	TeX font metric data
23526!:mime	application/x-tex-tfm
23527>33	string		>\0		(%s)
235282	string		\000\022	TeX font metric data
23529!:mime	application/x-tex-tfm
23530>33	string		>\0		(%s)
23531
23532# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
235330	search/1	\\input\ texinfo	Texinfo source text
23534!:mime	text/x-texinfo
235350	search/1	This\ is\ Info\ file	GNU Info text
23536!:mime	text/x-info
23537
23538# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
235390	search/4096	\\input		TeX document text
23540!:mime	text/x-tex
23541!:strength + 15
235420	search/4096	\\begin		LaTeX document text
23543!:mime	text/x-tex
23544!:strength + 15
235450	search/4096	\\section	LaTeX document text
23546!:mime	text/x-tex
23547!:strength + 18
235480	search/4096	\\setlength	LaTeX document text
23549!:mime	text/x-tex
23550!:strength + 15
235510	search/4096	\\documentstyle	LaTeX document text
23552!:mime	text/x-tex
23553!:strength + 18
235540	search/4096	\\chapter	LaTeX document text
23555!:mime	text/x-tex
23556!:strength + 18
235570	search/4096	\\documentclass	LaTeX 2e document text
23558!:mime	text/x-tex
23559!:strength + 15
235600	search/4096	\\relax		LaTeX auxiliary file
23561!:mime	text/x-tex
23562!:strength + 15
235630	search/4096	\\contentsline	LaTeX table of contents
23564!:mime	text/x-tex
23565!:strength + 15
235660	search/4096	%\ -*-latex-*-	LaTeX document text
23567!:mime	text/x-tex
23568
23569# Tex document, from Hendrik Scholz <hendrik@scholz.net>
235700   	search/1	\\ifx		TeX document text
23571
23572# Index and glossary files
235730	search/4096	\\indexentry	LaTeX raw index file
235740	search/4096	\\begin{theindex}	LaTeX sorted index
235750	search/4096	\\glossaryentry	LaTeX raw glossary
235760	search/4096	\\begin{theglossary}	LaTeX sorted glossary
235770	search/4096	This\ is\ makeindex	Makeindex log file
23578
23579# End of TeX
23580
23581#------------------------------------------------------------------------------
23582# file(1) magic for BibTex text files
23583# From Hendrik Scholz <hendrik@scholz.net>
23584
235850	search/1/c	@article{	BibTeX text file
235860	search/1/c	@book{		BibTeX text file
235870	search/1/c	@inbook{	BibTeX text file
235880	search/1/c	@incollection{	BibTeX text file
235890	search/1/c	@inproceedings{	BibTeX text file
235900	search/1/c	@manual{	BibTeX text file
235910	search/1/c	@misc{		BibTeX text file
235920	search/1/c	@preamble{	BibTeX text file
235930	search/1/c	@phdthesis{	BibTeX text file
235940	search/1/c	@techreport{	BibTeX text file
235950	search/1/c	@unpublished{	BibTeX text file
23596
2359773	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)
23598
2359973	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
23600
236010	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file
23602
236030	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file
23604
236050	search/1	@c\ @mapfile{	TeX font aliases text file
23606
236070	string		#LyX		LyX document text
23608
23609# ConTeXt documents
23610#	http://wiki.contextgarden.net/
236110	search/4096	\\setupcolors[		ConTeXt document text
23612!:strength + 15
236130	search/4096	\\definecolor[		ConTeXt document text
23614!:strength + 15
236150	search/4096	\\setupinteraction[	ConTeXt document text
23616!:strength + 15
236170	search/4096	\\useURL[		ConTeXt document text
23618!:strength + 15
236190	search/4096	\\setuppapersize[	ConTeXt document text
23620!:strength + 15
236210	search/4096	\\setuplayout[		ConTeXt document text
23622!:strength + 15
236230	search/4096	\\setupfooter[		ConTeXt document text
23624!:strength + 15
236250	search/4096	\\setupfootertexts[	ConTeXt document text
23626!:strength + 15
236270	search/4096	\\setuppagenumbering[	ConTeXt document text
23628!:strength + 15
236290	search/4096	\\setupbodyfont[	ConTeXt document text
23630!:strength + 15
236310	search/4096	\\setuphead[		ConTeXt document text
23632!:strength + 15
236330	search/4096	\\setupitemize[		ConTeXt document text
23634!:strength + 15
236350	search/4096	\\setupwhitespace[	ConTeXt document text
23636!:strength + 15
236370	search/4096	\\setupindenting[	ConTeXt document text
23638!:strength + 15
23639
23640#------------------------------------------------------------------------------
23641# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
23642# file(1) magic for tgif(1) files
23643# From Hendrik Scholz <hendrik@scholz.net>
236440	string	%TGIF\ 			Tgif file version
23645>6	string	x			%s
23646
23647#------------------------------------------------------------------------------
23648# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $
23649# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
23650#
23651# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
23652#
23653# Update: Romain Lievin (roms@lpg.ticalc.org).
23654#
23655# NOTE: This list is not complete.
23656# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
23657# program/group magic numbers in here because I cannot find any.
236580		string		**TI80**	TI-80 Graphing Calculator File.
236590		string		**TI81**	TI-81 Graphing Calculator File.
23660#
23661# Magic Numbers for the TI-73
23662#
236630		string		**TI73**	TI-73 Graphing Calculator
23664>0x00003B	byte		0x00		(real number)
23665>0x00003B	byte		0x01		(list)
23666>0x00003B	byte		0x02		(matrix)
23667>0x00003B	byte		0x03		(equation)
23668>0x00003B	byte		0x04		(string)
23669>0x00003B	byte		0x05		(program)
23670>0x00003B	byte		0x06		(assembly program)
23671>0x00003B	byte		0x07		(picture)
23672>0x00003B	byte		0x08		(gdb)
23673>0x00003B	byte		0x0C		(complex number)
23674>0x00003B	byte		0x0F		(window settings)
23675>0x00003B	byte		0x10		(zoom)
23676>0x00003B	byte		0x11		(table setup)
23677>0x00003B	byte		0x13		(backup)
23678
23679# Magic Numbers for the TI-82
23680#
236810		string		**TI82**	TI-82 Graphing Calculator
23682>0x00003B	byte		0x00		(real)
23683>0x00003B	byte		0x01		(list)
23684>0x00003B	byte		0x02		(matrix)
23685>0x00003B	byte		0x03		(Y-variable)
23686>0x00003B	byte		0x05		(program)
23687>0x00003B	byte		0x06		(protected prgm)
23688>0x00003B	byte		0x07		(picture)
23689>0x00003B	byte		0x08		(gdb)
23690>0x00003B	byte		0x0B		(window settings)
23691>0x00003B	byte		0x0C		(window settings)
23692>0x00003B	byte		0x0D		(table setup)
23693>0x00003B	byte		0x0E		(screenshot)
23694>0x00003B	byte		0x0F		(backup)
23695#
23696# Magic Numbers for the TI-83
23697#
236980		string		**TI83**	TI-83 Graphing Calculator
23699>0x00003B	byte		0x00		(real)
23700>0x00003B	byte		0x01		(list)
23701>0x00003B	byte		0x02		(matrix)
23702>0x00003B	byte		0x03		(Y-variable)
23703>0x00003B	byte		0x04		(string)
23704>0x00003B	byte		0x05		(program)
23705>0x00003B	byte		0x06		(protected prgm)
23706>0x00003B	byte		0x07		(picture)
23707>0x00003B	byte		0x08		(gdb)
23708>0x00003B	byte		0x0B		(window settings)
23709>0x00003B	byte		0x0C		(window settings)
23710>0x00003B	byte		0x0D		(table setup)
23711>0x00003B	byte		0x0E		(screenshot)
23712>0x00003B	byte		0x13		(backup)
23713#
23714# Magic Numbers for the TI-83+
23715#
237160		string		**TI83F*	TI-83+ Graphing Calculator
23717>0x00003B	byte		0x00		(real number)
23718>0x00003B	byte		0x01		(list)
23719>0x00003B	byte		0x02		(matrix)
23720>0x00003B	byte		0x03		(equation)
23721>0x00003B	byte		0x04		(string)
23722>0x00003B	byte		0x05		(program)
23723>0x00003B	byte		0x06		(assembly program)
23724>0x00003B	byte		0x07		(picture)
23725>0x00003B	byte		0x08		(gdb)
23726>0x00003B	byte		0x0C		(complex number)
23727>0x00003B	byte		0x0F		(window settings)
23728>0x00003B	byte		0x10		(zoom)
23729>0x00003B	byte		0x11		(table setup)
23730>0x00003B	byte		0x13		(backup)
23731>0x00003B	byte		0x15		(application variable)
23732>0x00003B	byte		0x17		(group of variable)
23733
23734#
23735# Magic Numbers for the TI-85
23736#
237370		string		**TI85**	TI-85 Graphing Calculator
23738>0x00003B	byte		0x00		(real number)
23739>0x00003B	byte		0x01		(complex number)
23740>0x00003B	byte		0x02		(real vector)
23741>0x00003B	byte		0x03		(complex vector)
23742>0x00003B	byte		0x04		(real list)
23743>0x00003B	byte		0x05		(complex list)
23744>0x00003B	byte		0x06		(real matrix)
23745>0x00003B	byte		0x07		(complex matrix)
23746>0x00003B	byte		0x08		(real constant)
23747>0x00003B	byte		0x09		(complex constant)
23748>0x00003B	byte		0x0A		(equation)
23749>0x00003B	byte		0x0C		(string)
23750>0x00003B	byte		0x0D		(function GDB)
23751>0x00003B	byte		0x0E		(polar GDB)
23752>0x00003B	byte		0x0F		(parametric GDB)
23753>0x00003B	byte		0x10		(diffeq GDB)
23754>0x00003B	byte		0x11		(picture)
23755>0x00003B	byte		0x12		(program)
23756>0x00003B	byte		0x13		(range)
23757>0x00003B	byte		0x17		(window settings)
23758>0x00003B	byte		0x18		(window settings)
23759>0x00003B	byte		0x19		(window settings)
23760>0x00003B	byte		0x1A		(window settings)
23761>0x00003B	byte		0x1B		(zoom)
23762>0x00003B	byte		0x1D		(backup)
23763>0x00003B	byte		0x1E		(unknown)
23764>0x00003B	byte		0x2A		(equation)
23765>0x000032	string		ZS4		- ZShell Version 4 File.
23766>0x000032	string		ZS3		- ZShell Version 3 File.
23767#
23768# Magic Numbers for the TI-86
23769#
237700		string		**TI86**	TI-86 Graphing Calculator
23771>0x00003B	byte		0x00		(real number)
23772>0x00003B	byte		0x01		(complex number)
23773>0x00003B	byte		0x02		(real vector)
23774>0x00003B	byte		0x03		(complex vector)
23775>0x00003B	byte		0x04		(real list)
23776>0x00003B	byte		0x05		(complex list)
23777>0x00003B	byte		0x06		(real matrix)
23778>0x00003B	byte		0x07		(complex matrix)
23779>0x00003B	byte		0x08		(real constant)
23780>0x00003B	byte		0x09		(complex constant)
23781>0x00003B	byte		0x0A		(equation)
23782>0x00003B	byte		0x0C		(string)
23783>0x00003B	byte		0x0D		(function GDB)
23784>0x00003B	byte		0x0E		(polar GDB)
23785>0x00003B	byte		0x0F		(parametric GDB)
23786>0x00003B	byte		0x10		(diffeq GDB)
23787>0x00003B	byte		0x11		(picture)
23788>0x00003B	byte		0x12		(program)
23789>0x00003B	byte		0x13		(range)
23790>0x00003B	byte		0x17		(window settings)
23791>0x00003B	byte		0x18		(window settings)
23792>0x00003B	byte		0x19		(window settings)
23793>0x00003B	byte		0x1A		(window settings)
23794>0x00003B	byte		0x1B		(zoom)
23795>0x00003B	byte		0x1D		(backup)
23796>0x00003B	byte		0x1E		(unknown)
23797>0x00003B	byte		0x2A		(equation)
23798#
23799# Magic Numbers for the TI-89
23800#
238010		string		**TI89**	TI-89 Graphing Calculator
23802>0x000048	byte		0x00		(expression)
23803>0x000048	byte		0x04		(list)
23804>0x000048	byte		0x06		(matrix)
23805>0x000048	byte		0x0A		(data)
23806>0x000048	byte		0x0B		(text)
23807>0x000048	byte		0x0C		(string)
23808>0x000048	byte		0x0D		(graphic data base)
23809>0x000048	byte		0x0E		(figure)
23810>0x000048	byte		0x10		(picture)
23811>0x000048	byte		0x12		(program)
23812>0x000048	byte		0x13		(function)
23813>0x000048	byte		0x14		(macro)
23814>0x000048	byte		0x1C		(zipped)
23815>0x000048	byte		0x21		(assembler)
23816#
23817# Magic Numbers for the TI-92
23818#
238190		string		**TI92**	TI-92 Graphing Calculator
23820>0x000048	byte		0x00		(expression)
23821>0x000048	byte		0x04		(list)
23822>0x000048	byte		0x06		(matrix)
23823>0x000048	byte		0x0A		(data)
23824>0x000048	byte		0x0B		(text)
23825>0x000048	byte		0x0C		(string)
23826>0x000048	byte		0x0D		(graphic data base)
23827>0x000048	byte		0x0E		(figure)
23828>0x000048	byte		0x10		(picture)
23829>0x000048	byte		0x12		(program)
23830>0x000048	byte		0x13		(function)
23831>0x000048	byte		0x14		(macro)
23832>0x000048	byte		0x1D		(backup)
23833#
23834# Magic Numbers for the TI-92+/V200
23835#
238360		string		**TI92P*	TI-92+/V200 Graphing Calculator
23837>0x000048	byte		0x00		(expression)
23838>0x000048	byte		0x04		(list)
23839>0x000048	byte		0x06		(matrix)
23840>0x000048	byte		0x0A		(data)
23841>0x000048	byte		0x0B		(text)
23842>0x000048	byte		0x0C		(string)
23843>0x000048	byte		0x0D		(graphic data base)
23844>0x000048	byte		0x0E		(figure)
23845>0x000048	byte		0x10		(picture)
23846>0x000048	byte		0x12		(program)
23847>0x000048	byte		0x13		(function)
23848>0x000048	byte		0x14		(macro)
23849>0x000048	byte		0x1C		(zipped)
23850>0x000048	byte		0x21		(assembler)
23851#
23852# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
23853#
238540x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
238550		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
23856>8		byte		>0		- Revision %d
23857>>9 		byte		x		\b.%d,
23858>12		byte		>0		Revision date %02x
23859>>13		byte		x		\b/%02x
23860>>14		beshort		x		\b/%04x,
23861>17		string		>/0		name: '%s',
23862>48		byte		0x74		device: TI-73,
23863>48		byte		0x73		device: TI-83+,
23864>48		byte		0x98		device: TI-89,
23865>48		byte		0x88		device: TI-92+,
23866>49		byte		0x23		type: OS upgrade,
23867>49		byte		0x24		type: application,
23868>49		byte		0x25		type: certificate,
23869>49		byte		0x3e		type: license,
23870>74		lelong		>0		size: %d bytes
23871
23872# VTi & TiEmu skins (TI Graphing Calculators).
23873# From: Romain Lievin (roms@lpg.ticalc.org).
23874# Magic Numbers for the VTi skins
238750               string          VTI		Virtual TI skin
23876>3		string		v		- Version
23877>>4		byte		>0		\b %c
23878>>6		byte		x		\b.%c
23879# Magic Numbers for the TiEmu skins
238800		string		TiEmu		TiEmu skin
23881>6              string          v               - Version
23882>>7             byte            >0              \b %c
23883>>9             byte            x               \b.%c
23884>>10		byte		x		\b%c
23885
23886#------------------------------------------------------------------------------
23887# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
23888# timezone:  file(1) magic for timezone data
23889#
23890# from Daniel Quinlan (quinlan@yggdrasil.com)
23891# this should work on Linux, SunOS, and maybe others
23892# Added new official magic number for recent versions of the Olson code
238930	string	TZif	timezone data
23894>4	byte	0	\b, old version
23895>4	byte	>0	\b, version %c
23896>20	belong	0	\b, no gmt time flags
23897>20	belong	1	\b, 1 gmt time flag
23898>20	belong	>1	\b, %d gmt time flags
23899>24	belong	0	\b, no std time flags
23900>20	belong	1	\b, 1 std time flag
23901>24	belong	>1	\b, %d std time flags
23902>28	belong	0	\b, no leap seconds
23903>28	belong	1	\b, 1 leap second
23904>28	belong  >1	\b, %d leap seconds
23905>32	belong	0	\b, no transition times
23906>32	belong	1	\b, 1 transition time
23907>32	belong  >1	\b, %d transition times
23908>36	belong	0	\b, no abbreviation chars
23909>36	belong	1	\b, 1 abbreviation char
23910>36	belong	>1	\b, %d abbreviation chars
239110	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
239120	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
239130	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
239140	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
239150	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
239160	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
23917
23918#------------------------------------------------------------------------------
23919# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $
23920# troff:  file(1) magic for *roff
23921#
23922# updated by Daniel Quinlan (quinlan@yggdrasil.com)
23923
23924# troff input
239250	search/1	.\\"		troff or preprocessor input text
23926!:mime	text/troff
239270	search/1	'\\"		troff or preprocessor input text
23928!:mime	text/troff
239290	search/1	'.\\"		troff or preprocessor input text
23930!:mime	text/troff
239310	search/1	\\"		troff or preprocessor input text
23932!:mime	text/troff
239330	search/1	'''		troff or preprocessor input text
23934!:mime	text/troff
239350	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9][\ \t]	troff or preprocessor input text
23936!:mime	text/troff
239370	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9]$	troff or preprocessor input text
23938!:mime	text/troff
23939
23940# ditroff intermediate output text
239410	search/1	x\ T		ditroff output text
23942>4	search/1	cat		for the C/A/T phototypesetter
23943>4	search/1	ps		for PostScript
23944>4	search/1	dvi		for DVI
23945>4	search/1	ascii		for ASCII
23946>4	search/1	lj4		for LaserJet 4
23947>4	search/1	latin1		for ISO 8859-1 (Latin 1)
23948>4	search/1	X75		for xditview at 75dpi
23949>>7	search/1	-12		(12pt)
23950>4	search/1	X100		for xditview at 100dpi
23951>>8	search/1	-12		(12pt)
23952
23953# output data formats
239540	string		\100\357	very old (C/A/T) troff output data
23955
23956#------------------------------------------------------------------------------
23957# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
23958# tuxedo:	file(1) magic for BEA TUXEDO data files
23959#
23960# from Ian Springer <ispringer@hotmail.com>
23961#
239620	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
23963
23964#------------------------------------------------------------------------------
23965# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
23966# typeset:  file(1) magic for other typesetting
23967#
239680	string		Interpress/Xerox	Xerox InterPress data
23969>16	string		/			(version
23970>>17	string		>\0			%s)
23971
23972#------------------------------------------------------------------------------
23973# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $
23974# Unicode:  BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
23975# GRR: These types should be recognised in file_ascmagic so these
23976# encodings can be treated by text patterns.
23977# Missing types are already dealt with internally.
23978#
239790	string	+/v8			Unicode text, UTF-7
239800	string	+/v9			Unicode text, UTF-7
239810	string	+/v+			Unicode text, UTF-7
239820	string	+/v/			Unicode text, UTF-7
239830	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
239840	string	\000\000\376\377	Unicode text, UTF-32, big-endian
239850	string	\377\376\000\000	Unicode text, UTF-32, little-endian
239860	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)
23987
23988#------------------------------------------------------------------------------
23989# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
23990# unknown:  file(1) magic for unknown machines
23991#
23992# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
23993# (executable, pure, and split I&D, respectively), but the PDP-11 version
23994# doesn't have the "version %ld", which may be a bogus COFFism (I don't
23995# think there was ever COFF for the PDP-11).
23996#
23997# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
23998# long, as it would be on a VAX.  In any case, that could collide with
23999# VAX demand-paged files, as the magic number is little-endian on those
24000# binaries, so the first 16 bits of the file would contain 0x10B.
24001#
24002# Therefore, those entries are commented out.
24003#
24004# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
24005#
24006#0	short		0x107		unknown machine executable
24007#>8	short		>0		not stripped
24008#>15	byte		>0		- version %ld
24009#0	short		0x108		unknown pure executable
24010#>8	short		>0		not stripped
24011#>15	byte		>0		- version %ld
24012#0	short		0x109		PDP-11 separate I&D
24013#>8	short		>0		not stripped
24014#>15	byte		>0		- version %ld
24015#0	short		0x10b		unknown pure executable
24016#>8	short		>0		not stripped
24017#>15	byte		>0		- version %ld
240180	long		0x10c		unknown demand paged pure executable
24019>16	long		>0		not stripped
240200	long		0x10e		unknown readable demand paged pure executable
24021
24022#------------------------------------------------------------------------------
24023# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
24024# file(1) magic for uterus files
24025# http://freecode.com/projects/uterus
24026#
240270	string		UTE+	uterus file
24028>4	string		v	\b, version
24029>5	byte		x	%c
24030>6	string		.	\b.
24031>7	byte		x	\b%c
24032>8	string		\<\>	\b, big-endian
24033>>16	belong		>0	\b, slut size %u
24034>8	string		\>\<	\b, litte-endian
24035>>16	lelong		>0	\b, slut size %u
24036>10	byte		&8	\b, compressed
24037
24038#------------------------------------------------------------------------------
24039# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
24040# uuencode:  file(1) magic for ASCII-encoded files
24041#
24042
24043# GRR:  the first line of xxencoded files is identical to that in uuencoded
24044# files, but the first character in most subsequent lines is 'h' instead of
24045# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
24046# punctuation and survives BITNET gateways better.)  If regular expressions
24047# were supported, this entry could possibly be split into two with
24048# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
240490	search/1	begin\ 		uuencoded or xxencoded text
24050
24051# btoa(1) is an alternative to uuencode that requires less space.
240520	search/1	xbtoa\ Begin	btoa'd text
24053
24054# ship(1) is another, much cooler alternative to uuencode.
24055# Greg Roelofs, newt@uchicago.edu
240560	search/1	$\012ship	ship'd binary text
24057
24058# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
24059# Greg Roelofs, newt@uchicago.edu
240600	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text
24061
24062# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
24063# Daniel Quinlan, quinlan@yggdrasil.com
2406411	search/1	must\ be\ converted\ with\ BinHex	BinHex binary text
24065>41	search/1	x					\b, version %.3s
24066
24067# GRR: handle BASE64
24068
24069#------------------------------------------------------------------------------
24070# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $
24071# vacuum cleaner magic by Thomas M. Ott (ThMO)
24072#
24073# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx
24074# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk
24075# -> yyyymmdd: year, month, day of cleaning
24076# -> hhmmss: hour, minute, second of cleaning
24077# -> xxxxxx: 6 digits
24078# -> cc: cleaning runs counter
24079# size: 136044 bytes
24080#
24081# struct maphdr {
24082#     int32_t  map_cnt;	     /*  0: single map */
24083#     int32_t  min_ceil;     /*  4: 100 mm == 10 cm == min. ceil */
24084#     int32_t  max_ceil;     /*  8: 10000 mm == 100 m == max. ceil */
24085#     int32_t  max_climb;    /* 12: 50 mm = 5 cm == max. height to climb */
24086#     int32_t  unknown;	     /* 16: 50000 ??? */
24087#     int32_t  cell_bytes;   /* 20: # of bytes for cells per block */
24088#     int32_t  block_max;    /* 24: 1000 == max. # of blocks */
24089#     int32_t  route_max;    /* 28: 1000 == max. # of routes */
24090#     int32_t  used_blocks;  /* 32: 5/45/33/... == # of block entries used! */
24091#     int32_t  cell_dim;     /* 36: 10 == cell dimension */
24092#     int32_t  clock_tick;   /* 40: 100 == clock ticks */
24093# #if	0
24094#     struct {		     /* 44: 1000 blocks for 10x10 cells */
24095#         int32_t  yoffset;
24096#         int32_t  xoffset;
24097#         int32_t  posxy;
24098#         int32_t  timecode;
24099#       }      blocks[ 1000];
24100#     char     cells[ 1000* 100]; /* 16044: 1000 10x10 cells */
24101#     int16_t  routes[ 1000* 10]; /* 116044: 1000 10-routes */
24102# #endif
24103#   };
24104
241050                lelong =1
24106>4               lelong =100
24107>>8              lelong =10000
24108>>>12            lelong =50
24109>>>>16           lelong =50000
24110>>>>>20          lelong =100
24111>>>>>>24         lelong =1000
24112>>>>>>>28        lelong =1000
24113>>>>>>>>36       lelong =10
24114>>>>>>>>>40      lelong =100
24115>>>>>>>>>>32     lelong x       LG robot VR6[234]xx %dm^2 navigation
24116>>>>>>>>>>136040 lelong =-1     reuse map data
24117>>>>>>>>>>136040 lelong =0      map data
24118>>>>>>>>>>136040 lelong >0      spurious map data
24119>>>>>>>>>>136040 lelong <-1     spurious map data
24120
24121
24122
24123#------------------------------------------------------------------------------
24124# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
24125# varied.out:  file(1) magic for various USG systems
24126#
24127#	Herewith many of the object file formats used by USG systems.
24128#	Most have been moved to files for a particular processor,
24129#	and deleted if they duplicate other entries.
24130#
241310	short		0610		Perkin-Elmer executable
24132# AMD 29K
241330	beshort		0572		amd 29k coff noprebar executable
241340	beshort		01572		amd 29k coff prebar executable
241350	beshort		0160007		amd 29k coff archive
24136# Cray
241376	beshort		0407		unicos (cray) executable
24138# Ultrix 4.3
24139596	string		\130\337\377\377	Ultrix core file
24140>600	string		>\0		from '%s'
24141# BeOS and MAcOS PEF executables
24142# From: hplus@zilker.net (Jon Watte)
241430	string		Joy!peffpwpc	header for PowerPC PEF executable
24144#
24145# ava assembler/linker Uros Platise <uros.platise@ijs.si>
241460       string          avaobj  AVR assembler object code
24147>7      string          >\0     version '%s'
24148# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
241490	string		gmon		GNU prof performance data
24150>4	long		x		- version %d
24151# From: Dave Pearson <davep@davep.org>
24152# Harbour <URL:http://harbour-project.org/> HRB files.
241530	string		\xc0HRB		Harbour HRB file
24154>4	leshort		x		version %d
24155# Harbour HBV files
241560	string		\xc0HBV		Harbour variable dump file
24157>4	leshort		x		version %d
24158
24159# From: Alex Beregszaszi <alex@fsn.hu>
24160# 0	string		exec 		BugOS executable
24161# 0	string		pack		BugOS archive
24162
24163# From: Jason Spence <jspence@lightconsulting.com>
24164# Generated by the "examples" in STM's ST40 devkit, and derived code.
241650	lelong		0x13a9f17e	ST40 component image format
24166>4	string		>\0		\b, name '%s'
24167
24168#------------------------------------------------------------------------------
24169# $File: varied.script,v 1.11 2015/03/27 17:59:39 christos Exp $
24170# varied.script:  file(1) magic for various interpreter scripts
24171
241720	string/t		#!\ /			a
24173>3	string		>\0			%s script text executable
24174
241750	string/b		#!\ /			a
24176>3	string		>\0			%s script executable (binary data)
24177
241780	string/t		#!\t/			a
24179>3	string		>\0			%s script text executable
24180
241810	string/b		#!\t/			a
24182>3	string		>\0			%s script executable (binary data)
24183
241840	string/t		#!/			a
24185>2	string		>\0			%s script text executable
24186
241870	string/b		#!/			a
24188>2	string		>\0			%s script executable (binary data)
24189
241900	string/t		#!\ 			script text executable
24191>3	string		>\0			for %s
24192
241930	string/b		#!\ 			script executable
24194>3	string		>\0			for %s (binary data)
24195
24196# using env
241970	string/t	#!/usr/bin/env		a
24198>15	string/t	>\0			%s script text executable
24199!:strength / 10
24200
242010	string/b	#!/usr/bin/env		a
24202>15	string/b	>\0			%s script executable (binary data)
24203!:strength / 10
24204
242050	string/t	#!\ /usr/bin/env	a
24206>16	string/t	>\0			%s script text executable
24207!:strength / 10
24208
242090	string/b	#!\ /usr/bin/env	a
24210>16	string/b	>\0			%s script executable (binary data)
24211!:strength / 10
24212
24213# From: arno <arenevier@fdn.fr>
24214# mozilla xpconnect typelib
24215# see http://www.mozilla.org/scriptable/typelib_file.html
242160	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
24217>0x10  byte        x       version %d
24218>>0x11 byte        x      \b.%d
24219
24220#------------------------------------------------------------------------------
24221# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $
24222# vax:  file(1) magic for VAX executable/object and APL workspace
24223#
242240	lelong		0101557		VAX single precision APL workspace
242250	lelong		0101556		VAX double precision APL workspace
24226
24227#
24228# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
24229# executables, and are handled in aout)
24230#
242310	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
24232>16	lelong		>0		not stripped
24233
24234#
24235# VAX COFF
24236#
24237# The `versions' were commented out, but have been un-commented out.
24238# (Was the problem just one of endianness?)
24239#
242400	leshort		0570		VAX COFF executable
24241>12	lelong		>0		not stripped
24242>22	leshort		>0		- version %d
242430	leshort		0575		VAX COFF pure executable
24244>12	lelong		>0		not stripped
24245>22	leshort		>0		- version %d
24246
24247#------------------------------------------------------------------------------
24248# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
24249# vicar:  file(1) magic for VICAR files.
24250#
24251# From: Ossama Othman <othman@astrosun.tn.cornell.edu
24252# VICAR is JPL's in-house spacecraft image processing program
24253# VICAR image
242540	string	LBLSIZE=	VICAR image data
24255>32	string	BYTE		\b, 8 bits  = VAX byte
24256>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
24257>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
24258>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
24259>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
24260>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
24261# VICAR label file
2426243	string	SFDU_LABEL	VICAR label file
24263
24264#------------------------------------------------------------------------------
24265# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $
24266# From: James Nobis <quel@quelrod.net>
24267# Microsoft hard disk images for:
24268# Virtual Server
24269# Virtual PC
24270# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
24271# .vhd
242720	string	conectix	Microsoft Disk Image, Virtual Server or Virtual PC
24273
24274# libvirt
24275# From: Philipp Hahn <hahn@univention.de>
242760	string	LibvirtQemudSave	Libvirt QEMU Suspend Image
24277>0x10	lelong	x	\b, version %u
24278>0x14	lelong	x	\b, XML length %u
24279>0x18	lelong	1	\b, running
24280>0x1c	lelong	1	\b, compressed
24281
242820	string	LibvirtQemudPart	Libvirt QEMU partial Suspend Image
24283# From: Alex Beregszaszi <alex@fsn.hu>
242840	string/b	COWD		VMWare3
24285>4	byte	3		disk image
24286>>32	lelong	x		(%d/
24287>>36	lelong	x		\b%d/
24288>>40	lelong	x		\b%d)
24289>4	byte	2		undoable disk image
24290>>32	string	>\0		(%s)
24291
242920	string/b	VMDK		 VMware4 disk image
242930	string/b	KDMV		 VMware4 disk image
24294
24295#--------------------------------------------------------------------
24296# Qemu Emulator Images
24297# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
24298# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
24299# Made by reading sources, reading documentation, and doing trial and error
24300# on existing QCOW files
243010	string/b	QFI\xFB	QEMU QCOW Image
24302
24303# Uncomment the following line to display Magic (only used for debugging
24304# this magic number)
24305#>0	string/b	x	, Magic: %s
24306
24307# There are currently 2 Versions: "1" and "2".
24308# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
24309>4	belong	1	(v1)
24310
24311# Using the existence of the Backing File Offset to determine whether
24312# to read Backing File Information
24313>>12	belong	 >0	 \b, has backing file (
24314# Note that this isn't a null-terminated string; the length is actually
24315# (16.L). Assuming a null-terminated string happens to work usually, but it
24316# may spew junk until it reaches a \0 in some cases.
24317>>>(12.L)	 string >\0	\bpath %s
24318
24319# Modification time of the Backing File
24320# Really useful if you want to know if your backing
24321# file is still usable together with this image
24322>>>>20	bedate >0	\b, mtime %s)
24323>>>>20	default x	\b)
24324
24325# Size is stored in bytes in a big-endian u64.
24326>>24	bequad	x	 \b, %lld bytes
24327
24328# 1 for AES encryption, 0 for none.
24329>>36	belong	1	\b, AES-encrypted
24330
24331# http://www.gnome.org/~markmc/qcow-image-format.html
24332>4	belong	2	(v2)
24333# Using the existence of the Backing File Offset to determine whether
24334# to read Backing File Information
24335>>8	bequad  >0	 \b, has backing file
24336# Note that this isn't a null-terminated string; the length is actually
24337# (16.L). Assuming a null-terminated string happens to work usually, but it
24338# may spew junk until it reaches a \0 in some cases. Also, since there's no
24339# .Q modifier, we just use the bottom four bytes as an offset. Note that if
24340# the file is over 4G, and the backing file path is stored after the first 4G,
24341# the wrong filename will be printed. (This should be (8.Q), when that syntax
24342# is introduced.)
24343>>>(12.L)	 string >\0	(path %s)
24344>>24	bequad	x	\b, %lld bytes
24345>>32	belong	1	\b, AES-encrypted
24346
24347>4	belong	3	(v3)
24348# Using the existence of the Backing File Offset to determine whether
24349# to read Backing File Information
24350>>8	bequad  >0	 \b, has backing file
24351# Note that this isn't a null-terminated string; the length is actually
24352# (16.L). Assuming a null-terminated string happens to work usually, but it
24353# may spew junk until it reaches a \0 in some cases. Also, since there's no
24354# .Q modifier, we just use the bottom four bytes as an offset. Note that if
24355# the file is over 4G, and the backing file path is stored after the first 4G,
24356# the wrong filename will be printed. (This should be (8.Q), when that syntax
24357# is introduced.)
24358>>>(12.L)	 string >\0	(path %s)
24359>>24	bequad	x	\b, %lld bytes
24360>>32	belong	1	\b, AES-encrypted
24361
24362>4	default x	(unknown version)
24363
243640	string/b	QEVM		QEMU suspend to disk image
24365
24366# QEMU QED Image
24367# http://wiki.qemu.org/Features/QED/Specification
243680	string/b	QED\0		QEMU QED Image
24369
24370# VDI Image
24371# Sun xVM VirtualBox Disk Image
24372# From: Richard W.M. Jones <rich@annexia.org>
24373# VirtualBox Disk Image
243740x40	ulelong		0xbeda107f	VirtualBox Disk Image
24375>0x44	uleshort	>0		\b, major %u
24376>0x46	uleshort	>0		\b, minor %u
24377>0	string		>\0		(%s)
24378>368	lequad		x		 \b, %lld bytes
24379
243800	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
24381>32	string	x				type %s,
24382>48	string	x				subtype %s
24383
243840	lelong	0x02468ace			Bochs Sparse disk image
24385
24386
24387#------------------------------------------------------------------------------
24388# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
24389# Virtutech Compressed Random Access File Format
24390#
24391# From <gustav@virtutech.com>
243920      string          \211\277\036\203        Virtutech CRAFF
24393>4     belong          x               v%d
24394>20    belong          0               uncompressed
24395>20    belong          1               bzipp2ed
24396>20    belong          2               gzipped
24397>24    belong          0               not clean
24398
24399#------------------------------------------------------------------------------
24400# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
24401# visx:  file(1) magic for Visx format files
24402#
244030	short		0x5555		VISX image file
24404>2	byte		0		(zero)
24405>2	byte		1		(unsigned char)
24406>2	byte		2		(short integer)
24407>2	byte		3		(float 32)
24408>2	byte		4		(float 64)
24409>2	byte		5		(signed char)
24410>2	byte		6		(bit-plane)
24411>2	byte		7		(classes)
24412>2	byte		8		(statistics)
24413>2	byte		10		(ascii text)
24414>2	byte		15		(image segments)
24415>2	byte		100		(image set)
24416>2	byte		101		(unsigned char vector)
24417>2	byte		102		(short integer vector)
24418>2	byte		103		(float 32 vector)
24419>2	byte		104		(float 64 vector)
24420>2	byte		105		(signed char vector)
24421>2	byte		106		(bit plane vector)
24422>2	byte		121		(feature vector)
24423>2	byte		122		(feature vector library)
24424>2	byte		124		(chain code)
24425>2	byte		126		(bit vector)
24426>2	byte		130		(graph)
24427>2	byte		131		(adjacency graph)
24428>2	byte		132		(adjacency graph library)
24429>2	string		.VISIX		(ascii text)
24430
24431#------------------------------------------------------------------------------
24432# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
24433# vms:  file(1) magic for VMS executables (experimental)
24434#
24435# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
24436
24437# GRR 950122:  I'm just guessing on these, based on inspection of the headers
24438# of three executables each for Alpha and VAX architectures.  The VAX files
24439# all had headers similar to this:
24440#
24441#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
24442#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
24443#
244440	string	\xb0\0\x30\0	VMS VAX executable
24445>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
24446#
24447# The AXP files all looked like this, except that the byte at offset 0x22
24448# was 06 in some of them and 07 in others:
24449#
24450#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
24451#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
24452#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
24453#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
24454#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
24455#
24456# GRR this test is still too general as it catches example adressen.dbt
244570	belong	0x03000000
24458>8	ubelong	0xec020000	VMS Alpha executable
24459>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
24460
24461#------------------------------------------------------------------------------
24462# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
24463# VMware specific files (deducted from version 1.1 and log file entries)
24464# Anthon van der Neut (anthon@mnt.org)
244650	belong	0x4d52564e	VMware nvram
24466
24467#------------------------------------------------------------------------------
24468# $File: vorbis,v 1.23 2017/03/17 21:35:28 christos Exp $
24469# vorbis:  file(1) magic for Ogg/Vorbis files
24470#
24471# From Felix von Leitner <leitner@fefe.de>
24472# Extended by Beni Cherniavsky <cben@crosswinds.net>
24473# Further extended by Greg Wooledge <greg@wooledge.org>
24474#
24475# Most (everything but the number of channels and bitrate) is commented
24476# out with `##' as it's not interesting to the average user.  The most
24477# probable things advanced users would want to uncomment are probably
24478# the number of comments and the encoder version.
24479#
24480# FIXME: The first match has been made a search, so that it can skip
24481# over prepended ID3 tags. This will work for MIME type detection, but
24482# won't work for detecting other properties of the file (they all need
24483# to be made relative to the search). In any case, if the file has ID3
24484# tags, the ID3 information will be printed, not the Ogg information,
24485# so until that's fixed, this doesn't matter.
24486# FIXME[2]: Disable the above for now, since search assumes text mode.
24487#
24488# --- Ogg Framing ---
24489#0		search/1000	OggS		Ogg data
244900		string	OggS		Ogg data
24491>4		byte		!0		UNKNOWN REVISION %u
24492##>4		byte		0		revision 0
24493>4		byte		0
24494##>>14		lelong		x		(Serial %lX)
24495# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
24496>>28		string		\x7fFLAC	\b, FLAC audio
24497# non-Vorbis content: Theora
24498!:mime		audio/ogg
24499>>28		string		\x80theora	\b, Theora video
24500!:mime		video/ogg
24501# non-Vorbis content: Kate
24502>>28		string		\x80kate\0\0\0\0	\b, Kate (Karaoke and Text)
24503!:mime		application/ogg
24504>>>37		ubyte		x		v%u
24505>>>38		ubyte		x		\b.%u,
24506>>>40		byte		0		utf8 encoding,
24507>>>40		byte		!0		unknown character encoding,
24508>>>60		string		>\0		language %s,
24509>>>60		string		\0		no language set,
24510>>>76		string		>\0		category %s
24511>>>76		string		\0		no category set
24512# non-Vorbis content: Skeleton
24513>>28		string		fishead\0	\b, Skeleton
24514!:mime		video/ogg
24515>>>36		leshort		x		v%u
24516>>>40		leshort		x		\b.%u
24517# non-Vorbis content: Speex
24518>>28		string		Speex\ \ \ 	\b, Speex audio
24519!:mime		audio/ogg
24520# non-Vorbis content: OGM
24521>>28		string		\x01video\0\0\0	\b, OGM video
24522!:mime		video/ogg
24523>>>37		string/c	div3		(DivX 3)
24524>>>37		string/c	divx		(DivX 4)
24525>>>37		string/c	dx50		(DivX 5)
24526>>>37		string/c	xvid		(XviD)
24527# --- First vorbis packet - general header ---
24528>>28		string		\x01vorbis	\b, Vorbis audio,
24529!:mime		audio/ogg
24530>>>35		lelong		!0		UNKNOWN VERSION %u,
24531##>>>35		lelong		0		version 0,
24532>>>35		lelong		0
24533>>>>39		ubyte		1		mono,
24534>>>>39		ubyte		2		stereo,
24535>>>>39		ubyte		>2		%u channels,
24536>>>>40		lelong		x		%u Hz
24537# Minimal, nominal and maximal bitrates specified when encoding
24538>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
24539# The above tests if at least one of these is specified:
24540>>>>>52		lelong		!-1
24541# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
24542# instead of -1.
24543# Vorbis 1.0 uses 0 instead of -1.
24544>>>>>>52	lelong		!0
24545>>>>>>>52	lelong		!-1000
24546>>>>>>>>52	lelong		x		<%u
24547>>>>>48		lelong		!-1
24548>>>>>>48	lelong		x		~%u
24549>>>>>44		lelong		!-1
24550>>>>>>44	lelong		!-1000
24551>>>>>>>44	lelong		!0
24552>>>>>>>>44	lelong		x		>%u
24553>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
24554# -- Second vorbis header packet - the comments
24555# A kludge to read the vendor string.  It's a counted string, not a
24556# zero-terminated one, so file(1) can't read it in a generic way.
24557# libVorbis is the only one existing currently, so I detect specifically
24558# it.  The interesting value is the cvs date (8 digits decimal).
24559# Post-RC1 Ogg files have the second header packet (and thus the version)
24560# in a different place, so we must use an indirect offset.
24561>>>(84.b+85)		string		\x03vorbis
24562>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
24563>>>>>(84.b+120)		string		>00000000
24564# Map to beta version numbers:
24565>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
24566>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
24567>>>>>>(84.b+120)	string		>20000508
24568>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
24569>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
24570>>>>>>(84.b+120)	string		>20001031
24571>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
24572>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
24573>>>>>>(84.b+120)	string		>20010225
24574>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
24575>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
24576>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
24577>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
24578>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
24579>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
24580>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
24581# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
24582>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
24583# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
24584>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
24585>>>>>(84.b+117)		string		>00000000
24586>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
24587>>>>>>(84.b+117)	string		20020717	(1.0)
24588>>>>>>(84.b+117)	string		20030909	(1.0.1)
24589>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
24590
24591# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5
24592>>28		string		OpusHead	\b, Opus audio,
24593!:mime		audio/ogg
24594>>>36		ubyte		>0x0F		UNKNOWN VERSION %u,
24595>>>36		ubyte		&0x0F		version 0.%d
24596>>>>46		ubyte		>1
24597>>>>>46		ubyte		!255		unknown channel mapping family %u,
24598>>>>>37		ubyte		x		%u channels
24599>>>>46		ubyte		0
24600>>>>>37		ubyte		1		mono
24601>>>>>37		ubyte		2		stereo
24602>>>>46		ubyte		1
24603>>>>>37		ubyte		1		mono
24604>>>>>37		ubyte		2		stereo
24605>>>>>37		ubyte		3		linear surround
24606>>>>>37		ubyte		4		quadraphonic
24607>>>>>37		ubyte		5		5.0 surround
24608>>>>>37		ubyte		6		5.1 surround
24609>>>>>37		ubyte		7		6.1 surround
24610>>>>>37		ubyte		8		7.1 surround
24611>>>>40		lelong		!0		\b, %u Hz
24612
24613#------------------------------------------------------------------------------
24614# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
24615# VXL: file(1) magic for VXL binary IO data files
24616#
24617# from Ian Scott <scottim@sf.net>
24618#
24619# VXL is a collection of C++ libraries for Computer Vision.
24620# See the vsl chapter in the VXL Book for more info
24621# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
24622# http:/vxl.sf.net
24623
246242	lelong	0x472b2c4e	VXL data file,
24625>0	leshort	>0		schema version no %d
24626
24627#------------------------------------------------------------------------------
24628# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $
24629# warc:  file(1) magic for WARC files
24630
246310	string	WARC/	WARC Archive
24632>5	string	x	version %.4s
24633!:mime application/warc
24634
24635#------------------------------------------------------------------------------
24636# Arc File Format from Internet Archive
24637# see http://www.archive.org/web/researcher/ArcFileFormat.php
246380      string          filedesc://     Internet Archive File
24639!:mime application/x-ia-arc
24640>11    search/256      \x0A    \b
24641>>&0   ubyte   >0      \b version %c
24642
24643#------------------------------------------------------------------------------
24644# weak:  file(1) magic for very weak magic entries, disabled by default
24645#
24646# These entries are so weak that they might interfere identification of
24647# other formats. Example include:
24648# - Only identify for 1 or 2 bytes
24649# - Match against very wide range of values
24650# - Match against generic word in some spoken languages (e.g. English)
24651
24652# Summary: Computer Graphics Metafile
24653# Extension: .cgm
24654#0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
24655#0	beshort		0x3020		character Computer Graphics Metafile
24656
24657#0	string		=!!		Bennet Yee's "face" format
24658#------------------------------------------------------------------------------
24659# $File: webassembly,v 1.2 2017/05/02 14:05:29 christos Exp $
24660# webassembly:  file(1) magic for WebAssembly modules
24661#
24662# WebAssembly is a virtual architecture developed by a W3C Community
24663# Group at http://webassembly.org/. The file extension is .wasm, and
24664# the MIME type is application/wasm.
24665#
24666# http://webassembly.org/docs/binary-encoding/ is the main
24667# document describing the binary format.
24668# From: Pip Cet <pipcet@gmail.com> and Joel Martin
24669
246700	string	\0asm	WebAssembly (wasm) binary module
24671>4	lelong	=1	version %#x (MVP)
24672>4	lelong	>1	version %#x
24673
24674#------------------------------------------------------------------------------
24675# $File: windows,v 1.16 2017/03/17 22:20:22 christos Exp $
24676# windows:  file(1) magic for Microsoft Windows
24677#
24678# This file is mainly reserved for files where programs
24679# using them are run almost always on MS Windows 3.x or
24680# above, or files only used exclusively in Windows OS,
24681# where there is no better category to allocate for.
24682# For example, even though WinZIP almost run on Windows
24683# only, it is better to treat them as "archive" instead.
24684# For format usable in DOS, such as generic executable
24685# format, please specify under "msdos" file.
24686#
24687
24688
24689# Summary: Outlook Express DBX file
24690# Extension: .dbx
24691# Created by: Christophe Monniez
246920	string	\xCF\xAD\x12\xFE	MS Outlook Express DBX file
24693>4	byte	=0xC5			\b, message database
24694>4	byte	=0xC6			\b, folder database
24695>4	byte	=0xC7			\b, account information
24696>4	byte	=0x30			\b, offline database
24697
24698
24699# Summary: Windows crash dump
24700# Extension: .dmp
24701# Created by: Andreas Schuster (http://computer.forensikblog.de/)
24702# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
24703# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
247040	string		PAGE
24705>4	string		DUMP		MS Windows 32bit crash dump
24706>>0x05c	byte            0		\b, no PAE
24707>>0x05c	byte            1		\b, PAE
24708>>0xf88	lelong		1		\b, full dump
24709>>0xf88	lelong		2		\b, kernel dump
24710>>0xf88	lelong		3		\b, small dump
24711>>0x068	lelong		x		\b, %d pages
24712>4	string		DU64		MS Windows 64bit crash dump
24713>>0xf98	lelong		1		\b, full dump
24714>>0xf98	lelong		2		\b, kernel dump
24715>>0xf98	lelong		3		\b, small dump
24716>>0x090	lequad		x		\b, %lld pages
24717
24718
24719# Summary: Vista Event Log
24720# Extension: .evtx
24721# Created by: Andreas Schuster (http://computer.forensikblog.de/)
24722# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
247230	string		ElfFile\0	MS Windows Vista Event Log
24724>0x2a	leshort		x		\b, %d chunks
24725>>0x10	lelong		x		\b (no. %d in use)
24726>0x18	lelong		>1		\b, next record no. %d
24727>0x18	lelong		=1		\b, empty
24728>0x78	lelong		&1		\b, DIRTY
24729>0x78	lelong		&2		\b, FULL
24730
24731
24732# Summary: Windows 3.1 group files
24733# Extension: .grp
24734# Created by: unknown
247350	string		\120\115\103\103	MS Windows 3.1 group files
24736
24737
24738# Summary: Old format help files
24739# URL: https://en.wikipedia.org/wiki/WinHelp
24740# Reference: http://www.oocities.org/mwinterhoff/helpfile.htm
24741# Update: Joerg Jenderek
24742# Created by: Dirk Jagdmann <doj@cubic.org>
24743#
24744# check and then display version and date inside MS Windows HeLP file fragment
247450	name				help-ver-date
24746# look for Magic of SYSTEMHEADER
24747>0	leshort		0x036C
24748# version Major		1 for right file fragment
24749>>4	leshort		1		Windows
24750# print non empty string above to avoid error message
24751# Warning: Current entry does not yet have a description for adding a MIME type
24752!:mime	application/winhelp
24753!:ext	hlp
24754# version Minor of help file format is hint for windows version
24755>>>2	leshort		0x0F		3.x
24756>>>2	leshort		0x15		3.0
24757>>>2	leshort		0x21		3.1
24758>>>2	leshort		0x27		x.y
24759>>>2	leshort		0x33		95
24760>>>2	default		x		y.z
24761>>>>2	leshort		x		0x%x
24762# to complete message string like "MS Windows 3.x help file"
24763>>>2	leshort		x		help
24764# GenDate often older than file creation date
24765>>>6	ldate		x		\b, %s
24766#
24767# Magic for HeLP files
247680	lelong		0x00035f3f
24769# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file"
24770# file header magic 0x293B at DirectoryStart+9
24771>(4.l+9)	uleshort	0x293B		MS
24772# look for @VERSION	bmf.. like IBMAVW.ANN
24773>>0xD4		string	=\x62\x6D\x66\x01\x00	Windows help annotation
24774!:mime	application/x-winhelp
24775!:ext	ann
24776>>0xD4		string	!\x62\x6D\x66\x01\x00
24777# "GID Help index" by TrID
24778>>>(4.l+0x65)	string	=|Pete			Windows help Global Index
24779!:mime	application/x-winhelp
24780!:ext	gid
24781# HeLP Bookmark or
24782# "Windows HELP File" by TrID
24783>>>(4.l+0x65)		string		!|Pete
24784# maybe there exist a cleaner way to detect HeLP fragments
24785# brute search for Magic 0x036C with matching Major maximal 7 iterations
24786# discapp.hlp
24787>>>>16			search/0x49AF/s	\x6c\x03
24788>>>>>&0			use 		help-ver-date
24789>>>>>&4			leshort		!1
24790# putty.hlp
24791>>>>>>&0		search/0x69AF/s	\x6c\x03
24792>>>>>>>&0		use 		help-ver-date
24793>>>>>>>&4		leshort		!1
24794>>>>>>>>&0		search/0x49AF/s	\x6c\x03
24795>>>>>>>>>&0		use 		help-ver-date
24796>>>>>>>>>&4		leshort		!1
24797>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
24798>>>>>>>>>>>&0		use 		help-ver-date
24799>>>>>>>>>>>&4		leshort		!1
24800>>>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
24801>>>>>>>>>>>>>&0		use 		help-ver-date
24802>>>>>>>>>>>>>&4		leshort		!1
24803>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
24804>>>>>>>>>>>>>>>&0	use 		help-ver-date
24805>>>>>>>>>>>>>>>&4	leshort		!1
24806>>>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
24807# GCC.HLP is detected after 7 iterations
24808>>>>>>>>>>>>>>>>>&0	use 		help-ver-date
24809# this only happens if bigger hlp file is detected after used search iterations
24810>>>>>>>>>>>>>>>>>&4	leshort		!1		Windows y.z help
24811!:mime	application/winhelp
24812!:ext	hlp
24813# repeat search again or following default line does not work
24814>>>>16			search/0x49AF/s	\x6c\x03
24815# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
24816>>>>16	default				x	Windows help Bookmark
24817!:mime	application/x-winhelp
24818!:ext	/bmk
24819## FirstFreeBlock normally FFFFFFFFh 10h for *ANN
24820##>>8	lelong			x		\b, FirstFreeBlock 0x%8.8x
24821# EntireFileSize
24822>>12	lelong			x		\b, %d bytes
24823## ReservedSpace normally 042Fh AFh for *.ANN
24824#>>(4.l)	lelong		x		\b, ReservedSpace 0x%8.8x
24825## UsedSpace normally 0426h A6h for *.ANN
24826#>>(4.l+4)	lelong		x		\b, UsedSpace 0x%8.8x
24827## FileFlags normally 04...
24828#>>(4.l+5)	lelong		x		\b, FileFlags 0x%8.8x
24829## file header magic 0x293B
24830#>>(4.l+9)	uleshort	x		\b, file header magic 0x%4.4x
24831## file header Flags		0x0402
24832#>>(4.l+11)	uleshort	x		\b, file header Flags 0x%4.4x
24833## file header PageSize	0400h 80h for *.ANN
24834#>>(4.l+13)	uleshort	x		\b, PageSize 0x%4.4x
24835## Structure[16]		z4
24836#>>(4.l+15)	string		>\0		\b, Structure_"%-.16s"
24837## MustBeZero			0
24838#>>(4.l+31)	uleshort	x		\b, MustBeZero 0x%4.4x
24839## PageSplits
24840#>>(4.l+33)	uleshort	x		\b, PageSplits 0x%4.4x
24841## RootPage
24842#>>(4.l+35)	uleshort	x		\b, RootPage 0x%4.4x
24843## MustBeNegOne			0xffff
24844#>>(4.l+37)	uleshort	x		\b, MustBeNegOne 0x%4.4x
24845## TotalPages			1
24846#>>(4.l+39)	uleshort	x		\b, TotalPages 0x%4.4x
24847## NLevels			0x0001
24848#>>(4.l+41)	uleshort	x		\b, NLevels 0x%4.4x
24849## TotalBtreeEntries
24850#>>(4.l+43)	ulelong		x		\b, TotalBtreeEntries 0x%8.8x
24851## pages of the B+ tree
24852#>>(4.l+47)	ubequad		x		\b, PageStart 0x%16.16llx
24853
24854# start with colon or semicolon for comment line like Back2Life.cnt
248550		regex		\^(:|;)
24856# look for first keyword Base
24857>0		search/45	:Base
24858>>&0				use 		cnt-name
24859# only solution to search again from beginning , because relative offsets changes when use is called
24860>0		search/45	:Base
24861>0		default		x
24862# look for other keyword Title like in putty.cnt
24863>>0		search/45	:Title
24864>>>&0				use 		cnt-name
24865#
24866# display mime type and name of Windows help Content source
248670	name				cnt-name
24868# skip space at beginning
24869>0     string		\040
24870# name without extension and greater character or name with hlp extension
24871>>1	regex/c		\^([^\xd>]*|.*\.hlp)	MS Windows help file Content, based "%s"
24872!:mime	text/plain
24873!:apple	????TEXT
24874!:ext	cnt
24875#
24876# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
248770	string		tfMR			MS Windows help Full Text Search index
24878!:mime application/x-winhelp-fts
24879!:ext	fts
24880>16	string		>\0			for "%s"
24881
24882# Summary: Hyper terminal
24883# Extension: .ht
24884# Created by: unknown
248850	string		HyperTerminal\040
24886>15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile
24887
24888# http://ithreats.files.wordpress.com/2009/05/\040
24889# lnk_the_windows_shortcut_file_format.pdf
24890# Summary: Windows shortcut
24891# Extension: .lnk
24892# Created by: unknown
24893# 'L' + GUUID
248940	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
24895>20	lelong&1	1	\b, Item id list present
24896>20	lelong&2	2	\b, Points to a file or directory
24897>20	lelong&4	4	\b, Has Description string
24898>20	lelong&8	8	\b, Has Relative path
24899>20	lelong&16	16	\b, Has Working directory
24900>20	lelong&32	32	\b, Has command line arguments
24901>20	lelong&64	64	\b, Icon
24902>>56	lelong		x	\b number=%d
24903>24	lelong&1	1	\b, Read-Only
24904>24	lelong&2	2	\b, Hidden
24905>24	lelong&4	4	\b, System
24906>24	lelong&8	8	\b, Volume Label
24907>24	lelong&16	16	\b, Directory
24908>24	lelong&32	32	\b, Archive
24909>24	lelong&64	64	\b, Encrypted
24910>24	lelong&128	128	\b, Normal
24911>24	lelong&256	256	\b, Temporary
24912>24	lelong&512	512	\b, Sparse
24913>24	lelong&1024	1024	\b, Reparse point
24914>24	lelong&2048	2048	\b, Compressed
24915>24	lelong&4096	4096	\b, Offline
24916>28	leqwdate	x	\b, ctime=%s
24917>36	leqwdate	x	\b, mtime=%s
24918>44	leqwdate	x	\b, atime=%s
24919>52	lelong		x	\b, length=%u, window=
24920>60	lelong&1	1	\bhide
24921>60	lelong&2	2	\bnormal
24922>60	lelong&4	4	\bshowminimized
24923>60	lelong&8	8	\bshowmaximized
24924>60	lelong&16	16	\bshownoactivate
24925>60	lelong&32	32	\bminimize
24926>60	lelong&64	64	\bshowminnoactive
24927>60	lelong&128	128	\bshowna
24928>60	lelong&256	256	\brestore
24929>60	lelong&512	512	\bshowdefault
24930#>20	lelong&1	0
24931#>>20	lelong&2	2
24932#>>>(72.l-64)	pstring/h	x	\b [%s]
24933#>20	lelong&1	1
24934#>>20	lelong&2	2
24935#>>>(72.s)	leshort	x
24936#>>>&75	pstring/h	x	\b [%s]
24937
24938# Summary: Outlook Personal Folders
24939# Created by: unknown
249400	lelong		0x4E444221	Microsoft Outlook email folder
24941>10	leshort		0x0e		(<=2002)
24942>10	leshort		0x17		(>=2003)
24943
24944
24945# Summary: Windows help cache
24946# Created by: unknown
249470	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
24948
24949
24950# Summary: IE cache file
24951# Created by: Christophe Monniez
249520	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
24953>20	string	>\0			version %s
24954
24955
24956# Summary: Registry files
24957# Created by: unknown
24958# Modified by (1): Joerg Jenderek
249590	string		regf		MS Windows registry file, NT/2000 or above
249600	string		CREG		MS Windows 95/98/ME registry file
249610	string		SHCC3		MS Windows 3.1 registry file
24962
24963
24964# Summary: Windows Registry text
24965# Extension: .reg
24966# Submitted by: Abel Cheung <abelcheung@gmail.com>
249670	string		REGEDIT4\r\n\r\n	Windows Registry text (Win95 or above)
249680	string		Windows\ Registry\ Editor\040
24969>&0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
24970
24971# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013
24972# empty ,comment , section
24973# PR/383: remove unicode BOM because it is not portable across regex impls
249740	regex/s		\\`(\\r\\n|;|[[])
24975# left bracket in section line
24976>&0	search/8192	[
24977# http://en.wikipedia.org/wiki/Autorun.inf
24978# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
24979>>&0	regex/c		\^(autorun)]\r\n
24980>>>&0	ubyte		=0x5b						INItialization configuration
24981!:mime application/x-wine-extension-ini
24982# From: Pal Tamas <folti@balabit.hu>
24983# Autorun File
24984>>>&0	ubyte		!0x5b						Microsoft Windows Autorun file
24985!:mime application/x-setupscript
24986# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
24987# version strings ASCII coded case-independent for Windows setup information script file
24988>>&0	regex/c		\^(version|strings)]				Windows setup INFormation
24989!:mime	application/x-setupscript
24990#!:mime application/inf
24991#!:mime application/x-wine-extension-inf
24992>>&0	regex/c		\^(WinsockCRCList|OEMCPL)]			Windows setup INFormation
24993!:mime	text/inf
24994# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
24995# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
24996# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
24997>>&0	regex/c	\^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)]	Windows desktop.ini
24998!:mime application/x-wine-extension-ini
24999#!:mime text/plain
25000# http://support.microsoft.com/kb/84709/
25001>>&0	regex/c		\^(don't\ load)]				Windows CONTROL.INI
25002!:mime application/x-wine-extension-ini
25003>>&0	regex/c		\^(ndishlp\\$|protman\\$|NETBEUI\\$)]		Windows PROTOCOL.INI
25004!:mime application/x-wine-extension-ini
25005# http://technet.microsoft.com/en-us/library/cc722567.aspx
25006# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
25007>>&0	regex/c		\^(windows|Compatibility|embedding)]		Windows WIN.INI
25008!:mime application/x-wine-extension-ini
25009# http://en.wikipedia.org/wiki/SYSTEM.INI
25010>>&0	regex/c		\^(boot|386enh|drivers)]			Windows SYSTEM.INI
25011!:mime application/x-wine-extension-ini
25012# http://www.mdgx.com/newtip6.htm
25013>>&0	regex/c		\^(SafeList)]					Windows IOS.INI
25014!:mime application/x-wine-extension-ini
25015# http://en.wikipedia.org/wiki/NTLDR	Windows Boot Loader information
25016>>&0	regex/c		\^(boot\x20loader)]				Windows boot.ini
25017!:mime application/x-wine-extension-ini
25018>>>&0	ubyte		x
25019# http://en.wikipedia.org/wiki/CONFIG.SYS
25020>>&0	regex/c		\^(menu)]\r\n					MS-DOS CONFIG.SYS
25021# http://support.microsoft.com/kb/118579/
25022>>&0	regex/c		\^(Paths)]\r\n					MS-DOS MSDOS.SYS
25023# VERS string unicoded case-independent
25024>>&0	ubequad&0xFFdfFFdfFFdfFFdf	0x0056004500520053
25025# ION] string unicoded case-independent
25026>>>&0	ubequad&0xFFdfFFdfFFdfFFff	0x0049004f004e005d		Windows setup INFormation
25027!:mime application/x-setupscript
25028# STRI string unicoded case-independent
25029>>&0	ubequad&0xFFdfFFdfFFdfFFdf	0x0053005400520049
25030# NGS] string unicoded case-independent
25031>>>&0	ubequad&0xFFdfFFdfFFdfFFff	0x004e00470053005D		Windows setup INFormation
25032!:mime application/x-setupscript
25033# unknown keyword after opening bracket
25034>>&0	default				x
25035>>>&0	search/8192			[
25036# version Strings FileIdentification
25037>>>>&0	string/c			version				Windows setup INFormation
25038!:mime application/x-setupscript
25039# VERS string unicoded case-independent
25040>>>>&0	ubequad&0xFFdfFFdfFFdfFFdf	0x0056004500520053
25041# ION] string unicoded case-independent
25042>>>>>&0	ubequad&0xFFdfFFdfFFdfFFff	0x0049004f004e005d		Windows setup INFormation
25043!:mime application/x-setupscript
25044# http://en.wikipedia.org/wiki/Initialization_file	Windows Initialization File or other
25045#>>>>&0	default				x				Generic INItialization configuration
25046#!:mime application/x-wine-extension-ini
25047
25048# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
25049# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
25050# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
250510		leshort&0xFeFe	0x0000
25052!:strength -5
25053# test for unused null bits in PNF_FLAGs
25054>4	ulelong&0xFCffFe00	0x00000000
25055# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
25056>>68		ulelong		>0x57
25057# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
25058# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
25059>>>(68.l-1)	ubelong&0xffE0C519	=0x00400018	Windows Precompiled iNF
25060!:mime	application/x-pnf
25061# currently only found Major Version=1 and Minor Version=1
25062#>>>>0		uleshort	=0x0101
25063#>>>>>1		ubyte		x		\b, version %u
25064#>>>>>0		ubyte		x		\b.%u
25065>>>>0		uleshort	!0x0101
25066>>>>>1		ubyte		x		\b, version %u
25067>>>>>0		ubyte		x		\b.%u
25068# 1 ,2 (windows 98 SE)
25069#>>>>2		uleshort	=2		\b, InfStyle %u
25070>>>>2		uleshort	!2		\b, InfStyle %u
25071#	PNF_FLAG_IS_UNICODE		0x00000001
25072#	PNF_FLAG_HAS_STRINGS		0x00000002
25073#	PNF_FLAG_SRCPATH_IS_URL		0x00000004
25074#	PNF_FLAG_HAS_VOLATILE_DIRIDS	0x00000008
25075#	PNF_FLAG_INF_VERIFIED		0x00000010
25076#	PNF_FLAG_INF_DIGITALLY_SIGNED	0x00000020
25077#	??				0x00000100
25078#	??				0x01000000
25079#	??				0x02000000
25080>>>>4	ulelong&0x00000001	0x00000001	\b, unicoded
25081>>>>4	ulelong&0x00000020	0x00000020	\b, digitally signed
25082#>>>>8		ulelong		x		\b, InfSubstValueListOffset 0x%x
25083# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
25084#>>>>12		uleshort	x		\b, InfSubstValueCount 0x%x
25085# only < 9 found
25086#>>>>14		uleshort	x		\b, InfVersionDatumCount 0x%x
25087# only found values lower 0x0000ffff
25088#>>>>16		ulelong		x		\b, InfVersionDataSize 0x%x
25089# only found positive values lower 0x00ffFFff for InfVersionDataOffset
25090>>>>20		ulelong		x		\b, at 0x%x
25091>>>>4	ulelong&0x00000001	=0x00000001
25092# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
25093>>>>>(20.l)	lestring16	x		"%s"
25094>>>>4	ulelong&0x00000001	!0x00000001
25095>>>>>(20.l)	string		x		"%s"
25096# FILETIME is number of 100-nanosecond intervals since 1 January 1601
25097#>>>>24		ulequad		x		\b, InfVersionLastWriteTime %16.16llx
25098# only found values lower 0x00ffFFff
25099#>>>>32		ulelong		x		\b, StringTableBlockOffset 0x%x
25100#>>>>36		ulelong		x		\b, StringTableBlockSize 0x%x
25101#>>>>40		ulelong		x		\b, InfSectionCount 0x%x
25102#>>>>44		ulelong		x		\b, InfSectionBlockOffset 0x%x
25103#>>>>48		ulelong		x		\b, InfSectionBlockSize 0x%x
25104#>>>>52		ulelong		x		\b, InfLineBlockOffset 0x%x
25105#>>>>56		ulelong		x		\b, InfLineBlockSize 0x%x
25106#>>>>60		ulelong		x		\b, InfValueBlockOffset 0x%x
25107#>>>>64		ulelong		x		\b, InfValueBlockSize 0x%x
25108# WinDirPathOffset
25109#>>>>68		ulelong		x		\b, at 0x%x
25110>>>>68		ulelong		>0x57
25111>>>>>4	ulelong&0x00000001	=0x00000001
25112>>>>>>(68.l)	ubequad		=0x43003a005c005700
25113# normally unicoded C:\Windows
25114#>>>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
25115>>>>>>(68.l)	ubequad		!0x43003a005c005700
25116>>>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
25117>>>>>4	ulelong&0x00000001	!0x00000001
25118# normally ASCII C:\WINDOWS
25119#>>>>>>(68.l)	string		=C:\\WINDOWS	\b, WinDirPath "%s"
25120>>>>>>(68.l)	string		!C:\\WINDOWS	\b, WinDirPath "%s"
25121# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
25122#>>>>72		ulelong		>0		\b, at 0x%x
25123>>>>72		ulelong		>0		\b,
25124>>>>>4	ulelong&0x00000001	=0x00000001
25125>>>>>>(72.l)	lestring16	x		OsLoaderPath "%s"
25126>>>>>4	ulelong&0x00000001	!0x00000001
25127# seldom C:\ instead empty
25128>>>>>>(72.l)	string		x		OsLoaderPath "%s"
25129# 1fdh
25130#>>>>76		uleshort	x		\b, StringTableHashBucketCount 0x%x
25131>>>>78		uleshort	!0x407		\b, LanguageId %x
25132# only 407h found
25133#>>>>78		uleshort	=0x407		\b, LanguageId %x
25134# InfSourcePathOffset often 0
25135#>>>>80		ulelong		>0		\b, at 0x%x
25136>>>>80		ulelong		>0		\b,
25137>>>>>4	ulelong&0x00000001	=0x00000001
25138>>>>>>(80.l)	lestring16	x		SourcePath "%s"
25139>>>>>4	ulelong&0x00000001	!0x00000001
25140>>>>>>(80.l)	string		>\0		SourcePath "%s"
25141# OriginalInfNameOffset often 0
25142#>>>>84		ulelong		>0		\b, at 0x%x
25143>>>>84		ulelong		>0		\b,
25144>>>>>4	ulelong&0x00000001	=0x00000001
25145>>>>>>(84.l)	lestring16	x		InfName "%s"
25146>>>>>4	ulelong&0x00000001	!0x00000001
25147>>>>>>(84.l)	string		>\0		InfName "%s"
25148
25149# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
25150# Extension: .bkf
25151# Created by: Joerg Jenderek
25152# URL: http://en.wikipedia.org/wiki/NTBackup
25153# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
25154# Descriptor BloCK name of Microsoft Tape Format
251550	string			TAPE
25156# Format Logical Address is zero
25157>20	ulequad			0
25158# Reserved for MBC is zero
25159>>28	uleshort		0
25160# Control Block ID is zero
25161>>>36	ulelong			0
25162# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
25163>>>>4	ulelong&0xFFfcFFe0	0		Windows NTbackup archive
25164#!:mime application/x-ntbackup
25165!:ext bkf
25166# OS ID
25167>>>>>10	ubyte			1		\b NetWare
25168>>>>>10	ubyte			13		\b NetWare SMS
25169>>>>>10	ubyte			14		\b NT
25170>>>>>10	ubyte			24		\b 3
25171>>>>>10	ubyte			25		\b OS/2
25172>>>>>10	ubyte			26		\b 95
25173>>>>>10	ubyte			27		\b Macintosh
25174>>>>>10	ubyte			28		\b UNIX
25175# OS Version (2)
25176#>>>>>11	ubyte			x		OS V=%x
25177# MTF_CONTINUATION	Media Sequence Number > 1
25178#>>>>>4	ulelong&0x00000001	!0		\b, continued
25179# MTF_COMPRESSION
25180>>>>>4	ulelong&0x00000004	!0		\b, compressed
25181# MTF_EOS_AT_EOM	End Of Medium was hit during end of set processing
25182>>>>>4	ulelong&0x00000008	!0		\b, End Of Medium hit
25183>>>>>4	ulelong&0x00020000	0
25184# MTF_SET_MAP_EXISTS	A Media Based Catalog Set Map may exist on tape
25185>>>>>>4	ulelong&0x00010000	!0		\b, with catalog
25186# MTF_FDD_ALLOWED	However File/Directory Detail can only exist if a Set Map is also present
25187>>>>>4	ulelong&0x00020000	!0		\b, with file catalog
25188# Offset To First Event 238h,240h,28Ch
25189#>>>>>8	uleshort		x		\b, event offset %4.4x
25190# Displayable Size (20e0230h 20e024ch 20e0224h)
25191#>>>>>8	ulequad			x		dis. size %16.16llx
25192# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h)
25193#>>>>>52	ulelong			x		family ID %8.8x
25194# TAPE Attributes (3)
25195#>>>>>56	ulelong			x		TAPE %8.8x
25196# Media Sequence Number
25197>>>>>60	uleshort		>1		\b, sequence %u
25198# Password Encryption Algorithm (3)
25199>>>>>62	uleshort		>0		\b, 0x%x encrypted
25200# Soft Filemark Block Size * 512 (2)
25201#>>>>>64	uleshort		=2		\b, soft size %u*512
25202>>>>>64	uleshort		!2		\b, soft size %u*512
25203# Media Based Catalog Type (1,2)
25204#>>>>>66	uleshort		x		\b, catalog type %4.4x
25205# size of Media Name (66,68,6Eh)
25206>>>>>68	uleshort		>0
25207# offset of Media Name (5Eh)
25208>>>>>>70	uleshort	>0
25209# 0~, 1~ANSI, 2~UNICODE
25210>>>>>>>48	ubyte		1
25211# size terminated ansi coded string normally followed by "MTF Media Label"
25212>>>>>>>>(70.s)	string		>\0		\b, name: %s
25213>>>>>>>48	ubyte		2
25214# Not null, but size terminated unicoded string
25215>>>>>>>>(70.s)	lestring16	x		\b, name: %s
25216# size of Media Label (104h)
25217>>>>>72	uleshort		>0
25218# offset of Media Label (C4h,C6h,CCh)
25219>>>>>74		uleshort	>0
25220>>>>>>48	ubyte		1
25221#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
25222>>>>>>>(74.s)	string		>\0		\b, label: %s
25223>>>>>>48	ubyte		2
25224>>>>>>>(74.s)	lestring16	x		\b, label: %s
25225# size of password name (0,1Ch)
25226#>>>>>76	uleshort		>0		\b, password size %4.4x
25227# Software Vendor ID (CBEh)
25228>>>>>86	uleshort		x		\b, software (0x%x)
25229# size of Software Name (6Eh)
25230>>>>>80	uleshort		>0
25231# offset of Software Name (1C8h,1CAh,1D0h)
25232>>>>>>82	uleshort	>0
25233# 1~ANSI, 2~UNICODE
25234>>>>>>>48	ubyte		1
25235>>>>>>>>(82.s)	string		>\0		\b: %s
25236>>>>>>>48	ubyte		2
25237# size terminated unicoded coded string normally followed by "SPAD"
25238>>>>>>>>(82.s)	lestring16	x		\b: %s
25239# Format Logical Block Size (512,1024)
25240#>>>>>84	uleshort		=1024		\b, block size %u
25241>>>>>84	uleshort		!1024		\b, block size %u
25242# Media Date of MTF_DATE_TIME type with 5 bytes
25243#>>>>>>88	ubequad			x		DATE %16.16llx
25244# MTF Major Version (1)
25245#>>>>>>93	ubyte		x		\b, MFT version %x
25246#
25247
25248
25249#------------------------------------------------------------------------------
25250# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
25251# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
25252#
252530	string	RGDB	CRDA wireless regulatory database file
25254>4	belong	19	(Version 1)
25255
25256#------------------------------------------------------------------------------
25257# $File: wordprocessors,v 1.19 2015/10/16 15:11:07 christos Exp $
25258# wordprocessors:  file(1) magic fo word processors.
25259#
25260####### PWP file format used on Smith Corona Personal Word Processors:
252612	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040'92	Smith Corona PWP
25262>24	byte	2	\b, single spaced
25263>24	byte	3	\b, 1.5 spaced
25264>24	byte	4	\b, double spaced
25265>25	byte	0x42	\b, letter
25266>25	byte	0x54	\b, legal
25267>26	byte	0x46	\b, A4
25268
25269# Corel/WordPerfect
252700	string	\xffWPC
25271# WordPerfect
25272>8	byte	1
25273>>9	byte	1	WordPerfect macro
25274>>9	byte	2	WordPerfect help file
25275>>9	byte	3	WordPerfect keyboard file
25276>>9	byte	10	WordPerfect document
25277>>9	byte	11	WordPerfect dictionary
25278>>9	byte	12	WordPerfect thesaurus
25279>>9	byte	13	WordPerfect block
25280>>9	byte	14	WordPerfect rectangular block
25281>>9	byte	15	WordPerfect column block
25282>>9	byte	16	WordPerfect printer data
25283>>9	byte	19	WordPerfect printer data
25284>>9	byte	20	WordPerfect driver resource data
25285>>9	byte	22	WordPerfect graphic image
25286>>9	byte	23	WordPerfect hyphenation code
25287>>9	byte	24	WordPerfect hyphenation data
25288>>9	byte	25	WordPerfect macro resource data
25289>>9	byte	27	WordPerfect hyphenation lex
25290>>9	byte	29	WordPerfect wordlist
25291>>9	byte	30	WordPerfect equation resource data
25292>>9	byte	33	WordPerfect spell rules
25293>>9	byte	34	WordPerfect dictionary rules
25294>>9	byte	39	WordPerfect spell rules (Microlytics)
25295>>9	byte	43	WordPerfect settings file
25296>>9	byte	44	WordPerfect 3.5 document
25297>>9	byte	45	WordPerfect 4.2 document
25298>>9	byte	69	WordPerfect dialog file
25299>>9	byte	76	WordPerfect button bar
25300>>9	default x
25301>>>9	byte	x	Corel WordPerfect: Unknown filetype %d
25302# Corel Shell
25303>8	byte	2
25304>>9	byte	1	Corel shell macro
25305>>9	byte	10	Corel shell definition
25306>>9	default x
25307>>>9	byte	x	Corel Shell: Unknown filetype %d
25308# Corel Notebook
25309>8	byte	3
25310>>9	byte	1	Corel Notebook macro
25311>>9	byte	2	Corel Notebook help file
25312>>9	byte	3	Corel Notebook keyboard file
25313>>9	byte	10	Corel Notebook definition
25314>>9	default	x
25315>>>9	byte	x	Corel Notebook: Unknown filetype %d
25316# Corel Calculator
25317>8	byte	4
25318>>9	byte	2	Corel Calculator help file
25319>>9	default	x
25320>>>9	byte	x	Corel Calculator: Unknown filetype %d
25321# Corel File Manager
25322>8	byte	5
25323>>9	default	x
25324>>>9	byte	x	Corel File Manager: Unknown filetype %d
25325# Corel Calendar
25326>8	byte	6
25327>>9	byte 	2	Corel Calendar help file
25328>>9	byte 	10	Corel Calendar data file
25329>>9	default	x
25330>>>9	byte	x	Corel Calendar: Unknown filetype %d
25331# Corel Program Editor/Ed Editor
25332>8	byte	7
25333>>9	byte	1	Corel Editor macro
25334>>9	byte	2	Corel Editor help file
25335>>9	byte	3	Corel Editor keyboard file
25336>>9	byte	25	Corel Editor macro resource file
25337>>9	default	x
25338>>>9	byte	x	Corel Program Editor/Ed Editor: Unknown filetype %d
25339# Corel Macro Editor
25340>8	byte	8
25341>>9	byte 	1	Corel Macro editor macro
25342>>9	byte 	2	Corel Macro editor help file
25343>>9	byte	3	Corel Macro editor keyboard file
25344>>9	default	x
25345>>>9	byte	x	Corel Macro Editor: Unknown filetype %d
25346# Corel Plan Perfect
25347>8	byte	9
25348>>9	default	x
25349>>>9	byte	x	Corel Plan Perfect: Unknown filetype %d
25350# Corel DataPerfect
25351>8	byte	10
25352# CHECK: Don't these belong into product 9?
25353>>9	byte	1	Corel PlanPerfect macro
25354>>9	byte	2	Corel PlanPerfect help file
25355>>9	byte	3	Corel PlanPerfect keyboard file
25356>>9	byte	10	Corel PlanPerfect worksheet
25357>>9	byte	15	Corel PlanPerfect printer definition
25358>>9	byte	18	Corel PlanPerfect graphic definition
25359>>9	byte	19	Corel PlanPerfect data
25360>>9	byte	20	Corel PlanPerfect temporary printer
25361>>9	byte	25	Corel PlanPerfect macro resource data
25362>>9	default	x
25363>>>9	byte	x	Corel DataPerfect: Unknown filetype %d
25364# Corel Mail
25365>8	byte	11
25366>>9	byte	2	Corel Mail help file
25367>>9	byte	5	Corel Mail distribution list
25368>>9	byte	10	Corel Mail out box
25369>>9	byte	11	Corel Mail in box
25370>>9	byte	20	Corel Mail users archived mailbox
25371>>9	byte	21	Corel Mail archived message database
25372>>9	byte	22	Corel Mail archived attachments
25373>>9	default	x
25374>>>9	byte	x	Corel Mail: Unknown filetype %d
25375# Corel Printer
25376>8	byte	12
25377>>9	byte	11	Corel Printer temporary file
25378>>9	default	x
25379>>>9	byte	x	Corel Printer: Unknown filetype %d
25380# Corel Scheduler
25381>8	byte	13
25382>>9	byte	2	Corel Scheduler help file
25383>>9	byte	10	Corel Scheduler in file
25384>>9	byte	11	Corel Scheduler out file
25385>>9	default	x
25386>>>9	byte	x	Corel Scheduler: Unknown filetype %d
25387# Corel WordPerfect Office
25388>8	byte	14
25389>>9	byte	10	Corel GroupWise settings file
25390>>9	byte	17	Corel GroupWise directory services
25391>>9	byte	43	Corel GroupWise settings file
25392>>9	default	x
25393>>>9	byte	x	Corel WordPerfect Office: Unknown filetype %d
25394# Corel DrawPerfect
25395>8	byte	15
25396>>9	default	x
25397>>>9	byte	x	Corel DrawPerfect: Unknown filetype %d
25398# Corel LetterPerfect
25399>8	byte	16
25400>>9	default	x
25401>>>9	byte	x	Corel LetterPerfect: Unknown filetype %d
25402# Corel Terminal
25403>8	byte	17
25404>>9	byte	10	Corel Terminal resource data
25405>>9	byte	11	Corel Terminal resource data
25406>>9	byte	43	Corel Terminal resource data
25407>>9	default	x
25408>>>9	byte	x	Corel Terminal: Unknown filetype %d
25409# Corel loadable file
25410>8	byte	18
25411>>9	byte	10	Corel loadable file
25412>>9	byte	11	Corel GUI loadable text
25413>>9	byte	12	Corel graphics resource data
25414>>9	byte	13	Corel printer settings file
25415>>9	byte	14	Corel port definition file
25416>>9	byte	15	Corel print queue parameters
25417>>9	byte	16	Corel compressed file
25418>>9	default	x
25419>>>9	byte	x	Corel loadable file: Unknown filetype %d
25420>>15	byte	0	\b, optimized for Intel
25421>>15	byte	1	\b, optimized for Non-Intel
25422# Network service
25423>8	byte	20
25424>>9	byte	10	Corel Network service msg file
25425>>9	byte	11	Corel Network service msg file
25426>>9	byte	12	Corel Async gateway login msg
25427>>9	byte	14	Corel GroupWise message file
25428>>9	default	x
25429>>>9	byte	x	Corel Network service: Unknown filetype %d
25430# GroupWise
25431>8	byte	31
25432>>9	byte	20	GroupWise admin domain database
25433>>9	byte	21	GroupWise admin host database
25434>>9	byte	23	GroupWise admin remote host database
25435>>9	byte	24	GroupWise admin ADS deferment data file
25436>>9	default	x
25437>>>9	byte	x	GroupWise: Unknown filetype %d
25438# IntelliTAG
25439>8	byte	33
25440>>9	byte	10	IntelliTAG (SGML) compiled DTD
25441>>9	default	x
25442>>>9	byte	x	IntelliTAG: Unknown filetype %d
25443# everything else
25444>8	default x
25445>>8	byte	x	Unknown Corel/Wordperfect product %d,
25446>>>9	byte	x	file type %d
25447>10	byte	0	\b, v5.
25448>10	byte	!0	\b, v%d.
25449>11	byte	x	\b%d
25450
25451# Hangul (Korean) Word Processor File
254520	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
25453# From: Won-Kyu Park <wkpark@kldp.org>
25454512	string		R\0o\0o\0t\0	Hangul (Korean) Word Processor File 2000
25455!:mime	application/x-hwp
25456
25457# CosmicBook, from Benoit Rouits
254580       string  CSBK    Ted Neslson's CosmicBook hypertext file
25459
254602       string  EYWR    AmigaWriter file
25461
25462# chi:  file(1) magic for ChiWriter files
254630       string          \\1cw\          ChiWriter file
25464>5      string          >\0             version %s
254650       string          \\1cw           ChiWriter file
25466
25467# Quark Express from http://www.garykessler.net/library/file_sigs.html
254682	string	IIXPR3			Intel Quark Express Document (English)
254692	string	IIXPRa			Intel Quark Express Document (Korean)
254702	string	MMXPR3			Motorola Quark Express Document (English)
25471!:mime	application/x-quark-xpress-3
254722	string	MMXPRa			Motorola Quark Express Document (Korean)
25473
25474# adobe indesign (document, whatever...) from querkan
254750	belong	0x0606edf5		Adobe InDesign
25476>16	string	DOCUMENT		Document
25477
25478#------------------------------------------------------------------------------
25479# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
25480#
25481# Contributor kenzo-:
25482# Reversed-engineered JS Ichitaro magic numbers
25483#
25484
254850	string		DOC
25486>43	byte		0x14	Just System Word Processor Ichitaro v4
25487!:mime	application/x-ichitaro4
25488>144	string	JDASH		application/x-ichitaro4
25489
254900	string		DOC
25491>43	byte		0x15	Just System Word Processor Ichitaro v5
25492!:mime	application/x-ichitaro5
25493
254940	string		DOC
25495>43	byte		0x16	Just System Word Processor Ichitaro v6
25496!:mime	application/x-ichitaro6
25497
25498# Type: Freemind mindmap documents
25499# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
255000	string/w	\<map\ version	Freemind document
25501!:mime	application/x-freemind
25502
25503# Type: Freeplane mindmap documents
25504# From: Felix Natter <fnatter@gmx.net>
255050       string/w        \<map\ version="freeplane  Freeplane document
25506!:mime  application/x-freeplane
25507
25508# Type:        Scribus
25509# From:        Werner Fink <werner@suse.de>
255100	string	\<SCRIBUSUTF8\ Version		Scribus Document
255110	string	\<SCRIBUSUTF8NEW\ Version	Scribus Document
25512!:mime	application/x-scribus
25513
25514# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
25515# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
255160	ulelong&0x8080FFFF	0x00001204	gfxboot compiled html help file
25517
25518#------------------------------------------------------------------------------
25519# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $
25520# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
25521# Cache format extracted from source:
25522# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
25523# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
25524# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
255250		string		wsdl		PHP WSDL cache,
25526>4		byte		x		version 0x%02x
25527>6		ledate		x		\b, created %s
25528
25529# uri
25530>10		lelong		<0x7fffffff
25531>>10		pstring/l	x		\b, uri: "%s"
25532
25533# source
25534>>>&0		lelong		<0x7fffffff
25535>>>>&-4		pstring/l	x		\b, source: "%s"
25536
25537# target_ns
25538>>>>>&0		lelong		<0x7fffffff
25539>>>>>>&-4	pstring/l	x		\b, target_ns: "%s"
25540#------------------------------------------------------------------------------
25541# x68000:  file(1) magic for the Sharp Home Computer
25542# v1.0
25543# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
25544
25545# Yanagisawa PIC picture
255460	string		PIC
25547>3	search/0x200	\x1A
25548>>&0	search/0x200	\x0
25549>>>&0	ubyte		0		Yanagisawa PIC image file,
25550>>>>&0	ubyte&15	0		model: X68000,
25551>>>>&0	ubyte&15	1		model: PC-88VA,
25552>>>>&0	ubyte&15	2		model: FM-TOWNS,
25553>>>>&0	ubyte&15	3		model: MAC,
25554>>>>&0	ubyte&15	15		model: Generic,
25555>>>>&3	ubeshort	x		%dx
25556>>>>&5	ubeshort	x		\b%d,
25557>>>>&1	ubeshort	4		colors: 16
25558>>>>&1	ubeshort	8		colors: 256
25559>>>>&1	ubeshort	12		colors: 4096
25560>>>>&1	ubeshort	15		colors: 32768
25561>>>>&1	ubeshort	16		colors: 65536
25562>>>>&1	ubeshort	>16		colors: %d-bit
25563
25564
25565
25566#------------------------------------------------------------------------------
25567# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
25568# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
25569#
255700	string	%XDELTA%	XDelta binary patch file 0.14
255710	string	%XDZ000%	XDelta binary patch file 0.18
255720	string	%XDZ001%	XDelta binary patch file 0.20
255730	string	%XDZ002%	XDelta binary patch file 1.0
255740	string	%XDZ003%	XDelta binary patch file 1.0.4
255750	string	%XDZ004%	XDelta binary patch file 1.1
25576
255770	string \xD6\xC3\xC4\x00	VCDIFF binary diff
25578
25579#------------------------------------------------------------------------------
25580# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $
25581# xenix:  file(1) magic for Microsoft Xenix
25582#
25583# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
25584# model" lifted from "magic.xenix", with comment "derived empirically;
25585# treat as folklore until proven"
25586#
25587# "small model", "large model", "huge model" stuff lifted from XXX
25588#
25589# XXX - "x.out" collides with PDP-11 archives
25590#
255910	string		core		core file (Xenix)
25592# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix
25593# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
25594# Update: Joerg Jenderek
25595# recordtype~TranslatorHEADerRecord
255960	byte		0x80
25597# GRR: line above is too general as it catches also Extensible storage engine DataBase
25598# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
25599>1	uleshort	<1022
25600# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length
25601>>1	uleshort	>0
25602# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length
25603>>>3	ubyte		>0
25604# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c"
25605>>>>4	regex	[a-zA-Z_/]{1,8}[.]	8086 relocatable (Microsoft)
25606#!:mime	application/octet-stream
25607!:mime	application/x-object
25608!:ext	o/a
25609>>>>>3	pstring		x		\b, "%s"
25610# checksum
25611#>>>>>(3.b+4)	ubyte	x		\b, checksum 0x%2.2x
256120	leshort		0xff65		x.out
25613>2	string		__.SYMDEF	 randomized
25614>0	byte		x		archive
256150	leshort		0x206		Microsoft a.out
25616>8	leshort		1		Middle model
25617>0x1e	leshort		&0x10		overlay
25618>0x1e	leshort		&0x2		separate
25619>0x1e	leshort		&0x4		pure
25620>0x1e	leshort		&0x800		segmented
25621>0x1e	leshort		&0x400		standalone
25622>0x1e	leshort		&0x8		fixed-stack
25623>0x1c	byte		&0x80		byte-swapped
25624>0x1c	byte		&0x40		word-swapped
25625>0x10	lelong		>0		not-stripped
25626>0x1e	leshort		^0xc000		pre-SysV
25627>0x1e	leshort		&0x4000		V2.3
25628>0x1e	leshort		&0x8000		V3.0
25629>0x1c	byte		&0x4		86
25630>0x1c	byte		&0xb		186
25631>0x1c	byte		&0x9		286
25632>0x1c	byte		&0xa		386
25633>0x1f	byte		<0x040		small model
25634>0x1f	byte		=0x048		large model
25635>0x1f	byte		=0x049		huge model
25636>0x1e	leshort		&0x1		executable
25637>0x1e	leshort		^0x1		object file
25638>0x1e	leshort		&0x40		Large Text
25639>0x1e	leshort		&0x20		Large Data
25640>0x1e	leshort		&0x120		Huge Objects Enabled
25641>0x10	lelong		>0		not stripped
25642
256430	leshort		0x140		old Microsoft 8086 x.out
25644>0x3	byte		&0x4		separate
25645>0x3	byte		&0x2		pure
25646>0	byte		&0x1		executable
25647>0	byte		^0x1		relocatable
25648>0x14	lelong		>0		not stripped
25649
256500	lelong		0x206		b.out
25651>0x1e	leshort		&0x10		overlay
25652>0x1e	leshort		&0x2		separate
25653>0x1e	leshort		&0x4		pure
25654>0x1e	leshort		&0x800		segmented
25655>0x1e	leshort		&0x400		standalone
25656>0x1e	leshort		&0x1		executable
25657>0x1e	leshort		^0x1		object file
25658>0x1e	leshort		&0x4000		V2.3
25659>0x1e	leshort		&0x8000		V3.0
25660>0x1c	byte		&0x4		86
25661>0x1c	byte		&0xb		186
25662>0x1c	byte		&0x9		286
25663>0x1c	byte		&0x29		286
25664>0x1c	byte		&0xa		386
25665>0x1e	leshort		&0x4		Large Text
25666>0x1e	leshort		&0x2		Large Data
25667>0x1e	leshort		&0x102		Huge Objects Enabled
25668
256690	leshort		0x580		XENIX 8086 relocatable or 80286 small model
25670
25671#------------------------------------------------------------------------------
25672# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $
25673# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
25674# Xilinx-Magic@RevRagnarok.com
25675# Got the info from FPGA-FAQ 0026
25676#
25677# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
25678# fixes at least reading of bitfiles from Spartan 2, 3, 6.
25679# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
25680#
25681# First there is the sync header and its length
256820	beshort 0x0009
25683>2 	belong	=0x0ff00ff0
25684>>&0	belong  =0x0ff00ff0
25685>>>&0	byte    =0x00
25686>>>&1   beshort =0x0001
25687>>>&3	string	a	Xilinx BIT data
25688# Next is a Pascal-style string with the NCD name. We want to capture that.
25689>>>>&0	   pstring/H	x	- from %s
25690# And then 'b'
25691>>>>>&1    string b
25692# Then the model / part number:
25693>>>>>>&0   pstring/H    x       - for %s
25694# Then 'c'
25695>>>>>>>&1 string c
25696# Then the build-date
25697>>>>>>>>&0 pstring/H    x       - built %s
25698# Then 'd'
25699>>>>>>>>>&1   string d
25700# Then the build-time
25701>>>>>>>>>>&0  pstring/H x        \b(%s)
25702# Then 'e'
25703>>>>>>>>>>>&1  string e
25704# And length of data
25705>>>>>>>>>>>>&0 belong x          - data length 0x%x
25706
25707# Raw bitstream files
257080      long    0xffffffff
25709>&0    belong  0xaa995566      Xilinx RAW bitstream (.BIN)
25710
25711#------------------------------------------------------------------------------
25712# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
25713# xo65 object files
25714# From: "Ullrich von Bassewitz" <uz@cc65.org>
25715#
257160	string		\x55\x7A\x6E\x61	xo65 object,
25717>4	leshort		x			version %d,
25718>6	leshort&0x0001 =0x0001			with debug info
25719>6	leshort&0x0001 =0x0000			no debug info
25720
25721# xo65 library files
257220	string		\x6E\x61\x55\x7A	xo65 library,
25723>4	leshort		x			version %d
25724
25725# o65 object files
257260	string		\x01\x00\x6F\x36\x35	o65
25727>6	leshort&0x1000	=0x0000			executable,
25728>6	leshort&0x1000	=0x1000			object,
25729>5	byte		x			version %d,
25730>6	leshort&0x8000	=0x8000			65816,
25731>6	leshort&0x8000	=0x0000			6502,
25732>6	leshort&0x2000	=0x2000			32 bit,
25733>6	leshort&0x2000	=0x0000			16 bit,
25734>6	leshort&0x4000	=0x4000			page reloc,
25735>6	leshort&0x4000	=0x0000			byte reloc,
25736>6	leshort&0x0003	=0x0000			alignment 1
25737>6	leshort&0x0003	=0x0001			alignment 2
25738>6	leshort&0x0003	=0x0002			alignment 4
25739>6	leshort&0x0003	=0x0003			alignment 256
25740
25741#------------------------------------------------------------------------------
25742# $File: xwindows,v 1.10 2017/03/17 21:35:28 christos Exp $
25743# xwindows:  file(1) magic for various X/Window system file formats.
25744
25745# Compiled X Keymap
25746# XKM (compiled X keymap) files (including version and byte ordering)
257471	string	mkx				Compiled XKB Keymap: lsb,
25748>0	byte	>0				version %d
25749>0	byte	=0				obsolete
257500	string	xkm				Compiled XKB Keymap: msb,
25751>3	byte	>0				version %d
25752>3	byte	=0				obsolete
25753
25754# xfsdump archive
257550	string	xFSdump0			xfsdump archive
25756>8	belong	x	(version %d)
25757
25758# Jaleo XFS files
257590	long	395726				Jaleo XFS file
25760>4	long	x				- version %d
25761>8	long	x				- [%d -
25762>20	long	x				\b%dx
25763>24	long	x				\b%dx
25764>28	long	1008				\bYUV422]
25765>28	long	1000				\bRGB24]
25766
25767# Xcursor data
25768# X11 mouse cursor format defined in libXcursor, see
25769# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
25770# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
257710	string		Xcur		Xcursor data
25772!:mime	image/x-xcursor
25773>10	leshort		x		version %d
25774>>8	leshort		x		\b.%d
25775
25776
25777#------------------------------------------------------------------------------
25778# $File: yara,v 1.1 2016/10/30 00:38:01 christos Exp $
25779# yara:  file(1) magic for http://virustotal.github.io/yara/
25780#
25781
257820	string	YARA
25783>4	lelong	>2047
25784>8	byte	<20	YARA 3.x compiled rule set
25785# version
25786>>8	clear
25787>>8	byte	6	created with version 3.3.0
25788>>8	byte	8	created with version 3.4.0
25789>>8	byte	11	created with version 3.5.0
25790>>8	default	x
25791>>>8	byte	x	development version 0x%02x
25792#------------------------------------------------------------------------------
25793# zfs:	file(1) magic for ZFS dumps
25794#
25795# From <rea-fbsd@codelabs.ru>
25796# ZFS dump header has the following structure (as per zfs_ioctl.h
25797# in FreeBSD with drr_type is set to DRR_BEGIN)
25798#
25799#   enum {
25800#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
25801#	DRR_WRITE, DRR_FREE, DRR_END,
25802#   } drr_type;
25803#   uint32_t drr_pad;
25804#   uint64_t drr_magic;
25805#   uint64_t drr_version;
25806#   uint64_t drr_creation_time;
25807#   dmu_objset_type_t drr_type;
25808#   uint32_t drr_pad;
25809#   uint64_t drr_toguid;
25810#   uint64_t drr_fromguid;
25811#   char drr_toname[MAXNAMELEN];
25812#
25813# Backup magic is 0x00000002f5bacbac (quad word)
25814# The drr_type is defined as
25815#   typedef enum dmu_objset_type {
25816#	  DMU_OST_NONE,
25817#	  DMU_OST_META,
25818#	  DMU_OST_ZFS,
25819#	  DMU_OST_ZVOL,
25820#	  DMU_OST_OTHER,		  /* For testing only! */
25821#	  DMU_OST_ANY,			  /* Be careful! */
25822#	  DMU_OST_NUMTYPES
25823#  } dmu_objset_type_t;
25824#
25825# Almost all uint64_t fields are printed as the 32-bit ones (with high
25826# 32 bits zeroed), because there is no simple way to print them as the
25827# full 64-bit values.
25828
25829# Big-endian values
258308	string	\000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
25831>20	belong	x	version %u,
25832>32	belong	0	type: NONE,
25833>32	belong	1	type: META,
25834>32	belong	2	type: ZFS,
25835>32	belong	3	type: ZVOL,
25836>32	belong	4	type: OTHER,
25837>32	belong	5	type: ANY,
25838>32	belong	>5	type: UNKNOWN (%u),
25839>40	byte	x	destination GUID: %02X
25840>41	byte	x	%02X
25841>42	byte	x	%02X
25842>43	byte	x	%02X
25843>44	byte	x	%02X
25844>45	byte	x	%02X
25845>46	byte	x	%02X
25846>47	byte	x	%02X,
25847>48	ulong	>0
25848>>52	ulong	>0
25849>>>48	byte	x	source GUID: %02X
25850>>>49	byte	x	%02X
25851>>>50	byte	x	%02X
25852>>>51	byte	x	%02X
25853>>>52	byte	x	%02X
25854>>>53	byte	x	%02X
25855>>>54	byte	x	%02X
25856>>>55	byte	x	%02X,
25857>56	string	>\0	name: '%s'
25858
25859# Little-endian values
258608	string	\254\313\272\365\002\000\000\000	ZFS shapshot (little-endian machine),
25861>16	lelong	x	version %u,
25862>32	lelong	0	type: NONE,
25863>32	lelong	1	type: META,
25864>32	lelong	2	type: ZFS,
25865>32	lelong	3	type: ZVOL,
25866>32	lelong	4	type: OTHER,
25867>32	lelong	5	type: ANY,
25868>32	lelong	>5	type: UNKNOWN (%u),
25869>47	byte	x	destination GUID: %02X
25870>46	byte	x	%02X
25871>45	byte	x	%02X
25872>44	byte	x	%02X
25873>43	byte	x	%02X
25874>42	byte	x	%02X
25875>41	byte	x	%02X
25876>40	byte	x	%02X,
25877>48	ulong	>0
25878>>52	ulong	>0
25879>>>55	byte	x	source GUID: %02X
25880>>>54	byte	x	%02X
25881>>>53	byte	x	%02X
25882>>>52	byte	x	%02X
25883>>>51	byte	x	%02X
25884>>>50	byte	x	%02X
25885>>>49	byte	x	%02X
25886>>>48	byte	x	%02X,
25887>56	string	>\0	name: '%s'
25888
25889#------------------------------------------------------------------------------
25890# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
25891# zilog:  file(1) magic for Zilog Z8000.
25892#
25893# Was it big-endian or little-endian?  My Product Specification doesn't
25894# say.
25895#
258960	long		0xe807		object file (z8000 a.out)
258970	long		0xe808		pure object file (z8000 a.out)
258980	long		0xe809		separate object file (z8000 a.out)
258990	long		0xe805		overlay object file (z8000 a.out)
25900
25901#------------------------------------------------------------------------------
25902# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
25903# zyxel:  file(1) magic for ZyXEL modems
25904#
25905# From <rob@pe1chl.ampr.org>
25906# These are the /etc/magic entries to decode datafiles as used for the
25907# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
25908# ZyXEL-defined standard)
25909
259100	string		ZyXEL\002	ZyXEL voice data
25911>10	byte		0		- CELP encoding
25912>10	byte&0x0B	1		- ADPCM2 encoding
25913>10	byte&0x0B	2		- ADPCM3 encoding
25914>10	byte&0x0B	3		- ADPCM4 encoding
25915>10	byte&0x0B	8		- New ADPCM3 encoding
25916>10	byte&0x04	4		with resync
25917