1# Magic data for file(1) command.
2# Format is described in magic(files), where:
3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID.
4# Don't edit this file, edit /etc/magic or send your magic improvements
5# to the maintainers, at file@mx.gw.com
6
7#------------------------------------------------------------------------------
8# Localstuff:  file(1) magic for locally observed files
9#
10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
11# Add any locally observed files here.  Remember:
12# text if readable, executable if runnable binary, data if unreadable.
13
14#------------------------------------------------------------------------------
15# $File: acorn,v 1.6 2017/10/19 16:40:37 christos Exp $
16# acorn:  file(1) magic for files found on Acorn systems
17#
18
19# RISC OS Chunk File Format
20# From RISC OS Programmer's Reference Manual, Appendix D
21# We guess the file type from the type of the first chunk.
220	lelong		0xc3cbc6c5	RISC OS Chunk data
23>12	string		OBJ_		\b, AOF object
24>12	string		LIB_		\b, ALF library
25
26# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
2716	lelong		0xef000011	RISC OS AIF executable
28
29# RISC OS Draw files
30# From RISC OS Programmer's Reference Manual, Appendix E
310	string 		Draw		RISC OS Draw file data
32
33# RISC OS new format font files
34# From RISC OS Programmer's Reference Manual, Appendix E
350	string		FONT\0		RISC OS outline font data,
36>5	byte		x		version %d
370	string		FONT\1		RISC OS 1bpp font data,
38>5	byte		x		version %d
390	string		FONT\4		RISC OS 4bpp font data
40>5	byte		x		version %d
41
42# RISC OS Music files
43# From RISC OS Programmer's Reference Manual, Appendix E
440	string		Maestro\r	RISC OS music file
45>8	byte		x		version %d
46
47>8	byte		x		type %d
48
49# Digital Symphony data files
50# From: Bernard Jungen (bern8817@euphonynet.be)
510		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
52>8		byte	x	version %d,
53>9		pstring	x	named "%s",
54>(9.b+19)	byte	=0	8-bit logarithmic
55>(9.b+19)	byte	=1	LZW-compressed linear
56>(9.b+19)	byte	=2	8-bit linear signed
57>(9.b+19)	byte	=3	16-bit linear signed
58>(9.b+19)	byte	=4	SigmaDelta-compressed linear
59>(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
60>(9.b+19)	byte	>5	unknown format
61
620	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
63>8	byte	x	version %d,
64>9	byte	=1	1 voice,
65>9	byte	!1	%d voices,
66>10	leshort	=1	1 track,
67>10	leshort	!1	%d tracks,
68>12	leshort	=1	1 pattern
69>12	leshort	!1	%d patterns
70
710	string	\x02\x01\x13\x13\x10\x14\x12\x0e
72>9	byte	=0	Digital Symphony sequence (RISC OS),
73>>8	byte	x	version %d,
74>>10	byte	=1	1 line,
75>>10	byte	!1	%d lines,
76>>11	leshort	=1	1 position
77>>11	leshort	!1	%d positions
78>9	byte	=1	Digital Symphony pattern data (RISC OS),
79>>8	byte	x	version %d,
80>>10	leshort	=1	1 pattern
81>>10	leshort	!1	%d patterns
82
83# From: Joerg Jenderek
84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
86# GRR: line below is too general as it matches also "Git pack" in ./revision
870	string	PACK\0
88# check for valid compression method 0-4
89>5	ulelong	<5
90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
91# To skip "Git pack" version 0 test for root directory object like
92# ADFS::RPC.$.websitezip.FONTFIX
93>>9	string	>ADFS\  PackDir archive (RISC OS)
94# TrID labels above as "Acorn PackDir compressed Archive"
95# compression mode y (0 - 4) for GIF LZW with a maximum n bits
96# (y~n,0~12,1~13,2~14,3~15,4~16)
97>>>5	ulelong+12 x	\b, LZW %u-bits compression
98# http://www.filebase.org.uk/filetypes
99# !Packdir compressed archive has three hexadecimal digits code 68E
100!:mime	application/x-acorn-68E
101!:ext	pkd/bin
102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
103>>>9	string	x	\b, root "%s"
104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
105>>>>&1	ulelong	x	\b, load address 0x%x
106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
107>>>>&5	ulelong	x	\b, exec address 0x%x
108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
109>>>>&9	ulelong	x	\b, attributes 0x%x
110# number of entries in this directory. for root dir 0
111#>>>&13	ulelong	x	\b, entries 0x%x
112# the entries start here with object name
113>>>>&17	string	x	\b, 1st object "%s"
114
115
116#------------------------------------------------------------------------------
117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
118# adi: file(1) magic for ADi's objects
119# From Gregory McGarry <g.mcgarry@ieee.org>
120#
1210	leshort		0x521c		COFF DSP21k
122>18	lelong		&02		executable,
123>18	lelong		^02
124>>18	lelong		&01		static object,
125>>18	lelong		^01		relocatable object,
126>18	lelong		&010		stripped
127>18	lelong		^010		not stripped
128
129#------------------------------------------------------------------------------
130# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $
131# adventure: file(1) magic for Adventure game files
132#
133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
136#
137# ALAN
138# I assume there are other, lower versions, but these are the only ones I
139# saw in the archive.
1400	beshort	0x0206	ALAN game data
141>2	byte	<10	version 2.6%d
142
143
144# Infocom (see z-machine)
145#------------------------------------------------------------------------------
146# Z-machine:  file(1) magic for Z-machine binaries.
147# Sanity checks by David Griffith <dave@661.org>
148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
149#
150#http://www.gnelson.demon.co.uk/zspec/sect11.html
151#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
152#http://en.wikipedia.org/wiki/Z-machine
153# The first byte is the Z-machine revision; it is always between 1 and 8. We
154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
155# well as an occasional MP3 file), so we sanity-check the version number.
156#
157# It might be possible to sanity-check the release number as well, as it seems
158# (at least in classic Infocom games) to always be a relatively small number,
159# always under 150 or so, but as this isn't rigorous, we'll wait on that until
160# it becomes clear that it's needed.
161#
1620	ubyte			>0
163>0	ubyte			<9
164>>16	belong&0xfe00f0f0	0x3030
165>>>0	ubyte			< 10
166>>>>2	ubeshort		x
167>>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
168>>>>>>0	ubyte			< 10	Infocom (Z-machine %d
169>>>>>>>2	ubeshort	x 	\b, Release %d
170>>>>>>>>18	string		>\0	\b, Serial %.6s
171>>>>>>>>18	string		x	\b)
172!:strength + 40
173!:mime	application/x-zmachine
174
175#------------------------------------------------------------------------------
176# Glulx:  file(1) magic for Glulx binaries.
177#
178# David Griffith <dave@661.org>
179# I haven't checked for false matches yet.
180#
1810	string			Glul	Glulx game data
182>4	beshort			x	(Version %d
183>>6	byte			x	\b.%d
184>>8	byte			x	\b.%d)
185>36	string			Info	Compiled by Inform
186!:mime	application/x-glulx
187
188
189# For Quetzal and blorb magic see iff
190
191
192# TADS (Text Adventure Development System) version 2
193#  All files are machine-independent (games compile to byte-code) and are tagged
194#  with a version string of the form "V2.<digit>.<digit>\0".
195#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
1960	string	TADS2\ bin	TADS
197>9	belong  !0x0A0D1A00	game data, CORRUPTED
198>9	belong	 0x0A0D1A00
199>>13	string	>\0		%s game data
200!:mime	application/x-tads
201#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
2020	string	TADS2\ rsc	TADS
203>9	belong  !0x0A0D1A00	resource data, CORRUPTED
204>9	belong	 0x0A0D1A00
205>>13	string	>\0		%s resource data
206!:mime	application/x-tads
207#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
208#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
209# "TADS2 save\n\r\032\0" and the interpreter version.
2100	string	TADS2\ save/g	TADS
211>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
212>12	belong	 0x0A0D1A00
213>>(16.s+32) string >\0		%s saved game data
214!:mime	application/x-tads
215#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
216#  version.
2170	string	TADS2\ save	TADS
218>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
219>10	belong	 0x0A0D1A00
220>>14	string	>\0		%s saved game data
221!:mime	application/x-tads
222
223# TADS (Text Adventure Development System) version 3
224#  Game files start with "T3-image\015\012\032"
2250	string	T3-image\015\012\032
226>11	leshort	x		TADS 3 game data (format version %d)
227#  Saved game files start with "T3-state-v####\015\012\032"
228#  where #### is a format version number
2290	string	T3-state-v
230>14	string	\015\012\032	TADS 3 saved game data (format version
231>>10	byte	x		%c
232>>11	byte	x		\b%c
233>>12	byte	x		\b%c
234>>13	byte	x		\b%c)
235!:mime	application/x-t3vm-image
236
237# edited by David Griffith <dave@661.org>
238# Danny Milosavljevic <danny.milo@gmx.net>
239# These are ADRIFT (adventure game standard) game files, extension .taf
240# Checked from source at (http://www.adrift.co/) and various taf files
241# found at the Interactive Fiction Archive (http://ifarchive.org/)
2420	belong  0x3C423FC9
243>4	belong  0x6A87C2CF	Adrift game file version
244>>8	belong  0x94453661	3.80
245>>8	belong  0x94453761	3.90
246>>8	belong  0x93453E61	4.0
247>>8	belong  0x92453E61	5.0
248>>8	default x		unknown
249!:mime	application/x-adrift
250
251#------------------------------------------------------------------------------
252# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $
253# algol68:  file(1) magic for Algol 68 source
254#
2550	search/8192	(input,			Algol 68 source text
256!:mime	text/x-Algol68
2570	regex		\^PROC			Algol 68 source text
258!:mime	text/x-Algol68
2590	regex           MODE[\t\ ]		Algol 68 source text
260!:mime	text/x-Algol68
2610	regex          	REF[\t\ ]		Algol 68 source text
262!:mime	text/x-Algol68
2630	regex          	FLEX[\t\ ]\*\\[		Algol 68 source text
264!:mime	text/x-Algol68
265#0	regex          	[\t\ ]OD		Algol 68 source text
266#!:mime	text/x-Algol68
267#0	regex          	[\t\ ]FI		Algol 68 source text
268#!:mime	text/x-Algol68
269
270#------------------------------------------------------------------------------
271# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
272# allegro:  file(1) magic for Allegro datafiles
273# Toby Deshane <hac@shoelace.digivill.net>
274#
2750 belong 0x736C6821   Allegro datafile (packed)
2760 belong 0x736C682E   Allegro datafile (not packed/autodetect)
2770 belong 0x736C682B   Allegro datafile (appended exe data)
278
279#------------------------------------------------------------------------------
280# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
281# alliant:  file(1) magic for Alliant FX series a.out files
282#
283# If the FX series is the one that had a processor with a 68K-derived
284# instruction set, the "short" should probably become "beshort" and the
285# "long" should probably become "belong".
286# If it's the i860-based one, they should probably become either the
287# big-endian or little-endian versions, depending on the mode they ran
288# the 860 in....
289#
2900	short		0420		0420 Alliant virtual executable
291>2	short		&0x0020		common library
292>16	long		>0		not stripped
2930	short		0421		0421 Alliant compact executable
294>2	short		&0x0020		common library
295>16	long		>0		not stripped
296
297#------------------------------------------------------------------------------
298# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
299# amanda:  file(1) magic for amanda file format
300#
3010	string	AMANDA:\ 		AMANDA
302>8	string	TAPESTART\ DATE		tape header file,
303>>23	string	X
304>>>25	string	>\ 			Unused %s
305>>23	string	>\ 			DATE %s
306>8	string	FILE\ 			dump file,
307>>13	string	>\ 			DATE %s
308
309#------------------------------------------------------------------------------
310# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $
311# amigaos:  file(1) magic for AmigaOS binary formats:
312
313#
314# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
315#
3160	belong		0x000003fa	AmigaOS shared library
3170	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
3180	belong		0x000003e7	AmigaOS object/library data
319#
3200	beshort		0xe310		Amiga Workbench
321>2	beshort		1
322>>48	byte		1		disk icon
323>>48	byte		2		drawer icon
324>>48	byte		3		tool icon
325>>48	byte		4		project icon
326>>48	byte		5		garbage icon
327>>48	byte		6		device icon
328>>48	byte		7		kickstart icon
329>>48	byte		8		workbench application icon
330>2	beshort		>1		icon, vers. %d
331#
332# various sound formats from the Amiga
333# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
334#
3350	string		FC14		Future Composer 1.4 Module sound file
3360	string		SMOD		Future Composer 1.3 Module sound file
3370	string		AON4artofnoise	Art Of Noise Module sound file
3381	string		MUGICIAN/SOFTEYES Mugician Module sound file
33958	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
3400	string		Synth4.0	Synthesis Module sound file
3410	string		ARP.		The Holy Noise Module sound file
3420	string		BeEp\0		JamCracker Module sound file
3430	string		COSO\0		Hippel-COSO Module sound file
344# Too simple (short, pure ASCII, deep), MPi
345#26	string		V.3		Brian Postma's Soundmon Module sound file v3
346#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
347#26	string		V.2		Brian Postma's Soundmon Module sound file v2
348
349# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
3500	beshort		0x0f00		AmigaOS bitmap font
3510	beshort		0x0f03		AmigaOS outline font
3520	belong		0x80001001	AmigaOS outline tag
3530	string		##\ version	catalog translation
3540	string		EMOD\0		Amiga E module
3558	string		ECXM\0		ECX module
3560	string/c	@database	AmigaGuide file
357
358# Amiga disk types
359#
3600	string		RDSK		Rigid Disk Block
361>160	string		x		on %.24s
3620	string		DOS\0		Amiga DOS disk
3630	string		DOS\1		Amiga FFS disk
3640	string		DOS\2		Amiga Inter DOS disk
3650	string		DOS\3		Amiga Inter FFS disk
3660	string		DOS\4		Amiga Fastdir DOS disk
3670	string		DOS\5		Amiga Fastdir FFS disk
3680	string		KICK		Kickstart disk
369
370# From: Alex Beregszaszi <alex@fsn.hu>
3710	string		LZX		LZX compressed archive (Amiga)
372
373# From: Przemek Kramarczyk <pkramarczyk@gmail.com>
3740	string 		.KEY		AmigaDOS script
3750	string 		.key		AmigaDOS script
376
377#------------------------------------------------------------
378# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $
379# Various android related magic entries
380#------------------------------------------------------------
381
382# Dalvik .dex format. http://retrodev.com/android/dexformat.html
383# From <mkf@google.com> "Mike Fleming"
384# Fixed to avoid regexec 17 errors on some dex files
385# From <diff@lookout.com> "Tim Strazzere"
3860	string	dex\n
387>0	regex	dex\n[0-9]{2}\0	Dalvik dex file
388>4	string	>000			version %s
3890	string	dey\n
390>0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
391>4	string	>000			version %s
392
393# Android bootimg format
394# From https://android.googlesource.com/\
395# platform/system/core/+/master/mkbootimg/bootimg.h
3960		string	ANDROID!	Android bootimg
397>1024	string	LOKI\01		\b, LOKI'd
398>8		lelong	>0			\b, kernel
399>>12	lelong	>0			\b (0x%x)
400>16		lelong	>0			\b, ramdisk
401>>20	lelong	>0			\b (0x%x)
402>24		lelong	>0			\b, second stage
403>>28	lelong	>0			\b (0x%x)
404>36		lelong	>0			\b, page size: %d
405>38		string	>0			\b, name: %s
406>64		string	>0		 	\b, cmdline (%s)
407
408# Android Backup archive
409# From: Ariel Shkedi
410# File extension: .ab
411# No mime-type defined
412# URL: https://github.com/android/platform_frameworks_base/blob/\
413# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
414# android/server/BackupManagerService.java#L2367
415# After the header comes a tar file
416# If compressed, the entire tar file is compressed with JAVA deflate
417#
418# Include the version number hardcoded with the magic string to avoid
419# false positives
4200	string/b	ANDROID\ BACKUP\n1\n	Android Backup
421>17	string		0\n			\b, Not-Compressed
422>17	string		1\n			\b, Compressed
423# any string as long as it's not the word none (which is matched below)
424>>19    regex/1l	\^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).*	\b, Encrypted (%s)
425>>19	string		none\n			\b, Not-Encrypted
426# Commented out because they don't seem useful to print
427# (but they are part of the header - the tar file comes after them):
428#>>>&1		regex/1l .*	\b, Password salt: %s
429#>>>>&1		regex/1l .*	\b, Master salt: %s
430#>>>>>&1	regex/1l .*	\b, PBKDF2 rounds: %s
431#>>>>>>&1	regex/1l .*	\b, IV: %s
432#>>>>>>>&1	regex/1l .*	\b, Key: %s
433
434# *.pit files by Joerg Jenderek
435# http://forum.xda-developers.com/showthread.php?p=9122369
436# http://forum.xda-developers.com/showthread.php?t=816449
437# Partition Information Table for Samsung's smartphone with Android
438# used by flash software Odin
4390		ulelong			0x12349876
440# 1st pit entry marker
441>0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
442# minimal 13 and maximal 18 PIT entries found
443>>4		ulelong			<128	Partition Information Table for Samsung smartphone
444>>>4		ulelong			x	\b, %d entries
445# 1. pit entry
446>>>4		ulelong			>0	\b; #1
447>>>0x01C	use				PIT-entry
448>>>4		ulelong			>1	\b; #2
449>>>0x0A0	use				PIT-entry
450>>>4		ulelong			>2	\b; #3
451>>>0x124	use				PIT-entry
452>>>4		ulelong			>3	\b; #4
453>>>0x1A8	use				PIT-entry
454>>>4		ulelong			>4	\b; #5
455>>>0x22C	use				PIT-entry
456>>>4		ulelong			>5	\b; #6
457>>>0x2B0	use				PIT-entry
458>>>4		ulelong			>6	\b; #7
459>>>0x334	use				PIT-entry
460>>>4		ulelong			>7 	\b; #8
461>>>0x3B8	use				PIT-entry
462>>>4		ulelong			>8 	\b; #9
463>>>0x43C	use				PIT-entry
464>>>4		ulelong			>9	\b; #10
465>>>0x4C0	use				PIT-entry
466>>>4		ulelong			>10	\b; #11
467>>>0x544	use				PIT-entry
468>>>4		ulelong			>11	\b; #12
469>>>0x5C8	use				PIT-entry
470>>>4		ulelong			>12	\b; #13
471>>>>0x64C	use				PIT-entry
472# 14. pit entry
473>>>4		ulelong			>13	\b; #14
474>>>>0x6D0	use				PIT-entry
475>>>4		ulelong			>14	\b; #15
476>>>0x754	use				PIT-entry
477>>>4		ulelong			>15	\b; #16
478>>>0x7D8	use				PIT-entry
479>>>4		ulelong			>16	\b; #17
480>>>0x85C	use				PIT-entry
481# 18. pit entry
482>>>4		ulelong			>17	\b; #18
483>>>0x8E0	use				PIT-entry
484
4850	name			PIT-entry
486# garbage value implies end of pit entries
487>0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
488# skip empty partition name
489>>0x24		ubyte				!0
490# partition name
491>>>0x24		string				>\0			%-.32s
492# flags
493>>>0x0C		ulelong&0x00000002		2			\b+RW
494# partition ID:
495# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
496# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
497>>>0x08	ulelong		x			(0x%x)
498# filename
499>>>0x44		string				>\0			"%-.64s"
500#>>>0x18	ulelong				>0
501# blocksize in 512 byte units ?
502#>>>>0x18	ulelong				x			\b, %db
503# partition size in blocks ?
504#>>>>0x22	ulelong				x			\b*%d
505
506# Android sparse img format
507# From https://android.googlesource.com/\
508# platform/system/core/+/master/libsparse/sparse_format.h
5090		lelong	0xed26ff3a		Android sparse image
510>4		leshort	x			\b, version: %d
511>6		leshort	x			\b.%d
512>16		lelong	x			\b, Total of %d
513>12		lelong	x			\b %d-byte output blocks in
514>20		lelong	x			\b %d input chunks.
515
516# Android binary XML magic
517# In include/androidfw/ResourceTypes.h:
518# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
519# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
5200	lelong	0x00080003	Android binary XML
521
522#------------------------------------------------------------------------------
523# $File: animation,v 1.68 2018/05/06 16:08:07 christos Exp $
524# animation:  file(1) magic for animation/movie formats
525#
526# animation formats
527# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
528# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
529
530# SGI and Apple formats
5310	string		MOVI		Silicon Graphics movie file
532!:mime	video/x-sgi-movie
5334       string          moov            Apple QuickTime
534!:mime	video/quicktime
535>12     string          mvhd            \b movie (fast start)
536>12     string          mdra            \b URL
537>12     string          cmov            \b movie (fast start, compressed header)
538>12     string          rmra            \b multiple URLs
5394       string          mdat            Apple QuickTime movie (unoptimized)
540!:mime	video/quicktime
541#4       string          wide            Apple QuickTime movie (unoptimized)
542#!:mime	video/quicktime
543#4       string          skip            Apple QuickTime movie (modified)
544#!:mime	video/quicktime
545#4       string          free            Apple QuickTime movie (modified)
546#!:mime	video/quicktime
5474       string          idsc            Apple QuickTime image (fast start)
548!:mime	image/x-quicktime
549#4       string          idat            Apple QuickTime image (unoptimized)
550#!:mime	image/x-quicktime
5514       string          pckg            Apple QuickTime compressed archive
552!:mime	application/x-quicktime-player
5534	string/W	jP		JPEG 2000 image
554!:mime	image/jp2
555# http://www.ftyps.com/ with local additions
5564	string		ftyp		ISO Media
557# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
558>8	string		XAVC		\b, MPEG v4 system, Sony XAVC Codec
559>>96	string		x		\b, Audio "%.4s"
560>>118	beshort		x		at %dHz
561>>140	string		x		\b, Video "%.4s"
562>>168	beshort		x		%d
563>>170	beshort		x		\bx%d
564>8	string		3g2		\b, MPEG v4 system, 3GPP2
565!:mime	video/3gpp2
566>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
567>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
568>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
569# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
570# Section 8.1.1, corresponds to a, b, c
571>>11	byte		0x61		\b C.S0050-0 V1.0
572>>11	byte		0x62		\b C.S0050-0-A V1.0.0
573>>11	byte		0x63		\b C.S0050-0-B V1.0
574>8	string		3ge		\b, MPEG v4 system, 3GPP
575!:mime	video/3gpp
576>>11	byte		6		\b, Release 6 MBMS Extended Presentations
577>>11	byte		7		\b, Release 7 MBMS Extended Presentations
578>8	string		3gg		\b, MPEG v4 system, 3GPP
579!:mime	video/3gpp
580>>11	byte		6		\b, Release 6 General Profile
581>8	string		3gp		\b, MPEG v4 system, 3GPP
582!:mime	video/3gpp
583>>11	byte		1		\b, Release %d (non existent)
584>>11	byte		2		\b, Release %d (non existent)
585>>11	byte		3		\b, Release %d (non existent)
586>>11	byte		4		\b, Release %d
587>>11	byte		5		\b, Release %d
588>>11	byte		6		\b, Release %d
589>>11	byte		7		\b, Release %d Streaming Servers
590>8	string		3gs		\b, MPEG v4 system, 3GPP
591!:mime	video/3gpp
592>>11	byte		7		\b, Release %d Streaming Servers
593>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
594!:mime	video/mp4
595>8	string/W	qt		\b, Apple QuickTime movie
596!:mime	video/quicktime
597>8	string		CAEP		\b, Canon Digital Camera
598>8	string		caqv		\b, Casio Digital Camera
599>8	string		CDes		\b, Convergent Design
600>8	string		da0a		\b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
601>8	string		da0b		\b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
602>8	string		da1a		\b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
603>8	string		da1b		\b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
604>8	string		da2a		\b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
605>8	string		da2b		\b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
606>8	string		da3a		\b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
607>8	string		da3b		\b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
608>8	string		dash		\b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
609!:mime	video/mp4
610>8	string		dmb1		\b, DMB MAF supporting all the components defined in the spec
611>8	string		dmpf		\b, Digital Media Project
612>8	string		drc1		\b, Dirac (wavelet compression), encap in ISO base media (MP4)
613>8	string		dv1a		\b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
614>8	string		dv1b		\b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
615>8	string		dv2a		\b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
616>8	string		dv2b		\b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
617>8	string		dv3a		\b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
618>8	string		dv3b		\b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
619>8	string		dvr1		\b, DVB (.DVB) over RTP
620!:mime	video/vnd.dvb.file
621>8	string		dvt1		\b, DVB (.DVB) over MPEG-2 Transport Stream
622!:mime	video/vnd.dvb.file
623>8	string		F4V		\b, Video for Adobe Flash Player 9+ (.F4V)
624!:mime	video/mp4
625>8	string		F4P		\b, Protected Video for Adobe Flash Player 9+ (.F4P)
626!:mime	video/mp4
627>8	string		F4A		\b, Audio for Adobe Flash Player 9+ (.F4A)
628!:mime	audio/mp4
629>8	string		F4B		\b, Audio Book for Adobe Flash Player 9+ (.F4B)
630!:mime	audio/mp4
631>8	string		isc2		\b, ISMACryp 2.0 Encrypted File
632#	?/enc-isoff-generic
633>8	string		iso2		\b, MP4 Base Media v2 [ISO 14496-12:2005]
634!:mime	video/mp4
635>8	string		isom		\b, MP4 Base Media v1 [IS0 14496-12:2003]
636!:mime	video/mp4
637>8	string/W	jp2		\b, JPEG 2000
638!:mime	image/jp2
639>8	string		JP2		\b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
640!:mime	image/jp2
641>8	string		JP20		\b, Unknown, from GPAC samples (prob non-existent)
642>8	string		jpm		\b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
643!:mime	image/jpm
644>8	string		jpx		\b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
645!:mime	image/jpx
646>8	string		KDDI		\b, 3GPP2 EZmovie for KDDI 3G cellphones
647!:mime	video/3gpp2
648>8	string		M4A 		\b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
649!:mime	audio/x-m4a
650>8	string		M4B 		\b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
651!:mime	audio/mp4
652>8	string		M4P 		\b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio
653!:mime	video/mp4
654>8	string		M4V 		\b, Apple iTunes Video (.M4V) Video
655!:mime	video/x-m4v
656>8	string		M4VH		\b, Apple TV (.M4V)
657!:mime	video/x-m4v
658>8	string		M4VP		\b, Apple iPhone (.M4V)
659!:mime	video/x-m4v
660>8	string		mj2s		\b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
661!:mime	video/mj2
662>8	string		mjp2		\b, Motion JPEG 2000 [ISO 15444-3] General Profile
663!:mime	video/mj2
664>8	string		mmp4		\b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
665!:mime	video/mp4
666>8	string		mobi		\b, MPEG-4, MOBI format
667!:mime	video/mp4
668>8	string		mp21		\b, MPEG-21 [ISO/IEC 21000-9]
669>8	string		mp41		\b, MP4 v1 [ISO 14496-1:ch13]
670!:mime	video/mp4
671>8	string		mp42		\b, MP4 v2 [ISO 14496-14]
672!:mime	video/mp4
673>8	string		mp71		\b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
674>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
675>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
676>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
677!:mime	video/mp4
678>8	string		MPPI		\b, Photo Player, MAF [ISO/IEC 23000-3]
679>8	string		mqt		\b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
680!:mime	video/quicktime
681>8	string		MSNV		\b, MPEG-4 (.MP4) for SonyPSP
682!:mime	audio/mp4
683>8	string		NDAS		\b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
684!:mime	audio/mp4
685>8	string		NDSC		\b, MPEG-4 (.MP4) Nero Cinema Profile
686!:mime	video/mp4
687>8	string		NDSH		\b, MPEG-4 (.MP4) Nero HDTV Profile
688!:mime	video/mp4
689>8	string		NDSM		\b, MPEG-4 (.MP4) Nero Mobile Profile
690!:mime	video/mp4
691>8	string		NDSP		\b, MPEG-4 (.MP4) Nero Portable Profile
692!:mime	video/mp4
693>8	string		NDSS		\b, MPEG-4 (.MP4) Nero Standard Profile
694!:mime	video/mp4
695>8	string		NDXC		\b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
696!:mime	video/mp4
697>8	string		NDXH		\b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
698!:mime	video/mp4
699>8	string		NDXM		\b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
700!:mime	video/mp4
701>8	string		NDXP		\b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
702!:mime	video/mp4
703>8	string		NDXS		\b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
704!:mime	video/mp4
705>8	string		odcf  		\b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
706>8	string		opf2 		\b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
707>8	string		opx2  		\b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
708>8	string		pana		\b, Panasonic Digital Camera
709>8	string		qt  		\b, Apple QuickTime (.MOV/QT)
710!:mime	video/quicktime
711# HEIF image format
712# see https://nokiatech.github.io/heif/technical.html
713>8	string		mif1		\b, HEIF Image
714!:mime image/heif
715>8	string		msf1		\b, HEIF Image Sequence
716!:mime image/heif-sequence
717>8	string		heic		\b, HEIF Image HEVC Main or Main Still Picture Profile
718!:mime image/heic
719>8	string		heix		\b, HEIF Image HEVC Main 10 Profile
720!:mime image/heic
721>8	string		hevc		\b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile
722!:mime image/heic-sequence
723>8	string		hevx		\b, HEIF Image Sequence HEVC Main 10 Profile
724!:mime image/heic-sequence
725# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017)
726# but used in the reference implementation:
727# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp
728>8	string		heim		\b, HEIF Image L-HEVC
729!:mime image/heif
730>8	string		heis		\b, HEIF Image L-HEVC
731!:mime image/heif
732>8	string		avic		\b, HEIF Image AVC
733!:mime image/heif
734>8	string		hevm		\b, HEIF Image Sequence L-HEVC
735!:mime image/heif-sequence
736>8	string		hevs		\b, HEIF Image Sequence L-HEVC
737!:mime image/heif-sequence
738>8	string		avcs		\b, HEIF Image Sequence AVC
739!:mime image/heif-sequence
740
741>8	string		ROSS		\b, Ross Video
742>8	string		sdv		\b, SD Memory Card Video
743>8	string		ssc1		\b, Samsung stereo, single stream (patent pending)
744>8	string		ssc2		\b, Samsung stereo, dual stream (patent pending)
745
746# MPEG sequences
747# Scans for all common MPEG header start codes
7480	 belong		    0x00000001
749>4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
750>>5      byte               66             \b, baseline
751>>5      byte               77             \b, main
752>>5      byte               88             \b, extended
753>>7      byte               x              \b @ L %u
7540        belong&0xFFFFFF00  0x00000100
755>3       byte               0xBA           MPEG sequence
756!:mime  video/mpeg
757>>4      byte               &0x40          \b, v2, program multiplex
758>>4      byte               ^0x40          \b, v1, system multiplex
759>3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
760>3       byte&0x1F          0x07           MPEG sequence, H.264 video
761>>4      byte               66             \b, baseline
762>>4      byte               77             \b, main
763>>4      byte               88             \b, extended
764>>6      byte               x              \b @ L %u
765# GRR too general as it catches also FoxPro Memo example NG.FPT
766>3       byte               0xB0           MPEG sequence, v4
767# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
768#>>4      byte               !0             MPEG sequence, v4
769!:mime  video/mpeg4-generic
770>>5      belong             0x000001B5
771>>>9     byte               &0x80
772>>>>10   byte&0xF0          16             \b, video
773>>>>10   byte&0xF0          32             \b, still texture
774>>>>10   byte&0xF0          48             \b, mesh
775>>>>10   byte&0xF0          64             \b, face
776>>>9     byte&0xF8          8              \b, video
777>>>9     byte&0xF8          16             \b, still texture
778>>>9     byte&0xF8          24             \b, mesh
779>>>9     byte&0xF8          32             \b, face
780>>4      byte               1              \b, simple @ L1
781>>4      byte               2              \b, simple @ L2
782>>4      byte               3              \b, simple @ L3
783>>4      byte               4              \b, simple @ L0
784>>4      byte               17             \b, simple scalable @ L1
785>>4      byte               18             \b, simple scalable @ L2
786>>4      byte               33             \b, core @ L1
787>>4      byte               34             \b, core @ L2
788>>4      byte               50             \b, main @ L2
789>>4      byte               51             \b, main @ L3
790>>4      byte               53             \b, main @ L4
791>>4      byte               66             \b, n-bit @ L2
792>>4      byte               81             \b, scalable texture @ L1
793>>4      byte               97             \b, simple face animation @ L1
794>>4      byte               98             \b, simple face animation @ L2
795>>4      byte               99             \b, simple face basic animation @ L1
796>>4      byte               100            \b, simple face basic animation @ L2
797>>4      byte               113            \b, basic animation text @ L1
798>>4      byte               114            \b, basic animation text @ L2
799>>4      byte               129            \b, hybrid @ L1
800>>4      byte               130            \b, hybrid @ L2
801>>4      byte               145            \b, advanced RT simple @ L!
802>>4      byte               146            \b, advanced RT simple @ L2
803>>4      byte               147            \b, advanced RT simple @ L3
804>>4      byte               148            \b, advanced RT simple @ L4
805>>4      byte               161            \b, core scalable @ L1
806>>4      byte               162            \b, core scalable @ L2
807>>4      byte               163            \b, core scalable @ L3
808>>4      byte               177            \b, advanced coding efficiency @ L1
809>>4      byte               178            \b, advanced coding efficiency @ L2
810>>4      byte               179            \b, advanced coding efficiency @ L3
811>>4      byte               180            \b, advanced coding efficiency @ L4
812>>4      byte               193            \b, advanced core @ L1
813>>4      byte               194            \b, advanced core @ L2
814>>4      byte               209            \b, advanced scalable texture @ L1
815>>4      byte               210            \b, advanced scalable texture @ L2
816>>4      byte               211            \b, advanced scalable texture @ L3
817>>4      byte               225            \b, simple studio @ L1
818>>4      byte               226            \b, simple studio @ L2
819>>4      byte               227            \b, simple studio @ L3
820>>4      byte               228            \b, simple studio @ L4
821>>4      byte               229            \b, core studio @ L1
822>>4      byte               230            \b, core studio @ L2
823>>4      byte               231            \b, core studio @ L3
824>>4      byte               232            \b, core studio @ L4
825>>4      byte               240            \b, advanced simple @ L0
826>>4      byte               241            \b, advanced simple @ L1
827>>4      byte               242            \b, advanced simple @ L2
828>>4      byte               243            \b, advanced simple @ L3
829>>4      byte               244            \b, advanced simple @ L4
830>>4      byte               245            \b, advanced simple @ L5
831>>4      byte               247            \b, advanced simple @ L3b
832>>4      byte               248            \b, FGS @ L0
833>>4      byte               249            \b, FGS @ L1
834>>4      byte               250            \b, FGS @ L2
835>>4      byte               251            \b, FGS @ L3
836>>4      byte               252            \b, FGS @ L4
837>>4      byte               253            \b, FGS @ L5
838>3       byte               0xB5           MPEG sequence, v4
839!:mime  video/mpeg4-generic
840>>4      byte               &0x80
841>>>5     byte&0xF0          16             \b, video (missing profile header)
842>>>5     byte&0xF0          32             \b, still texture (missing profile header)
843>>>5     byte&0xF0          48             \b, mesh (missing profile header)
844>>>5     byte&0xF0          64             \b, face (missing profile header)
845>>4      byte&0xF8          8              \b, video (missing profile header)
846>>4      byte&0xF8          16             \b, still texture (missing profile header)
847>>4      byte&0xF8          24             \b, mesh (missing profile header)
848>>4      byte&0xF8          32             \b, face (missing profile header)
849>3       byte               0xB3           MPEG sequence
850!:mime  video/mpeg
851>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
852>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
853>>12     belong             0x000001B5     \b, v2,
854>>>16    byte&0x0F          1              \b HP
855>>>16    byte&0x0F          2              \b Spt
856>>>16    byte&0x0F          3              \b SNR
857>>>16    byte&0x0F          4              \b MP
858>>>16    byte&0x0F          5              \b SP
859>>>17    byte&0xF0          64             \b@HL
860>>>17    byte&0xF0          96             \b@H-14
861>>>17    byte&0xF0          128            \b@ML
862>>>17    byte&0xF0          160            \b@LL
863>>>17    byte               &0x08          \b progressive
864>>>17    byte               ^0x08          \b interlaced
865>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
866>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
867>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
868>>11     byte               &0x02
869>>>75    byte               &0x01
870>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
871>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
872>>>>140  belong             0x000001B5     \b, v2,
873>>>>>144 byte&0x0F          1              \b HP
874>>>>>144 byte&0x0F          2              \b Spt
875>>>>>144 byte&0x0F          3              \b SNR
876>>>>>144 byte&0x0F          4              \b MP
877>>>>>144 byte&0x0F          5              \b SP
878>>>>>145 byte&0xF0          64             \b@HL
879>>>>>145 byte&0xF0          96             \b@H-14
880>>>>>145 byte&0xF0          128            \b@ML
881>>>>>145 byte&0xF0          160            \b@LL
882>>>>>145 byte               &0x08          \b progressive
883>>>>>145 byte               ^0x08          \b interlaced
884>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
885>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
886>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
887>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
888>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
889>>76    belong             0x000001B5     \b, v2,
890>>>80   byte&0x0F          1              \b HP
891>>>80   byte&0x0F          2              \b Spt
892>>>80   byte&0x0F          3              \b SNR
893>>>80   byte&0x0F          4              \b MP
894>>>80   byte&0x0F          5              \b SP
895>>>81   byte&0xF0          64             \b@HL
896>>>81   byte&0xF0          96             \b@H-14
897>>>81   byte&0xF0          128            \b@ML
898>>>81   byte&0xF0          160            \b@LL
899>>>81   byte               &0x08          \b progressive
900>>>81   byte               ^0x08          \b interlaced
901>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
902>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
903>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
904>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
905>>>7     byte&0xF0          0x10           \b, 16:9
906>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
907>>>7     byte&0xF0          0x10           \b, 16:9
908>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
909>>>7     byte&0xF0          0x10           \b, 4:3
910>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
911>>>5     beshort&0x0FFF     0x01E0         \b NTSC
912>>>5     beshort&0x0FFF     0x0240         \b PAL
913>>>7     byte&0xF0          0x20           \b, 4:3
914>>>7     byte&0xF0          0x30           \b, 16:9
915>>>7     byte&0xF0          0x40           \b, 11:5
916>>>7     byte&0xF0          0x80           \b, PAL 4:3
917>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
918>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
919>>>7     byte&0xF0          0x10           \b, 4:3
920>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
921>>>7     byte&0xF0          0x10           \b, 4:3
922>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
923>>>7     byte&0xF0          0x10           \b, 4:3
924>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
925>>>7     byte&0xF0          0x10           \b, 4:3
926>>4      beshort&0xFFF0     0x1600         \b, CIF
927>>>5     beshort&0x0FFF     0x00F0         \b NTSC
928>>>5     beshort&0x0FFF     0x0120         \b PAL
929>>>7     byte&0xF0          0x20           \b, 4:3
930>>>7     byte&0xF0          0x30           \b, 16:9
931>>>7     byte&0xF0          0x40           \b, 11:5
932>>>7     byte&0xF0          0x80           \b, PAL 4:3
933>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
934>>>5     beshort&0x0FFF     0x0240         \b PAL 625
935>>>>7    byte&0xF0          0x20           \b, 4:3
936>>>>7    byte&0xF0          0x30           \b, 16:9
937>>>>7    byte&0xF0          0x40           \b, 11:5
938>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
939>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
940>>>5     beshort&0x0FFF     0x0240         \b PAL 625
941>>>7     byte&0xF0          0x20           \b, 4:3
942>>>7     byte&0xF0          0x30           \b, 16:9
943>>>7     byte&0xF0          0x40           \b, 11:5
944>>4      beshort&0xFFF0     0x1E00         \b, SVCD
945>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
946>>>5     beshort&0x0FFF     0x0240         \b PAL 625
947>>>7     byte&0xF0          0x20           \b, 4:3
948>>>7     byte&0xF0          0x30           \b, 16:9
949>>>7     byte&0xF0          0x40           \b, 11:5
950>>7      byte&0x0F          1              \b, 23.976 fps
951>>7      byte&0x0F          2              \b, 24 fps
952>>7      byte&0x0F          3              \b, 25 fps
953>>7      byte&0x0F          4              \b, 29.97 fps
954>>7      byte&0x0F          5              \b, 30 fps
955>>7      byte&0x0F          6              \b, 50 fps
956>>7      byte&0x0F          7              \b, 59.94 fps
957>>7      byte&0x0F          8              \b, 60 fps
958>>11     byte               &0x04          \b, Constrained
959
960# MPEG ADTS Audio (*.mpx/mxa/aac)
961# from dreesen@math.fu-berlin.de
962# modified to fully support MPEG ADTS
963
964# MP3, M1A
965# modified by Joerg Jenderek
966# GRR the original test are too common for many DOS files
967# so don't accept as MP3 until we've tested the rate
9680       beshort&0xFFFE  0xFFFA
969# rates
970>2      byte&0xF0       0x10           MPEG ADTS, layer III, v1,  32 kbps
971!:mime	audio/mpeg
972>2      byte&0xF0       0x20           MPEG ADTS, layer III, v1,  40 kbps
973!:mime	audio/mpeg
974>2      byte&0xF0       0x30           MPEG ADTS, layer III, v1,  48 kbps
975!:mime	audio/mpeg
976>2      byte&0xF0       0x40           MPEG ADTS, layer III, v1,  56 kbps
977!:mime	audio/mpeg
978>2      byte&0xF0       0x50           MPEG ADTS, layer III, v1,  64 kbps
979!:mime	audio/mpeg
980>2      byte&0xF0       0x60           MPEG ADTS, layer III, v1,  80 kbps
981!:mime	audio/mpeg
982>2      byte&0xF0       0x70           MPEG ADTS, layer III, v1,  96 kbps
983!:mime	audio/mpeg
984>2      byte&0xF0       0x80           MPEG ADTS, layer III, v1, 112 kbps
985!:mime	audio/mpeg
986>2      byte&0xF0       0x90           MPEG ADTS, layer III, v1, 128 kbps
987!:mime	audio/mpeg
988>2      byte&0xF0       0xA0           MPEG ADTS, layer III, v1, 160 kbps
989!:mime	audio/mpeg
990>2      byte&0xF0       0xB0           MPEG ADTS, layer III, v1, 192 kbps
991!:mime	audio/mpeg
992>2      byte&0xF0       0xC0           MPEG ADTS, layer III, v1, 224 kbps
993!:mime	audio/mpeg
994>2      byte&0xF0       0xD0           MPEG ADTS, layer III, v1, 256 kbps
995!:mime	audio/mpeg
996>2      byte&0xF0       0xE0           MPEG ADTS, layer III, v1, 320 kbps
997!:mime	audio/mpeg
998# timing
999>2      byte&0x0C       0x00           \b, 44.1 kHz
1000>2      byte&0x0C       0x04           \b, 48 kHz
1001>2      byte&0x0C       0x08           \b, 32 kHz
1002# channels/options
1003>3      byte&0xC0       0x00           \b, Stereo
1004>3      byte&0xC0       0x40           \b, JntStereo
1005>3      byte&0xC0       0x80           \b, 2x Monaural
1006>3      byte&0xC0       0xC0           \b, Monaural
1007#>1     byte            ^0x01          \b, Data Verify
1008#>2     byte            &0x02          \b, Packet Pad
1009#>2     byte            &0x01          \b, Custom Flag
1010#>3     byte            &0x08          \b, Copyrighted
1011#>3     byte            &0x04          \b, Original Source
1012#>3     byte&0x03       1              \b, NR: 50/15 ms
1013#>3     byte&0x03       3              \b, NR: CCIT J.17
1014
1015# MP2, M1A
10160       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
1017!:mime	audio/mpeg
1018# rates
1019>2      byte&0xF0       0x10           \b,  32 kbps
1020>2      byte&0xF0       0x20           \b,  48 kbps
1021>2      byte&0xF0       0x30           \b,  56 kbps
1022>2      byte&0xF0       0x40           \b,  64 kbps
1023>2      byte&0xF0       0x50           \b,  80 kbps
1024>2      byte&0xF0       0x60           \b,  96 kbps
1025>2      byte&0xF0       0x70           \b, 112 kbps
1026>2      byte&0xF0       0x80           \b, 128 kbps
1027>2      byte&0xF0       0x90           \b, 160 kbps
1028>2      byte&0xF0       0xA0           \b, 192 kbps
1029>2      byte&0xF0       0xB0           \b, 224 kbps
1030>2      byte&0xF0       0xC0           \b, 256 kbps
1031>2      byte&0xF0       0xD0           \b, 320 kbps
1032>2      byte&0xF0       0xE0           \b, 384 kbps
1033# timing
1034>2      byte&0x0C       0x00           \b, 44.1 kHz
1035>2      byte&0x0C       0x04           \b, 48 kHz
1036>2      byte&0x0C       0x08           \b, 32 kHz
1037# channels/options
1038>3      byte&0xC0       0x00           \b, Stereo
1039>3      byte&0xC0       0x40           \b, JntStereo
1040>3      byte&0xC0       0x80           \b, 2x Monaural
1041>3      byte&0xC0       0xC0           \b, Monaural
1042#>1     byte            ^0x01          \b, Data Verify
1043#>2     byte            &0x02          \b, Packet Pad
1044#>2     byte            &0x01          \b, Custom Flag
1045#>3     byte            &0x08          \b, Copyrighted
1046#>3     byte            &0x04          \b, Original Source
1047#>3     byte&0x03       1              \b, NR: 50/15 ms
1048#>3     byte&0x03       3              \b, NR: CCIT J.17
1049
1050# MPA, M1A
1051# updated by Joerg Jenderek
1052# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
1053# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
1054# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
1055#0	beshort&0xFFFE		0xFFFE
1056#>2	ubyte&0xF0	>0x0F
1057#>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
1058## rate
1059#>>>2      byte&0xF0       0x10           \b,  32 kbps
1060#>>>2      byte&0xF0       0x20           \b,  64 kbps
1061#>>>2      byte&0xF0       0x30           \b,  96 kbps
1062#>>>2      byte&0xF0       0x40           \b, 128 kbps
1063#>>>2      byte&0xF0       0x50           \b, 160 kbps
1064#>>>2      byte&0xF0       0x60           \b, 192 kbps
1065#>>>2      byte&0xF0       0x70           \b, 224 kbps
1066#>>>2      byte&0xF0       0x80           \b, 256 kbps
1067#>>>2      byte&0xF0       0x90           \b, 288 kbps
1068#>>>2      byte&0xF0       0xA0           \b, 320 kbps
1069#>>>2      byte&0xF0       0xB0           \b, 352 kbps
1070#>>>2      byte&0xF0       0xC0           \b, 384 kbps
1071#>>>2      byte&0xF0       0xD0           \b, 416 kbps
1072#>>>2      byte&0xF0       0xE0           \b, 448 kbps
1073## timing
1074#>>>2      byte&0x0C       0x00           \b, 44.1 kHz
1075#>>>2      byte&0x0C       0x04           \b, 48 kHz
1076#>>>2      byte&0x0C       0x08           \b, 32 kHz
1077## channels/options
1078#>>>3      byte&0xC0       0x00           \b, Stereo
1079#>>>3      byte&0xC0       0x40           \b, JntStereo
1080#>>>3      byte&0xC0       0x80           \b, 2x Monaural
1081#>>>3      byte&0xC0       0xC0           \b, Monaural
1082##>1     byte            ^0x01          \b, Data Verify
1083##>2     byte            &0x02          \b, Packet Pad
1084##>2     byte            &0x01          \b, Custom Flag
1085##>3     byte            &0x08          \b, Copyrighted
1086##>3     byte            &0x04          \b, Original Source
1087##>3     byte&0x03       1              \b, NR: 50/15 ms
1088##>3     byte&0x03       3              \b, NR: CCIT J.17
1089
1090# MP3, M2A
10910       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
1092!:mime	audio/mpeg
1093# rate
1094>2      byte&0xF0       0x10           \b,   8 kbps
1095>2      byte&0xF0       0x20           \b,  16 kbps
1096>2      byte&0xF0       0x30           \b,  24 kbps
1097>2      byte&0xF0       0x40           \b,  32 kbps
1098>2      byte&0xF0       0x50           \b,  40 kbps
1099>2      byte&0xF0       0x60           \b,  48 kbps
1100>2      byte&0xF0       0x70           \b,  56 kbps
1101>2      byte&0xF0       0x80           \b,  64 kbps
1102>2      byte&0xF0       0x90           \b,  80 kbps
1103>2      byte&0xF0       0xA0           \b,  96 kbps
1104>2      byte&0xF0       0xB0           \b, 112 kbps
1105>2      byte&0xF0       0xC0           \b, 128 kbps
1106>2      byte&0xF0       0xD0           \b, 144 kbps
1107>2      byte&0xF0       0xE0           \b, 160 kbps
1108# timing
1109>2      byte&0x0C       0x00           \b, 22.05 kHz
1110>2      byte&0x0C       0x04           \b, 24 kHz
1111>2      byte&0x0C       0x08           \b, 16 kHz
1112# channels/options
1113>3      byte&0xC0       0x00           \b, Stereo
1114>3      byte&0xC0       0x40           \b, JntStereo
1115>3      byte&0xC0       0x80           \b, 2x Monaural
1116>3      byte&0xC0       0xC0           \b, Monaural
1117#>1     byte            ^0x01          \b, Data Verify
1118#>2     byte            &0x02          \b, Packet Pad
1119#>2     byte            &0x01          \b, Custom Flag
1120#>3     byte            &0x08          \b, Copyrighted
1121#>3     byte            &0x04          \b, Original Source
1122#>3     byte&0x03       1              \b, NR: 50/15 ms
1123#>3     byte&0x03       3              \b, NR: CCIT J.17
1124
1125# MP2, M2A
11260       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
1127!:mime	audio/mpeg
1128# rate
1129>2      byte&0xF0       0x10           \b,   8 kbps
1130>2      byte&0xF0       0x20           \b,  16 kbps
1131>2      byte&0xF0       0x30           \b,  24 kbps
1132>2      byte&0xF0       0x40           \b,  32 kbps
1133>2      byte&0xF0       0x50           \b,  40 kbps
1134>2      byte&0xF0       0x60           \b,  48 kbps
1135>2      byte&0xF0       0x70           \b,  56 kbps
1136>2      byte&0xF0       0x80           \b,  64 kbps
1137>2      byte&0xF0       0x90           \b,  80 kbps
1138>2      byte&0xF0       0xA0           \b,  96 kbps
1139>2      byte&0xF0       0xB0           \b, 112 kbps
1140>2      byte&0xF0       0xC0           \b, 128 kbps
1141>2      byte&0xF0       0xD0           \b, 144 kbps
1142>2      byte&0xF0       0xE0           \b, 160 kbps
1143# timing
1144>2      byte&0x0C       0x00           \b, 22.05 kHz
1145>2      byte&0x0C       0x04           \b, 24 kHz
1146>2      byte&0x0C       0x08           \b, 16 kHz
1147# channels/options
1148>3      byte&0xC0       0x00           \b, Stereo
1149>3      byte&0xC0       0x40           \b, JntStereo
1150>3      byte&0xC0       0x80           \b, 2x Monaural
1151>3      byte&0xC0       0xC0           \b, Monaural
1152#>1     byte            ^0x01          \b, Data Verify
1153#>2     byte            &0x02          \b, Packet Pad
1154#>2     byte            &0x01          \b, Custom Flag
1155#>3     byte            &0x08          \b, Copyrighted
1156#>3     byte            &0x04          \b, Original Source
1157#>3     byte&0x03       1              \b, NR: 50/15 ms
1158#>3     byte&0x03       3              \b, NR: CCIT J.17
1159
1160# MPA, M2A
11610       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
1162!:mime	audio/mpeg
1163# rate
1164>2      byte&0xF0       0x10           \b,  32 kbps
1165>2      byte&0xF0       0x20           \b,  48 kbps
1166>2      byte&0xF0       0x30           \b,  56 kbps
1167>2      byte&0xF0       0x40           \b,  64 kbps
1168>2      byte&0xF0       0x50           \b,  80 kbps
1169>2      byte&0xF0       0x60           \b,  96 kbps
1170>2      byte&0xF0       0x70           \b, 112 kbps
1171>2      byte&0xF0       0x80           \b, 128 kbps
1172>2      byte&0xF0       0x90           \b, 144 kbps
1173>2      byte&0xF0       0xA0           \b, 160 kbps
1174>2      byte&0xF0       0xB0           \b, 176 kbps
1175>2      byte&0xF0       0xC0           \b, 192 kbps
1176>2      byte&0xF0       0xD0           \b, 224 kbps
1177>2      byte&0xF0       0xE0           \b, 256 kbps
1178# timing
1179>2      byte&0x0C       0x00           \b, 22.05 kHz
1180>2      byte&0x0C       0x04           \b, 24 kHz
1181>2      byte&0x0C       0x08           \b, 16 kHz
1182# channels/options
1183>3      byte&0xC0       0x00           \b, Stereo
1184>3      byte&0xC0       0x40           \b, JntStereo
1185>3      byte&0xC0       0x80           \b, 2x Monaural
1186>3      byte&0xC0       0xC0           \b, Monaural
1187#>1     byte            ^0x01          \b, Data Verify
1188#>2     byte            &0x02          \b, Packet Pad
1189#>2     byte            &0x01          \b, Custom Flag
1190#>3     byte            &0x08          \b, Copyrighted
1191#>3     byte            &0x04          \b, Original Source
1192#>3     byte&0x03       1              \b, NR: 50/15 ms
1193#>3     byte&0x03       3              \b, NR: CCIT J.17
1194
1195# MP3, M25A
11960       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
1197!:mime	audio/mpeg
1198# rate
1199>2      byte&0xF0       0x10           \b,   8 kbps
1200>2      byte&0xF0       0x20           \b,  16 kbps
1201>2      byte&0xF0       0x30           \b,  24 kbps
1202>2      byte&0xF0       0x40           \b,  32 kbps
1203>2      byte&0xF0       0x50           \b,  40 kbps
1204>2      byte&0xF0       0x60           \b,  48 kbps
1205>2      byte&0xF0       0x70           \b,  56 kbps
1206>2      byte&0xF0       0x80           \b,  64 kbps
1207>2      byte&0xF0       0x90           \b,  80 kbps
1208>2      byte&0xF0       0xA0           \b,  96 kbps
1209>2      byte&0xF0       0xB0           \b, 112 kbps
1210>2      byte&0xF0       0xC0           \b, 128 kbps
1211>2      byte&0xF0       0xD0           \b, 144 kbps
1212>2      byte&0xF0       0xE0           \b, 160 kbps
1213# timing
1214>2      byte&0x0C       0x00           \b, 11.025 kHz
1215>2      byte&0x0C       0x04           \b, 12 kHz
1216>2      byte&0x0C       0x08           \b, 8 kHz
1217# channels/options
1218>3      byte&0xC0       0x00           \b, Stereo
1219>3      byte&0xC0       0x40           \b, JntStereo
1220>3      byte&0xC0       0x80           \b, 2x Monaural
1221>3      byte&0xC0       0xC0           \b, Monaural
1222#>1     byte            ^0x01          \b, Data Verify
1223#>2     byte            &0x02          \b, Packet Pad
1224#>2     byte            &0x01          \b, Custom Flag
1225#>3     byte            &0x08          \b, Copyrighted
1226#>3     byte            &0x04          \b, Original Source
1227#>3     byte&0x03       1              \b, NR: 50/15 ms
1228#>3     byte&0x03       3              \b, NR: CCIT J.17
1229
1230# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
1231
1232# Stored AAC streams (instead of the MP4 format)
12330       string          ADIF           MPEG ADIF, AAC
1234!:mime	audio/x-hx-aac-adif
1235>4      byte            &0x80
1236>>13    byte            &0x10          \b, VBR
1237>>13    byte            ^0x10          \b, CBR
1238>>16    byte&0x1E       0x02           \b, single stream
1239>>16    byte&0x1E       0x04           \b, 2 streams
1240>>16    byte&0x1E       0x06           \b, 3 streams
1241>>16    byte            &0x08          \b, 4 or more streams
1242>>16    byte            &0x10          \b, 8 or more streams
1243>>4    byte            &0x80          \b, Copyrighted
1244>>13   byte            &0x40          \b, Original Source
1245>>13   byte            &0x20          \b, Home Flag
1246>4      byte            ^0x80
1247>>4     byte            &0x10          \b, VBR
1248>>4     byte            ^0x10          \b, CBR
1249>>7     byte&0x1E       0x02           \b, single stream
1250>>7     byte&0x1E       0x04           \b, 2 streams
1251>>7     byte&0x1E       0x06           \b, 3 streams
1252>>7     byte            &0x08          \b, 4 or more streams
1253>>7     byte            &0x10          \b, 8 or more streams
1254>>4    byte            &0x40          \b, Original Stream(s)
1255>>4    byte            &0x20          \b, Home Source
1256
1257# Live or stored single AAC stream (used with MPEG-2 systems)
12580       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
1259!:mime	audio/x-hx-aac-adts
1260>1      byte            &0x08          \b, v2
1261>1      byte            ^0x08          \b, v4
1262# profile
1263>>2     byte            &0xC0          \b LTP
1264>2      byte&0xc0       0x00           \b Main
1265>2      byte&0xc0       0x40           \b LC
1266>2      byte&0xc0       0x80           \b SSR
1267# timing
1268>2      byte&0x3c       0x00           \b, 96 kHz
1269>2      byte&0x3c       0x04           \b, 88.2 kHz
1270>2      byte&0x3c       0x08           \b, 64 kHz
1271>2      byte&0x3c       0x0c           \b, 48 kHz
1272>2      byte&0x3c       0x10           \b, 44.1 kHz
1273>2      byte&0x3c       0x14           \b, 32 kHz
1274>2      byte&0x3c       0x18           \b, 24 kHz
1275>2      byte&0x3c       0x1c           \b, 22.05 kHz
1276>2      byte&0x3c       0x20           \b, 16 kHz
1277>2      byte&0x3c       0x24           \b, 12 kHz
1278>2      byte&0x3c       0x28           \b, 11.025 kHz
1279>2      byte&0x3c       0x2c           \b, 8 kHz
1280# channels
1281>2      beshort&0x01c0  0x0040         \b, monaural
1282>2      beshort&0x01c0  0x0080         \b, stereo
1283>2      beshort&0x01c0  0x00c0         \b, stereo + center
1284>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
1285>2      beshort&0x01c0  0x0140         \b, surround
1286>2      beshort&0x01c0  0x0180         \b, surround + LFE
1287>2      beshort         &0x01C0        \b, surround + side
1288#>1     byte            ^0x01           \b, Data Verify
1289#>2     byte            &0x02           \b, Custom Flag
1290#>3     byte            &0x20           \b, Original Stream
1291#>3     byte            &0x10           \b, Home Source
1292#>3     byte            &0x08           \b, Copyrighted
1293
1294# Live MPEG-4 audio streams (instead of RTP FlexMux)
12950       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
1296!:mime	audio/x-mp4a-latm
1297#>1     beshort&0x1FFF  x              \b, %hu byte packet
1298>3      byte&0xE0       0x40
1299>>4     byte&0x3C       0x04           \b, single stream
1300>>4     byte&0x3C       0x08           \b, 2 streams
1301>>4     byte&0x3C       0x0C           \b, 3 streams
1302>>4     byte            &0x08          \b, 4 or more streams
1303>>4     byte            &0x20          \b, 8 or more streams
1304>3      byte&0xC0       0
1305>>4     byte&0x78       0x08           \b, single stream
1306>>4     byte&0x78       0x10           \b, 2 streams
1307>>4     byte&0x78       0x18           \b, 3 streams
1308>>4     byte            &0x20          \b, 4 or more streams
1309>>4     byte            &0x40          \b, 8 or more streams
1310# This magic isn't strong enough (matches plausible ISO-8859-1 text)
1311#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
1312#!:mime	audio/x-mp4a-latm
1313
1314# Summary: FLI animation format
1315# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1316# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
13174	leshort		0xAF11
1318# standard FLI always has 320x200 resolution and 8 bit color
1319>8	leshort		320
1320>>10	leshort		200
1321>>>12	leshort		8			FLI animation, 320x200x8
1322!:mime	video/x-fli
1323>>>>6	leshort		x			\b, %d frames
1324# frame speed is multiple of 1/70s
1325>>>>16	leshort		x			\b, %d/70s per frame
1326
1327# Summary: FLC animation format
1328# Created by: Daniel Quinlan <quinlan@yggdrasil.com>
1329# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection)
13304	leshort		0xAF12
1331# standard FLC always use 8 bit color
1332>12	leshort		8			FLC animation
1333!:mime	video/x-flc
1334>>8	leshort		x			\b, %d
1335>>10	leshort		x			\bx%dx8
1336>>6	uleshort	x			\b, %d frames
1337>>16	uleshort	x			\b, %dms per frame
1338
1339# DL animation format
1340# XXX - collision with most `mips' magic
1341#
1342# I couldn't find a real magic number for these, however, this
1343# -appears- to work.  Note that it might catch other files, too, so be
1344# careful!
1345#
1346# Note that title and author appear in the two 20-byte chunks
1347# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
1348# 255 (hex FF)!  The DL format is really bad.
1349#
1350#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
1351#!:mime	video/x-unknown
1352#>42	byte	x	- %d screens,
1353#>43	byte	x	%d commands
1354#0	byte	2	DL version 2
1355#!:mime	video/x-unknown
1356#>1	byte	1	- large format (320x200,1 image/screen),
1357#>1	byte	2	- medium format (160x100,4 images/screen),
1358#>1	byte	>2	- unknown format,
1359#>42	byte	x	%d screens,
1360#>43	byte	x	%d commands
1361# Based on empirical evidence, DL version 3 have several nulls following the
1362# \003.  Most of them start with non-null values at hex offset 0x34 or so.
1363#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
1364
1365# iso 13818 transport stream
1366#
1367# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
1368# syncbyte      8 bit	0x47
1369# error_ind     1 bit	-
1370# payload_start 1 bit	1
1371# priority      1 bit	-
1372# PID          13 bit	0x0000
1373# scrambling    2 bit	-
1374# adaptfld_ctrl 2 bit	1 or 3
1375# conti_count   4 bit	-
13760	belong&0xFF5FFF10	0x47400010
1377>188	byte			0x47		MPEG transport stream data
1378
1379# DIF digital video file format <mpruett@sgi.com>
13800	belong&0xffffff00	0x1f070000      DIF
1381>4	byte			&0x01		(DVCPRO) movie file
1382>4	byte			^0x01		(DV) movie file
1383>3	byte			&0x80		(PAL)
1384>3	byte			^0x80		(NTSC)
1385
1386# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
13870	belong			0x3026b275	Microsoft ASF
1388!:mime  video/x-ms-asf
1389
1390# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
13910	string			\x8aMNG		MNG video data,
1392!:mime	video/x-mng
1393>4	belong			!0x0d0a1a0a	CORRUPTED,
1394>4	belong			0x0d0a1a0a
1395>>16    belong	x				%d x
1396>>20    belong	x				%d
1397
1398# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
13990	string			\x8bJNG		JNG video data,
1400!:mime	video/x-jng
1401>4	belong			!0x0d0a1a0a	CORRUPTED,
1402>4	belong			0x0d0a1a0a
1403>>16    belong	x				%d x
1404>>20    belong	x				%d
1405
1406# Vivo video (Wolfram Kleff)
14073	string		\x0D\x0AVersion:Vivo	Vivo video data
1408
1409# VRML (Virtual Reality Modelling Language)
14100       string/w        #VRML\ V1.0\ ascii	VRML 1 file
1411!:mime	model/vrml
14120	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
1413!:mime	model/vrml
1414
1415# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
1416# From Michel Briand <michelbriand@free.fr>
1417# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
1418# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
14190	string/w	\<?xml\ version=
1420!:strength + 5
1421>20	search/1000/w	\<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
1422!:mime model/x3d+xml
1423
1424#---------------------------------------------------------------------------
1425# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
1426# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
1427#
14280	string		HVQM4		%s
1429>6	string		>\0		v%s
1430>0	byte		x		GameCube movie,
1431>0x34	ubeshort	x		%d x
1432>0x36	ubeshort	x		%d,
1433>0x26	ubeshort	x		%dus,
1434>0x42	ubeshort	0		no audio
1435>0x42	ubeshort	>0		%dHz audio
1436
1437# From: "Stefan A. Haubenthal" <polluks@web.de>
14380	string		DVDVIDEO-VTS	Video title set,
1439>0x21	byte		x		v%x
14400	string		DVDVIDEO-VMG	Video manager,
1441>0x21	byte		x		v%x
1442
1443# From: Behan Webster <behanw@websterwood.com>
1444# NuppelVideo used by Mythtv (*.nuv)
1445# Note: there are two identical stanzas here differing only in the
1446# initial string matched. It used to be done with a regex, but we're
1447# trying to get rid of those.
14480	string		NuppelVideo	MythTV NuppelVideo
1449>12	string		x		v%s
1450>20	lelong		x		(%d
1451>24	lelong		x		\bx%d),
1452>36	string		P		\bprogressive,
1453>36	string		I		\binterlaced,
1454>40	ledouble	x		\baspect:%.2f,
1455>48	ledouble	x		\bfps:%.2f
14560	string		MythTV		MythTV NuppelVideo
1457>12	string		x		v%s
1458>20	lelong		x		(%d
1459>24	lelong		x		\bx%d),
1460>36	string		P		\bprogressive,
1461>36	string		I		\binterlaced,
1462>40	ledouble	x		\baspect:%.2f,
1463>48	ledouble	x		\bfps:%.2f
1464
1465#						MPEG file
1466# MPEG sequences
1467# FIXME: This section is from the old magic.mime file and needs
1468# integrating with the rest
1469#0       belong             0x000001BA
1470#>4      byte               &0x40
1471#!:mime	video/mp2p
1472#>4      byte               ^0x40
1473#!:mime	video/mpeg
1474#0       belong             0x000001BB
1475#!:mime	video/mpeg
1476#0       belong             0x000001B0
1477#!:mime	video/mp4v-es
1478#0       belong             0x000001B5
1479#!:mime	video/mp4v-es
1480#0       belong             0x000001B3
1481#!:mime	video/mpv
1482#0       belong&0xFF5FFF10  0x47400010
1483#!:mime	video/mp2t
1484#0       belong             0x00000001
1485#>4      byte&0x1F	   0x07
1486#!:mime	video/h264
1487
1488# Type: Bink Video
1489# Extension: .bik
1490# URL:  http://wiki.multimedia.cx/index.php?title=Bink_Container
1491# From: <hoehle@users.sourceforge.net>  2008-07-18
14920	string		BIK	Bink Video
1493>3	regex		=[a-z]	rev.%s
1494#>4	ulelong		x	size %d
1495>20	ulelong		x	\b, %d
1496>24	ulelong		x	\bx%d
1497>8	ulelong		x	\b, %d frames
1498>32	ulelong		x	at rate %d/
1499>28	ulelong		>1	\b%d
1500>40	ulelong		=0	\b, no audio
1501>40	ulelong		!0	\b, %d audio track
1502>>40	ulelong		!1	\bs
1503# follow properties of the first audio track only
1504>>48	uleshort	x	%dHz
1505>>51	byte&0x20	0	mono
1506>>51	byte&0x20	!0	stereo
1507#>>51	byte&0x10	0	FFT
1508#>>51	byte&0x10	!0	DCT
1509
1510# Type:	NUT Container
1511# URL:	http://wiki.multimedia.cx/index.php?title=NUT
1512# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
15130	string	nut/multimedia\ container\0	NUT multimedia container
1514
1515# Type: Nullsoft Video (NSV)
1516# URL:  http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
1517# From: Mike Melanson <mike@multimedia.cx>
15180	string	NSVf	Nullsoft Video
1519
1520# Type: REDCode Video
1521# URL:  http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
1522# From: Mike Melanson <mike@multimedia.cx>
15234	string	RED1	REDCode Video
1524
1525# Type: MTV Multimedia File
1526# URL:  http://wiki.multimedia.cx/index.php?title=MTV
1527# From: Mike Melanson <mike@multimedia.cx>
15280	string	AMVS	MTV Multimedia File
1529
1530# Type: ARMovie
1531# URL:  http://wiki.multimedia.cx/index.php?title=ARMovie
1532# From: Mike Melanson <mike@multimedia.cx>
15330	string	ARMovie\012	ARMovie
1534
1535# Type: Interplay MVE Movie
1536# URL:  http://wiki.multimedia.cx/index.php?title=Interplay_MVE
1537# From: Mike Melanson <mike@multimedia.cx>
15380	string	Interplay\040MVE\040File\032	Interplay MVE Movie
1539
1540# Type: Windows Television DVR File
1541# URL:  http://wiki.multimedia.cx/index.php?title=WTV
1542# From: Mike Melanson <mike@mutlimedia.cx>
1543# This takes the form of a Windows-style GUID
15440	bequad	0xB7D800203749DA11
1545>8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media
1546
1547# Type: Sega FILM/CPK Multimedia
1548# URL:  http://wiki.multimedia.cx/index.php?title=Sega_FILM
1549# From: Mike Melanson <mike@multimedia.cx>
15500	string	FILM	Sega FILM/CPK Multimedia,
1551>32	belong	x	%d x
1552>28	belong	x	%d
1553
1554# Type: Nintendo THP Multimedia
1555# URL:  http://wiki.multimedia.cx/index.php?title=THP
1556# From: Mike Melanson <mike@multimedia.cx>
15570	string	THP\0	Nintendo THP Multimedia
1558
1559# Type: BBC Dirac Video
1560# URL:  http://wiki.multimedia.cx/index.php?title=Dirac
1561# From: Mike Melanson <mike@multimedia.cx>
15620	string	BBCD	BBC Dirac Video
1563
1564# Type: RAD Game Tools Smacker Multimedia
1565# URL:  http://wiki.multimedia.cx/index.php?title=Smacker
1566# From: Mike Melanson <mike@multimedia.cx>
15670	string	SMK	RAD Game Tools Smacker Multimedia
1568>3	byte	x	version %c,
1569>4	lelong	x	%d x
1570>8	lelong	x	%d,
1571>12	lelong	x	%d frames
1572
1573# Material Exchange Format
1574# More information:
1575# https://en.wikipedia.org/wiki/Material_Exchange_Format
1576# http://www.freemxf.org/
15770	string	\x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02	Material exchange container format
1578!:ext	mxf
1579!:mime	application/mxf
1580
1581# Recognize LucasArts Smush video files (cf.
1582# https://wiki.multimedia.cx/index.php/Smush)
15830	string	ANIM
1584>8	string	AHDR	LucasArts Smush Animation Format (SAN) video
15850	string	SANM
1586>8	string	SHDR	LucasArts Smush v2 (SANM) video
1587
1588#------------------------------------------------------------------------------
1589# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
1590# aout:  file(1) magic for a.out executable/object/etc entries that
1591# handle executables on multiple platforms.
1592#
1593
1594#
1595# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
1596# BSDI), netbsd, and vax (for UNIX/32V and BSD)
1597#
1598# XXX - is there anything we can look at to distinguish BSD/OS 386 from
1599# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
1600# works only for binaries using shared libraries.  Grabbing the entry
1601# point from the a.out header, using it to find the first code executed
1602# in the program, and looking at that might help.
1603#
16040	lelong		0407		a.out little-endian 32-bit executable
1605>16	lelong		>0		not stripped
1606>32	byte		0x6a		(uses BSD/OS shared libs)
1607
16080	lelong		0410		a.out little-endian 32-bit pure executable
1609>16	lelong		>0		not stripped
1610>32	byte		0x6a		(uses BSD/OS shared libs)
1611
16120	lelong		0413		a.out little-endian 32-bit demand paged pure executable
1613>16	lelong		>0		not stripped
1614>32	byte		0x6a		(uses BSD/OS shared libs)
1615
1616#
1617# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
1618# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
1619#
1620# XXX - is there anything we can look at to distinguish old SunOS 68010
1621# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
1622# the first instruction or instructions in the program.
1623#
16240	belong		0407		a.out big-endian 32-bit executable
1625>16	belong		>0		not stripped
1626
16270	belong		0410		a.out big-endian 32-bit pure executable
1628>16	belong		>0		not stripped
1629
16300	belong		0413		a.out big-endian 32-bit demand paged executable
1631>16	belong		>0		not stripped
1632
1633
1634#------------------------------------------------------------------------------
1635# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
1636# apache: file(1) magic for Apache Big Data formats
1637
1638# Avro files
16390	string		Obj		Apache Avro
1640>3	byte		x		version %d
1641
1642# ORC files
1643# Important information is in file footer, which we can't index to :(
16440	string		ORC		Apache ORC
1645
1646# Parquet files
16470	string		PAR1		Apache Parquet
1648
1649# Hive RC files
16500	string		RCF		Apache Hive RC file
1651>3	byte		x		version %d
1652
1653# Sequence files (and the careless first version of RC file)
1654
16550	string		SEQ
1656>3	byte		<6		Apache Hadoop Sequence file version %d
1657>3	byte		>6		Apache Hadoop Sequence file version %d
1658>3	byte		=6
1659>>5	string		org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer  Apache Hive RC file version 0
1660>>3	default		x		Apache Hadoop Sequence file version 6
1661
1662#------------------------------------------------------------------------------
1663# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
1664# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
1665#       workspaces)
1666#
16670	long		0100554		APL workspace (Ken's original?)
1668
1669#------------------------------------------------------------------------------
1670# $File: apple,v 1.39 2018/03/02 15:26:39 christos Exp $
1671# apple:  file(1) magic for Apple file formats
1672#
16730	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
16740	string		\x0aGL			Binary II (apple ][) data
16750	string		\x76\xff		Squeezed (apple ][) data
16760	string		NuFile			NuFile archive (apple ][) data
16770	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
16780	belong		0x00051600		AppleSingle encoded Macintosh file
16790	belong		0x00051607		AppleDouble encoded Macintosh file
1680
1681# Type: Apple Emulator 2IMG format
1682# From: Radek Vokal <rvokal@redhat.com>
16830	string		2IMG	Apple ][ 2IMG Disk Image
1684>4	string		XGS!	\b, XGS
1685>4	string		CTKG	\b, Catakig
1686>4	string		ShIm	\b, Sheppy's ImageMaker
1687>4	string		WOOF	\b, Sweet 16
1688>4	string		B2TR	\b, Bernie ][ the Rescue
1689>4	string		!nfc	\b, ASIMOV2
1690>4	string		x	\b, Unknown Format
1691>0xc	byte		00	\b, DOS 3.3 sector order
1692>>0x10	byte		00	\b, Volume 254
1693>>0x10	byte&0x7f	x	\b, Volume %u
1694>0xc	byte		01	\b, ProDOS sector order
1695>>0x14	short		x	\b, %u Blocks
1696>0xc	byte		02	\b, NIB data
1697
1698# magic for Newton PDA package formats
1699# from Ruda Moura <ruda@helllabs.org>
17000	string	package0	Newton package, NOS 1.x,
1701>12	belong	&0x80000000	AutoRemove,
1702>12	belong	&0x40000000	CopyProtect,
1703>12	belong	&0x10000000	NoCompression,
1704>12	belong	&0x04000000	Relocation,
1705>12	belong	&0x02000000	UseFasterCompression,
1706>16	belong	x		version %d
1707
17080	string	package1	Newton package, NOS 2.x,
1709>12	belong	&0x80000000	AutoRemove,
1710>12	belong	&0x40000000	CopyProtect,
1711>12	belong	&0x10000000	NoCompression,
1712>12	belong	&0x04000000	Relocation,
1713>12	belong	&0x02000000	UseFasterCompression,
1714>16	belong	x		version %d
1715
17160	string	package4	Newton package,
1717>8	byte	8		NOS 1.x,
1718>8	byte	9		NOS 2.x,
1719>12	belong	&0x80000000	AutoRemove,
1720>12	belong	&0x40000000	CopyProtect,
1721>12	belong	&0x10000000	NoCompression,
1722
1723# The following entries for the Apple II are for files that have
1724# been transferred as raw binary data from an Apple, without having
1725# been encapsulated by any of the above archivers.
1726#
1727# In general, Apple II formats are hard to identify because Apple DOS
1728# and especially Apple ProDOS have strong typing in the file system and
1729# therefore programmers never felt much need to include type information
1730# in the files themselves.
1731#
1732# Eric Fischer <enf@pobox.com>
1733
1734# AppleWorks word processor:
1735# URL: https://en.wikipedia.org/wiki/AppleWorks
1736# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
1737# Update: Joerg Jenderek
1738# NOTE:
1739# The "O" is really the magic number, but that's so common that it's
1740# necessary to check the tab stops that follow it to avoid false positives.
1741# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
1742# the newer AppleWorks is from claris with extension CWK
17434	string		O
1744# test for unused bits of zoom- , paginated-boolean bytes
1745>84	ubequad		^0x00Fe00000000Fe00
1746# look for tabstop definitions "=" no tab, "|" no tab
1747# "<" left tab,"^" center tab,">" right tab, "." decimal tab,
1748# unofficial "!" other , "\x8a" other
1749# official only if SFMinVers is nonzero
1750>>5	regex/s	[=.<>|!^\x8a]{79}	AppleWorks Word Processor
1751# AppleWorks Word Processor File (Apple II)
1752# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data"
1753# application/x-appleworks is mime type for claris version with cwk extension
1754!:mime	application/x-appleworks3
1755# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
1756# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
1757# $70 $1A $F8 $FF is this the apple type ?
1758#:apple pdosp��
1759!:ext awp
1760# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
1761>>>183	ubyte		30	3.0
1762>>>183	ubyte		!30
1763>>>>183	ubyte		!0	0x%x
1764# usual tabstop start sequence "=====<"
1765>>>5	string		x	\b, tabstop ruler "%6.6s"
1766# tabstop ruler
1767#>>>5	string		>\0	\b, tabstops "%-79s"
1768# zoom switch
1769>>>85	  byte&0x01	>0	\b, zoomed
1770# whether paginated
1771>>>90	  byte&0x01	>0	\b, paginated
1772# contains any mail-merge commands
1773>>>92	  byte&0x01	>0	\b, with mail merge
1774# left margin in 1/10 inches ( normally 0 or 10 )
1775>>>91	ubyte		>0
1776>>>>91	ubyte		x	\b, %d/10 inch left margin
1777
1778# AppleWorks database:
1779#
1780# This isn't really a magic number, but it's the closest thing to one
1781# that I could find.  The 1 and 2 really mean "order in which you defined
1782# categories" and "left to right, top to bottom," respectively; the D and R
1783# mean that the cursor should move either down or right when you press Return.
1784
1785#30	string		\x01D	AppleWorks database data
1786#30	string		\x02D	AppleWorks database data
1787#30	string		\x01R	AppleWorks database data
1788#30	string		\x02R	AppleWorks database data
1789
1790# AppleWorks spreadsheet:
1791#
1792# Likewise, this isn't really meant as a magic number.  The R or C means
1793# row- or column-order recalculation; the A or M means automatic or manual
1794# recalculation.
1795
1796#131	string		RA	AppleWorks spreadsheet data
1797#131	string		RM	AppleWorks spreadsheet data
1798#131	string		CA	AppleWorks spreadsheet data
1799#131	string		CM	AppleWorks spreadsheet data
1800
1801# Applesoft BASIC:
1802#
1803# This is incredibly sloppy, but will be true if the program was
1804# written at its usual memory location of 2048 and its first line
1805# number is less than 256.  Yuck.
1806# update by Joerg Jenderek at Feb 2013
1807
1808# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
1809#0       belong&0xff00ff 0x80000 Applesoft BASIC program data
18100	belong&0x00ff00ff	0x00080000
1811# assuming that line number must be positive
1812>2	leshort			>0		Applesoft BASIC program data, first line number %d
1813#>2     leshort         x       \b, first line number %d
1814
1815# ORCA/EZ assembler:
1816#
1817# This will not identify ORCA/M source files, since those have
1818# some sort of date code instead of the two zero bytes at 6 and 7
1819# XXX Conflicts with ELF
1820#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
1821#>5      byte                    x               \b, build number %d
1822
1823# Broderbund Fantavision
1824#
1825# I don't know what these values really mean, but they seem to recur.
1826# Will they cause too many conflicts?
1827
1828# Probably :-)
1829#2	belong&0xFF00FF		0x040008	Fantavision movie data
1830
1831# Some attempts at images.
1832#
1833# These are actually just bit-for-bit dumps of the frame buffer, so
1834# there's really no reasonably way to distinguish them except for their
1835# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
1836# or, occasionally, 8184.
1837#
1838# Nevertheless this will manage to catch a lot of images that happen
1839# to have a solid-colored line at the bottom of the screen.
1840
1841# GRR: Magic too weak
1842#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
1843#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
1844#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
1845#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
1846#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
1847
1848# Beagle Bros. Apple Mechanic fonts
1849
18500	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
1851
1852# Apple Universal Disk Image Format (UDIF) - dmg files.
1853# From Johan Gade.
1854# These entries are disabled for now until we fix the following issues.
1855#
1856# Note there might be some problems with the "VAX COFF executable"
1857# entry. Note this entry should be placed before the mac filesystem section,
1858# particularly the "Apple Partition data" entry.
1859#
1860# The intended meaning of these tests is, that the file is only of the
1861# specified type if both of the lines are correct - i.e. if the first
1862# line matches and the second doesn't then it is not of that type.
1863#
1864#0	long	0x7801730d
1865#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
1866#
1867# Note that this entry is recognized correctly by the "Apple Partition
1868# data" entry - however since this entry is more specific - this
1869# information seems to be more useful.
1870#0	long	0x45520200
1871#>0x410	string	disk\ image	UDIF read/write image (UDRW)
1872
1873# From: Toby Peterson <toby@apple.com>
18740	string	bplist00	Apple binary property list
1875
1876# Apple binary property list (bplist)
1877#  Assumes version bytes are hex.
1878#  Provides content hints for version 0 files. Assumes that the root
1879#  object is the first object (true for CoreFoundation implementation).
1880# From: David Remahl <dremahl@apple.com>
18810		string	bplist
1882>6		byte	x	\bCoreFoundation binary property list data, version 0x%c
1883>>7		byte	x	\b%c
1884>6		string		00		\b
1885>>8		byte&0xF0	0x00	\b
1886>>>8	byte&0x0F	0x00	\b, root type: null
1887>>>8	byte&0x0F	0x08	\b, root type: false boolean
1888>>>8	byte&0x0F	0x09	\b, root type: true boolean
1889>>8		byte&0xF0	0x10	\b, root type: integer
1890>>8		byte&0xF0	0x20	\b, root type: real
1891>>8		byte&0xF0	0x30	\b, root type: date
1892>>8		byte&0xF0	0x40    \b, root type: data
1893>>8		byte&0xF0	0x50	\b, root type: ascii string
1894>>8		byte&0xF0	0x60	\b, root type: unicode string
1895>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
1896>>8		byte&0xF0	0xa0	\b, root type: array
1897>>8		byte&0xF0	0xd0	\b, root type: dictionary
1898
1899# Apple/NeXT typedstream data
1900#  Serialization format used by NeXT and Apple for various
1901#  purposes in YellowStep/Cocoa, including some nib files.
1902# From: David Remahl <dremahl@apple.com>
19032		string		typedstream	NeXT/Apple typedstream data, big endian
1904>0		byte		x		\b, version %d
1905>0		byte		<5		\b
1906>>13	byte		0x81	\b
1907>>>14	ubeshort	x		\b, system %d
19082		string		streamtyped NeXT/Apple typedstream data, little endian
1909>0		byte		x		\b, version %d
1910>0		byte		<5		\b
1911>>13	byte		0x81	\b
1912>>>14	uleshort	x		\b, system %d
1913
1914#------------------------------------------------------------------------------
1915# CAF: Apple CoreAudio File Format
1916#
1917# Container format for high-end audio purposes.
1918# From: David Remahl <dremahl@apple.com>
1919#
19200	string		caff		CoreAudio Format audio file
1921>4	beshort		<10		version %d
1922>6	beshort		x
1923
1924
1925#------------------------------------------------------------------------------
1926# Keychain database files
19270	string		kych		Mac OS X Keychain File
1928
1929#------------------------------------------------------------------------------
1930# Code Signing related file types
19310	belong		0xfade0c00	Mac OS X Code Requirement
1932>8	belong		1			(opExpr)
1933>4	belong		x			- %d bytes
1934
19350	belong		0xfade0c01	Mac OS X Code Requirement Set
1936>8	belong		>1			containing %d items
1937>4	belong		x			- %d bytes
1938
19390	belong		0xfade0c02	Mac OS X Code Directory
1940>8	belong		x			version %x
1941>12	belong		>0			flags 0x%x
1942>4	belong		x			- %d bytes
1943
19440	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
1945>4	belong		x			- %d bytes
1946
19470	belong		0xfade0cc1	Mac OS X Detached Code Signature
1948>8	belong		>1			(%d elements)
1949>4	belong		x			- %d bytes
1950
1951# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
1952# .vdi
19534	string innotek\ VirtualBox\ Disk\ Image %s
1954
1955# Apple disk partition stuff
1956# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
1957# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
1958# Update: Joerg Jenderek
1959# "ER" is APPLE_DRVR_MAP_MAGIC signature
19600	beshort	0x4552
1961# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
1962#!:strength +0
1963# strengthen the magic by looking for used blocksizes 512 2048
1964>2	ubeshort&0xf1FF		0	Apple Driver Map
1965# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
1966#>>504	ubequad&0x0000FFffFFff0000	0
1967!:mime	application/x-apple-diskimage
1968!:apple	????devr
1969# https://en.wikipedia.org/wiki/Apple_Disk_Image
1970!:ext	dmg/iso
1971# sbBlkSize for driver descriptor map 512 2048
1972>>2	beshort	x			\b, blocksize %d
1973# sbBlkCount sometimes garbish like
1974# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
1975# 0xf2720100 for bunziped Firefox 48.0-2.dmg
1976# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
1977# 0x00009090 by syslinux-6.03/utils/isohybrid.c
1978>>4	ubelong	x			\b, blockcount %u
1979# following device/driver information not very useful
1980# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
1981>>8	ubeshort	x		\b, devtype %u
1982# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
1983>>10	ubeshort	x		\b, devid %u
1984# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
1985>>12	ubelong		>0
1986>>>12	ubelong		x		\b, driver data %u
1987# number of driver descriptors sbDrvrCount <= 61
1988# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
1989>>16	ubeshort	x		\b, driver count %u
1990# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
1991# >>18	use		apple-driver-map
1992# >>26	use		apple-driver-map
1993# # ...
1994# >>500	use		apple-driver-map
1995# number of partitions is always same in every partition (map block count)
1996#>>0x0204	ubelong		x	\b, %u partitions
1997>>0x0204	ubelong		>0	\b, contains[@0x200]:
1998>>>0x0200	use		apple-apm
1999>>0x0204	ubelong		>1	\b, contains[@0x400]:
2000>>>0x0400	use		apple-apm
2001>>0x0204	ubelong		>2	\b, contains[@0x600]:
2002>>>0x0600	use		apple-apm
2003>>0x0204	ubelong		>3	\b, contains[@0x800]:
2004>>>0x0800	use		apple-apm
2005>>0x0204	ubelong		>4	\b, contains[@0xA00]:
2006>>>0x0A00	use		apple-apm
2007>>0x0204	ubelong		>5	\b, contains[@0xC00]:
2008>>>0x0C00	use		apple-apm
2009>>0x0204	ubelong		>6	\b, contains[@0xE00]:
2010>>>0x0E00	use		apple-apm
2011>>0x0204	ubelong		>7	\b, contains[@0x1000]:
2012>>>0x1000	use		apple-apm
2013#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
20140	name				apple-driver-map
2015>0	ubequad		!0
2016# descBlock first block of driver
2017>>0	ubelong	x			\b, driver start block %u
2018# descSize driver size in blocks
2019>>4	ubeshort	x		\b, size %u
2020# descType driver system type 1 701h F8FFh FFFFh
2021>>6	ubeshort	x		\b, type 0x%x
2022
2023# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
2024# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
2025# Update: Joerg Jenderek
2026# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
2027# magic stronger.
2028# for apple partition map stored as a single file
20290	belong	0x504d0000
2030# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
2031#!:strength +0
2032>0	use		apple-apm
2033# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
2034# file: could not find any valid magic files!
2035#!:ext	bin
2036#	display apple partition map. Normally called after Apple driver map
20370	name				apple-apm
2038>0	belong	0x504d0000		Apple Partition Map
2039# number of partitions
2040>>4	ubelong	x			\b, map block count %u
2041# logical block (512 bytes) start of partition
2042>>8	ubelong	x			\b, start block %u
2043>>12	ubelong	x			\b, block count %u
2044>>16	string >0			\b, name %s
2045>>48	string >0			\b, type %s
2046# processor type dpme_process_id[16] e.g. "68000" "68020"
2047>>120	string >0			\b, processor %s
2048# A/UX boot arguments BootArgs[128]
2049>>136	string >0			\b, boot arguments %s
2050# status of partition dpme_flags
2051>>88	belong	& 1			\b, valid
2052>>88	belong	& 2			\b, allocated
2053>>88	belong	& 4			\b, in use
2054>>88	belong	& 8			\b, has boot info
2055>>88	belong	& 16			\b, readable
2056>>88	belong	& 32			\b, writable
2057>>88	belong	& 64			\b, pic boot code
2058>>88	belong	& 128			\b, chain compatible driver
2059>>88	belong	& 256			\b, real driver
2060>>88	belong	& 512			\b, chain driver
2061# mount automatically at startup APPLE_PS_AUTO_MOUNT
2062>>88	ubelong	&0x40000000		\b, mount at startup
2063# is the startup partition APPLE_PS_STARTUP
2064>>88	ubelong	&0x80000000		\b, is the startup partition
2065
2066#http://wiki.mozilla.org/DS_Store_File_Format
2067#http://en.wikipedia.org/wiki/.DS_Store
20680	string	\0\0\0\1Bud1\0		Apple Desktop Services Store
2069
2070# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
2071# Usually not in separate files, but have either filename rsrc with
2072# no extension, or a filename corresponding to another file, with
2073# extensions rsr/rsrc
20740	string  \000\000\001\000
2075>4	leshort 0
2076>>16	lelong  0			Apple HFS/HFS+ resource fork
2077
2078#https://en.wikipedia.org/wiki/AppleScript
20790	string	FasdUAS			AppleScript compiled
2080
2081# AppleWorks/ClarisWorks
2082# https://github.com/joshenders/appleworks_format
2083# http://fileformats.archiveteam.org/wiki/AppleWorks
20840	name			appleworks
2085>0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
2086>0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
2087>0	default			x
2088>>0	belong			x		AppleWorks/ClarisWorks CWK Document
2089>0	byte			x		\b, version %d
2090>30	beshort			x		\b, %d
2091>32	beshort			x		\bx%d
2092!:ext cwk
2093
20944	string	BOBO
2095>0	byte	>4
2096>>12	belong	0
2097>>>26	belong	0
2098>>>>0	use	appleworks
2099>0	belong	0x0481ad00
2100>>0	use 	appleworks
2101
2102# magic for Apple File System (APFS)
2103# from Alex Myczko <alex@aiei.ch>
210432		string	NXSB		Apple File System (APFS)
2105>36		ulelong	x		\b, blocksize %u
2106
2107# iTunes cover art (versions 1 and 2)
21084		string	itch
2109>24		string	artw
2110>>0x1e8		string	data		iTunes cover art
2111>>>0x1ed	string	PNG		(PNG)
2112>>>0x1ec	beshort 0xffd8		(JPEG)
2113
2114# MacPaint image
211565		string	PNTGMPNT	MacPaint image data
2116#0		belong	2		MacPaint image data
2117
2118#------------------------------------------------------------------------------
2119# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
2120# application:  file(1) magic for applications on small devices
2121#
2122# Pebble Application
21230	string	PBLAPP\000\000	Pebble application
2124
2125#------------------------------------------------------------------------------
2126# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
2127# applix:  file(1) magic for Applixware
2128# From: Peter Soos <sp@osb.hu>
2129#
21300	string		*BEGIN		Applixware
2131>7	string		WORDS			Words Document
2132>7	string		GRAPHICS		Graphic
2133>7	string		RASTER			Bitmap
2134>7	string		SPREADSHEETS		Spreadsheet
2135>7	string		MACRO			Macro
2136>7	string		BUILDER			Builder Object
2137
2138#------------------------------------------------------------------------------
2139# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
2140# apt: file(1) magic for APT Cache files
2141# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html>
2142# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292>
2143
2144# before version 10 ("old format"), data was in arch-specific long/short
2145
2146# old format 64 bit
21470   	name		apt-cache-64bit-be
2148>12	beshort		1		\b, dirty
2149>40 	bequad		x		\b, %llu packages
2150>48 	bequad		x		\b, %llu versions
2151
2152# old format 32 bit
21530   	name    	apt-cache-32bit-be
2154>8  	beshort 	1		\b, dirty
2155>40 	belong  	x		\b, %u packages
2156>44 	belong  	x		\b, %u versions
2157
2158# new format
21590	name		apt-cache-be
2160>6	byte    	1		\b, dirty
2161>24	belong  	x		\b, %u packages
2162>28	belong		x		\b, %u versions
2163
21640	bequad		0x98FE76DC
2165>8	ubeshort	<10		APT cache data, version %u
2166>>10	beshort	    	x	  	\b.%u, 64 bit big-endian
2167>>0	use		apt-cache-64bit-be
2168
21690	lequad	    	0x98FE76DC
2170>8	uleshort    	<10		APT cache data, version %u
2171>>10	leshort		x		\b.%u, 64 bit little-endian
2172>>0	use		\^apt-cache-64bit-be
2173
21740	belong	    	0x98FE76DC
2175>4	ubeshort    	<10	 	APT cache data, version %u
2176>>6	ubeshort    	x		\b.%u, 32 bit big-endian
2177>>0	use  		apt-cache-32bit-be
2178>4	ubyte	    	>9		APT cache data, version %u
2179>>5	ubyte	    	x		\b.%u, big-endian
2180>>0	use 		apt-cache-be
2181
21820	lelong	    	0x98FE76DC
2183>4	uleshort    	<10		APT cache data, version %u
2184>>6	uleshort   	x		\b.%u, 32 bit little-endian
2185>>0	use 		\^apt-cache-32bit-be
2186>4	ubyte	    	>9		APT cache data, version %u
2187>>5	ubyte	    	x		\b.%u, little-endian
2188>>0	use		\^apt-cache-be
2189#------------------------------------------------------------------------------
2190# $File: archive,v 1.119 2018/04/24 23:19:45 christos Exp $
2191# archive:  file(1) magic for archive formats (see also "msdos" for self-
2192#           extracting compressed archives)
2193#
2194# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
2195# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c.
2196
2197# POSIX tar archives
2198# URL: https://en.wikipedia.org/wiki/Tar_(computing)
2199# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current
2200# header mainly padded with nul bytes
2201500	quad		0
2202!:strength /2
2203# filename or extended attribute printable strings in range space null til umlaut ue
2204>0	ubeshort	>0x1F00
2205>>0	ubeshort	<0xFCFD
2206# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
2207# at https://sourceforge.net/projects/s-tar/files/testscripts/
2208>>>508	ubelong&0x8B9E8DFF	0
2209# nul, space or ascii digit 0-7 at start of mode
2210>>>>100	ubyte&0xC8	=0
2211>>>>>101 ubyte&0xC8	=0
2212# nul, space at end of check sum
2213>>>>>>155 ubyte&0xDF	=0
2214# space or ascii digit 0 at start of check sum
2215>>>>>>>148	ubyte&0xEF	=0x20
2216>>>>>>>>0	use	tar-file
2217#	minimal check and then display tar archive information which can also be
2218#	embedded inside others like Android Backup, Clam AntiVirus database
22190	name		tar-file
2220>257	string		!ustar
2221# header padded with nuls
2222>>257	ulong		=0
2223# GNU tar version 1.29 with non pax format option without refusing
2224# creates misleading V7 header for Long path, Multi-volume, Volume type
2225>>>156	ubyte		0x4c		GNU tar archive
2226!:mime	application/x-gtar
2227!:ext	tar/gtar
2228>>>156	ubyte		0x4d		GNU tar archive
2229!:mime	application/x-gtar
2230!:ext	tar/gtar
2231>>>156	ubyte		0x56		GNU tar archive
2232!:mime	application/x-gtar
2233!:ext	tar/gtar
2234>>>156	default		x		tar archive (V7)
2235!:mime	application/x-tar
2236!:ext	tar
2237# other stuff in padding
2238# some implementations add new fields to the blank area at the end of the header record
2239# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
2240>>257	ulong		!0		tar archive (old)
2241!:mime	application/x-tar
2242!:ext	tar
2243# magic in newer, GNU, posix variants
2244>257	string		=ustar
2245# 2 last char of magic and UStar version because string expression does not work
2246# 2 space characters followed by a null for GNU variant
2247>>261	ubelong		=0x72202000	POSIX tar archive (GNU)
2248!:mime	application/x-gtar
2249!:ext	tar/gtar
2250# UStar version with ASCII "00"
2251>>261	ubelong		0x72003030	POSIX
2252# gLOBAL and ExTENSION type only found in POSIX.1-2001 format
2253>>>156	ubyte		0x67		\b.1-2001
2254>>>156	ubyte		0x78		\b.1-2001
2255>>>156	ubyte		x		tar archive
2256!:mime	application/x-ustar
2257!:ext	tar/ustar
2258# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
2259>>261	ubelong		0x72000000	tar archive (ustar)
2260!:mime	application/x-ustar
2261!:ext	tar/ustar
2262# not seen ustar variant with garbish version
2263>>261	default		x		tar archive (unknown ustar)
2264!:mime	application/x-ustar
2265!:ext	tar/ustar
2266# type flag of 1st tar archive member
2267#>156	ubyte		x		\b, %c-type
2268>156	ubyte		x
2269>>156	ubyte		0		\b, file
2270>>156	ubyte		0x30		\b, file
2271>>156	ubyte		0x31		\b, hard link
2272>>156	ubyte		0x32		\b, symlink
2273>>156	ubyte		0x33		\b, char device
2274>>156	ubyte		0x34		\b, block device
2275>>156	ubyte		0x35		\b, directory
2276>>156	ubyte		0x36		\b, fifo
2277>>156	ubyte		0x37		\b, reserved
2278>>156	ubyte		0x4c		\b, long path
2279>>156	ubyte		0x4d		\b, multi volume
2280>>156	ubyte		0x56		\b, volume
2281>>156	ubyte		0x67		\b, global
2282>>156	ubyte		0x78		\b, extension
2283>>156	default		x		\b, type
2284>>>156	ubyte		x		'%c'
2285# name[100]
2286>0	string		>\0		%-.60s
2287# mode mainly stored as an octal number in ASCII null or space terminated
2288>100	string		>\0		\b, mode %-.7s
2289# user id mainly as octal numbers in ASCII null or space terminated
2290>108	string		>\0		\b, uid %-.7s
2291# group id mainly as octal numbers in ASCII null or space terminated
2292>116	string		>\0		\b, gid %-.7s
2293# size mainly as octal number in ASCII
2294>124	ubyte		<0x38
2295>>124	string		>\0		\b, size %-.12s
2296# coding indicated by setting the high-order bit of the leftmost byte
2297>124	ubyte		>0xEF		\b, size 0x
2298>>124	ubyte		!0xff		\b%2.2x
2299>>125	ubyte		!0xff		\b%2.2x
2300>>126	ubyte		!0xff		\b%2.2x
2301>>127	ubyte		!0xff		\b%2.2x
2302>>128	ubyte		!0xff		\b%2.2x
2303>>129	ubyte		!0xff		\b%2.2x
2304>>130	ubyte		!0xff		\b%2.2x
2305>>131	ubyte		!0xff		\b%2.2x
2306>>132	ubyte		!0xff		\b%2.2x
2307>>133	ubyte		!0xff		\b%2.2x
2308>>134	ubyte		!0xff		\b%2.2x
2309>>135	ubyte		!0xff		\b%2.2x
2310# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated
2311>136	string		>\0		\b, seconds %-.11s
2312# header checksum stored as an octal number in ASCII null or space terminated
2313#>148	string		x		\b, cksum %.7s
2314# linkname[100]
2315>157	string		>\0		\b, linkname %-.40s
2316# additional fields for ustar
2317>257	string		=ustar
2318# owner user name null terminated
2319>>265	string		>\0		\b, user %-.32s
2320# group name null terminated
2321>>297	string		>\0		\b, group %-.32s
2322# device major minor if not zero
2323>>329	ubequad&0xCFCFCFCFcFcFcFdf	!0
2324>>>329	string		x		\b, devmaj %-.7s
2325>>337	ubequad&0xCFCFCFCFcFcFcFdf	!0
2326>>>337	string		x		\b, devmin %-.7s
2327# prefix[155]
2328>>345	string		>\0		\b, prefix %-.155s
2329# old non ustar/POSIX tar
2330>257	string		!ustar
2331>>508	string		=tar\0
2332# padding[255] in old star
2333>>>257	string		>\0		\b, padding: %-.40s
2334>>508	default		x
2335# padding[255] in old tar sometimes comment field
2336>>>257	string		>\0		\b, comment: %-.40s
2337
2338# Incremental snapshot gnu-tar format from:
2339# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
23400	string		GNU\ tar-	GNU tar incremental snapshot data
2341>&0	regex		[0-9]\.[0-9]+-[0-9]+	version %s
2342
2343# cpio archives
2344#
2345# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
2346# The idea is to indicate archives produced on machines with the same
2347# byte order as the machine running "file" with "cpio archive", and
2348# to indicate archives produced on machines with the opposite byte order
2349# from the machine running "file" with "byte-swapped cpio archive".
2350#
2351# The SVR4 "cpio(4)" hints that there are additional formats, but they
2352# are defined as "short"s; I think all the new formats are
2353# character-header formats and thus are strings, not numbers.
23540	short		070707		cpio archive
2355!:mime	application/x-cpio
23560	short		0143561		byte-swapped cpio archive
2357!:mime	application/x-cpio # encoding: swapped
23580	string		070707		ASCII cpio archive (pre-SVR4 or odc)
23590	string		070701		ASCII cpio archive (SVR4 with no CRC)
23600	string		070702		ASCII cpio archive (SVR4 with CRC)
2361
2362#
2363# Various archive formats used by various versions of the "ar"
2364# command.
2365#
2366
2367#
2368# Original UNIX archive formats.
2369# They were written with binary values in host byte order, and
2370# the magic number was a host "int", which might have been 16 bits
2371# or 32 bits.  We don't say "PDP-11" or "VAX", as there might have
2372# been ports to little-endian 16-bit-int or 32-bit-int platforms
2373# (x86?) using some of those formats; if none existed, feel free
2374# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian
2375# 32-bit.  There might have been big-endian ports of that sort as
2376# well.
2377#
23780	leshort		0177555		very old 16-bit-int little-endian archive
23790	beshort		0177555		very old 16-bit-int big-endian archive
23800	lelong		0177555		very old 32-bit-int little-endian archive
23810	belong		0177555		very old 32-bit-int big-endian archive
2382
23830	leshort		0177545		old 16-bit-int little-endian archive
2384>2	string		__.SYMDEF	random library
23850	beshort		0177545		old 16-bit-int big-endian archive
2386>2	string		__.SYMDEF	random library
23870	lelong		0177545		old 32-bit-int little-endian archive
2388>4	string		__.SYMDEF	random library
23890	belong		0177545		old 32-bit-int big-endian archive
2390>4	string		__.SYMDEF	random library
2391
2392#
2393# From "pdp" (but why a 4-byte quantity?)
2394#
23950	lelong		0x39bed		PDP-11 old archive
23960	lelong		0x39bee		PDP-11 4.0 archive
2397
2398#
2399# XXX - what flavor of APL used this, and was it a variant of
2400# some ar archive format?  It's similar to, but not the same
2401# as, the APL workspace magic numbers in pdp.
2402#
24030	long		0100554		apl workspace
2404
2405#
2406# System V Release 1 portable(?) archive format.
2407#
24080	string		=<ar>		System V Release 1 ar archive
2409!:mime	application/x-archive
2410
2411#
2412# Debian package; it's in the portable archive format, and needs to go
2413# before the entry for regular portable archives, as it's recognized as
2414# a portable archive whose first member has a name beginning with
2415# "debian".
2416#
24170	string		=!<arch>\ndebian
2418>8	string		debian-split	part of multipart Debian package
2419!:mime	application/vnd.debian.binary-package
2420>8	string		debian-binary	Debian binary package
2421!:mime	application/vnd.debian.binary-package
2422>8	string		!debian
2423>68	string		>\0		(format %s)
2424# These next two lines do not work, because a bzip2 Debian archive
2425# still uses gzip for the control.tar (first in the archive).  Only
2426# data.tar varies, and the location of its filename varies too.
2427# file/libmagic does not current have support for ascii-string based
2428# (offsets) as of 2005-09-15.
2429#>81	string		bz2		\b, uses bzip2 compression
2430#>84	string		gz		\b, uses gzip compression
2431#>136	ledate		x		created: %s
2432
2433#
2434# MIPS archive; they're in the portable archive format, and need to go
2435# before the entry for regular portable archives, as it's recognized as
2436# a portable archive whose first member has a name beginning with
2437# "__________E".
2438#
24390	string	=!<arch>\n__________E	MIPS archive
2440!:mime	application/x-archive
2441>20	string	U			with MIPS Ucode members
2442>21	string	L			with MIPSEL members
2443>21	string	B			with MIPSEB members
2444>19	string	L			and an EL hash table
2445>19	string	B			and an EB hash table
2446>22	string	X			-- out of date
2447
24480	search/1	-h-		Software Tools format archive text
2449
2450#
2451# BSD/SVR2-and-later portable archive formats.
2452#
24530	string		=!<arch>\n		current ar archive
2454!:mime	application/x-archive
2455>8	string		__.SYMDEF	random library
2456>68	string		__.SYMDEF\ SORTED	random library
2457
2458#
2459# "Thin" archive, as can be produced by GNU ar.
2460#
24610	string		=!<thin>\n	thin archive with
2462>68	belong		0		no symbol entries
2463>68	belong		1		%d symbol entry
2464>68	belong		>1		%d symbol entries
2465
2466# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
2467#
2468# The first byte is the magic (0x1a), byte 2 is the compression type for
2469# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
2470# filename of the first file (null terminated).  Since some types collide
2471# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
2472# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
24730	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
2474!:mime	application/x-arc
24750	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
2476!:mime	application/x-arc
24770	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
2478!:mime	application/x-arc
24790	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
2480!:mime	application/x-arc
24810	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
2482!:mime	application/x-arc
24830	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
2484!:mime	application/x-arc
2485# [JW] stuff taken from idarc, obviously ARC successors:
24860	lelong&0x8080ffff	0x00000a1a	PAK archive data
2487!:mime	application/x-arc
24880	lelong&0x8080ffff	0x0000141a	ARC+ archive data
2489!:mime	application/x-arc
24900	lelong&0x8080ffff	0x0000481a	HYP archive data
2491!:mime	application/x-arc
2492
2493# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
2494# I can't create either SPARK or ArcFS archives so I have not tested this stuff
2495# [GRR:  the original entries collide with ARC, above; replaced with combined
2496#  version (not tested)]
2497#0	byte		0x1a		RISC OS archive (spark format)
24980	string		\032archive	RISC OS archive (ArcFS format)
24990       string          Archive\000     RISC OS archive (ArcFS format)
2500
2501# All these were taken from idarc, many could not be verified. Unfortunately,
2502# there were many low-quality sigs, i.e. easy to trigger false positives.
2503# Please notify me of any real-world fishy/ambiguous signatures and I'll try
2504# to get my hands on the actual archiver and see if I find something better. [JW]
2505# probably many can be enhanced by finding some 0-byte or control char near the start
2506
2507# idarc calls this Crush/Uncompressed... *shrug*
25080	string	CRUSH Crush archive data
2509# Squeeze It (.sqz)
25100	string	HLSQZ Squeeze It archive data
2511# SQWEZ
25120	string	SQWEZ SQWEZ archive data
2513# HPack (.hpk)
25140	string	HPAK HPack archive data
2515# HAP
25160	string	\x91\x33HF HAP archive data
2517# MD/MDCD
25180	string	MDmd MDCD archive data
2519# LIM
25200	string	LIM\x1a LIM archive data
2521# SAR
25223	string	LH5 SAR archive data
2523# BSArc/BS2
25240	string	\212\3SB\020\0	BSArc/BS2 archive data
2525# Bethesda Softworks Archive (Oblivion)
25260	string	BSA\0 		BSArc archive data
2527>4	lelong	x		version %d
2528# MAR
25292	string	=-ah MAR archive data
2530# ACB
2531#0	belong&0x00f800ff	0x00800000 ACB archive data
2532# CPZ
2533# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
2534# JRC
25350	string	JRchive JRC archive data
2536# Quantum
25370	string	DS\0 Quantum archive data
2538# ReSOF
25390	string	PK\3\6 ReSOF archive data
2540# QuArk
25410	string	7\4 QuArk archive data
2542# YAC
254314	string	YC YAC archive data
2544# X1
25450	string	X1 X1 archive data
25460	string	XhDr X1 archive data
2547# CDC Codec (.dqt)
25480	belong&0xffffe000	0x76ff2000 CDC Codec archive data
2549# AMGC
25500	string	\xad6" AMGC archive data
2551# NuLIB
25520	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
2553# PakLeo
25540	string	LEOLZW PAKLeo archive data
2555# ChArc
25560	string	SChF ChArc archive data
2557# PSA
25580	string	PSA PSA archive data
2559# CrossePAC
25600	string	DSIGDCC CrossePAC archive data
2561# Freeze
25620	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
2563# KBoom
25640	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
2565# NSQ, must go after CDC Codec
25660	string	\x76\xff NSQ archive data
2567# DPA
25680	string	Dirk\ Paehl DPA archive data
2569# BA
2570# TODO: idarc says "bytes 0-2 == bytes 3-5"
2571# TTComp
2572# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
2573# Update: Joerg Jenderek
2574# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
25750	string	\0\6
2576# look for first keyword of Panorama database *.pan
2577>12	search/261	DESIGN
2578# skip keyword with low entropy
2579>12	default		x	TTComp archive, binary, 4K dictionary
2580# (version 5.25) labeled the above entry as "TTComp archive data"
2581# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
25820	string	ESP ESP archive data
2583# ZPack
25840	string	\1ZPK\1 ZPack archive data
2585# Sky
25860	string	\xbc\x40 Sky archive data
2587# UFA
25880	string	UFA UFA archive data
2589# Dry
25900	string	=-H2O DRY archive data
2591# FoxSQZ
25920	string	FOXSQZ FoxSQZ archive data
2593# AR7
25940	string	,AR7 AR7 archive data
2595# PPMZ
25960	string	PPMZ PPMZ archive data
2597# MS Compress
2598# Update: Joerg Jenderek
2599# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
2600# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html
2601# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z
26024	string	\x88\xf0\x27
2603#		KWAJ variant
2604>0	string	KWAJ		MS Compress archive data, KWAJ variant
2605!:mime	application/x-ms-compress-kwaj
2606# extension not working in version 5.32
2607# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?'
2608# file: line 284: Bad magic entry '   ??_'
2609!:ext	??_
2610# compression method (0-4)
2611>>8	uleshort	x	\b, %u method
2612# offset of compressed data
2613>>10	uleshort	x	\b, 0x%x offset
2614#>>(10.s)	uleshort	x
2615#>>>&-6		string	x	\b, TEST extension %-.3s
2616# header flags to mark header extensions
2617>>12	uleshort	>0	\b, 0x%x flags
2618# 4 bytes: decompressed length of file
2619>>12	uleshort	&0x01
2620>>>14	ulelong		x	\b, original size: %u bytes
2621# 2 bytes: unknown purpose
2622# 2 bytes: length of unknown data + mentioned bytes
2623# 1-9 bytes: null-terminated file name
2624# 1-4 bytes: null-terminated file extension
2625>>12	uleshort	&0x08
2626>>>12	uleshort				^0x01
2627>>>>12		uleshort			^0x02
2628>>>>>12			uleshort		^0x04
2629>>>>>>12			uleshort	^0x10
2630>>>>>>>14				string	x	\b, %-.8s
2631>>>>>>12			uleshort	&0x10
2632>>>>>>>14				string	x	\b, %-.8s
2633>>>>>>>>&1				string	x	\b.%-.3s
2634>>>>>12			uleshort		&0x04
2635>>>>>>12			uleshort	^0x10
2636>>>>>>>(14.s)			uleshort	x
2637>>>>>>>>&14				string	x	\b, %-.8s
2638>>>>>>12			uleshort	&0x10
2639>>>>>>>(14.s)			uleshort	x
2640>>>>>>>>&14				string	x	\b, %-.8s
2641>>>>>>>>>&1				string	x	\b.%-.3s
2642>>>>12		uleshort			&0x02
2643>>>>>12			uleshort		^0x04
2644>>>>>>12			uleshort	^0x10
2645>>>>>>>16				string	x	\b, %-.8s
2646>>>>>>12			uleshort	&0x10
2647>>>>>>>16				string	x	\b, %-.8s
2648>>>>>>>>&1				string	x	\b.%-.3s
2649>>>>>12			uleshort		&0x04
2650>>>>>>12			uleshort	^0x10
2651>>>>>>>(16.s)			uleshort	x
2652>>>>>>>>&16				string	x	\b, %-.8s
2653>>>>>>12			uleshort	&0x10
2654>>>>>>>(16.s)			uleshort	x
2655>>>>>>>&16				string	x	%-.8s
2656>>>>>>>>&1				string	x	\b.%-.3s
2657>>>12	uleshort				&0x01
2658>>>>12		uleshort			^0x02
2659>>>>>12			uleshort		^0x04
2660>>>>>>12			uleshort	^0x10
2661>>>>>>>18				string	x	\b, %-.8s
2662>>>>>>12			uleshort	&0x10
2663>>>>>>>18				string	x	\b, %-.8s
2664>>>>>>>>&1				string	x	\b.%-.3s
2665>>>>>12			uleshort		&0x04
2666>>>>>>12			uleshort	^0x10
2667>>>>>>>(18.s)			uleshort	x
2668>>>>>>>>&18				string	x	\b, %-.8s
2669>>>>>>12			uleshort	&0x10
2670>>>>>>>(18.s)			uleshort	x
2671>>>>>>>>&18				string	x	\b, %-.8s
2672>>>>>>>>>&1				string	x	\b.%-.3s
2673>>>>12		uleshort			&0x02
2674>>>>>12			uleshort		^0x04
2675>>>>>>12			uleshort	^0x10
2676>>>>>>>20				string	x	\b, %-.8s
2677>>>>>>12			uleshort	&0x10
2678>>>>>>>20				string	x	\b, %-.8s
2679>>>>>>>>&1				string	x	\b.%-.3s
2680>>>>>12			uleshort		&0x04
2681>>>>>>12			uleshort	^0x10
2682>>>>>>>(20.s)			uleshort	x
2683>>>>>>>>&20				string	x	\b, %-.8s
2684>>>>>>12			uleshort	&0x10
2685>>>>>>>(20.s)			uleshort	x
2686>>>>>>>>&20				string	x	\b, %-.8s
2687>>>>>>>>>&1				string	x	\b.%-.3s
2688# 2 bytes: length of data + mentioned bytes
2689#
2690#		SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ
2691>0	string	SZDD		MS Compress archive data, SZDD variant
2692!:mime	application/x-ms-compress-szdd
2693!:ext	??_
2694# The character missing from the end of the filename (0=unknown)
2695>>9	string	>\0		\b, %-.1s is last character of original name
2696# https://www.betaarchive.com/forum/viewtopic.php?t=26161
2697# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e
2698>>8	string	!A		\b, %-.1s method
2699>>10	ulelong	>0		\b, original size: %u bytes
2700#		QBasic SZDD variant
27013	string	\x88\xf0\x27
2702>0	string	SZ\x20		MS Compress archive data, QBasic variant
2703!:mime	application/x-ms-compress-sz
2704!:ext	??$
2705>>8	ulelong	>0		\b, original size: %u bytes
2706
2707# MP3 (archiver, not lossy audio compression)
27080	string	MP3\x1a MP3-Archiver archive data
2709# ZET
27100	string	OZ\xc3\x9d ZET archive data
2711# TSComp
27120	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
2713# ARQ
27140	string	gW\4\1 ARQ archive data
2715# Squash
27163	string	OctSqu Squash archive data
2717# Terse
27180	string	\5\1\1\0 Terse archive data
2719# PUCrunch
27200	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
2721# UHarc
27220	string	UHA UHarc archive data
2723# ABComp
27240	string	\2AB ABComp archive data
27250	string	\3AB2 ABComp archive data
2726# CMP
27270	string	CO\0 CMP archive data
2728# Splint
27290	string	\x93\xb9\x06 Splint archive data
2730# InstallShield
27310	string	\x13\x5d\x65\x8c InstallShield Z archive Data
2732# Gather
27331	string	GTH Gather archive data
2734# BOA
27350	string	BOA BOA archive data
2736# RAX
27370	string	ULEB\xa RAX archive data
2738# Xtreme
27390	string	ULEB\0 Xtreme archive data
2740# Pack Magic
27410	string	@\xc3\xa2\1\0 Pack Magic archive data
2742# BTS
27430	belong&0xfeffffff	0x1a034465 BTS archive data
2744# ELI 5750
27450	string	Ora\  ELI 5750 archive data
2746# QFC
27470	string	\x1aFC\x1a QFC archive data
27480	string	\x1aQF\x1a QFC archive data
2749# PRO-PACK
27500	string	RNC PRO-PACK archive data
2751# 777
27520	string	777 777 archive data
2753# LZS221
27540	string	sTaC LZS221 archive data
2755# HPA
27560	string	HPA HPA archive data
2757# Arhangel
27580	string	LG Arhangel archive data
2759# EXP1, uses bzip2
27600	string	0123456789012345BZh EXP1 archive data
2761# IMP
27620	string	IMP\xa IMP archive data
2763# NRV
27640	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
2765# Squish
27660	string	\x73\xb2\x90\xf4 Squish archive data
2767# Par
27680	string	PHILIPP Par archive data
27690	string	PAR Par archive data
2770# HIT
27710	string	UB HIT archive data
2772# SBX
27730	belong&0xfffff000	0x53423000 SBX archive data
2774# NaShrink
27750	string	NSK NaShrink archive data
2776# SAPCAR
27770	string	#\ CAR\ archive\ header SAPCAR archive data
27780	string	CAR\ 2.00RG SAPCAR archive data
2779# Disintegrator
27800	string	DST Disintegrator archive data
2781# ASD
27820	string	ASD ASD archive data
2783# InstallShield CAB
27840	string	ISc( InstallShield CAB
2785# TOP4
27860	string	T4\x1a TOP4 archive data
2787# BatComp left out: sig looks like COM executable
2788# so TODO: get real 4dos batcomp file and find sig
2789# BlakHole
27900	string	BH\5\7 BlakHole archive data
2791# BIX
27920	string	BIX0 BIX archive data
2793# ChiefLZA
27940	string	ChfLZ ChiefLZA archive data
2795# Blink
27960	string	Blink Blink archive data
2797# Logitech Compress
27980	string	\xda\xfa Logitech Compress archive data
2799# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
28001	string	(C)\ STEPANYUK ARS-Sfx archive data
2801# AKT/AKT32
28020	string	AKT32 AKT32 archive data
28030	string	AKT AKT archive data
2804# NPack
28050	string	MSTSM NPack archive data
2806# PFT
28070	string	\0\x50\0\x14 PFT archive data
2808# SemOne
28090	string	SEM SemOne archive data
2810# PPMD
28110	string	\x8f\xaf\xac\x84 PPMD archive data
2812# FIZ
28130	string	FIZ FIZ archive data
2814# MSXiE
28150	belong&0xfffff0f0	0x4d530000 MSXiE archive data
2816# DeepFreezer
28170	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
2818# DC
28190	string	=<DC- DC archive data
2820# TPac
28210	string	\4TPAC\3 TPac archive data
2822# Ai
28230	string	Ai\1\1\0 Ai archive data
28240	string	Ai\1\0\0 Ai archive data
2825# Ai32
28260	string	Ai\2\0 Ai32 archive data
28270	string	Ai\2\1 Ai32 archive data
2828# SBC
28290	string	SBC SBC archive data
2830# Ybs
28310	string	YBS Ybs archive data
2832# DitPack
28330	string	\x9e\0\0 DitPack archive data
2834# DMS
28350	string	DMS! DMS archive data
2836# EPC
28370	string	\x8f\xaf\xac\x8c EPC archive data
2838# VSARC
28390	string	VS\x1a VSARC archive data
2840# PDZ
28410	string	PDZ PDZ archive data
2842# ReDuq
28430	string	rdqx ReDuq archive data
2844# GCA
28450	string	GCAX GCA archive data
2846# PPMN
28470	string	pN PPMN archive data
2848# WinImage
28493	string	WINIMAGE WinImage archive data
2850# Compressia
28510	string	CMP0CMP Compressia archive data
2852# UHBC
28530	string	UHB UHBC archive data
2854# WinHKI
28550	string	\x61\x5C\x04\x05 WinHKI archive data
2856# WWPack data file
28570	string	WWP WWPack archive data
2858# BSN (BSA, PTS-DOS)
28590	string	\xffBSG BSN archive data
28601	string	\xffBSG BSN archive data
28613	string	\xffBSG BSN archive data
28621	string	\0\xae\2 BSN archive data
28631	string	\0\xae\3 BSN archive data
28641	string	\0\xae\7 BSN archive data
2865# AIN
28660	string	\x33\x18 AIN archive data
28670	string	\x33\x17 AIN archive data
2868# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
2869# SZip (TODO: doesn't catch all versions)
28700	string	SZ\x0a\4 SZip archive data
2871# XPack DiskImage
2872# *.XDI updated by Joerg Jenderek Sep 2015
2873# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
2874# GRR: this test is still too general as it catches also text files starting with jm
28750	string	jm
2876# only found examples with this additional characteristic 2 bytes
2877>2	string	\x2\x4	Xpack DiskImage archive data
2878#!:ext xdi
2879# XPack Data
2880# *.xpa updated by Joerg Jenderek Sep 2015
2881# ftp://ftp.elf.stuba.sk/pub/pc/pack/
28820	string	xpa	XPA
2883!:ext	xpa
2884# XPA32
2885# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
2886# created by XPA32.EXE version 1.0.2 for Windows
2887>0	string	xpa\0\1 \b32 archive data
2888# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
2889>3	ubeshort	!0x0001	\bck archive data
2890# XPack Single Data
2891# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
2892# letter 'I'+ acute accent is equivalent to \xcd
28930	string	\xcd\ jm	Xpack single archive data
2894#!:mime	application/x-xpa-compressed
2895!:ext xpa
2896
2897# TODO: missing due to unknown magic/magic at end of file:
2898#DWC
2899#ARG
2900#ZAR
2901#PC/3270
2902#InstallIt
2903#RKive
2904#RK
2905#XPack Diskimage
2906
2907# These were inspired by idarc, but actually verified
2908# Dzip archiver (.dz)
2909# Update: Joerg Jenderek
2910# URL: http://speeddemosarchive.com/dzip/
2911# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c
2912# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt
29130	string	DZ
2914# latest version is 2.9 dated 7 may 2003
2915>2	byte	<4 Dzip archive data
2916!:mime	application/x-dzip
2917!:ext	dz
2918>>2	byte	x \b, version %i
2919>>3	byte	x \b.%i
2920>>4	ulelong	x \b, offset 0x%x
2921>>8	ulelong	x \b, %u files
2922# ZZip archiver (.zz)
29230	string	ZZ\ \0\0 ZZip archive data
29240	string	ZZ0 ZZip archive data
2925# PAQ archiver (.paq)
29260	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
29270	string	PAQ PAQ archive data
2928>3	byte&0xf0	0x30
2929>>3	byte	x (v%c)
2930# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
29310xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
29320	string	JARCS JAR (ARJ Software, Inc.) archive data
2933
2934# ARJ archiver (jason@jarthur.Claremont.EDU)
29350	leshort		0xea60		ARJ archive data
2936!:mime	application/x-arj
2937>5	byte		x		\b, v%d,
2938>8	byte		&0x04		multi-volume,
2939>8	byte		&0x10		slash-switched,
2940>8	byte		&0x20		backup,
2941>34	string		x		original name: %s,
2942>7	byte		0		os: MS-DOS
2943>7	byte		1		os: PRIMOS
2944>7	byte		2		os: Unix
2945>7	byte		3		os: Amiga
2946>7	byte		4		os: Macintosh
2947>7	byte		5		os: OS/2
2948>7	byte		6		os: Apple ][ GS
2949>7	byte		7		os: Atari ST
2950>7	byte		8		os: NeXT
2951>7	byte		9		os: VAX/VMS
2952>3	byte		>0		%d]
2953# [JW] idarc says this is also possible
29542	leshort		0xea60		ARJ archive data
2955
2956# HA archiver (Greg Roelofs, newt@uchicago.edu)
2957# This is a really bad format. A file containing HAWAII will match this...
2958#0	string		HA		HA archive data,
2959#>2	leshort		=1		1 file,
2960#>2	leshort		>1		%hu files,
2961#>4	byte&0x0f	=0		first is type CPY
2962#>4	byte&0x0f	=1		first is type ASC
2963#>4	byte&0x0f	=2		first is type HSC
2964#>4	byte&0x0f	=0x0e		first is type DIR
2965#>4	byte&0x0f	=0x0f		first is type SPECIAL
2966# suggestion: at least identify small archives (<1024 files)
29670  belong&0xffff00fc 0x48410000 HA archive data
2968>2	leshort		=1		1 file,
2969>2	leshort		>1		%u files,
2970>4	byte&0x0f	=0		first is type CPY
2971>4	byte&0x0f	=1		first is type ASC
2972>4	byte&0x0f	=2		first is type HSC
2973>4	byte&0x0f	=0x0e		first is type DIR
2974>4	byte&0x0f	=0x0f		first is type SPECIAL
2975
2976# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
29770	string		HPAK		HPACK archive data
2978
2979# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
29800	string		\351,\001JAM\ 		JAM archive,
2981>7	string		>\0			version %.4s
2982>0x26	byte		=0x27			-
2983>>0x2b	string          >\0			label %.11s,
2984>>0x27	lelong		x			serial %08x,
2985>>0x36	string		>\0			fstype %.8s
2986
2987# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2988# Update: Joerg Jenderek
2989# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
2990# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
2991#
2992#	check and display information of lharc (LHa,PMarc) file
29930	name				lharc-file
2994# check 1st character of method id like -lz4- -lh5- or -pm2-
2995>2	string		-
2996# check 5th character of method id
2997>>6	string		-
2998# check header level 0 1 2 3
2999>>>20	ubyte		<4
3000# check 2nd, 3th and 4th character of method id
3001>>>>3	regex		\^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1)		\b
3002!:mime	application/x-lzh-compressed
3003# creator type "LHA "
3004!:apple	????LHA
3005# display archive type name like "LHa/LZS archive data" or "LArc archive"
3006>>>>>2	string		-lz		\b
3007!:ext	lzs
3008# already known  -lzs- -lz4- -lz5- with old names
3009>>>>>>2	string	-lzs		LHa/LZS archive data
3010>>>>>>3	regex	\^lz[45]	LHarc 1.x archive data
3011# missing -lz?- with wikipedia names
3012>>>>>>3	regex	\^lz[2378]	LArc archive
3013# display archive type name like "LHa (2.x) archive data"
3014>>>>>2	string		-lh		\b
3015# already known -lh0- -lh1- -lh2- -lh3-  -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
3016>>>>>>3	regex		\^lh[01]	LHarc 1.x/ARX archive data
3017# LHice archiver use ".ICE" as name extension instead usual one ".lzh"
3018# FOOBAR archiver use ".foo" as name extension instead usual one
3019# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
3020>>>>>>>2	string	-lh1		\b
3021!:ext lha/lzh/ice
3022>>>>>>3	regex		\^lh[23d]	LHa 2.x? archive data
3023>>>>>>3	regex		\^lh[7]		LHa (2.x)/LHark archive data
3024>>>>>>3	regex		\^lh[456]	LHa (2.x) archive data
3025>>>>>>>2	string	-lh5		\b
3026# https://en.wikipedia.org/wiki/BIOS
3027# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
3028# bios.rom , kd7_v14.bin, 1010.004, ...
3029!:ext lha/lzh/rom/bin
3030# missing -lh?- variants (Joe Jared)
3031>>>>>>3	regex		\^lh[89a-ce]	LHa (Joe Jared) archive
3032# UNLHA32 2.67a
3033>>>>>>2	string		-lhx		LHa (UNLHA32) archive
3034# lha archives with standard file name extensions ".lha" ".lzh"
3035>>>>>>3	regex		!\^(lh1|lh5)	\b
3036!:ext lha/lzh
3037# this should not happen if all -lh variants are described
3038>>>>>>2	default		x		LHa (unknown) archive
3039#!:ext	lha
3040# PMarc
3041>>>>>3	regex		\^pm[012]	PMarc archive data
3042!:ext pma
3043# append method id without leading and trailing minus character
3044>>>>>3	string		x		[%3.3s]
3045>>>>>>0	use	lharc-header
3046#
3047#	check and display information of lharc header
30480	name				lharc-header
3049# header size 0x4 , 0x1b-0x61
3050>0	ubyte		x
3051# compressed data size != compressed file size
3052#>7	ulelong		x		\b, data size %d
3053# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
3054#>19	ubyte		x		\b, 19_0x%x
3055# level identifier 0 1 2 3
3056#>20	ubyte		x		\b, level %d
3057# time stamp
3058#>15		ubelong	x		DATE 0x%8.8x
3059# OS ID for level 1
3060>20	ubyte		1
3061# 0x20 types find for *.rom files
3062>>(21.b+24)	ubyte	<0x21		\b, 0x%x OS
3063# ascii type like M for MSDOS
3064>>(21.b+24)	ubyte	>0x20		\b, '%c' OS
3065# OS ID for level 2
3066>20	ubyte		2
3067#>>23	ubyte		x		\b, OS ID 0x%x
3068>>23	ubyte		<0x21		\b, 0x%x OS
3069>>23	ubyte		>0x20		\b, '%c' OS
3070# filename only for level 0 and 1
3071>20	ubyte		<2
3072# length of filename
3073>>21		ubyte	>0		\b, with
3074# filename
3075>>>21		pstring	x		"%s"
3076#
3077#2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
3078#!:mime	application/x-lharc
30792	string		-lh0-
3080>0	use	lharc-file
3081#2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
3082#!:mime	application/x-lharc
30832	string		-lh1-
3084>0	use	lharc-file
3085# NEW -lz2- ... -lz8-
30862	string		-lz2-
3087>0	use	lharc-file
30882	string		-lz3-
3089>0	use	lharc-file
30902	string		-lz4-
3091>0	use	lharc-file
30922	string		-lz5-
3093>0	use	lharc-file
30942	string		-lz7-
3095>0	use	lharc-file
30962	string		-lz8-
3097>0	use	lharc-file
3098#	[never seen any but the last; -lh4- reported in comp.compression:]
3099#2	string		-lzs-		LHa/LZS archive data [lzs]
31002	string		-lzs-
3101>0	use	lharc-file
3102# According to wikipedia and others such a version does not exist
3103#2	string		-lh\40-		LHa 2.x? archive data [lh ]
3104#2	string		-lhd-		LHa 2.x? archive data [lhd]
31052	string		-lhd-
3106>0	use	lharc-file
3107#2	string		-lh2-		LHa 2.x? archive data [lh2]
31082	string		-lh2-
3109>0	use	lharc-file
3110#2	string		-lh3-		LHa 2.x? archive data [lh3]
31112	string		-lh3-
3112>0	use	lharc-file
3113#2	string		-lh4-		LHa (2.x) archive data [lh4]
31142	string		-lh4-
3115>0	use	lharc-file
3116#2	string		-lh5-		LHa (2.x) archive data [lh5]
31172	string		-lh5-
3118>0	use	lharc-file
3119#2	string		-lh6-		LHa (2.x) archive data [lh6]
31202	string		-lh6-
3121>0	use	lharc-file
3122#2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
31232	string		-lh7-
3124# !:mime	application/x-lha
3125# >20	byte		x		- header level %d
3126>0	use	lharc-file
3127# NEW -lh8- ... -lhe- , -lhx-
31282	string		-lh8-
3129>0	use	lharc-file
31302	string		-lh9-
3131>0	use	lharc-file
31322	string		-lha-
3133>0	use	lharc-file
31342	string		-lhb-
3135>0	use	lharc-file
31362	string		-lhc-
3137>0	use	lharc-file
31382	string		-lhe-
3139>0	use	lharc-file
31402	string		-lhx-
3141>0	use	lharc-file
3142# taken from idarc [JW]
31432   string      -lZ         PUT archive data
3144# already done by LHarc magics
3145# this should never happen if all sub types of LZS archive are identified
3146#2   string      -lz         LZS archive data
31472   string      -sw1-       Swag archive data
3148
31490	name		rar-file-header
3150>24	byte		15		\b, v1.5
3151>24	byte		20		\b, v2.0
3152>24	byte		29		\b, v4
3153>15	byte		0		\b, os: MS-DOS
3154>15	byte		1		\b, os: OS/2
3155>15	byte		2		\b, os: Win32
3156>15	byte		3		\b, os: Unix
3157>15	byte		4		\b, os: Mac OS
3158>15	byte		5		\b, os: BeOS
3159
31600	name		rar-archive-header
3161>3	leshort&0x1ff	>0		\b, flags:
3162>>3	leshort		&0x01		ArchiveVolume
3163>>3	leshort		&0x02		Commented
3164>>3	leshort		&0x04		Locked
3165>>3	leshort		&0x10		NewVolumeNaming
3166>>3	leshort		&0x08		Solid
3167>>3	leshort		&0x20		Authenticated
3168>>3	leshort		&0x40		RecoveryRecordPresent
3169>>3	leshort		&0x80		EncryptedBlockHeader
3170>>3	leshort		&0x100		FirstVolume
3171
3172# RAR (Roshal Archive) archive
31730	string		Rar!\x1a\7\0		RAR archive data
3174!:mime	application/x-rar
3175!:ext	rar/cbr
3176# file header
3177>(0xc.l+9)	byte	0x74
3178>>(0xc.l+7)	use	rar-file-header
3179# subblock seems to share information with file header
3180>(0xc.l+9)	byte	0x7a
3181>>(0xc.l+7)	use	rar-file-header
3182>9		byte	0x73
3183>>7		use	rar-archive-header
3184
31850	string		Rar!\x1a\7\1\0		RAR archive data, v5
3186!:mime	application/x-rar
3187!:ext	rar
3188
3189# Very old RAR archive
3190# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
31910	string		RE\x7e\x5e  RAR archive data (<v1.5)
3192!:mime	application/x-rar
3193!:ext	rar/cbr
3194
3195# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
31960	string		SQSH		squished archive data (Acorn RISCOS)
3197
3198# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
3199# [JW] see exe section for self-extracting version
32000	string		UC2\x1a		UC2 archive data
3201
3202# PKZIP multi-volume archive
32030	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
3204!:mime	application/zip
3205!:ext zip/cbz
3206
3207# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
32080	string		PK\005\006	Zip archive data (empty)
3209!:mime application/zip
3210!:ext zip/cbz
32110	string		PK\003\004
3212
3213# Specialised zip formats which start with a member named 'mimetype'
3214# (stored uncompressed, with no 'extra field') containing the file's MIME type.
3215# Check for have 8-byte name, 0-byte extra field, name "mimetype", and
3216#  contents starting with "application/":
3217>26	string		\x8\0\0\0mimetypeapplication/
3218
3219#  KOffice / OpenOffice & StarOffice / OpenDocument formats
3220#    From: Abel Cheung <abel@oaka.org>
3221
3222#   KOffice (1.2 or above) formats
3223#    (mimetype contains "application/vnd.kde.<SUBTYPE>")
3224>>50	string	vnd.kde.		KOffice (>=1.2)
3225>>>58	string	karbon			Karbon document
3226>>>58	string	kchart			KChart document
3227>>>58	string	kformula		KFormula document
3228>>>58	string	kivio			Kivio document
3229>>>58	string	kontour			Kontour document
3230>>>58	string	kpresenter		KPresenter document
3231>>>58	string	kspread			KSpread document
3232>>>58	string	kword			KWord document
3233
3234#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
3235#    (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
3236>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
3237>>>62	string	writer			Writer
3238>>>>68	byte	!0x2e			document
3239>>>>68	string	.template		template
3240>>>>68	string	.global			global document
3241>>>62	string	calc			Calc
3242>>>>66	byte	!0x2e			spreadsheet
3243>>>>66	string	.template		template
3244>>>62	string	draw			Draw
3245>>>>66	byte	!0x2e			document
3246>>>>66	string	.template		template
3247>>>62	string	impress			Impress
3248>>>>69	byte	!0x2e			presentation
3249>>>>69	string	.template		template
3250>>>62	string	math			Math document
3251>>>62	string	base			Database file
3252
3253#   OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
3254#    http://lists.oasis-open.org/archives/office/200505/msg00006.html
3255#    (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
3256>>50	string	vnd.oasis.opendocument.	OpenDocument
3257>>>73	string	text
3258>>>>77	byte	!0x2d			Text
3259!:mime	application/vnd.oasis.opendocument.text
3260>>>>77	string	-template		Text Template
3261!:mime	application/vnd.oasis.opendocument.text-template
3262>>>>77	string	-web			HTML Document Template
3263!:mime	application/vnd.oasis.opendocument.text-web
3264>>>>77	string	-master			Master Document
3265!:mime	application/vnd.oasis.opendocument.text-master
3266>>>73	string	graphics
3267>>>>81	byte	!0x2d			Drawing
3268!:mime	application/vnd.oasis.opendocument.graphics
3269>>>>81	string	-template		Template
3270!:mime	application/vnd.oasis.opendocument.graphics-template
3271>>>73	string	presentation
3272>>>>85	byte	!0x2d			Presentation
3273!:mime	application/vnd.oasis.opendocument.presentation
3274>>>>85	string	-template		Template
3275!:mime	application/vnd.oasis.opendocument.presentation-template
3276>>>73	string	spreadsheet
3277>>>>84	byte	!0x2d			Spreadsheet
3278!:mime	application/vnd.oasis.opendocument.spreadsheet
3279>>>>84	string	-template		Template
3280!:mime	application/vnd.oasis.opendocument.spreadsheet-template
3281>>>73	string	chart
3282>>>>78	byte	!0x2d			Chart
3283!:mime	application/vnd.oasis.opendocument.chart
3284>>>>78	string	-template		Template
3285!:mime	application/vnd.oasis.opendocument.chart-template
3286>>>73	string	formula
3287>>>>80	byte	!0x2d			Formula
3288!:mime	application/vnd.oasis.opendocument.formula
3289>>>>80	string	-template		Template
3290!:mime	application/vnd.oasis.opendocument.formula-template
3291>>>73	string	database		Database
3292!:mime	application/vnd.oasis.opendocument.database
3293# Valid for LibreOffice Base 6.0.1.1 at least
3294>>>73	string	base 			Database
3295!:mime	application/vnd.oasis.opendocument.base
3296>>>73	string	image
3297>>>>78	byte	!0x2d			Image
3298!:mime	application/vnd.oasis.opendocument.image
3299>>>>78	string	-template		Template
3300!:mime	application/vnd.oasis.opendocument.image-template
3301
3302#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
3303#    http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
3304#    From: Ralf Brown <ralf.brown@gmail.com>
3305>>50	string	epub+zip	EPUB document
3306!:mime application/epub+zip
3307
3308#  Catch other ZIP-with-mimetype formats
3309#	In a ZIP file, the bytes immediately after a member's contents are
3310#	always "PK". The 2 regex rules here print the "mimetype" member's
3311#	contents up to the first 'P'. Luckily, most MIME types don't contain
3312#	any capital 'P's. This is a kludge.
3313#    (mimetype contains "application/<OTHER>")
3314>>50		string	!epub+zip
3315>>>50		string	!vnd.oasis.opendocument.
3316>>>>50		string	!vnd.sun.xml.
3317>>>>>50		string	!vnd.kde.
3318>>>>>>38	regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
3319!:mime	application/zip
3320#    (mimetype contents other than "application/*")
3321>26		string	\x8\0\0\0mimetype
3322>>38		string	!application/
3323>>>38		regex	[!-OQ-~]+		Zip data (MIME type "%s"?)
3324!:mime	application/zip
3325
3326# Java Jar files
3327>(26.s+30)	leshort	0xcafe		Java archive data (JAR)
3328!:mime	application/java-archive
3329
3330# iOS App
3331>(26.s+30)	leshort	!0xcafe
3332>>26		string	!\x8\0\0\0mimetype
3333>>>30		string	Payload/
3334>>>>38		search/64       .app/   iOS App
3335!:mime application/x-ios-app
3336
3337
3338# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
3339#   Next line excludes specialized formats:
3340>(26.s+30)	leshort	!0xcafe
3341>>26    string          !\x8\0\0\0mimetype	Zip archive data
3342!:mime	application/zip
3343>>>4	beshort		x			\b, at least
3344>>>4	use		zipversion
3345>>>4	beshort		x			to extract
3346>>>0x161	string		WINZIP		\b, WinZIP self-extracting
3347
3348# StarView Metafile
3349# From Pierre Ducroquet <pinaraf@pinaraf.info>
33500	string	VCLMTF	StarView MetaFile
3351>6	beshort	x	\b, version %d
3352>8	belong	x	\b, size %d
3353
3354# Zoo archiver
335520	lelong		0xfdc4a7dc	Zoo archive data
3356!:mime	application/x-zoo
3357>4	byte		>48		\b, v%c.
3358>>6	byte		>47		\b%c
3359>>>7	byte		>47		\b%c
3360>32	byte		>0		\b, modify: v%d
3361>>33	byte		x		\b.%d+
3362>42	lelong		0xfdc4a7dc	\b,
3363>>70	byte		>0		extract: v%d
3364>>>71	byte		x		\b.%d+
3365
3366# Shell archives
336710	string		#\ This\ is\ a\ shell\ archive	shell archive text
3368!:mime	application/octet-stream
3369
3370#
3371# LBR. NB: May conflict with the questionable
3372#          "binary Computer Graphics Metafile" format.
3373#
33740       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
3375#
3376# PMA (CP/M derivative of LHA)
3377# Update: Joerg Jenderek
3378# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
3379#
3380#2       string          -pm0-           PMarc archive data [pm0]
33812	string		-pm0-
3382>0	use	lharc-file
3383#2       string          -pm1-           PMarc archive data [pm1]
33842	string		-pm1-
3385>0	use	lharc-file
3386#2       string          -pm2-           PMarc archive data [pm2]
33872	string		-pm2-
3388>0	use	lharc-file
33892       string          -pms-           PMarc SFX archive (CP/M, DOS)
3390#!:mime	application/x-foobar-exec
3391!:ext com
33925       string          -pc1-           PopCom compressed executable (CP/M)
3393#!:mime	application/x-
3394#!:ext com
3395
3396# From Rafael Laboissiere <rafael@laboissiere.net>
3397# The Project Revision Control System (see
3398# http://prcs.sourceforge.net) generates a packaged project
3399# file which is recognized by the following entry:
34000	leshort		0xeb81	PRCS packaged project
3401
3402# Microsoft cabinets
3403# by David Necas (Yeti) <yeti@physics.muni.cz>
3404#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
3405#>25	byte	x		v%d
3406#>24	byte	x		\b.%d
3407# MPi: All CABs have version 1.3, so this is pointless.
3408# Better magic in debian-additions.
3409
3410# GTKtalog catalogs
3411# by David Necas (Yeti) <yeti@physics.muni.cz>
34124	string	gtktalog\ 	GTKtalog catalog data,
3413>13	string	3		version 3
3414>>14	beshort	0x677a		(gzipped)
3415>>14	beshort	!0x677a		(not gzipped)
3416>13	string	>3		version %s
3417
3418############################################################################
3419# Parity archive reconstruction file, the 'par' file format now used on Usenet.
34200       string          PAR\0	PARity archive data
3421>48	leshort		=0	- Index file
3422>48	leshort		>0	- file number %d
3423
3424# Felix von Leitner <felix-file@fefe.de>
34250	string	d8:announce	BitTorrent file
3426!:mime	application/x-bittorrent
3427# Durval Menezes, <jmgthbfile at durval dot com>
34280	string	d13:announce-list	BitTorrent file
3429!:mime	application/x-bittorrent
3430
3431# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
34320	beshort 0x0e0f		Atari MSA archive data
3433>2	beshort x		\b, %d sectors per track
3434>4	beshort 0		\b, 1 sided
3435>4	beshort 1		\b, 2 sided
3436>6	beshort x		\b, starting track: %d
3437>8	beshort x		\b, ending track: %d
3438
3439# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
34400	string	PK00PK\003\004	Zip archive data
3441!:mime	application/zip
3442!:ext zip/cbz
3443
3444# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
3445# by Stefan `Sec` Zehl <sec@42.org>
34467	string		**ACE**		ACE archive data
3447>15	byte	>0		version %d
3448>16	byte	=0x00		\b, from MS-DOS
3449>16	byte	=0x01		\b, from OS/2
3450>16	byte	=0x02		\b, from Win/32
3451>16	byte	=0x03		\b, from Unix
3452>16	byte	=0x04		\b, from MacOS
3453>16	byte	=0x05		\b, from WinNT
3454>16	byte	=0x06		\b, from Primos
3455>16	byte	=0x07		\b, from AppleGS
3456>16	byte	=0x08		\b, from Atari
3457>16	byte	=0x09		\b, from Vax/VMS
3458>16	byte	=0x0A		\b, from Amiga
3459>16	byte	=0x0B		\b, from Next
3460>14	byte	x		\b, version %d to extract
3461>5	leshort &0x0080		\b, multiple volumes,
3462>>17	byte	x		\b (part %d),
3463>5	leshort &0x0002		\b, contains comment
3464>5	leshort	&0x0200		\b, sfx
3465>5	leshort	&0x0400		\b, small dictionary
3466>5	leshort	&0x0800		\b, multi-volume
3467>5	leshort	&0x1000		\b, contains AV-String
3468>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
3469>5	leshort &0x2000		\b, with recovery record
3470>5	leshort &0x4000		\b, locked
3471>5	leshort &0x8000		\b, solid
3472# Date in MS-DOS format (whatever that is)
3473#>18	lelong	x		Created on
3474
3475# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
3476# <doj@cubic.org>
34770x1A	string	sfArk		sfArk compressed Soundfont
3478>0x15	string	2
3479>>0x1	string	>\0		Version %s
3480>>0x2A	string	>\0		: %s
3481
3482# DR-DOS 7.03 Packed File *.??_
34830	string	Packed\ File\ 	Personal NetWare Packed File
3484>12	string	x		\b, was "%.12s"
3485
3486# EET archive
3487# From: Tilman Sauerbeck <tilman@code-monkey.de>
34880	belong	0x1ee7ff00	EET archive
3489!:mime	application/x-eet
3490
3491# rzip archives
34920	string	RZIP		rzip compressed data
3493>4	byte	x		- version %d
3494>5	byte	x		\b.%d
3495>6	belong	x		(%d bytes)
3496
3497# From: "Robert Dale" <robdale@gmail.com>
34980	belong	123		dar archive,
3499>4	belong	x		label "%.8x
3500>>8	belong	x		%.8x
3501>>>12	beshort	x		%.4x"
3502>14	byte	0x54		end slice
3503>14	beshort	0x4e4e		multi-part
3504>14	beshort	0x4e53		multi-part, with -S
3505
3506# Symbian installation files
3507#  http://www.thouky.co.uk/software/psifs/sis.html
3508#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
35098	lelong	0x10000419	Symbian installation file
3510!:mime	application/vnd.symbian.install
3511>4	lelong	0x1000006D	(EPOC release 3/4/5)
3512>4	lelong	0x10003A12	(EPOC release 6)
35130	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
3514!:mime	x-epoc/x-sisx-app
3515
3516# From "Nelson A. de Oliveira" <naoliv@gmail.com>
35170	string	MPQ\032		MoPaQ (MPQ) archive
3518
3519# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
3520# .kgb
35210	string KGB_arch		KGB Archiver file
3522>10	string x		with compression level %.1s
3523
3524# xar (eXtensible ARchiver) archive
3525# xar archive format: http://code.google.com/p/xar/
3526# From: "David Remahl" <dremahl@apple.com>
35270	string	xar!		xar archive
3528!:mime	application/x-xar
3529#>4	beshort	x		header size %d
3530>6	beshort	x		version %d,
3531#>8	quad	x		compressed TOC: %d,
3532#>16	quad	x		uncompressed TOC: %d,
3533>24	belong	0		no checksum
3534>24	belong	1		SHA-1 checksum
3535>24	belong	2		MD5 checksum
3536
3537# Type: Parity Archive
3538# From: Daniel van Eeden <daniel_e@dds.nl>
35390	string	PAR2		Parity Archive Volume Set
3540
3541# Bacula volume format. (Volumes always start with a block header.)
3542# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
3543# From: Adam Buchbinder <adam.buchbinder@gmail.com>
354412	string	BB02		Bacula volume
3545>20	bedate	x		\b, started %s
3546
3547# ePub is XHTML + XML inside a ZIP archive.  The first member of the
3548#   archive must be an uncompressed file called 'mimetype' with contents
3549#   'application/epub+zip'
3550
3551
3552# From: "Michael Gorny" <mgorny@gentoo.org>
3553# ZPAQ: http://mattmahoney.net/dc/zpaq.html
35540	string	zPQ	ZPAQ stream
3555>3	byte	x	\b, level %d
3556# From: Barry Carter <carter.barry@gmail.com>
3557# http://encode.ru/threads/456-zpaq-updates/page32
35580	string	7kSt	ZPAQ file
3559
3560# BBeB ebook, unencrypted (LRF format)
3561# URL: http://www.sven.de/librie/Librie/LrfFormat
3562# From: Adam Buchbinder <adam.buchbinder@gmail.com>
35630	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
3564>8	beshort	x		\b, version %d
3565>36	byte	1		\b, front-to-back
3566>36	byte	16		\b, back-to-front
3567>42	beshort	x		\b, (%dx,
3568>44	beshort	x		%d)
3569
3570# Symantec GHOST image by Joerg Jenderek at May 2014
3571# http://us.norton.com/ghost/
3572# http://www.garykessler.net/library/file_sigs.html
35730		ubelong&0xFFFFf7f0	0xFEEF0100	Norton GHost image
3574# *.GHO
3575>2		ubyte&0x08		0x00		\b, first file
3576# *.GHS or *.[0-9] with cns program option
3577>2		ubyte&0x08		0x08		\b, split file
3578# part of split index interesting for *.ghs
3579>>4		ubyte			x		id=0x%x
3580# compression tag minus one equals numeric compression command line switch z[1-9]
3581>3		ubyte			0		\b, no compression
3582>3		ubyte			2		\b, fast compression (Z1)
3583>3		ubyte			3		\b, medium compression (Z2)
3584>3		ubyte			>3
3585>>3		ubyte			<11		\b, compression (Z%d-1)
3586>2		ubyte&0x08		0x00
3587# ~ 30 byte password field only for *.gho
3588>>12		ubequad			!0		\b, password protected
3589>>44		ubyte			!1
3590# 1~Image All, sector-by-sector only for *.gho
3591>>>10		ubyte			1		\b, sector copy
3592# 1~Image Boot track only for *.gho
3593>>>43		ubyte			1		\b, boot track
3594# 1~Image Disc only for *.gho implies Image Boot track and sector copy
3595>>44		ubyte			1		\b, disc sector copy
3596# optional image description only *.gho
3597>>0xff		string			>\0		"%-.254s"
3598# look for DOS sector end sequence
3599>0xE08	search/7776		\x55\xAA
3600>>&-512	indirect		x		\b; contains
3601
3602# Google Chrome extensions
3603# https://developer.chrome.com/extensions/crx
3604# https://developer.chrome.com/extensions/hosting
36050	string	Cr24	Google Chrome extension
3606!:mime	application/x-chrome-extension
3607>4	ulong	x	\b, version %u
3608
3609# SeqBox - Sequenced container
3610# ext: sbx, seqbox
3611# Marco Pontello marcopon@gmail.com
3612# reference: https://github.com/MarcoPon/SeqBox
36130	string	SBx	SeqBox,
3614>3	byte	x	version %d
3615
3616# LyNX archive
361756	string	USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE	 LyNX archive
3618#------------------------------------------------------------------------------
3619# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
3620# make:  file(1) magic for assembler source
3621#
36220	regex	\^[\040\t]{0,50}\\.asciiz		assembler source text
3623!:mime	text/x-asm
36240	regex	\^[\040\t]{0,50}\\.byte		assembler source text
3625!:mime	text/x-asm
36260	regex	\^[\040\t]{0,50}\\.even		assembler source text
3627!:mime	text/x-asm
36280	regex	\^[\040\t]{0,50}\\.globl		assembler source text
3629!:mime	text/x-asm
36300	regex	\^[\040\t]{0,50}\\.text		assembler source text
3631!:mime	text/x-asm
36320	regex	\^[\040\t]{0,50}\\.file		assembler source text
3633!:mime	text/x-asm
36340	regex	\^[\040\t]{0,50}\\.type		assembler source text
3635!:mime	text/x-asm
3636
3637#------------------------------------------------------------------------------
3638# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
3639# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
3640# strings as "long" - we assume they're just strings:
3641# From: guy@netapp.com (Guy Harris)
3642#
36430	string		*STA		Aster*x
3644>7	string		WORD			Words Document
3645>7	string		GRAP			Graphic
3646>7	string		SPRE			Spreadsheet
3647>7	string		MACR			Macro
36480	string		2278		Aster*x Version 2
3649>29	byte		0x36			Words Document
3650>29	byte		0x35			Graphic
3651>29	byte		0x32			Spreadsheet
3652>29	byte		0x38			Macro
3653
3654
3655#------------------------------------------------------------------------------
3656# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
3657# att3b:  file(1) magic for AT&T 3B machines
3658#
3659# The `versions' should be un-commented if they work for you.
3660# (Was the problem just one of endianness?)
3661#
3662# 3B20
3663#
3664# The 3B20 conflicts with SCCS.
3665#0	beshort		0550		3b20 COFF executable
3666#>12	belong		>0		not stripped
3667#>22	beshort		>0		- version %d
3668#0	beshort		0551		3b20 COFF executable (TV)
3669#>12	belong		>0		not stripped
3670#>22	beshort		>0		- version %d
3671#
3672# WE32K
3673#
36740	beshort		0560		WE32000 COFF
3675>18	beshort		^00000020	object
3676>18	beshort		&00000020	executable
3677>12	belong		>0		not stripped
3678>18	beshort		^00010000	N/A on 3b2/300 w/paging
3679>18	beshort		&00020000	32100 required
3680>18	beshort		&00040000	and MAU hardware required
3681>20	beshort		0407		(impure)
3682>20	beshort		0410		(pure)
3683>20	beshort		0413		(demand paged)
3684>20	beshort		0443		(target shared library)
3685>22	beshort		>0		- version %d
36860	beshort		0561		WE32000 COFF executable (TV)
3687>12	belong		>0		not stripped
3688#>18	beshort		&00020000	- 32100 required
3689#>18	beshort		&00040000	and MAU hardware required
3690#>22	beshort		>0		- version %d
3691#
3692# core file for 3b2
36930	string		\000\004\036\212\200	3b2 core file
3694>364	string		>\0		of '%s'
3695
3696#------------------------------------------------------------------------------
3697# $File: audio,v 1.89 2018/07/03 20:55:37 christos Exp $
3698# audio:  file(1) magic for sound formats (see also "iff")
3699#
3700# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
3701# and others
3702#
3703
3704# Sun/NeXT audio data
37050	string		.snd		Sun/NeXT audio data:
3706>12	belong		1		8-bit ISDN mu-law,
3707!:mime	audio/basic
3708>12	belong		2		8-bit linear PCM [REF-PCM],
3709!:mime	audio/basic
3710>12	belong		3		16-bit linear PCM,
3711!:mime	audio/basic
3712>12	belong		4		24-bit linear PCM,
3713!:mime	audio/basic
3714>12	belong		5		32-bit linear PCM,
3715!:mime	audio/basic
3716>12	belong		6		32-bit IEEE floating point,
3717!:mime	audio/basic
3718>12	belong		7		64-bit IEEE floating point,
3719!:mime	audio/basic
3720>12	belong		8		Fragmented sample data,
3721>12	belong		10		DSP program,
3722>12	belong		11		8-bit fixed point,
3723>12	belong		12		16-bit fixed point,
3724>12	belong		13		24-bit fixed point,
3725>12	belong		14		32-bit fixed point,
3726>12	belong		18		16-bit linear with emphasis,
3727>12	belong		19		16-bit linear compressed,
3728>12	belong		20		16-bit linear with emphasis and compression,
3729>12	belong		21		Music kit DSP commands,
3730>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
3731!:mime  audio/x-adpcm
3732>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
3733>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
3734>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
3735>12	belong		27		8-bit A-law (CCITT G.711),
3736>20	belong		1		mono,
3737>20	belong		2		stereo,
3738>20	belong		4		quad,
3739>16	belong		>0		%d Hz
3740
3741# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
3742# that uses little-endian encoding and has a different magic number
37430	lelong		0x0064732E	DEC audio data:
3744>12	lelong		1		8-bit ISDN mu-law,
3745!:mime	audio/x-dec-basic
3746>12	lelong		2		8-bit linear PCM [REF-PCM],
3747!:mime	audio/x-dec-basic
3748>12	lelong		3		16-bit linear PCM,
3749!:mime	audio/x-dec-basic
3750>12	lelong		4		24-bit linear PCM,
3751!:mime	audio/x-dec-basic
3752>12	lelong		5		32-bit linear PCM,
3753!:mime	audio/x-dec-basic
3754>12	lelong		6		32-bit IEEE floating point,
3755!:mime	audio/x-dec-basic
3756>12	lelong		7		64-bit IEEE floating point,
3757!:mime	audio/x-dec-basic
3758>12	belong		8		Fragmented sample data,
3759>12	belong		10		DSP program,
3760>12	belong		11		8-bit fixed point,
3761>12	belong		12		16-bit fixed point,
3762>12	belong		13		24-bit fixed point,
3763>12	belong		14		32-bit fixed point,
3764>12	belong		18		16-bit linear with emphasis,
3765>12	belong		19		16-bit linear compressed,
3766>12	belong		20		16-bit linear with emphasis and compression,
3767>12	belong		21		Music kit DSP commands,
3768>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
3769!:mime	audio/x-dec-basic
3770>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
3771>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
3772>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
3773>12	belong		27		8-bit A-law (CCITT G.711),
3774>20	lelong		1		mono,
3775>20	lelong		2		stereo,
3776>20	lelong		4		quad,
3777>16	lelong		>0		%d Hz
3778
3779# Creative Labs AUDIO stuff
37800	string	MThd			Standard MIDI data
3781!:mime	audio/midi
3782>8 	beshort	x			(format %d)
3783>10	beshort	x			using %d track
3784>10	beshort		>1		\bs
3785>12	beshort&0x7fff	x		at 1/%d
3786>12	beshort&0x8000	>0		SMPTE
3787
37880	string	CTMF			Creative Music (CMF) data
3789!:mime	audio/x-unknown
37900	string	SBI			SoundBlaster instrument data
3791!:mime	audio/x-unknown
37920	string	Creative\ Voice\ File	Creative Labs voice data
3793!:mime	audio/x-unknown
3794# is this next line right?  it came this way...
3795>19	byte	0x1A
3796>23	byte	>0			- version %d
3797>22	byte	>0			\b.%d
3798
3799# first entry is also the string "NTRK"
38000	belong		0x4e54524b	MultiTrack sound data
3801>4	belong		x		- version %d
3802
3803# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
3804# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
38050	string		EMOD		Extended MOD sound data,
3806>4	byte&0xf0	x		version %d
3807>4	byte&0x0f	x		\b.%d,
3808>45	byte		x		%d instruments
3809>83	byte		0		(module)
3810>83	byte		1		(song)
3811
3812# Real Audio (Magic .ra\0375)
38130	belong		0x2e7261fd	RealAudio sound file
3814!:mime	audio/x-pn-realaudio
38150	string		.RMF\0\0\0	RealMedia file
3816!:mime	application/vnd.rn-realmedia
3817#video/x-pn-realvideo
3818#video/vnd.rn-realvideo
3819#application/vnd.rn-realmedia
3820#	sigh, there are many mimes for that but the above are the most common.
3821
3822# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
3823# Oct 31, 1995
3824# fixed by <doj@cubic.org> 2003-06-24
3825# Too short...
3826#0	string		MTM		MultiTracker Module sound file
3827#0	string		if		Composer 669 Module sound data
3828#0	string		JN		Composer 669 Module sound data (extended format)
38290	string		MAS_U		ULT(imate) Module sound data
3830
3831#0	string		FAR		Module sound data
3832#>4	string		>\15		Title: "%s"
3833
38340x2c	string		SCRM		ScreamTracker III Module sound data
3835>0	string		>\0		Title: "%s"
3836
3837# Gravis UltraSound patches
3838# From <ache@nagual.ru>
3839
38400	string		GF1PATCH110\0ID#000002\0	GUS patch
38410	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
3842
3843# mime types according to http://www.geocities.com/nevilo/mod.htm:
3844#	audio/it	.it
3845#	audio/x-zipped-it	.itz
3846#	audio/xm	fasttracker modules
3847#	audio/x-s3m	screamtracker modules
3848#	audio/s3m	screamtracker modules
3849#	audio/x-zipped-mod	mdz
3850#	audio/mod	mod
3851#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
3852
3853#
3854# Taken from loader code from mikmod version 2.14
3855# by Steve McIntyre (stevem@chiark.greenend.org.uk)
3856# <doj@cubic.org> added title printing on 2003-06-24
38570	string	MAS_UTrack_V00
3858>14	string	>/0		ultratracker V1.%.1s module sound data
3859!:mime	audio/x-mod
3860#audio/x-tracker-module
3861
38620	string	UN05		MikMod UNI format module sound data
3863
38640	string	Extended\ Module: Fasttracker II module sound data
3865!:mime	audio/x-mod
3866#audio/x-tracker-module
3867>17	string	>\0		Title: "%s"
3868
386921	string/c	=!SCREAM!	Screamtracker 2 module sound data
3870!:mime	audio/x-mod
3871#audio/x-screamtracker-module
387221	string	BMOD2STM	Screamtracker 2 module sound data
3873!:mime	audio/x-mod
3874#audio/x-screamtracker-module
38751080	string	M.K.		4-channel Protracker module sound data
3876!:mime	audio/x-mod
3877#audio/x-protracker-module
3878>0	string	>\0		Title: "%s"
38791080	string	M!K!		4-channel Protracker module sound data
3880!:mime	audio/x-mod
3881#audio/x-protracker-module
3882>0	string	>\0		Title: "%s"
38831080	string	FLT4		4-channel Startracker module sound data
3884!:mime	audio/x-mod
3885#audio/x-startracker-module
3886>0	string	>\0		Title: "%s"
38871080	string	FLT8		8-channel Startracker module sound data
3888!:mime	audio/x-mod
3889#audio/x-startracker-module
3890>0	string	>\0		Title: "%s"
38911080	string	4CHN		4-channel Fasttracker module sound data
3892!:mime	audio/x-mod
3893#audio/x-fasttracker-module
3894>0	string	>\0		Title: "%s"
38951080	string	6CHN		6-channel Fasttracker module sound data
3896!:mime	audio/x-mod
3897#audio/x-fasttracker-module
3898>0	string	>\0		Title: "%s"
38991080	string	8CHN		8-channel Fasttracker module sound data
3900!:mime	audio/x-mod
3901#audio/x-fasttracker-module
3902>0	string	>\0		Title: "%s"
39031080	string	CD81		8-channel Octalyser module sound data
3904!:mime	audio/x-mod
3905#audio/x-octalysertracker-module
3906>0	string	>\0		Title: "%s"
39071080	string	OKTA		8-channel Octalyzer module sound data
3908!:mime	audio/x-mod
3909#audio/x-octalysertracker-module
3910>0	string	>\0		Title: "%s"
3911# Not good enough.
3912#1082	string	CH
3913#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
39141080	string	16CN		16-channel Taketracker module sound data
3915!:mime	audio/x-mod
3916#audio/x-taketracker-module
3917>0	string	>\0		Title: "%s"
39181080	string	32CN		32-channel Taketracker module sound data
3919!:mime	audio/x-mod
3920#audio/x-taketracker-module
3921>0	string	>\0		Title: "%s"
3922
3923# TOC sound files -Trevor Johnson <trevor@jpj.net>
3924#
39250       string          TOC             TOC sound file
3926
3927# sidfiles <pooka@iki.fi>
3928# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
39290	string		SIDPLAY\ INFOFILE	Sidplay info file
3930
39310	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
3932>4	beshort		>0			w/ header v%d,
3933>14	beshort		=1			single song,
3934>14	beshort		>1			%d songs,
3935>16	beshort		>0			default song: %d
3936>0x16	string		>\0			name: "%s"
3937>0x36	string		>\0			author: "%s"
3938>0x56	string		>\0			copyright: "%s"
3939
39400	string		RSID			RSID sidtune PlaySID compatible
3941>4	beshort		>0			w/ header v%d,
3942>14	beshort		=1			single song,
3943>14	beshort		>1			%d songs,
3944>16	beshort		>0			default song: %d
3945>0x16	string		>\0			name: "%s"
3946>0x36	string		>\0			author: "%s"
3947>0x56	string		>\0			copyright: "%s"
3948
3949# IRCAM sound files - Michael Pruett <michael@68k.org>
3950# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
39510	belong		0x64a30100		IRCAM file (VAX little-endian)
39520	belong		0x0001a364		IRCAM file (VAX big-endian)
39530	belong		0x64a30200		IRCAM file (Sun big-endian)
39540	belong		0x0002a364		IRCAM file (Sun little-endian)
39550	belong		0x64a30300		IRCAM file (MIPS little-endian)
39560	belong		0x0003a364		IRCAM file (MIPS big-endian)
39570	belong		0x64a30400		IRCAM file (NeXT big-endian)
39580	belong		0x64a30400		IRCAM file (NeXT big-endian)
39590	belong		0x0004a364		IRCAM file (NeXT little-endian)
3960
3961# NIST SPHERE <mpruett@sgi.com>
39620	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
3963
3964# Sample Vision <mpruett@sgi.com>
39650	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
3966
3967# Audio Visual Research <tonigonenstein@users.sourceforge.net>
39680	string		2BIT			Audio Visual Research file,
3969>12	beshort		=0			mono,
3970>12	beshort		=-1			stereo,
3971>14	beshort		x			%d bits
3972>16	beshort		=0			unsigned,
3973>16	beshort		=-1			signed,
3974>22	belong&0x00ffffff	x		%d Hz,
3975>18	beshort		=0			no loop,
3976>18	beshort		=-1			loop,
3977>21	ubyte		<128			note %d,
3978>22	byte		=0			replay 5.485 KHz
3979>22	byte		=1			replay 8.084 KHz
3980>22	byte		=2			replay 10.971 KHz
3981>22	byte		=3			replay 16.168 KHz
3982>22	byte		=4			replay 21.942 KHz
3983>22	byte		=5			replay 32.336 KHz
3984>22	byte		=6			replay 43.885 KHz
3985>22	byte		=7			replay 47.261 KHz
3986
3987# SGI SoundTrack <mpruett@sgi.com>
39880	string		_SGI_SoundTrack		SGI SoundTrack project file
3989# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
39900	string		ID3	Audio file with ID3 version 2
3991>3	byte		x	\b.%d
3992>4	byte		x	\b.%d
3993>>5	byte		&0x80	\b, unsynchronized frames
3994>>5	byte		&0x40	\b, extended header
3995>>5	byte		&0x20	\b, experimental
3996>>5	byte		&0x10	\b, footer present
3997>(6.I+10)	indirect	x	\b, contains:
3998
3999# NSF (NES sound file) magic
40000	string		NESM\x1a	NES Sound File
4001>14	string		>\0		("%s" by
4002>46	string		>\0		%s, copyright
4003>78	string		>\0		%s),
4004>5	byte		x		version %d,
4005>6	byte		x		%d tracks,
4006>122	byte&0x2	=1		dual PAL/NTSC
4007>122	byte&0x1	=1		PAL
4008>122	byte&0x1	=0		NTSC
4009
4010# NSFE (Extended NES sound file) magic
4011# http://slickproductions.org/docs/NSF/nsfespec.txt
4012# From: David Pflug <david@pflug.email>
40130	string		NSFE		Extended NES Sound File
4014>48	search/0x1000	auth
4015>>&0	string		>\0		("%s"
4016>>>&1	string		>\0		by %s
4017>>>>&1	string		>\0		\b, copyright %s
4018>>>>>&1	string		>\0		\b, ripped by %s
4019>20	byte		x		\b), %d tracks,
4020>18	byte&0x2	=1		dual PAL/NTSC
4021>18     byte&0x2	=0
4022>>18	byte&0x1	=1		PAL
4023>>18	byte&0x1	=0		NTSC
4024
4025# Type: SNES SPC700 sound files
4026# From: Josh Triplett <josh@freedesktop.org>
40270	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
4028>&0	string	0.30					\b, version %s
4029>>0x23	byte	0x1B					\b, without ID666 tag
4030>>0x23	byte	0x1A					\b, with ID666 tag
4031>>>0x2E	string	>\0					\b, song "%.32s"
4032>>>0x4E	string	>\0					\b, game "%.32s"
4033
4034# Impulse tracker module (audio/x-it)
40350	string		IMPM		Impulse Tracker module sound data -
4036!:mime	audio/x-mod
4037>4	string		>\0		"%s"
4038>40	leshort		!0		compatible w/ITv%x
4039>42	leshort		!0		created w/ITv%x
4040
4041# Imago Orpheus module (audio/x-imf)
404260	string		IM10		Imago Orpheus module sound data -
4043>0	string		>\0		"%s"
4044
4045# From <collver1@attbi.com>
4046# These are the /etc/magic entries to decode modules, instruments, and
4047# samples in Impulse Tracker's native format.
4048
40490	string		IMPS		Impulse Tracker Sample
4050>18	byte		&2		16 bit
4051>18	byte		^2		8 bit
4052>18	byte		&4		stereo
4053>18	byte		^4		mono
40540	string		IMPI		Impulse Tracker Instrument
4055>28	leshort		!0		ITv%x
4056>30	byte		!0		%d samples
4057
4058# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
4059# From <collver1@attbi.com>
40600	string		LM8953		Yamaha TX Wave
4061>22	byte		0x49		looped
4062>22	byte		0xC9		non-looped
4063>23	byte		1		33kHz
4064>23	byte		2		50kHz
4065>23	byte		3		16kHz
4066
4067# scream tracker:  file(1) magic for Scream Tracker sample files
4068#
4069# From <collver1@attbi.com>
407076	string		SCRS		Scream Tracker Sample
4071>0	byte		1		sample
4072>0	byte		2		adlib melody
4073>0	byte		>2		adlib drum
4074>31	byte		&2		stereo
4075>31	byte		^2		mono
4076>31	byte		&4		16bit little endian
4077>31	byte		^4		8bit
4078>30	byte		0		unpacked
4079>30	byte		1		packed
4080
4081# audio
4082# From: Cory Dikkers <cdikkers@swbell.net>
40830	string		MMD0		MED music file, version 0
40840	string		MMD1		OctaMED Pro music file, version 1
40850	string		MMD3		OctaMED Soundstudio music file, version 3
40860	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
40870	string		MED		MED_Song
40880	string		SymM		Symphonie SymMOD music file
4089#
40900	string		THX		AHX version
4091>3	byte		=0		1 module data
4092>3	byte		=1		2 module data
4093#
40940	string		OKTASONG	Oktalyzer module data
4095#
40960	string		DIGI\ Booster\ module\0	%s
4097>20	byte		>0		%c
4098>>21	byte		>0		\b%c
4099>>>22	byte		>0		\b%c
4100>>>>23	byte		>0		\b%c
4101>610	string		>\0		\b, "%s"
4102#
41030	string		DBM0	   	DIGI Booster Pro Module
4104>4	byte		>0		V%X.
4105>>5	byte		x		\b%02X
4106>16	string		>\0		\b, "%s"
4107#
41080	string		FTMN		FaceTheMusic module
4109>16	string		>\0d		\b, "%s"
4110
4111# From: <doj@cubic.org> 2003-06-24
41120	string		AMShdr\32	Velvet Studio AMS Module v2.2
41130	string		Extreme		Extreme Tracker AMS Module v1.3
41140	string		DDMF		Xtracker DMF Module
4115>4	byte		x		v%i
4116>0xD	string		>\0		Title: "%s"
4117>0x2B	string		>\0		Composer: "%s"
41180	string		DSM\32		Dynamic Studio Module DSM
41190	string		SONG		DigiTrekker DTM Module
41200	string		DMDL		DigiTrakker MDL Module
41210	string		PSM\32		Protracker Studio PSM Module
412244	string		PTMF		Poly Tracker PTM Module
4123>0	string		>\32		Title: "%s"
41240	string		MT20		MadTracker 2.0 Module MT2
41250	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
41260	string		RTMM		RTM Module
41270x426	string		MaDoKaN96	XMS Adlib Module
4128>0	string		>\0		Composer: "%s"
41290	string		AMF		AMF Module
4130>4	string		>\0		Title: "%s"
41310	string		MODINFO1	Open Cubic Player Module Inforation MDZ
41320	string		Extended\40Instrument: Fast Tracker II Instrument
4133
4134# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
4135# NOA Nancy Codec file
41360	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
4137# Yamaha SMAF format
41380	string		MMMD		Yamaha SMAF file
4139# Sharp Jisaku Melody format for PDC
41400	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
4141>20	string		Ver01.00	Ver. 1.00
4142>>32	byte		x		, %d tracks
4143
4144# Free lossless audio codec <http://flac.sourceforge.net>
4145# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
41460	string			fLaC		FLAC audio bitstream data
4147!:mime	audio/flac
4148>4	byte&0x7f		>0		\b, unknown version
4149>4	byte&0x7f		0		\b
4150# some common bits/sample values
4151>>20	beshort&0x1f0		0x030		\b, 4 bit
4152>>20	beshort&0x1f0		0x050		\b, 6 bit
4153>>20	beshort&0x1f0		0x070		\b, 8 bit
4154>>20	beshort&0x1f0		0x0b0		\b, 12 bit
4155>>20	beshort&0x1f0		0x0f0		\b, 16 bit
4156>>20	beshort&0x1f0		0x170		\b, 24 bit
4157>>20	byte&0xe		0x0		\b, mono
4158>>20	byte&0xe		0x2		\b, stereo
4159>>20	byte&0xe		0x4		\b, 3 channels
4160>>20	byte&0xe		0x6		\b, 4 channels
4161>>20	byte&0xe		0x8		\b, 5 channels
4162>>20	byte&0xe		0xa		\b, 6 channels
4163>>20	byte&0xe		0xc		\b, 7 channels
4164>>20	byte&0xe		0xe		\b, 8 channels
4165# sample rates derived from known oscillator frequencies;
4166# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and
4167# 16.384 (other/fs=32kHz).
4168>>17	belong&0xfffff0       	0x02b110	\b, 11.025 kHz
4169>>17	belong&0xfffff0       	0x03e800	\b, 16 kHz
4170>>17	belong&0xfffff0       	0x056220	\b, 22.05 kHz
4171>>17	belong&0xfffff0       	0x05dc00	\b, 24 kHz
4172>>17	belong&0xfffff0       	0x07d000	\b, 32 kHz
4173>>17	belong&0xfffff0       	0x0ac440	\b, 44.1 kHz
4174>>17	belong&0xfffff0       	0x0bb800	\b, 48 kHz
4175>>17	belong&0xfffff0       	0x0fa000	\b, 64 kHz
4176>>17	belong&0xfffff0       	0x158880	\b, 88.2 kHz
4177>>17	belong&0xfffff0       	0x177000	\b, 96 kHz
4178>>17	belong&0xfffff0       	0x1f4000	\b, 128 kHz
4179>>17	belong&0xfffff0       	0x2b1100	\b, 176.4 kHz
4180>>17	belong&0xfffff0       	0x2ee000	\b, 192 kHz
4181>>17	belong&0xfffff0       	0x3e8000	\b, 256 kHz
4182>>17	belong&0xfffff0       	0x562200	\b, 352.8 kHz
4183>>17	belong&0xfffff0       	0x5dc000	\b, 384 kHz
4184>>21	byte&0xf		>0		\b, >4G samples
4185>>21	byte&0xf		0		\b
4186>>>22	belong			>0		\b, %u samples
4187>>>22	belong			0		\b, length unknown
4188
4189# (ISDN) VBOX voice message file (Wolfram Kleff)
41900       string          VBOX            VBOX voice message data
4191
4192# ReBorn Song Files (.rbs)
4193# David J. Singer <doc@deadvirgins.org.uk>
41948       string          RB40             RBS Song file
4195>29     string          ReBorn           created by ReBorn
4196>37     string          Propellerhead    created by ReBirth
4197
4198# Synthesizer Generator and Kimwitu share their file format
41990	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
4200# Kimwitu++ uses a slightly different magic
42010	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
4202
4203# From "Simon Hosie
42040       string  TFMX-SONG       TFMX module sound data
4205
4206# Monkey's Audio compressed audio format (.ape)
4207# From danny.milo@gmx.net (Danny Milosavljevic)
4208# New version from Abel Cheung <abel (@) oaka.org>
42090		string		MAC\040		Monkey's Audio compressed format
4210!:mime audio/x-ape
4211>4		uleshort	>0x0F8B		version %d
4212>>(0x08.l)	uleshort	=1000		with fast compression
4213>>(0x08.l)	uleshort	=2000		with normal compression
4214>>(0x08.l)	uleshort	=3000		with high compression
4215>>(0x08.l)	uleshort	=4000		with extra high compression
4216>>(0x08.l)	uleshort	=5000		with insane compression
4217>>(0x08.l+18)	uleshort	=1		\b, mono
4218>>(0x08.l+18)	uleshort	=2		\b, stereo
4219>>(0x08.l+20)	ulelong		x		\b, sample rate %d
4220>4		uleshort	<0x0F8C		version %d
4221>>6		uleshort	=1000		with fast compression
4222>>6		uleshort	=2000		with normal compression
4223>>6		uleshort	=3000		with high compression
4224>>6		uleshort	=4000		with extra high compression
4225>>6		uleshort	=5000		with insane compression
4226>>10		uleshort	=1		\b, mono
4227>>10		uleshort	=2		\b, stereo
4228>>12		ulelong		x		\b, sample rate %d
4229
4230# adlib sound files
4231# From: Alex Myczko <alex@aiei.ch>
42320    	string		RAWADATA	RdosPlay RAW
4233
42341068	string		RoR		AMUSIC Adlib Tracker
4235
42360	string		JCH		EdLib
4237
42380	string		mpu401tr	MPU-401 Trakker
4239
42400	string		SAdT		Surprise! Adlib Tracker
4241>4	byte		x		Version %d
4242
42430	string		XAD!		eXotic ADlib
4244
42450	string		ofTAZ!		eXtra Simple Music
4246
4247# Spectrum 128 tunes (.ay files).
4248# From: Emanuel Haupt <ehaupt@critical.ch>
42490	string		ZXAYEMUL	Spectrum 128 tune
4250
42510	string		\0BONK		BONK,
4252#>5	byte		x		version %d
4253>14	byte		x		%d channel(s),
4254>15	byte		=1		lossless,
4255>15	byte		=0		lossy,
4256>16	byte		x		mid-side
4257
4258384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
4259
4260# format VQF (proprietary codec for sound)
4261# some infos on the header file available at :
4262# http://www.twinvq.org/english/technology_format.html
42630	string		TWIN97012000	VQF data
4264>27	short		0		\b, Mono
4265>27	short		1		\b, Stereo
4266>31	short 		>0		\b, %d kbit/s
4267>35	short 		>0		\b, %d kHz
4268
4269# Nelson A. de Oliveira (naoliv@gmail.com)
4270# .eqf
42710	string	Winamp\ EQ\ library\ file	%s
4272# it will match only versions like v<digit>.<digit>
4273# Since I saw only eqf files with version v1.1 I think that it's OK
4274>23	string	x	\b%.4s
4275# .preset
42760	string	[Equalizer\ preset]	XMMS equalizer preset
4277# .m3u
42780	search/1	#EXTM3U 	M3U playlist text
4279# .pls
42800	search/1	[playlist]	PLS playlist text
4281# licq.conf
42821	string	[licq]			LICQ configuration file
4283
4284# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
42850	string		ICE!		SNDH Atari ST music
42860	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music
4287
4288# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
42890       string          MP+     Musepack audio (MP+)
4290!:mime	audio/x-musepack
4291>3      byte            255     \b, SV pre8
4292>3      byte&0xF        0x6     \b, SV 6
4293>3      byte&0xF        0x8     \b, SV 8
4294>3      byte&0xF        0x7     \b, SV 7
4295>>3     byte&0xF0       0x0     \b.0
4296>>3     byte&0xF0       0x10    \b.1
4297>>3     byte&0xF0       240     \b.15
4298>>10    byte&0xF0       0x0     \b, no profile
4299>>10    byte&0xF0       0x10    \b, profile 'Unstable/Experimental'
4300>>10    byte&0xF0       0x50    \b, quality 0
4301>>10    byte&0xF0       0x60    \b, quality 1
4302>>10    byte&0xF0       0x70    \b, quality 2 (Telephone)
4303>>10    byte&0xF0       0x80    \b, quality 3 (Thumb)
4304>>10    byte&0xF0       0x90    \b, quality 4 (Radio)
4305>>10    byte&0xF0       0xA0    \b, quality 5 (Standard)
4306>>10    byte&0xF0       0xB0    \b, quality 6 (Xtreme)
4307>>10    byte&0xF0       0xC0    \b, quality 7 (Insane)
4308>>10    byte&0xF0       0xD0    \b, quality 8 (BrainDead)
4309>>10    byte&0xF0       0xE0    \b, quality 9
4310>>10    byte&0xF0       0xF0    \b, quality 10
4311>>27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
4312>>27    byte            102     \b, Beta 1.02
4313>>27    byte            104     \b, Beta 1.04
4314>>27    byte            105     \b, Alpha 1.05
4315>>27    byte            106     \b, Beta 1.06
4316>>27    byte            110     \b, Release 1.1
4317>>27    byte            111     \b, Alpha 1.11
4318>>27    byte            112     \b, Beta 1.12
4319>>27    byte            113     \b, Alpha 1.13
4320>>27    byte            114     \b, Beta 1.14
4321>>27    byte            115     \b, Alpha 1.15
4322
43230       string          MPCK    Musepack audio (MPCK)
4324!:mime	audio/x-musepack
4325
4326# IMY
4327# from http://filext.com/detaillist.php?extdetail=IMY
4328# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
4329# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
4330# http://www.wx800.com/msg/download/irda/iMelody.pdf
43310	string	BEGIN:IMELODY	iMelody Ringtone Format
4332
4333# From: "Mateus Caruccio" <mateus@caruccio.com>
4334# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
43350	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature
4336
4337# From: "Leslie P. Polzer" <leslie.polzer@gmx.net>
433860	string	SONG		SoundFX Module sound file
4339
4340# Type: Adaptive Multi-Rate Codec
4341# URL:  http://filext.com/detaillist.php?extdetail=AMR
4342# From: Russell Coker <russell@coker.com.au>
43430	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
4344
4345# Type: SuperCollider 3 Synth Definition File Format
4346# From: Mario Lang <mlang@debian.org>
43470	string	SCgf	SuperCollider3 Synth Definition file,
4348>4	belong	x	version %d
4349
4350# Type: True Audio Lossless Audio
4351# URL:  http://wiki.multimedia.cx/index.php?title=True_Audio
4352# From: Mike Melanson <mike@multimedia.cx>
43530	string	TTA1	True Audio Lossless Audio
4354
4355# Type: WavPack Lossless Audio
4356# URL:  http://wiki.multimedia.cx/index.php?title=WavPack
4357# From: Mike Melanson <mike@multimedia.cx>
43580	string	wvpk	WavPack Lossless Audio
4359
4360# From Fabio R. Schmidlin <frs@pop.com.br>
4361# VGM music file
43620	string		Vgm\040
4363>9	ubyte		>0	VGM Video Game Music dump v
4364>>9	ubyte/16	>0	\b%d
4365>>9	ubyte&0x0F	x	\b%d
4366>>8	ubyte/16	x	\b.%d
4367>>8	ubyte&0x0F	>0	\b%d
4368#Get soundchips
4369>>8	ubyte		x	\b, soundchip(s)=
4370>>0x0C	ulelong		>0	SN76489,
4371>>0x10	ulelong		>0	YM2413,
4372>>0x2C	ulelong		>0	YM2612,
4373>>0x30	ulelong		>0	YM2151,
4374>>0x38	ulelong		>0	Sega PCM,
4375>>0x34	ulelong		>0xC
4376>>>0x40	ulelong		>0	RF5C68,
4377>>0x34	ulelong		>0x10
4378>>>0x44	ulelong		>0	YM2203,
4379>>0x34	ulelong		>0x14
4380>>>0x48	ulelong		>0	YM2608,
4381>>0x34	ulelong		>0x18
4382>>>0x4C	lelong		>0	YM2610,
4383>>>0x4C	lelong		<0	YM2610B,
4384>>0x34	ulelong		>0x1C
4385>>>0x50	ulelong		>0	YM3812,
4386>>0x34	ulelong		>0x20
4387>>>0x54	ulelong		>0	YM3526,
4388>>0x34	ulelong		>0x24
4389>>>0x58	ulelong		>0	Y8950,
4390>>0x34	ulelong		>0x28
4391>>>0x5C	ulelong		>0	YMF262,
4392>>0x34	ulelong		>0x2C
4393>>>0x60	ulelong		>0	YMF278B,
4394>>0x34	ulelong		>0x30
4395>>>0x64	ulelong		>0	YMF271,
4396>>0x34	ulelong		>0x34
4397>>>0x68	ulelong		>0	YMZ280B,
4398>>0x34	ulelong		>0x38
4399>>>0x6C	ulelong		>0	RF5C164,
4400>>0x34	ulelong		>0x3C
4401>>>0x70	ulelong		>0	PWM,
4402>>0x34	ulelong		>0x40
4403>>>0x74	ulelong		>0
4404>>>>0x78 ubyte		0x00	AY-3-8910,
4405>>>>0x78 ubyte		0x01	AY-3-8912,
4406>>>>0x78 ubyte		0x02	AY-3-8913,
4407>>>>0x78 ubyte		0x03	AY-3-8930,
4408>>>>0x78 ubyte		0x10	YM2149,
4409>>>>0x78 ubyte		0x11	YM3439,
4410
4411# GVOX Encore file format
4412# Since this is a proprietary file format and there is no publicly available
4413# format specification, this is just based on induction
4414#
44150	string	SCOW
4416>4	byte	0xc4	GVOX Encore music, version 5.0 or above
4417>4	byte	0xc2	GVOX Encore music, version < 5.0
4418
44190	string	ZBOT
4420>4	byte	0xc5	GVOX Encore music, version < 5.0
4421
4422# Summary:	Garmin Voice Processing Module (WAVE audios)
4423# From:		Joerg Jenderek
4424# URL:		http://www.garmin.com/
4425# Reference:	http://turboccc.wikispaces.com/share/view/28622555
4426# NOTE:		there exist 2 other Garmin VPM formats
44270		string	AUDIMG
4428# skip text files starting with string "AUDIMG"
4429>13		ubyte		<13	Garmin Voice Processing Module
4430!:mime	audio/x-vpm-wav-garmin
4431!:ext	vpm
4432# 3 bytes indicating the voice version (200,220)
4433>>6		string		x	\b, version %3.3s
4434# day of release (01-31)
4435>>12		ubyte		x	\b, %.2d
4436# month of release (01-12)
4437>>13		ubyte		x	\b.%.2d
4438# year of release (like 2006, 2007, 2008)
4439>>14		uleshort	x	\b.%.4d
4440# hour of release (0-23)
4441>>11		ubyte		x	%.2d
4442# minute of release (0-59)
4443>>10		ubyte		x	\b:%.2d
4444# second of release (0-59)
4445>>9		ubyte		x	\b:%.2d
4446# if you select a language like german on your garmin device
4447# you can only select voice modules with corresponding language byte ID like 1
4448>>18		ubyte		x	\b, language ID %d
4449# pointer to 1st audio WAV sample
4450>>16		uleshort	>0
4451>>>(16.s)	ulelong		>0	\b, at offset 0x%x
4452# WAV length
4453>>>>(16.s+4)	ulelong		>0	%d Bytes
4454# look for magic
4455>>>>>(&-8.l)	string		RIFF
4456# determine type by ./riff
4457>>>>>>&-4	indirect	x	\b
4458# 2 - ~ 131 WAV samples following same way
4459
4460# From Martin Mueller Skarbiniks Pedersen
44610		string		GDM
4462>0x3		byte		0xFE	General Digital Music.
4463>0x4		string		>\0	title: "%s"
4464>0x24		string		>\0	musician: "%s"
4465>>0x44		beshort		0x0D0A
4466>>>0x46		byte		0x1A
4467>>>>0x47	string		GMFS	Version
4468>>>>0x4B	byte		x	%d.
4469>>>>0x4C	byte		x	\b%02d
4470>>>>0x4D	beshort		0x000	(2GDM v
4471>>>>0x4F	byte		x	\b%d.
4472>>>>>0x50	byte		x	\b%d)
4473
44740		string		MTM	Multitracker
4475>0x3		byte/16		x	Version %d.
4476>0x3		byte&0x0F	x	\b%02d
4477>>0x4		string		>\0	title: "%s"
4478
44790		string		HVL
4480>3		byte		<2	Hively Tracker Song
4481>3		byte		0	1 module data
4482>3		byte		1	2 module data
4483
44840		string		MO3
4485>3		ubyte		<6	MOdule with MP3
4486>>3		byte		0	Version	0	(With MP3 and lossless)
4487>>3		byte		1	Version	1	(With ogg and lossless)
4488>>3		byte		3	Version 2.2
4489>>3		byte		4	(With no LAME header)
4490>>3		byte		5	Version 2.4
4491
44920		string		ADRVPACK	AProSys	module
4493
4494# ftp://ftp.modland.com/pub/documents/format_documentation/\
4495# Art%20Of%20Noise%20(.aon).txt
44960		string		AON
4497>4		string		"ArtOfNoise by Bastian Spiegel(twice/lego)"
4498>0x2e		string		NAME	Art of Noise Tracker Song
4499>3		string		<9
4500>3		string		4	(4 voices)
4501>3		string		8	(8 voices)
4502>>0x36		string		>\0	Title: "%s"
4503
45040		string		FAR
4505>0x2c		byte		0x0d
4506>0x2d		byte		0x0a
4507>0x2e		byte		0x1a
4508>>0x3		byte		0xFE	Farandole Tracker Song
4509>>>0x31		byte/16		x	Version %d.
4510>>>0x31		byte&0x0F	x	\b%02d
4511>>>>0x4		string		>\0	\b, title: "%s"
4512
4513# magic for Klystrack, http://kometbomb.github.io/klystrack/
4514# from Alex Myczko <alex@aiei.ch>
45150	string	cyd!song	Klystrack song
4516>8	byte	>0		\b, version %u
4517>8	byte	>26
4518#>>9	byte	x		\b, channels %u
4519#>>10	leshort	x		\b, time signature %u
4520#>>12	leshort	x		\b, sequence step %u
4521#>>14	byte	x		\b, instruments %u
4522#>>15	leshort	x		\b, patterns %u
4523#>>17	leshort	x		\b, sequences %u
4524#>>19	leshort	x		\b, length %u
4525#>>21	leshort	x		\b, loop point %u
4526#>>23	byte	x		\b, master volume %u
4527#>>24	byte	x		\b, song speed %u
4528#>>25	byte	x		\b, song speed2 %u
4529#>>26	byte	x		\b, song rate %u
4530#>>27	belong	x		\b, flags %#x
4531#>>31	byte	x		\b, multiplex period %u
4532#>>32	byte	x		\b, pitch inaccuracy %u
4533>>149	pstring	x		\b, title %s
4534
45350	string	cyd!inst	Klystrack instrument
4536
4537# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor
4538# see Specifications/WOPL-and-OPLI-Specification.txt
4539
45400	string	WOPL3-INST\0	WOPL instrument
4541>11	leshort	x	\b, version %u
45420	string	WOPL3-BANK\0	WOPL instrument bank
4543>11	leshort	x	\b, version %u
4544
4545# AdLib/OPL instrument files. Format specifications on
4546#  http://www.shikadi.net/moddingwiki
45470	string	Junglevision\ Patch\ File	Junglevision instrument data
45480	string	#OPL_II#	DMX OP2 instrument data
45490	string	IBK\x1a		IBK instrument data
45500	string	2OP\x1a		IBK instrument data, 2 operators
45510	string	4OP\x1a		IBK instrument data, 4 operators
45522	string	ADLIB-		AdLib instrument data
4553>0	byte	x		\b, version %u
4554>1	byte	x		\b.%u
4555
4556# CRI ADX ADPCM audio
4557# Used by various Sega games.
4558# https://en.wikipedia.org/wiki/ADX_(file_format)
4559# https://wiki.multimedia.cx/index.php/CRI_ADX_file
4560# Added by David Korth <gerbilsoft@gerbilsoft.com>
45610x00		beshort		0x8000
4562>(2.S-2)	string		(c)CRI		CRI ADX ADPCM audio
4563>>0x12		byte		x		v%u
4564>>0x04		byte		0x02		\b, pre-set prediction coefficients
4565>>0x04		byte		0x03		\b, standard ADX
4566>>0x04		byte		0x04		\b, exponential scale
4567>>0x04		byte		0x05		\b, AHX
4568>>0x08		belong		x		\b, %u Hz
4569>>0x12		byte		0x03
4570>>>0x02		beshort		>0x2B
4571>>>>0x18	belong		!0		\b, looping
4572>>0x12		byte		0x04
4573>>>0x02		beshort		>0x37
4574>>>>0x24	belong		!0		\b, looping
4575>>0x13		byte&0x08	0x08		\b, encrypted
4576
4577# Lossless audio (.la) (http://www.lossless-audio.com/)
45780	string	LA
4579>2	string	03	Lossless audio version 0.3
4580>2	string	04	Lossless audio version 0.4
4581
4582# Sony PlayStation Audio (.xa)
45830	leshort 0x4158	Sony PlayStation Audio
4584
4585
4586#----------------------------------------------------------------
4587# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
4588# basis: file(1) magic for BBx/Pro5-files
4589#      Oliver Dammer <dammer@olida.de>	 2005/11/07
4590# http://www.basis.com business-basic-files.
4591#
45920	string		\074\074bbx\076\076	BBx
4593>7	string		\000			indexed file
4594>7	string		\001			serial file
4595>7	string		\002			keyed file
4596>>13	short		0			(sort)
4597>7	string		\004			program
4598>>18	byte		x			(LEVEL %d)
4599>>>23	string		>\000			psaved
4600>7	string		\006			mkeyed file
4601>>13	short		0			(sort)
4602>>8	string		\000			(mkey)
4603#------------------------------------------------------------------------------
4604# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $
4605# beetle:  file(1) magic for Beetle VM object files
4606# https://github.com/rrthomas/beetle/
4607
4608# Beetle object module
46090	string		BEETLE\000	Beetle VM object file
4610
4611#------------------------------------------------------------------------------
4612# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $
4613# ber:  file(1) magic for several BER formats used in the mobile
4614# telecommunications industry (Georg Sauthoff)
4615
4616# The file formats are standardized by the GSMA (GSM association).
4617# They are specified via ASN.1 schemas and some prose. Basic encoding
4618# rules (BER) is the used encoding. The formats are used for exchanging
4619# call data records (CDRs) between mobile operators and associated
4620# parties for roaming clearing purposes and fraud detection.
4621
4622# The magic file covers:
4623
4624# - TAP files (TD.57) - CDR batches and notifications
4625# - RAP files (TD.32) - return batches and acknowledgements
4626# - NRT files (TD.35) - CDR batches for 'near real time' processing
4627
4628#
4629# TAP 3 Files
4630# TAP -> Transferred Account Procedure
4631# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
4632# TransferBatch short tag
46330	byte	0x61
4634# BatchControlInfo short tag
4635>&1	search/b5	\x64
4636# Sender long tag #TAP 3.x (BER encoded)
4637>>&1	search/b8	\x5f\x81\x44
4638# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
4639>>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
4640>>>>&0	byte	x	TAP 3.%d Batch (TD.57, Transferred Account)
4641
4642# Notification short tag
46430	byte	0x62
4644# Sender long tag
4645>2	search/b8	\x5f\x81\x44
4646# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
4647>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
4648>>>&0	byte	x	TAP 3.%d Notification (TD.57, Transferred Account)
4649
4650
4651# NRT Files
4652# NRT a.k.a. NRTRDE
46530	byte	0x61
4654# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
4655>&1	search/b8 \x5f\x29\x01\x02\x5f\x25\x01
4656>>&0	byte	x	NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)
4657
4658# RAP Files
4659# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
4660# Long ReturnBatch tag
46610	string	\x7f\x84\x16
4662# Long RapBatchControlInfo tag
4663>&1	search/b8	\x7f\x84\x19
4664# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block
4665>>&64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
4666# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block
4667>>>&1	string/b	\x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
4668>>>>&0	byte	x	RAP 1.%d Batch (TD.32, Returned Account Procedure),
4669>>>&0	byte	x	TAP 3.%d
4670
4671# Long Acknowledgement tag
46720	string \x7f\x84\x17
4673# Long Sender tag
4674>&1	search/b5	\x5f\x81\x44	RAP Acknowledgement (TD.32, Returned Account Procedure)
4675
4676#------------------------------------------------------------------------------
4677# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
4678# bFLT: file(1) magic for BFLT uclinux binary files
4679#
4680# From Philippe De Muyter <phdm@macqel.be>
4681#
46820	string		bFLT		BFLT executable
4683>4	belong		x		- version %d
4684>4	belong		4
4685>>36	belong&0x1	0x1		ram
4686>>36	belong&0x2	0x2		gotpic
4687>>36	belong&0x4	0x4		gzip
4688>>36	belong&0x8	0x8		gzdata
4689
4690#------------------------------------------------------------------------------
4691# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
4692# BlockHashLoc
4693# ext: bhl
4694# Marco Pontello marcopon@gmail.com
4695# reference: https://github.com/MarcoPon/BlockHashLoc
46960	string	BlockHashLoc\x1a	BlockHashLoc recovery info,
4697>13	byte	x			version %d
4698!:ext   bhl
4699
4700#------------------------------------------------------------------------------
4701# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $
4702# bioinfomatics:  file(1) magic for Bioinfomatics file formats
4703
4704###############################################################################
4705# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
4706# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
4707###############################################################################
47080	string		\037\213
4709>3	byte		&0x04
4710>>12	string		BC
4711>>>14	leshort		&0x02	Blocked GNU Zip Format (BGZF; gzip compatible)
4712>>>>16	leshort		x	\b, block length %d
4713!:mime	application/x-gzip
4714
4715
4716###############################################################################
4717# Tabix index file
4718# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
4719###############################################################################
47200	string	TBI\1		SAMtools TBI (Tabix index format)
4721>0x04	lelong	=1		\b, with %d reference sequence
4722>0x04	lelong	>1		\b, with %d reference sequences
4723>0x08	lelong	&0x10000	\b, using half-closed-half-open coordinates (BED style)
4724>0x08	lelong	^0x10000
4725>>0x08	lelong	=0		\b, using closed and one based coordinates (GFF style)
4726>>0x08	lelong	=1		\b, using SAM format
4727>>0x08	lelong	=2		\b, using VCF format
4728>0x0c	lelong	x		\b, sequence name column: %d
4729>0x10	lelong	x		\b, region start column: %d
4730>0x08	lelong	=0
4731>>0x14	lelong	x		\b, region end column: %d
4732>0x18	byte	x		\b, comment character: %c
4733>0x1c	lelong	x		\b, skip line count: %d
4734
4735
4736###############################################################################
4737# BAM (Binary Sequence Alignment/Map format)
4738# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
4739# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
4740###############################################################################
47410	string	BAM\1	SAMtools BAM (Binary Sequence Alignment/Map)
4742>0x04	lelong	>0
4743>>&0x00 regex	=^[@]HD\t.*VN:		\b, with SAM header
4744>>>&0	regex	=[0-9.]+		\b version %s
4745>>&(0x04)	lelong	>0	\b, with %d reference sequences
4746
4747
4748###############################################################################
4749# BAI (BAM indexing format)
4750# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
4751###############################################################################
47520		string	BAI\1	SAMtools BAI (BAM indexing format)
4753>0x04		lelong	>0	\b, with %d reference sequences
4754
4755
4756###############################################################################
4757# CRAM (Binary Sequence Alignment/Map format)
4758###############################################################################
47590	string	CRAM	CRAM
4760>0x04	byte	>-1	version %d.
4761>0x05	byte	>-1	\b%d
4762>0x06	string	>\0	(identified as %s)
4763
4764
4765###############################################################################
4766# BCF (Binary Call Format), version 1
4767# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
4768# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
4769###############################################################################
47700		string	   BCF\4
4771# length of seqnm data in bytes is positive
4772>&0x00		lelong	  >0
4773# length of smpl data in bytes is positive
4774>>&(&-0x04)	lelong	  >0			SAMtools BCF (Binary Call Format)
4775# length of meta in bytes
4776>>>&(&-0x04)	lelong	  >0
4777# have meta text string
4778>>>>&0x00	search	  ##samtoolsVersion=
4779>>>>>&0x00	string	  x			\b, generated by SAMtools version %s
4780
4781
4782###############################################################################
4783# BCF (Binary Call Format), version 2.1
4784# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
4785# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
4786###############################################################################
47870		string	   BCF\2\1    Binary Call Format (BCF) version 2.1
4788# length of header text
4789>&0x00		lelong	  >0
4790# have header string
4791>>&0x00 search	  ##samtoolsVersion=
4792>>>&0x00	string	  x			\b, generated by SAMtools version %s
4793
4794
4795###############################################################################
4796# BCF (Binary Call Format), version 2.2
4797# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
4798# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
4799###############################################################################
48000		string	   BCF\2\2    Binary Call Format (BCF) version 2.2
4801# length of header text
4802>&0x00		lelong	  >0
4803# have header string
4804>>&0x00 search	  ##samtoolsVersion=
4805>>>&0x00	string	  x			\b, generated by SAMtools version %s
4806
4807###############################################################################
4808# VCF (Variant Call Format)
4809# used by VCFtools (http://vcftools.sourceforge.net/)
4810###############################################################################
48110      search	   ##fileformat=VCFv	Variant Call Format (VCF)
4812>&0    string	   x			\b version %s
4813
4814###############################################################################
4815# FASTQ
4816# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
4817###############################################################################
4818# XXX Broken?
4819# @<seqname>
4820#0	regex	=^@[A-Za-z0-9_.:-]+\?\n
4821# <seq>
4822#>&1	regex	=^[A-Za-z\n.~]++
4823# +[<seqname>]
4824#>>&1	regex	=^[A-Za-z0-9_.:-]*\?\n
4825# <qual>
4826#>>>&1	regex	=^[!-~\n]+\n		FASTQ
4827
4828###############################################################################
4829# FASTA
4830# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
4831###############################################################################
4832#0	byte	0x3e
4833# q>0	regex	=^[>][!-~\t\ ]+$
4834# Amino Acid codes: [A-IK-Z*-]+
4835#>>1	regex	!=[!-'Jj;:=?@^`|~\\]		FASTA
4836# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
4837# not in IUPAC codes/gaps: [EFIJLOPQZ]
4838#>>>1	regex	!=[EFIJLOPQZefijlopqz]		\b, with IUPAC nucleotide codes
4839#>>>1	regex	=^[EFIJLOPQZefijlopqz]+$	\b, with Amino Acid codes
4840
4841###############################################################################
4842# SAM (Sequence Alignment/Map format)
4843# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
4844###############################################################################
4845# Short-cut version to recognise SAM files with (optional) header at beginning
4846###############################################################################
48470      string	   @HD\t
4848>4     search	   VN:		Sequence Alignment/Map (SAM), with header
4849>>&0   regex	   [0-9.]+	\b version %s
4850###############################################################################
4851# Longer version to recognise SAM alignment lines using (many) regexes
4852###############################################################################
4853# SAM Alignment QNAME
48540		regex	=^[!-?A-~]{1,255}(\t[^\t]+){11}
4855# SAM Alignment FLAG
4856>0		regex	=^([^\t]+\t){1}[0-9]{1,5}\t
4857# SAM Alignment RNAME
4858>>0		regex	=^([^\t]+\t){2}\\*|[^*=]*\t
4859# SAM Alignment POS
4860>>>0		regex	=^([^\t]+\t){3}[0-9]{1,9}\t
4861# SAM Alignment MAPQ
4862>>>>0		regex	=^([^\t]+\t){4}[0-9]{1,3}\t
4863# SAM Alignment CIGAR
4864>>>>>0		regex	=\t(\\*|([0-9]+[MIDNSHPX=])+)\t
4865# SAM Alignment RNEXT
4866>>>>>>0		regex	=\t(\\*|=|[!-()+->?-~][!-~]*)\t
4867# SAM Alignment PNEXT
4868>>>>>>>0	regex	=^([^\t]+\t){7}[0-9]{1,9}\t
4869# SAM Alignment TLEN
4870>>>>>>>>0	regex	=\t[+-]{0,1}[0-9]{1,9}\t.*\t
4871# SAM Alignment SEQ
4872>>>>>>>>>0	regex	=^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
4873# SAM Alignment QUAL
4874>>>>>>>>>>0	regex	=^([^\t]+\t){10}[!-~]+	Sequence Alignment/Map (SAM)
4875>>>>>>>>>>>0	regex	=^[@]HD\t.*VN:		\b, with header
4876>>>>>>>>>>>>&0	regex	=[0-9.]+		\b version %s
4877
4878#------------------------------------------------------------------------------
4879# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
4880# blackberry:  file(1) magic for BlackBerry file formats
4881#
48825	belong	0
4883>8	belong  010010010	BlackBerry RIM ETP file
4884>>22	string	x		\b for %s
4885# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
4886# http://ftg.lbl.gov/checkpoint
48870	string	C\0\0\0R\0\0\0	BLCR
4888>16	lelong	1	x86
4889>16	lelong	3	alpha
4890>16	lelong	5	x86-64
4891>16	lelong	7	ARM
4892>8	lelong	x	context data (little endian, version %d)
4893# Uncomment the following only of your "file" program supports "search"
4894#>0	search/1024	VMA\06	for kernel
4895#>>&1	byte	x	%d.
4896#>>&2	byte	x	%d.
4897#>>&3	byte	x	%d
48980	string	\0\0\0C\0\0\0R	BLCR
4899>16	belong	2	SPARC
4900>16	belong	4	ppc
4901>16	belong	6	ppc64
4902>16	belong	7	ARMEB
4903>16	belong	8	SPARC64
4904>8	belong	x	context data (big endian, version %d)
4905# Uncomment the following only of your "file" program supports "search"
4906#>0	search/1024	VMA\06	for kernel
4907#>>&1	byte	x	%d.
4908#>>&2	byte	x	\b%d.
4909#>>&3	byte	x	\b%d
4910
4911#------------------------------------------------------------------------------
4912# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $
4913# blender: file(1) magic for Blender 3D related files
4914#
4915# Native format rule v1.2. For questions use the developers list
4916# http://lists.blender.org/mailman/listinfo/bf-committers
4917# GLOB chunk was moved near start and provides subversion info since 2.42
4918
49190		string	=BLENDER	Blender3D,
4920>7		string	=_		saved as 32-bits
4921>>8		string	=v		little endian
4922>>>9		byte	x		with version %c.
4923>>>10		byte	x		\b%c
4924>>>11		byte	x		\b%c
4925>>>0x40		string	=GLOB		\b.
4926>>>>0x58	leshort	x		\b%.4d
4927>>8		string	=V		big endian
4928>>>9		byte	x		with version %c.
4929>>>10		byte	x		\b%c
4930>>>11		byte	x		\b%c
4931>>>0x40		string	=GLOB		\b.
4932>>>>0x58	beshort	x		\b%.4d
4933>7		string	=-		saved as 64-bits
4934>>8		string	=v		little endian
4935>>9		byte	x		with version %c.
4936>>10		byte	x		\b%c
4937>>11		byte	x		\b%c
4938>>0x44		string	=GLOB		\b.
4939>>>0x60		leshort	x		\b%.4d
4940>>8		string	=V		big endian
4941>>>9		byte	x		with version %c.
4942>>>10		byte	x		\b%c
4943>>>11		byte	x		\b%c
4944>>>0x44		string	=GLOB		\b.
4945>>>>0x60	beshort	x		\b%.4d
4946
4947# Scripts that run in the embedded Python interpreter
49480		string	#!BPY		Blender3D BPython script
4949
4950#------------------------------------------------------------------------------
4951# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
4952# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
4953#
4954# Note that this 0407 conflicts with several other a.out formats...
4955#
4956# XXX - should this be redone with "be" and "le", so that it works on
4957# little-endian machines as well?  If so, what's the deal with
4958# "VAX-order" and "VAX-order2"?
4959#
4960#0	long		0407		68K Blit (standalone) executable
4961#0	short		0407		VAX-order2 68K Blit (standalone) executable
49620	short		03401		VAX-order 68K Blit (standalone) executable
49630	long		0406		68k Blit mpx/mux executable
49640	short		0406		VAX-order2 68k Blit mpx/mux executable
49650	short		03001		VAX-order 68k Blit mpx/mux executable
4966# Need more values for WE32 DMD executables.
4967# Note that 0520 is the same as COFF
4968#0	short		0520		tty630 layers executable
4969
4970#------------------------------------------------------------------------------
4971# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
4972# i80960 b.out objects and archives
4973#
49740	long		0x10d		i960 b.out relocatable object
4975>16	long		>0		not stripped
4976#
4977# b.out archive (hp-rt on i960)
49780	string		=!<bout>	b.out archive
4979>8	string		__.SYMDEF	random library
4980
4981#------------------------------------------------------------------------------
4982# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
4983# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
4984# Some object/executable formats use the same magic numbers as are used
4985# in other OSes; those are handled by entries in aout.
4986#
4987
49880	lelong		0314		386 compact demand paged pure executable
4989>16	lelong		>0		not stripped
4990>32	byte		0x6a		(uses shared libs)
4991
4992# same as in SunOS 4.x, except for static shared libraries
49930	belong&077777777	0600413		SPARC demand paged
4994>0	byte		&0x80
4995>>20	belong		<4096		shared library
4996>>20	belong		=4096		dynamically linked executable
4997>>20	belong		>4096		dynamically linked executable
4998>0	byte		^0x80		executable
4999>16	belong		>0		not stripped
5000>36	belong		0xb4100001	(uses shared libs)
5001
50020	belong&077777777	0600410		SPARC pure
5003>0	byte		&0x80		dynamically linked executable
5004>0	byte		^0x80		executable
5005>16	belong		>0		not stripped
5006>36	belong		0xb4100001	(uses shared libs)
5007
50080	belong&077777777	0600407		SPARC
5009>0	byte		&0x80		dynamically linked executable
5010>0	byte		^0x80		executable
5011>16	belong		>0		not stripped
5012>36	belong		0xb4100001	(uses shared libs)
5013# Chiasmus is a encryption standard developed by the German Federal
5014# Office for Information Security (Bundesamt fuer Sicherheit in der
5015# Informationstechnik).
5016
5017# Extension: .xia
50180	string	XIA1	Chiasmus encrypted data
5019
5020# Extension: .xis
50210	string	XIS	Chiasmus key
5022
5023#------------------------------------------------------------------------------
5024# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
5025# BTSnoop:  file(1) magic for BTSnoop files
5026#
5027# From <marcel@holtmann.org>
50280	string		btsnoop\0		BTSnoop
5029>8	belong		x			version %d,
5030>12	belong		1001			Unencapsulated HCI
5031>12	belong		1002			HCI UART (H4)
5032>12	belong		1003			HCI BCSP
5033>12	belong		1004			HCI Serial (H5)
5034>>12	belong		x			type %d
5035
5036#------------------------------------------------------------------------------
5037# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $
5038# c64:  file(1) magic for various commodore 64 related files
5039#
5040# From: Dirk Jagdmann <doj@cubic.org>
5041
50420x16500	belong		0x12014100	D64 Image
50430x16500	belong		0x12014180	D71 Image
50440x61800 belong		0x28034400	D81 Image
50450	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
50460	belong		0x43154164	X64 Image
5047
50480	string		GCR-1541	GCR Image
5049>8	byte		x		version: %i
5050>9	byte		x		tracks: %i
5051
50529	string		PSUR		ARC archive (c64)
50532	string		-LH1-		LHA archive (c64)
5054
50550	string		C64File		PC64 Emulator file
5056>8	string		>\0		"%s"
50570	string		C64Image	PC64 Freezer Image
5058
50590	beshort		0x38CD		C64 PCLink Image
50600	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
5061
50620	belong		0xFF424CFF	WRAptor packer (c64)
5063
50640	string		C64S\x20tape\x20file	T64 tape Image
5065>32	leshort		x		Version:0x%x
5066>36	leshort		!0		Entries:%i
5067>40	string		x		Name:%.24s
5068
50690	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
5070>32	leshort		x		Version:0x%x
5071>36	leshort		!0		Entries:%i
5072>40	string		x		Name:%.24s
5073
50740	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
5075>32	leshort		x		Version:0x%x
5076>36	leshort		!0		Entries:%i
5077>40	string		x		Name:%.24s
5078
5079# Raw tape file format (.tap files)
5080# Esa Hyyti <esa@netlab.tkk.fi>
50810	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
5082>0x0c	byte		x		Version:%u,
5083>0x10	lelong		x		Length:%u cycles
5084
5085# magic for Goattracker2, http://covertbitops.c64.org/
5086# from Alex Myczko <alex@aiei.ch>
50870	string		GTS5		GoatTracker 2 song
5088>4	string		>\0		\b, "%s"
5089>36	string		>\0		\b by %s
5090>68	string		>\0		\b (C) %s
5091>100	byte		>0		\b, %u subsong(s)
5092
5093
5094#------------------------------------------------------------------------------
5095# $File: cad,v 1.16 2018/05/07 23:26:31 christos Exp $
5096# autocad:  file(1) magic for cad files
5097#
5098
5099# Microstation DGN/CIT Files (www.bentley.com)
5100# Last updated July 29, 2005 by Lester Hightower
5101# DGN is the default file extension of Microstation/Intergraph CAD files.
5102# CIT is the proprietary raster format (similar to TIFF) used to attach
5103# raster underlays to Microstation DGN (vector) drawings.
5104#
5105# http://www.wotsit.org/search.asp
5106# http://filext.com/detaillist.php?extdetail=DGN
5107# http://filext.com/detaillist.php?extdetail=CIT
5108#
5109# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
5110# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
5111# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
5112# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
51130	string	\010\011\376			Microstation
5114>3	string	\002
5115>>30	string	\026\105			DGNFile
5116>>30	string	\034\105			DGNFile
5117>>30	string	\073\107			DGNFile
5118>>30	string	\073\110			DGNFile
5119>>30	string	\106\107			DGNFile
5120>>30	string	\110\103			DGNFile
5121>>30	string	\120\104			DGNFile
5122>>30	string	\172\104			DGNFile
5123>>30	string	\172\105			DGNFile
5124>>30	string	\172\106			DGNFile
5125>>30	string	\234\106			DGNFile
5126>>30	string	\273\105			DGNFile
5127>>30	string	\306\106			DGNFile
5128>>30	string	\310\104			DGNFile
5129>>30	string	\341\104			DGNFile
5130>>30	string	\372\103			DGNFile
5131>>30	string	\372\104			DGNFile
5132>>30	string	\372\106			DGNFile
5133>>30	string	\376\103			DGNFile
5134>4	string	\030\000\000			CITFile
5135>4	string	\030\000\003			CITFile
5136
5137# AutoCAD
5138# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
5139# and http://www.iana.org/assignments/media-types/image/vnd.dwg
51400	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
5141!:mime image/vnd.dwg
51420	string	AC1.2	DWG AutoDesk AutoCAD Release 1.2
5143!:mime image/vnd.dwg
51440	string	AC1.3	DWG AutoDesk AutoCAD Release 1.3
5145!:mime image/vnd.dwg
51460	string	AC1.40	DWG AutoDesk AutoCAD Release 1.40
5147!:mime image/vnd.dwg
51480	string	AC1.50	DWG AutoDesk AutoCAD Release 2.05
5149!:mime image/vnd.dwg
51500	string	AC2.10	DWG AutoDesk AutoCAD Release 2.10
5151!:mime image/vnd.dwg
51520	string	AC2.21	DWG AutoDesk AutoCAD Release 2.21
5153!:mime image/vnd.dwg
51540	string	AC2.22	DWG AutoDesk AutoCAD Release 2.22
5155!:mime image/vnd.dwg
51560	string	AC1001	DWG AutoDesk AutoCAD Release 2.22
5157!:mime image/vnd.dwg
51580	string	AC1002	DWG AutoDesk AutoCAD Release 2.50
5159!:mime image/vnd.dwg
51600	string	AC1003	DWG AutoDesk AutoCAD Release 2.60
5161!:mime image/vnd.dwg
51620	string	AC1004	DWG AutoDesk AutoCAD Release 9
5163!:mime image/vnd.dwg
51640	string	AC1006	DWG AutoDesk AutoCAD Release 10
5165!:mime image/vnd.dwg
51660	string	AC1009	DWG AutoDesk AutoCAD Release 11/12
5167!:mime image/vnd.dwg
5168# AutoCAD DWG versions R13/R14 (www.autodesk.com)
5169# Written December 01, 2003 by Lester Hightower
5170# Based on the DWG File Format Specifications at http://www.opendwg.org/
5171# AutoCad, from Nahuel Greco
5172# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
51730	string	AC1012	DWG AutoDesk AutoCAD Release 13
5174!:mime image/vnd.dwg
51750	string	AC1014	DWG AutoDesk AutoCAD Release 14
5176!:mime image/vnd.dwg
51770	string	AC1015	DWG AutoDesk AutoCAD 2000/2002
5178!:mime image/vnd.dwg
5179
5180# A new version of AutoCAD DWG
5181# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
5182# ICQ 358572321)
5183# From various sources like:
5184# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
51850	string	AC1018	DWG AutoDesk AutoCAD 2004/2005/2006
5186!:mime image/vnd.dwg
51870	string	AC1021	DWG AutoDesk AutoCAD 2007/2008/2009
5188!:mime image/vnd.dwg
51890	string	AC1024	DWG AutoDesk AutoCAD 2010/2011/2012
5190!:mime image/vnd.dwg
51910	string	AC1027	DWG AutoDesk AutoCAD 2013/2014
5192!:mime image/vnd.dwg
5193
5194# KOMPAS 2D drawing from ASCON
5195# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
5196# gathered nor specification
5197# ASCON http://ascon.net/main/ in English,
5198#	http://ascon.ru/ main site in Russian
5199# Extension is CDW for drawing and FRW for fragment of drawing
5200# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
5201# ICQ 358572321, http://vkontakte.ru/id16076543)
5202# From:
5203# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
5204# (in russian) and my experiments
52050	string	KF
5206>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
5207>2	belong	0x4D00000C	Kompas drawing 12.0
5208>2	belong	0x3200000B	Kompas drawing 11.0 SP1
5209>2	belong	0x3100000B	Kompas drawing 11.0
5210>2	belong	0x2310000A	Kompas drawing 10.0 SP1
5211>2	belong	0x2110000A	Kompas drawing 10.0
5212>2	belong	0x08000009	Kompas drawing 9.0 SP1
5213>2	belong	0x05000009	Kompas drawing 9.0
5214>2	belong	0x33010008	Kompas drawing 8+
5215>2	belong	0x1A000008	Kompas drawing 8.0
5216>2	belong	0x2C010107	Kompas drawing 7+
5217>2	belong	0x05000007	Kompas drawing 7.0
5218>2	belong	0x32000006	Kompas drawing 6+
5219>2	belong	0x09000006	Kompas drawing 6.0
5220>2	belong	0x5C009005	Kompas drawing 5.11R03
5221>2	belong	0x54009005	Kompas drawing 5.11R02
5222>2	belong	0x51009005	Kompas drawing 5.11R01
5223>2	belong	0x22009005	Kompas drawing 5.10R03
5224>2	belong	0x22009005	Kompas drawing 5.10R02 mar
5225>2	belong	0x21009005	Kompas drawing 5.10R02 febr
5226>2	belong	0x19009005	Kompas drawing 5.10R01
5227>2	belong	0xF4008005	Kompas drawing 5.9R01.003
5228>2	belong	0x1C008005	Kompas drawing 5.9R01.002
5229>2	belong	0x11008005	Kompas drawing 5.8R01.003
5230
5231# CAD: file(1) magic for computer aided design files
5232# Phillip Griffith <phillip dot griffith at gmail dot com>
5233# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
5234#
52350	belong	0x08051700	Bentley/Intergraph MicroStation DGN cell library
52360	belong	0x0809fe02	Bentley/Intergraph MicroStation DGN vector CAD
52370	belong	0xc809fe02	Bentley/Intergraph MicroStation DGN vector CAD
52380	beshort	0x0809		Bentley/Intergraph MicroStation
5239>0x02	byte	0xfe
5240>>0x04	beshort	0x1800		CIT raster CAD
5241
5242# 3DS (3d Studio files)
52430	leshort		0x4d4d
5244>6	leshort		0x2
5245>>8	lelong		0xa
5246>>>16	leshort		0x3d3d	3D Studio model
5247!:mime	image/x-3ds
5248!:ext 3ds
5249
5250# MegaCAD 2D/3D drawing (.prt)
5251# http://megacad.de/
5252# From: Markus Heidelberg <markus.heidelberg@web.de>
52530	string	MegaCad23\0	MegaCAD 2D/3D drawing
5254
5255# Hoops CAD files
5256# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\
5257# HSF_architecture.html
5258# Stephane Charette <stephane.charette@gmail.com>
52590	string	;;\020HSF\020V		OpenHSF (Hoops Stream Format)
5260>7	regex/9 V[.0-9]{4,5}\020	%s
5261!:ext hsf
5262
5263#------------------------------------------------------------------------------
5264# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $
5265# Cafe Babes unite!
5266#
5267# Since Java bytecode and Mach-O universal binaries have the same magic number,
5268# the test must be performed in the same "magic" sequence to get both right.
5269# The long at offset 4 in a Mach-O universal binary tells the number of
5270# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
5271# version and the short at offset 6 is the JVM major version.  Since there are only
5272# only 18 labeled Mach-O architectures at current, and the first released
5273# Java class format was version 43.0, we can safely choose any number
5274# between 18 and 39 to test the number of architectures against
5275# (and use as a hack). Let's not use 18, because the Mach-O people
5276# might add another one or two as time goes by...
5277#
5278### JAVA START ###
52790	belong		0xcafebabe
5280>4	belong		>30		compiled Java class data,
5281!:mime	application/x-java-applet
5282>>6	beshort		x	        version %d.
5283>>4	beshort		x       	\b%d
5284# Which is which?
5285#>>4	belong		0x032d		(Java 1.0)
5286#>>4	belong		0x032d		(Java 1.1)
5287>>4	belong		0x002e		(Java 1.2)
5288>>4	belong		0x002f		(Java 1.3)
5289>>4	belong		0x0030		(Java 1.4)
5290>>4	belong		0x0031		(Java 1.5)
5291>>4	belong		0x0032		(Java 1.6)
5292>>4	belong		0x0033		(Java 1.7)
5293>>4	belong		0x0034		(Java 1.8)
5294
52950	belong		0xcafed00d	JAR compressed with pack200,
5296>5	byte		x		version %d.
5297>4	byte		x		\b%d
5298!:mime	application/x-java-pack200
5299
5300
53010	belong		0xcafed00d	JAR compressed with pack200,
5302>5	byte		x		version %d.
5303>4	byte		x		\b%d
5304!:mime	application/x-java-pack200
5305
5306### JAVA END ###
5307### MACH-O START ###
5308
53090	name		mach-o		\b [
5310>0	use		mach-o-cpu	\b
5311>(8.L)	indirect	x		\b:
5312>0	belong		x		\b]
5313
53140	belong		0xcafebabe
5315>4	belong		1		Mach-O universal binary with 1 architecture:
5316!:mime application/x-mach-binary
5317>>8	use		mach-o		\b
5318>4	belong		>1
5319>>4	belong		<20		Mach-O universal binary with %d architectures:
5320!:mime application/x-mach-binary
5321>>>8	use		mach-o		\b
5322>>4	belong		2
5323>>>28	use		mach-o		\b
5324>>4	belong		3
5325>>>48	use		mach-o		\b
5326>>4	belong		4
5327>>>68	use		mach-o		\b
5328>>4	belong		5
5329>>>88	use		mach-o		\b
5330>>4	belong		6
5331>>>108	use		mach-o		\b
5332
5333### MACH-O END ###
5334
5335#------------------------------------------------------------------------------
5336# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
5337# cbor:  file(1) magic for CBOR files as defined in RFC 7049
5338
53390	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
5340!:mime	application/cbor
5341>3	ubyte	<0x20	(positive integer)
5342>3	ubyte	<0x40
5343>>3	ubyte	>0x1f	(negative integer)
5344>3	ubyte	<0x60
5345>>3	ubyte	>0x3f	(byte string)
5346>3	ubyte	<0x80
5347>>3	ubyte	>0x5f	(text string)
5348>3	ubyte	<0xa0
5349>3	ubyte	>0x7f	(array)
5350>3	ubyte	<0xc0
5351>>3	ubyte	>0x9f	(map)
5352>3	ubyte	<0xe0
5353>>3	ubyte	>0xbf	(tagged)
5354>3	ubyte	>0xdf	(other)
5355
5356#------------------------------------------------------------------------------
5357# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
5358# CDDB: file(1) magic for CDDB(tm) format CD text data files
5359#
5360# From <steve@gracenote.com>
5361#
5362# This is the /etc/magic entry to decode datafiles as used by
5363# CDDB-enabled CD player applications.
5364#
5365
53660	search/1/w	#\040xmcd	CDDB(tm) format CD text data
5367
5368#------------------------------------------------------------------------------
5369# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
5370# chord: file(1) magic for Chord music sheet typesetting utility input files
5371#
5372# From Philippe De Muyter <phdm@macqel.be>
5373# File format is actually free, but many distributed files begin with `{title'
5374#
53750	string		{title		Chord text file
5376
5377# Type:	PowerTab file format
5378# URL:	http://www.power-tab.net/
5379# From:	Jelmer Vernooij <jelmer@samba.org>
53800	string		ptab\003\000	Power-Tab v3 Tablature File
53810	string		ptab\004\000	Power-Tab v4 Tablature File
5382
5383#------------------------------------------------------------------------------
5384# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
5385# cisco:  file(1) magic for cisco Systems routers
5386#
5387# Most cisco file-formats are covered by the generic elf code
5388#
5389# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
53900	belong&0xffffff00	0x85011400  cisco IOS microcode
5391>7	string		>\0		    for '%s'
53920	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
5393>7	string		>\0		    for '%s'
5394
5395#------------------------------------------------------------------------------
5396# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
5397# citrus locale declaration
5398#
5399
54000	string		RuneCT		Citrus locale declaration for LC_CTYPE
5401
5402#------------------------------------------------------------------------------
5403# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $
5404# c-lang:  file(1) magic for C and related languages programs
5405#
5406# The strength is to beat standard HTML
5407
5408# BCPL
54090	search/8192	"libhdr"	BCPL source text
5410!:mime	text/x-bcpl
54110	search/8192	"LIBHDR"	BCPL source text
5412!:mime	text/x-bcpl
5413
5414# C
5415# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
54160	regex	\^#include			C
5417>0	regex/4096	\^class[[:space:]]+
5418>>&0	regex 	\\{[\.\*]\\}(;)?$			\b++
5419>&0	clear	x				source text
5420!:strength + 13
5421!:mime	text/x-c
54220	regex/4096	\^#[[:space:]]*pragma	C source text
5423!:mime	text/x-c
54240	regex/4096	\^#[[:space:]]*(if\|ifn)def
5425>&0	regex/4096	\^#[[:space:]]*endif$	C source text
5426!:mime	text/x-c
54270	regex/4096	\^#[[:space:]]*(if\|ifn)def
5428>&0	regex/4096	\^#[[:space:]]*define	C source text
5429!:mime	text/x-c
54300	regex/4096	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
5431!:mime	text/x-c
54320	regex/4096	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
5433!:mime	text/x-c
54340	regex/4096	\^[[:space:]]*extern[[:space:]]+		C source text
5435!:mime	text/x-c
54360	regex/4096	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
5437!:mime	text/x-c
54380	regex/4096	\^struct[[:space:]]+		C source text
5439!:mime	text/x-c
54400	regex/4096	\^union[[:space:]]+		C source text
5441!:mime	text/x-c
54420	search/8192	main(
5443>&0 regex/4096	\\)[[:space:]]*\\{		C source text
5444!:mime	text/x-c
5445
5446# C++
5447# The strength of these rules is increased so they beat the C rules above
54480	regex/4096	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
5449!:strength + 30
5450!:mime	text/x-c++
5451# using namespace [namespace] or using std::[lib]
54520	regex/4096	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
5453!:strength + 30
5454!:mime	text/x-c++
54550	regex/4096	\^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$	C++ source text
5456!:strength + 30
5457!:mime	text/x-c++
54580	regex/4096	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
5459!:strength + 30
5460!:mime	text/x-c++
5461# But class alone is reduced to avoid beating php (Jens Schleusener)
54620	regex/4096	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
5463!:strength + 13
5464!:mime	text/x-c++
54650	regex/4096	\^[[:space:]]*public:		C++ source text
5466!:strength + 30
5467!:mime	text/x-c++
54680	regex/4096	\^[[:space:]]*private:		C++ source text
5469!:strength + 30
5470!:mime	text/x-c++
54710	regex/4096	\^[[:space:]]*protected:		C++ source text
5472!:strength + 30
5473!:mime	text/x-c++
5474
5475# Objective-C
54760	regex	\^#import			Objective-C source text
5477!:strength + 25
5478!:mime	text/x-objective-c
5479
5480# From: Mikhail Teterin <mi@aldan.algebra.com>
54810	string		cscope		cscope reference data
5482>7	string		x		version %.2s
5483# We skip the path here, because it is often long (so file will
5484# truncate it) and mostly redundant.
5485# The inverted index functionality was added some time between
5486# versions 11 and 15, so look for -q if version is above 14:
5487>7	string		>14
5488>>10	search/100	\ -q\ 		with inverted index
5489>10	search/100	\ -c\ 		text (non-compressed)
5490
5491#------------------------------------------------------------------------------
5492# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
5493# clarion:  file(1) magic for # Clarion Personal/Professional Developer
5494# (v2 and above)
5495# From: Julien Blache <jb@jblache.org>
5496
5497# Database files
5498# signature
54990	leshort	0x3343	Clarion Developer (v2 and above) data file
5500# attributes
5501>2	leshort	&0x0001	\b, locked
5502>2	leshort	&0x0004	\b, encrypted
5503>2	leshort	&0x0008	\b, memo file exists
5504>2	leshort	&0x0010	\b, compressed
5505>2	leshort	&0x0040	\b, read only
5506# number of records
5507>5	lelong	x	\b, %d records
5508
5509# Memo files
55100	leshort	0x334d	Clarion Developer (v2 and above) memo data
5511
5512# Key/Index files
5513# No magic? :(
5514
5515# Help files
55160	leshort	0x49e0	Clarion Developer (v2 and above) help data
5517
5518#------------------------------------------------------------------------------
5519# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
5520# claris:  file(1) magic for claris
5521# "H. Nanosecond" <aldomel@ix.netcom.com>
5522# Claris Works a word processor, etc.
5523# Version 3.0
5524
5525# .pct claris works clip art files
5526#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
5527#*
5528#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
5529#null to byte 1000 octal
5530514	string	\377\377\377\377\000
5531>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
5532514	string	\377\377\377\377\001
5533>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
5534
5535# Claris works files
5536# .cwk
5537# Moved to Apple AppleWorks document
5538#0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
5539# .plt
55400	string	\020\341\000\000\010\010	Claris Works palette files .plt
5541
5542# .msp a dictionary file I am not sure about this I have only one .msp file
55430	string	\002\271\262\000\040\002\000\164	Claris works dictionary
5544
5545# .usp are user dictionary bits
5546# I am not sure about a magic header:
5547#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
5548#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
5549#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
5550#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
5551
5552# .mth Thesaurus
5553# starts with \0 but no magic header
5554
5555# .chy Hyphenation file
5556# I am not sure: 000 210 034 000 000
5557
5558# other claris files
5559#./windows/claris/useng.ndx: data
5560#./windows/claris/xtndtran.l32: data
5561#./windows/claris/xtndtran.lst: data
5562#./windows/claris/clworks.lbl: data
5563#./windows/claris/clworks.prf: data
5564#./windows/claris/userd.spl: data
5565
5566#------------------------------------------------------------------------------
5567# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
5568# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
5569#
5570# XXX - what byte order does the Clipper use?
5571#
5572# XXX - what's the "!" stuff:
5573#
5574# >18	short		!074000,000000	C1 R1
5575# >18	short		!074000,004000	C2 R1
5576# >18	short		!074000,010000	C3 R1
5577# >18	short		!074000,074000	TEST
5578#
5579# I shall assume it's ANDing the field with the first value and
5580# comparing it with the second, and rewrite it as:
5581#
5582# >18	short&074000	000000		C1 R1
5583# >18	short&074000	004000		C2 R1
5584# >18	short&074000	010000		C3 R1
5585# >18	short&074000	074000		TEST
5586#
5587# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
5588# sort, nor does SunOS 4.x, so either it's something Intergraph added
5589# in CLIX, or something AT&T added in SVR3.2 or later, or something
5590# somebody else thought was a good idea; it's not documented in the
5591# man page for this version of "magic", nor does it appear to be
5592# implemented (at least not after I blew off the bogus code to turn
5593# old-style "&"s into new-style "&"s, which just didn't work at all).
5594#
55950	short		0575		CLIPPER COFF executable (VAX #)
5596>20	short		0407		(impure)
5597>20	short		0410		(5.2 compatible)
5598>20	short		0411		(pure)
5599>20	short		0413		(demand paged)
5600>20	short		0443		(target shared library)
5601>12	long		>0		not stripped
5602>22	short		>0		- version %d
56030	short		0577		CLIPPER COFF executable
5604>18	short&074000	000000		C1 R1
5605>18	short&074000	004000		C2 R1
5606>18	short&074000	010000		C3 R1
5607>18	short&074000	074000		TEST
5608>20	short		0407		(impure)
5609>20	short		0410		(pure)
5610>20	short		0411		(separate I&D)
5611>20	short		0413		(paged)
5612>20	short		0443		(target shared library)
5613>12	long		>0		not stripped
5614>22	short		>0		- version %d
5615>48	long&01		01		alignment trap enabled
5616>52	byte		1		-Ctnc
5617>52	byte		2		-Ctsw
5618>52	byte		3		-Ctpw
5619>52	byte		4		-Ctcb
5620>53	byte		1		-Cdnc
5621>53	byte		2		-Cdsw
5622>53	byte		3		-Cdpw
5623>53	byte		4		-Cdcb
5624>54	byte		1		-Csnc
5625>54	byte		2		-Cssw
5626>54	byte		3		-Cspw
5627>54	byte		4		-Cscb
56284	string		pipe		CLIPPER instruction trace
56294	string		prof		CLIPPER instruction profile
5630
5631#------------------------------------------------------------------------------
5632# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $
5633# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
5634#
5635# COFF
5636#
5637# by Joerg Jenderek at Oct 2015
5638# https://en.wikipedia.org/wiki/COFF
5639# https://de.wikipedia.org/wiki/Common_Object_File_Format
5640# http://www.delorie.com/djgpp/doc/coff/filhdr.html
5641
5642# display name+variables+flags of Common Object Files Format (32bit)
5643# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
5644# mips,motorola,msdos,osf1,sharc,varied.out,vax
56450	name				display-coff
5646# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
5647>18	uleshort&0x8E80	0
5648>>0	clear		x
5649# f_magic - magic number
5650# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
5651>>0	uleshort	0x014C		Intel 80386
5652# Hitachi SH big-endian COFF (./hitachi-sh)
5653>>0	uleshort	0x0500		Hitachi SH big-endian
5654# Hitachi SH little-endian COFF (./hitachi-sh)
5655>>0	uleshort	0x0550		Hitachi SH little-endian
5656# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
5657#>>0	uleshort	0x01DF
5658# TODO for other COFFs
5659#>>0	uleshort	0xABCD		COFF_TEMPLATE
5660>>0	default		x
5661>>>0	uleshort	x		type 0x%04x
5662>>0	uleshort	x		COFF
5663# F_EXEC flag bit
5664>>18	leshort		^0x0002		object file
5665#!:mime	application/x-coff
5666#!:ext cof/o/obj/lib
5667>>18	leshort		&0x0002		executable
5668#!:mime	application/x-coffexec
5669# F_RELFLG flag bit,static object
5670>>18	leshort		&0x0001		\b, no relocation info
5671# F_LNNO flag bit
5672>>18	leshort		&0x0004		\b, no line number info
5673# F_LSYMS flag bit
5674>>18	leshort		&0x0008		\b, stripped
5675>>18	leshort		^0x0008		\b, not stripped
5676# flags in other COFF versions
5677#0x0010    F_FDPR_PROF
5678#0x0020    F_FDPR_OPTI
5679#0x0040    F_DSA
5680# F_AR32WR flag bit
5681#>>>18	leshort		&0x0100		\b, 32 bit little endian
5682#0x1000    F_DYNLOAD
5683#0x2000    F_SHROBJ
5684#0x4000    F_LOADONLY
5685# f_nscns - number of sections
5686>>2	uleshort	<2		\b, %d section
5687>>2	uleshort	>1		\b, %d sections
5688# f_timdat - file time & date stamp only for little endian
5689#>>4	date		x		\b, %s
5690# f_symptr - symbol table pointer, only for not stripped
5691>>8	ulelong		>0		\b, symbol offset=0x%x
5692# f_nsyms - number of symbols, only for not stripped
5693>>12	ulelong		>0		\b, %d symbols
5694# f_opthdr - optional header size
5695>>16	uleshort	>0		\b, optional header size %d
5696# at offset 20 can be optional header, extra bytes FILHSZ-20 because
5697# do not rely on sizeof(FILHDR) to give the correct size for header.
5698# or first section header
5699# additional variables for other COFF files
5700# >20	beshort		0407		(impure)
5701# >20	beshort		0410		(pure)
5702# >20	beshort		0413		(demand paged)
5703# >20	beshort		0421		(standalone)
5704# >22	leshort		>0		- version %d
5705# >168	string		.lowmem		Apple toolbox
5706
5707
5708#------------------------------------------------------------------------------
5709# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $
5710# commands:  file(1) magic for various shells and interpreters
5711#
5712#0	string/w	:			shell archive or script for antique kernel text
57130	string/wt	#!\ /bin/sh		POSIX shell script text executable
5714!:mime	text/x-shellscript
57150	string/wb	#!\ /bin/sh		POSIX shell script executable (binary data)
5716!:mime	text/x-shellscript
5717
57180	string/wt	#!\ /bin/csh		C shell script text executable
5719!:mime	text/x-shellscript
5720
5721# korn shell magic, sent by George Wu, gwu@clyde.att.com
57220	string/wt	#!\ /bin/ksh		Korn shell script text executable
5723!:mime	text/x-shellscript
57240	string/wb	#!\ /bin/ksh		Korn shell script executable (binary data)
5725!:mime	text/x-shellscript
5726
57270	string/wt 	#!\ /bin/tcsh		Tenex C shell script text executable
5728!:mime	text/x-shellscript
57290	string/wt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
5730!:mime	text/x-shellscript
57310	string/wt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
5732!:mime	text/x-shellscript
57330	string/wt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
5734!:mime	text/x-shellscript
5735
5736#
5737# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
57380	string/wt	#!\ /bin/zsh		Paul Falstad's zsh script text executable
5739!:mime	text/x-shellscript
57400	string/wt	#!\ /usr/bin/zsh	Paul Falstad's zsh script text executable
5741!:mime	text/x-shellscript
57420	string/wt	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
5743!:mime	text/x-shellscript
57440	string/wt	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
5745!:mime	text/x-shellscript
57460	string/wt	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
5747!:mime	text/x-shellscript
57480	string/wt	#!\ /bin/nawk		new awk script text executable
5749!:mime	text/x-nawk
57500	string/wt	#!\ /usr/bin/nawk	new awk script text executable
5751!:mime	text/x-nawk
57520	string/wt	#!\ /usr/local/bin/nawk	new awk script text executable
5753!:mime	text/x-nawk
57540	string/wt	#!\ /bin/gawk		GNU awk script text executable
5755!:mime	text/x-gawk
57560	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
5757!:mime	text/x-gawk
57580	string/wt	#!\ /usr/local/bin/gawk	GNU awk script text executable
5759!:mime	text/x-gawk
5760#
57610	string/wt	#!\ /bin/awk		awk script text executable
5762!:mime	text/x-awk
57630	string/wt	#!\ /usr/bin/awk	awk script text executable
5764!:mime	text/x-awk
57650	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text
5766
5767# AT&T Bell Labs' Plan 9 shell
57680	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
5769
5770# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
57710	string/wt	#!\ /bin/bash	Bourne-Again shell script text executable
5772!:mime	text/x-shellscript
57730	string/wb	#!\ /bin/bash	Bourne-Again shell script executable (binary data)
5774!:mime	text/x-shellscript
57750	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
5776!:mime	text/x-shellscript
57770	string/wb	#!\ /usr/bin/bash	Bourne-Again shell script executable (binary data)
5778!:mime	text/x-shellscript
57790	string/wt	#!\ /usr/local/bash	Bourne-Again shell script text executable
5780!:mime	text/x-shellscript
57810	string/wb	#!\ /usr/local/bash	Bourne-Again shell script executable (binary data)
5782!:mime	text/x-shellscript
57830	string/wt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
5784!:mime	text/x-shellscript
57850	string/wb	#!\ /usr/local/bin/bash	Bourne-Again shell script executable (binary data)
5786!:mime	text/x-shellscript
57870	string/wt	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
5788!:mime	text/x-shellscript
5789
5790# PHP scripts
5791# Ulf Harnhammar <ulfh@update.uu.se>
57920	search/1/c	=<?php			PHP script text
5793!:strength + 30
5794!:mime	text/x-php
57950	search/1	=<?\n			PHP script text
5796!:mime	text/x-php
57970	search/1	=<?\r			PHP script text
5798!:mime	text/x-php
57990	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
5800!:strength + 10
5801!:mime	text/x-php
58020	search/1/w	#!\ /usr/bin/php	PHP script text executable
5803!:strength + 10
5804!:mime	text/x-php
5805# Smarty compiled template, http://www.smarty.net/
5806# Elan Ruusamae <glen@delfi.ee>
58070	string	=<?php
5808>5	regex	[\ \n]
5809>>6	string	/*\ Smarty\ version		Smarty compiled template
5810>>>24	regex	[0-9.]+				\b, version %s
5811!:mime	text/x-php
5812
58130	string		Zend\x00		PHP script Zend Optimizer data
5814
58150	string/t	$!			DCL command file
5816
5817# Type: Pdmenu
5818# URL:  http://packages.debian.org/pdmenu
5819# From: Edward Betts <edward@debian.org>
58200	string		#!/usr/bin/pdmenu	Pdmenu configuration file text
5821
5822# From Danny Weldon
58230	string	\x0b\x13\x08\x00
5824>0x04   uleshort	<4      ksh byte-code version %d
5825
5826#----------------------------------------------------------------------------
5827# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
5828# communication
5829
5830# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
5831# It is used for conformance testing of communication protocols.
5832# Added by W. Borgert <debacle@debian.org>.
58330	string		$Suite			TTCN Abstract Test Suite
5834>&1	string		$SuiteId
5835>>&1	string		>\n			%s
5836>&2	string		$SuiteId
5837>>&1	string		>\n			%s
5838>&3	string		$SuiteId
5839>>&1	string		>\n			%s
5840
5841# MSC (message sequence charts) are a formal description technique,
5842# described in ITU-T Z.120, mainly used for communication protocols.
5843# Added by W. Borgert <debacle@debian.org>.
58440	string		mscdocument	Message Sequence Chart (document)
58450	string		msc		Message Sequence Chart (chart)
58460	string		submsc		Message Sequence Chart (subchart)
5847#------------------------------------------------------------------------------
5848# $File: compress,v 1.72 2018/03/27 23:26:41 christos Exp $
5849# compress:  file(1) magic for pure-compression formats (no archives)
5850#
5851# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
5852#
5853# Formats for various forms of compressed data
5854# Formats for "compress" proper have been moved into "compress.c",
5855# because it tries to uncompress it to figure out what's inside.
5856
5857# standard unix compress
58580	string		\037\235	compress'd data
5859!:mime	application/x-compress
5860!:apple	LZIVZIVU
5861>2	byte&0x80	>0		block compressed
5862>2	byte&0x1f	x		%d bits
5863
5864# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
5865#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
5866#	* Original filename is only at offset 10 if "extra field" absent
5867#	* Produce shorter output - notably, only report compression methods
5868#         other than 8 ("deflate", the only method defined in RFC 1952).
58690       string          \037\213        gzip compressed data
5870!:mime	application/x-gzip
5871!:strength * 2
5872>2	byte		<8		\b, reserved method
5873>2	byte		>8		\b, unknown method
5874>3	byte		&0x01		\b, ASCII
5875>3	byte		&0x02		\b, has CRC
5876>3	byte		&0x04		\b, extra field
5877>3	byte&0xC	=0x08
5878>>10	string		x		\b, was "%s"
5879>3	byte		&0x10		\b, has comment
5880>3	byte		&0x20		\b, encrypted
5881>4	ledate		>0		\b, last modified: %s
5882>8	byte		2		\b, max compression
5883>8	byte		4		\b, max speed
5884>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
5885>9	byte		=0x01		\b, from Amiga
5886>9	byte		=0x02		\b, from VMS
5887>9	byte		=0x03		\b, from Unix
5888>9	byte		=0x04		\b, from VM/CMS
5889>9	byte		=0x05		\b, from Atari
5890>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
5891>9	byte		=0x07		\b, from MacOS
5892>9	byte		=0x08		\b, from Z-System
5893>9	byte		=0x09		\b, from CP/M
5894>9	byte		=0x0A		\b, from TOPS/20
5895>9	byte		=0x0B		\b, from NTFS filesystem (NT)
5896>9	byte		=0x0C		\b, from QDOS
5897>9	byte		=0x0D		\b, from Acorn RISCOS
5898>-4	lelong		x		\b, original size %d
5899
5900# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
59010	string		\037\036	packed data
5902!:mime	application/octet-stream
5903>2	belong		>1		\b, %d characters originally
5904>2	belong		=1		\b, %d character originally
5905#
5906# This magic number is byte-order-independent.
59070	short		0x1f1f		old packed data
5908!:mime	application/octet-stream
5909
5910# XXX - why *two* entries for "compacted data", one of which is
5911# byte-order independent, and one of which is byte-order dependent?
5912#
59130	short		0x1fff		compacted data
5914!:mime	application/octet-stream
5915# This string is valid for SunOS (BE) and a matching "short" is listed
5916# in the Ultrix (LE) magic file.
59170	string		\377\037	compacted data
5918!:mime	application/octet-stream
59190	short		0145405		huf output
5920!:mime	application/octet-stream
5921
5922# bzip2
59230	string		BZh		bzip2 compressed data
5924!:mime	application/x-bzip2
5925>3	byte		>47		\b, block size = %c00k
5926
5927# bzip	a block-sorting file compressor
5928#	by Julian Seward <sewardj@cs.man.ac.uk> and others
59290	string		BZ0		bzip compressed data
5930!:mime	application/x-bzip
5931>3	byte		>47		\b, block size = %c00k
5932
5933# lzip
59340	string		LZIP		lzip compressed data
5935!:mime application/x-lzip
5936>4	byte		x		\b, version: %d
5937
5938# squeeze and crunch
5939# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
59400	beshort		0x76FF		squeezed data,
5941>4	string		x		original name %s
59420	beshort		0x76FE		crunched data,
5943>2	string		x		original name %s
59440	beshort		0x76FD		LZH compressed data,
5945>2	string		x		original name %s
5946
5947# Freeze
59480	string		\037\237	frozen file 2.1
59490	string		\037\236	frozen file 1.0 (or gzip 0.5)
5950
5951# SCO compress -H (LZH)
59520	string		\037\240	SCO compress -H (LZH) data
5953
5954# European GSM 06.10 is a provisional standard for full-rate speech
5955# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
5956# excitation/long term prediction) coding at 13 kbit/s.
5957#
5958# There's only a magic nibble (4 bits); that nibble repeats every 33
5959# bytes.  This isn't suited for use, but maybe we can use it someday.
5960#
5961# This will cause very short GSM files to be declared as data and
5962# mismatches to be declared as data too!
5963#0	byte&0xF0	0xd0		data
5964#>33	byte&0xF0	0xd0
5965#>66	byte&0xF0	0xd0
5966#>99	byte&0xF0	0xd0
5967#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
5968
5969# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
59700	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
5971>9	beshort		<0x0940
5972>>9	byte&0xf0	=0x00		- version 0.
5973>>9	beshort&0x0fff	x		\b%03x,
5974>>13	byte		1		LZO1X-1,
5975>>13	byte		2		LZO1X-1(15),
5976>>13	byte		3		LZO1X-999,
5977## >>22	bedate		>0		last modified: %s,
5978>>14	byte		=0x00		os: MS-DOS
5979>>14	byte		=0x01		os: Amiga
5980>>14	byte		=0x02		os: VMS
5981>>14	byte		=0x03		os: Unix
5982>>14	byte		=0x05		os: Atari
5983>>14	byte		=0x06		os: OS/2
5984>>14	byte		=0x07		os: MacOS
5985>>14	byte		=0x0A		os: Tops/20
5986>>14	byte		=0x0B		os: WinNT
5987>>14	byte		=0x0E		os: Win32
5988>9	beshort		>0x0939
5989>>9	byte&0xf0	=0x00		- version 0.
5990>>9	byte&0xf0	=0x10		- version 1.
5991>>9	byte&0xf0	=0x20		- version 2.
5992>>9	beshort&0x0fff	x		\b%03x,
5993>>15	byte		1		LZO1X-1,
5994>>15	byte		2		LZO1X-1(15),
5995>>15	byte		3		LZO1X-999,
5996## >>25	bedate		>0		last modified: %s,
5997>>17	byte		=0x00		os: MS-DOS
5998>>17	byte		=0x01		os: Amiga
5999>>17	byte		=0x02		os: VMS
6000>>17	byte		=0x03		os: Unix
6001>>17	byte		=0x05		os: Atari
6002>>17	byte		=0x06		os: OS/2
6003>>17	byte		=0x07		os: MacOS
6004>>17	byte		=0x0A		os: Tops/20
6005>>17	byte		=0x0B		os: WinNT
6006>>17	byte		=0x0E		os: Win32
6007
6008# 4.3BSD-Quasijarus Strong Compression
6009# http://minnie.tuhs.org/Quasijarus/compress.html
60100	string		\037\241	Quasijarus strong compressed data
6011
6012# From: Cory Dikkers <cdikkers@swbell.net>
60130	string		XPKF		Amiga xpkf.library compressed data
60140	string		PP11		Power Packer 1.1 compressed data
60150	string		PP20		Power Packer 2.0 compressed data,
6016>4	belong		0x09090909	fast compression
6017>4	belong		0x090A0A0A	mediocre compression
6018>4	belong		0x090A0B0B	good compression
6019>4	belong		0x090A0C0C	very good compression
6020>4	belong		0x090A0C0D	best compression
6021
6022# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
6023# http://www.7-zip.org or DOC/7zFormat.txt
6024#
60250	string		7z\274\257\047\034	7-zip archive data,
6026>6	byte		x			version %d
6027>7	byte		x			\b.%d
6028!:mime	application/x-7z-compressed
6029!:ext 7z/cb7
6030
6031# Type: LZMA
60320	lelong&0xffffff	=0x5d
6033>12	leshort		0xff			LZMA compressed data,
6034!:mime	application/x-lzma
6035>>5	lequad		=0xffffffffffffffff	streamed
6036>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
6037>12	leshort		0			LZMA compressed data,
6038>>5	lequad		=0xffffffffffffffff	streamed
6039>>5	lequad		!0xffffffffffffffff	non-streamed, size %lld
6040
6041# http://tukaani.org/xz/xz-file-format.txt
60420	ustring		\xFD7zXZ\x00		XZ compressed data
6043!:strength * 2
6044!:mime	application/x-xz
6045
6046# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
60470	string		LRZI			LRZIP compressed data
6048>4	byte		x			- version %d
6049>5	byte		x			\b.%d
6050!:mime	application/x-lrzip
6051
6052# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
60530	lelong		0x184d2204	LZ4 compressed data (v1.4+)
6054!:mime	application/x-lz4
6055# Added by osm0sis@xda-developers.com
60560 	lelong		0x184c2103	LZ4 compressed data (v1.0-v1.3)
6057!:mime	application/x-lz4
60580	lelong		0x184c2102	LZ4 compressed data (v0.1-v0.9)
6059!:mime	application/x-lz4
6060
6061# Zstandard/LZ4 skippable frames
6062# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
60630         lelong&0xFFFFFFF0  0x184D2A50
6064>(4.l+8)  indirect	x
6065
6066# Zstandard Dictionary ID subroutine
60670     name        zstd-dictionary-id
6068# Single Segment = True
6069>0    byte        &0x20   \b, Dictionary ID:
6070>>0   byte&0x03   0       None
6071>>0   byte&0x03   1
6072>>>1  byte        x       %u
6073>>0   byte&0x03   2
6074>>>1  leshort     x       %u
6075>>0   byte&0x03   3
6076>>>1  lelong      x       %u
6077# Single Segment = False
6078>0    byte        ^0x20   \b, Dictionary ID:
6079>>0   byte&0x03   0       None
6080>>0   byte&0x03   1
6081>>>2  byte        x       %u
6082>>0   byte&0x03   2
6083>>>2  leshort     x       %u
6084>>0   byte&0x03   3
6085>>>2  lelong      x       %u
6086
6087# Zstandard compressed data
6088# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
60890     lelong       0xFD2FB522  Zstandard compressed data (v0.2)
6090!:mime  application/x-zstd
60910     lelong       0xFD2FB523  Zstandard compressed data (v0.3)
6092!:mime  application/x-zstd
60930     lelong       0xFD2FB524  Zstandard compressed data (v0.4)
6094!:mime  application/x-zstd
60950     lelong       0xFD2FB525  Zstandard compressed data (v0.5)
6096!:mime  application/x-zstd
60970     lelong       0xFD2FB526  Zstandard compressed data (v0.6)
6098!:mime  application/x-zstd
60990     lelong       0xFD2FB527  Zstandard compressed data (v0.7)
6100!:mime  application/x-zstd
6101>4    use          zstd-dictionary-id
61020     lelong       0xFD2FB528  Zstandard compressed data (v0.8+)
6103!:mime  application/x-zstd
6104>4    use          zstd-dictionary-id
6105
6106# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
61070  lelong    0xEC30A437  Zstandard dictionary
6108!:mime  application/x-zstd-dictionary
6109>4 lelong    x           (ID %u)
6110
6111# AFX compressed files (Wolfram Kleff)
61122	string		-afx-		AFX compressed file data
6113
6114# Supplementary magic data for the file(1) command to support
6115# rzip(1).  The format is described in magic(5).
6116#
6117# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
6118# this file.
6119#
61200	string		RZIP		rzip compressed data
6121>4	byte		x		- version %d
6122>5	byte		x		\b.%d
6123>6	belong		x		(%d bytes)
6124
61250	string		ArC\x01		FreeArc archive <http://freearc.org>
6126
6127# Type:	DACT compressed files
61280	long	0x444354C3	DACT compressed data
6129>4	byte	>-1		(version %i.
6130>5	byte	>-1		%i.
6131>6	byte	>-1		%i)
6132>7	long	>0		, original size: %i bytes
6133>15	long	>30		, block size: %i bytes
6134
6135# Valve Pack (VPK) files
61360	lelong	0x55aa1234	Valve Pak file
6137>0x4	lelong	x		\b, version %u
6138>0x8	lelong	x		\b, %u entries
6139
6140# Snappy framing format
6141# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
61420	string	\377\006\0\0sNaPpY	snappy framed data
6143!:mime	application/x-snappy-framed
6144
6145# qpress, http://www.quicklz.com/
61460	string	qpress10	qpress compressed data
6147!:mime	application/x-qpress
6148
6149# Zlib https://www.ietf.org/rfc/rfc6713.txt
61500	string/b	x
6151>0	beshort%31	=0
6152>>0	byte&0xf	=8
6153>>>0	byte&0x80 	=0	zlib compressed data
6154!:mime	application/zlib
6155
6156# BWC compression
61570	string		BWC
6158>3	byte		0	BWC compressed data
6159
6160# UCL compression
61610	bequad		0x00e955434cff011a	UCL compressed data
6162
6163# Softlib archive
61640	string		SLIB	Softlib archive
6165>4	leshort		x	\b, version %d
6166>6	leshort		x	(contains %d files)
6167
6168# URL:  https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276
6169# From: Eric Hall <eric.hall@darkart.com>
61700	string	bvx-	lzfse encoded, no compression
61710	string	bvx1	lzfse compressed, uncompressed tables
61720	string	bvx2	lzfse compressed, compressed tables
61730	string	bvxn	lzfse encoded, lzvn compressed
6174
6175#------------------------------------------------------------------------------
6176# $File: console,v 1.40 2018/06/23 16:40:40 christos Exp $
6177# Console game magic
6178# Toby Deshane <hac@shoelace.digivill.net>
6179
6180# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format
6181# Updated by David Korth <gerbilsoft@gerbilsoft.com>
6182# References:
6183# - http://wiki.nesdev.com/w/index.php/INES
6184# - http://wiki.nesdev.com/w/index.php/NES_2.0
6185
6186# Common header for iNES, NES 2.0, and Wii U iNES.
61870	name		nes-rom-image-ines
6188>7	byte&0x0C	=0x8		(NES 2.0)
6189>4	byte		x		\b: %ux16k PRG
6190>5	byte		x		\b, %ux8k CHR
6191>6	byte&0x08	=0x8		[4-Scr]
6192>6	byte&0x09	=0x0		[H-mirror]
6193>6	byte&0x09	=0x1		[V-mirror]
6194>6	byte&0x02	=0x2		[SRAM]
6195>6	byte&0x04	=0x4		[Trainer]
6196>7	byte&0x03	=0x2		[PC10]
6197>7	byte&0x03	=0x1		[VS]
6198>>7	byte&0x0C	=0x8
6199# NES 2.0: VS PPU
6200>>>13	byte&0x0F	=0x0		\b, RP2C03B
6201>>>13	byte&0x0F	=0x1		\b, RP2C03G
6202>>>13	byte&0x0F	=0x2		\b, RP2C04-0001
6203>>>13	byte&0x0F	=0x3		\b, RP2C04-0002
6204>>>13	byte&0x0F	=0x4		\b, RP2C04-0003
6205>>>13	byte&0x0F	=0x5		\b, RP2C04-0004
6206>>>13	byte&0x0F	=0x6		\b, RP2C03B
6207>>>13	byte&0x0F	=0x7		\b, RP2C03C
6208>>>13	byte&0x0F	=0x8		\b, RP2C05-01
6209>>>13	byte&0x0F	=0x9		\b, RP2C05-02
6210>>>13	byte&0x0F	=0xA		\b, RP2C05-03
6211>>>13	byte&0x0F	=0xB		\b, RP2C05-04
6212>>>13	byte&0x0F	=0xC		\b, RP2C05-05
6213# TODO: VS protection hardware?
6214>>7	byte		x		\b]
6215# NES 2.0-specific flags.
6216>7	byte&0x0C	=0x8
6217>>12	byte&0x03	=0x0		[NTSC]
6218>>12	byte&0x03	=0x1		[PAL]
6219>>12	byte&0x02	=0x2		[NTSC+PAL]
6220
6221# Standard iNES ROM header.
62220	string		NES\x1A		NES ROM image (iNES)
6223!:mime	application/x-nes-rom
6224>0	use		nes-rom-image-ines
6225
6226# Wii U Virtual Console iNES ROM header.
62270	belong		0x4E455300	NES ROM image (Wii U Virtual Console)
6228!:mime	application/x-nes-rom
6229>0	use		nes-rom-image-ines
6230
6231#------------------------------------------------------------------------------
6232# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
6233# Reference: http://wiki.nesdev.com/w/index.php/UNIF
6234# From: David Korth <gerbilsoft@gerbilsoft.com>
6235#
6236# NOTE: The UNIF format uses chunks instead of a fixed header,
6237# so most of the data isn't easily parseable.
6238#
62390	string	UNIF
6240>4	lelong	<16	NES ROM image (UNIF v%d format)
6241!:mime	application/x-nes-rom
6242
6243#------------------------------------------------------------------------------
6244# fds: file(1) magic for Famciom Disk System disk images
6245# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
6246# From: David Korth <gerbilsoft@gerbilsoft.com>
6247# TODO: Check "Disk info block" and get info from that in addition to the optional header.
6248
6249# Disk info block. (block 1)
62500	name	nintendo-fds-disk-info-block
6251>23	byte	!1		FMC-
6252>23	byte	1		FSC-
6253>16	string	x		\b%.3s
6254>15	byte	x		\b, mfr %02X
6255>20	byte	x		(Rev.%02u)
6256
6257# Headered version.
62580	string	FDS\x1A
6259>0x11	string	*NINTENDO-HVC*	Famicom Disk System disk image:
6260!:mime	application/x-fds-disk
6261>>0x10	use	nintendo-fds-disk-info-block
6262>4	byte	1	(%u side)
6263>4	byte	!1	(%u sides)
6264
6265# Unheadered version.
62661	string	*NINTENDO-HVC*	Famicom Disk System disk image:
6267!:mime	application/x-fds-disk
6268>0	use	nintendo-fds-disk-info-block
6269
6270#------------------------------------------------------------------------------
6271# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
6272# Used by Nintendo 3DS NES Virtual Console games.
6273# From: David Korth <gerbilsoft@gerbilsoft.com>
6274#
62750		string	TNES	NES ROM image (Nintendo 3DS Virtual Console)
6276!:mime		application/x-nes-rom
6277>4		byte	100	\b: FDS,
6278>>0x2010	use	nintendo-fds-disk-info-block
6279>4		byte	!100	\b: TNES mapper %u
6280>>5	byte		x		\b, %ux8k PRG
6281>>6	byte		x		\b, %ux8k CHR
6282>>7	byte&0x08	=1		[WRAM]
6283>>8	byte&0x09	=1		[H-mirror]
6284>>8	byte&0x09	=2		[V-mirror]
6285>>8	byte&0x02	=3		[VRAM]
6286
6287#------------------------------------------------------------------------------
6288# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
6289# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
6290#
62910x104		bequad		0xCEED6666CC0D000B	Game Boy ROM image
6292# TODO: application/x-gameboy-color-rom for GBC.
6293!:mime		application/x-gameboy-rom
6294>0x143		byte&0x80	0x80
6295>>0x134		string		>\0			\b: "%.15s"
6296>0x143		byte&0x80	!0x80
6297>>0x134		string		>\0			\b: "%.16s"
6298>0x14c		byte		x			(Rev.%02u)
6299
6300# Machine type. (SGB, CGB, SGB+CGB)
6301>0x14b		byte		0x33
6302>>0x146		byte		0x03
6303>>>0x143	byte&0x80	0x80	[SGB+CGB]
6304>>>0x143	byte&0x80	!0x80	[SGB]
6305>>0x146		byte		!0x03
6306>>>0x143	byte&0xC0	0x80	[CGB]
6307>>>0x143	byte&0xC0	0xC0	[CGB ONLY]
6308>0x14b		byte		!0x33
6309
6310# Mapper.
6311>0x147 byte 0x00  [ROM ONLY]
6312>0x147 byte 0x01  [MBC1]
6313>0x147 byte 0x02  [MBC1+RAM]
6314>0x147 byte 0x03  [MBC1+RAM+BATT]
6315>0x147 byte 0x05  [MBC2]
6316>0x147 byte 0x06  [MBC2+BATTERY]
6317>0x147 byte 0x08  [ROM+RAM]
6318>0x147 byte 0x09  [ROM+RAM+BATTERY]
6319>0x147 byte 0x0B  [MMM01]
6320>0x147 byte 0x0C  [MMM01+SRAM]
6321>0x147 byte 0x0D  [MMM01+SRAM+BATT]
6322>0x147 byte 0x0F  [MBC3+TIMER+BATT]
6323>0x147 byte 0x10  [MBC3+TIMER+RAM+BATT]
6324>0x147 byte 0x11  [MBC3]
6325>0x147 byte 0x12  [MBC3+RAM]
6326>0x147 byte 0x13  [MBC3+RAM+BATT]
6327>0x147 byte 0x19  [MBC5]
6328>0x147 byte 0x1A  [MBC5+RAM]
6329>0x147 byte 0x1B  [MBC5+RAM+BATT]
6330>0x147 byte 0x1C  [MBC5+RUMBLE]
6331>0x147 byte 0x1D  [MBC5+RUMBLE+SRAM]
6332>0x147 byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
6333>0x147 byte 0xFC  [Pocket Camera]
6334>0x147 byte 0xFD  [Bandai TAMA5]
6335>0x147 byte 0xFE  [Hudson HuC-3]
6336>0x147 byte 0xFF  [Hudson HuC-1]
6337
6338# ROM size.
6339>0x148 byte 0     \b, ROM: 256Kbit
6340>0x148 byte 1     \b, ROM: 512Kbit
6341>0x148 byte 2     \b, ROM: 1Mbit
6342>0x148 byte 3     \b, ROM: 2Mbit
6343>0x148 byte 4     \b, ROM: 4Mbit
6344>0x148 byte 5     \b, ROM: 8Mbit
6345>0x148 byte 6     \b, ROM: 16Mbit
6346>0x148 byte 7     \b, ROM: 32Mbit
6347>0x148 byte 0x52  \b, ROM: 9Mbit
6348>0x148 byte 0x53  \b, ROM: 10Mbit
6349>0x148 byte 0x54  \b, ROM: 12Mbit
6350
6351# RAM size.
6352>0x149 byte 1     \b, RAM: 16Kbit
6353>0x149 byte 2     \b, RAM: 64Kbit
6354>0x149 byte 3     \b, RAM: 128Kbit
6355>0x149 byte 4     \b, RAM: 1Mbit
6356>0x149 byte 5     \b, RAM: 512Kbit
6357
6358#------------------------------------------------------------------------------
6359# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
6360# Updated by David Korth <gerbilsoft@gerbilsoft.com>
6361# References:
6362# - http://www.retrodev.com/segacd.html
6363# - http://devster.monkeeh.com/sega/32xguide1.txt
6364#
6365
6366# Common Sega Mega Drive header format.
6367# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s.
63680		name	sega-mega-drive-header
6369# ROM title. (Use domestic if present; if not, use international.)
6370>0x120		byte	>0x20
6371>>0x120		string	>\0	\b: "%.16s"
6372>0x120		byte	<0x21
6373>>0x150		string	>\0	\b: "%.16s"
6374# Other information.
6375>0x180		string	>\0	(%.14s
6376>>0x110		string  >\0	\b, %.16s
6377>0x180		byte	0
6378>>0x110		string  >\0	(%.16s
6379>0		byte	x	\b)
6380
6381# TODO: Check for 32X CD?
6382# Sega Mega CD disc images: 2048-byte sectors.
63830	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
6384!:mime	application/x-sega-cd-rom
6385>0	use	sega-mega-drive-header
6386>0	byte	x			\b, 2048-byte sectors
63870	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
6388!:mime	application/x-sega-cd-rom
6389>0	use	sega-mega-drive-header
6390>0	byte	x			\b, 2048-byte sectors
6391# Sega Mega CD disc images: 2352-byte sectors.
63920x10	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
6393!:mime	application/x-sega-cd-rom
6394>0x10	use	sega-mega-drive-header
6395>0	byte	x			\b, 2352-byte sectors
63960x10	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
6397!:mime	application/x-sega-cd-rom
6398>0x10	use	sega-mega-drive-header
6399>0	byte	x			\b, 2352-byte sectors
6400
6401# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images.
64020x100		string	SEGA
6403>0x3C0		bequad	0x4D41525320434845	Sega 32X ROM image
6404!:mime		application/x-genesis-32x-rom
6405>>0		use	sega-mega-drive-header
6406>0x3C0		bequad	!0x4D41525320434845
6407>>0x105		belong	0x5049434F	Sega Pico ROM image
6408!:mime		application/x-sega-pico-rom
6409>>>0		use	sega-mega-drive-header
6410>>0x105		belong	!0x5049434F
6411>>>0x180	beshort	0x4252		Sega Mega CD Boot ROM image
6412!:mime		application/x-genesis-rom
6413>>>0x180	beshort	!0x4252		Sega Mega Drive / Genesis ROM image
6414!:mime		application/x-genesis-rom
6415>>>0		use	sega-mega-drive-header
6416
6417#------------------------------------------------------------------------------
6418# genesis: file(1) magic for the Super MegaDrive ROM dump format
6419#
6420
6421# NOTE: Due to interleaving, we can't display anything
6422# other than the copier header information.
64230      name    sega-genesis-smd-header
6424>0     byte    x       %dx16k blocks
6425>2     byte    0       \b, last in series or standalone
6426>2     byte    >0      \b, split ROM
6427
6428# "Sega Genesis" header.
64290x280	string EAGN
6430>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
6431!:mime	application/x-genesis-rom
6432>>0	use     sega-genesis-smd-header
6433
6434# "Sega Mega Drive" header.
64350x280	string EAMG
6436>8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
6437!:mime	application/x-genesis-rom
6438>>0	use     sega-genesis-smd-header
6439
6440#------------------------------------------------------------------------------
6441# smsgg:  file(1) magic for Sega Master System and Game Gear ROM images
6442# Detects all Game Gear and export Sega Master System ROM images,
6443# and some Japanese Sega Master System ROM images.
6444# From: David Korth <gerbilsoft@gerbilsoft.com>
6445# Reference: http://www.smspower.org/Development/ROMHeader
6446#
6447
6448# General SMS header rule.
6449# The SMS boot ROM checks the header at three locations.
64500	name	sega-master-system-rom-header
6451# Machine type.
6452>0x0F	byte&0xF0	0x30	Sega Master System
6453!:mime	application/x-sms-rom
6454>0x0F	byte&0xF0	0x40	Sega Master System
6455!:mime	application/x-sms-rom
6456>0x0F	byte&0xF0	0x50	Sega Game Gear
6457!:mime	application/x-gamegear-rom
6458>0x0F	byte&0xF0	0x60	Sega Game Gear
6459!:mime	application/x-gamegear-rom
6460>0x0F	byte&0xF0	0x70	Sega Game Gear
6461!:mime	application/x-gamegear-rom
6462>0x0F	default		x	Sega Master System / Game Gear
6463!:mime	application/x-sms-rom
6464>0	byte		x	ROM image:
6465# Product code.
6466>0x0E	byte&0xF0	0x10	1
6467>0x0E	byte&0xF0	0x20	2
6468>0x0E	byte&0xF0	0x30	3
6469>0x0E	byte&0xF0	0x40	4
6470>0x0E	byte&0xF0	0x50	5
6471>0x0E	byte&0xF0	0x60	6
6472>0x0E	byte&0xF0	0x70	7
6473>0x0E	byte&0xF0	0x80	8
6474>0x0E	byte&0xF0	0x90	9
6475>0x0E	byte&0xF0	0xA0	10
6476>0x0E	byte&0xF0	0xB0	11
6477>0x0E	byte&0xF0	0xC0	12
6478>0x0E	byte&0xF0	0xD0	13
6479>0x0E	byte&0xF0	0xE0	14
6480>0x0E	byte&0xF0	0xF0	15
6481# If the product code is 5 digits, we'll need to backspace here.
6482>0x0E	byte&0xF0	!0
6483>>0x0C	leshort		x	\b%04x
6484>0x0E	byte&0xF0	0
6485>>0x0C	leshort		x	%04x
6486# Revision.
6487>0x0E	byte&0x0F	x	(Rev.%02d)
6488# ROM size. (Used for the boot ROM checksum routine.)
6489>0x0F	byte&0x0F	0x0A	(8 KB)
6490>0x0F	byte&0x0F	0x0B	(16 KB)
6491>0x0F	byte&0x0F	0x0C	(32 KB)
6492>0x0F	byte&0x0F	0x0D	(48 KB)
6493>0x0F	byte&0x0F	0x0E	(64 KB)
6494>0x0F	byte&0x0F	0x0F	(128 KB)
6495>0x0F	byte&0x0F	0x00	(256 KB)
6496>0x0F	byte&0x0F	0x01	(512 KB)
6497>0x0F	byte&0x0F	0x02	(1 MB)
6498
6499# SMS/GG header locations.
65000x7FF0	string	TMR\ SEGA
6501>0x7FF0	use	sega-master-system-rom-header
65020x3FF0	string	TMR\ SEGA
6503>0x3FF0	use	sega-master-system-rom-header
65040x1FF0	string	TMR\ SEGA
6505>0x1FF0	use	sega-master-system-rom-header
6506
6507#------------------------------------------------------------------------------
6508# saturn: file(1) magic for the Sega Saturn disc image format.
6509# From: David Korth <gerbilsoft@gerbilsoft.com>
6510#
6511
6512# Common Sega Saturn disc header format.
6513# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding.
6514# TODO: Release date, device information, region code, others?
65150	name	sega-saturn-disc-header
6516>0x60	string	>\0	\b: "%.32s"
6517>0x20	string	>\0	(%.10s
6518>>0x2A	string	>\0	\b, %.6s)
6519>>0x2A	byte	0	\b)
6520
6521# 2048-byte sector version.
65220	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
6523!:mime	application/x-saturn-rom
6524>0	use	sega-saturn-disc-header
6525>0	byte	x			(2048-byte sectors)
6526# 2352-byte sector version.
65270x10	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
6528!:mime	application/x-saturn-rom
6529>0x10	use	sega-saturn-disc-header
6530>0	byte	x			(2352-byte sectors)
6531
6532#------------------------------------------------------------------------------
6533# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
6534# From: David Korth <gerbilsoft@gerbilsoft.com>
6535# Reference: http://mc.pp.se/dc/ip0000.bin.html
6536#
6537
6538# Common Sega Dreamcast disc header format.
6539# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding.
6540# TODO: Release date, device information, region code, others?
65410	name	sega-dreamcast-disc-header
6542>0x80	string	>\0	\b: "%.32s"
6543>0x40	string	>\0	(%.10s
6544>>0x4A	string	>\0	\b, %.6s)
6545>>0x4A	byte	0	\b)
6546
6547# 2048-byte sector version.
65480	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
6549!:mime	application/x-dc-rom
6550>0	use	sega-dreamcast-disc-header
6551>0	byte	x			(2048-byte sectors)
6552# 2352-byte sector version.
65530x10	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
6554!:mime	application/x-dc-rom
6555>0x10	use	sega-dreamcast-disc-header
6556>0	byte	x			(2352-byte sectors)
6557
6558#------------------------------------------------------------------------------
6559# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
6560#
65610 belong 0x21068028   Sega Dreamcast VMU game image
65620 string LCDi         Dream Animator file
6563
6564#------------------------------------------------------------------------------
6565# z64: file(1) magic for the Z64 format N64 ROM dumps
6566# Reference: http://forum.pj64-emu.com/showthread.php?t=2239
6567# From: David Korth <gerbilsoft@gerbilsoft.com>
6568#
65690	bequad	0x803712400000000F	Nintendo 64 ROM image
6570!:mime	application/x-n64-rom
6571>0x20	string	>\0	\b: "%.20s"
6572>0x3B	string	x	(%.4s
6573>0x3F	byte	x	\b, Rev.%02u)
6574
6575#------------------------------------------------------------------------------
6576# v64: file(1) magic for the V64 format N64 ROM dumps
6577# Same as z64 format, but with 16-bit byteswapping.
6578#
65790	bequad	0x3780401200000F00	Nintendo 64 ROM image (V64)
6580!:mime	application/x-n64-rom
6581
6582#------------------------------------------------------------------------------
6583# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps
6584# Same as z64 format, but with swapped 16-bit words.
6585#
65860	bequad	0x12408037000F0000	Nintendo 64 ROM image (wordswapped)
6587!:mime	application/x-n64-rom
6588
6589#------------------------------------------------------------------------------
6590# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps
6591# Same as z64 format, but with 32-bit byteswapping.
6592#
65930	bequad	0x401237800F000000	Nintendo 64 ROM image (32-bit byteswapped)
6594!:mime	application/x-n64-rom
6595
6596#------------------------------------------------------------------------------
6597# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
6598# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader
6599#
6600# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
6601# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
6602#
66034	bequad	0x24FFAE51699AA221	Game Boy Advance ROM image
6604!:mime	application/x-gba-rom
6605>0xA0	string	>\0	\b: "%.12s"
6606>0xAC	string	x	(%.6s
6607>0xBC	byte	x	\b, Rev.%02u)
6608
6609#------------------------------------------------------------------------------
6610# nds: file(1) magic for the Nintendo DS(i) raw ROM format
6611# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader
6612#
6613# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com>
6614# Updated version from: David Korth <gerbilsoft@gerbilsoft.com>
6615#
66160xC0	bequad	0x24FFAE51699AA221	Nintendo DS ROM image
6617!:mime	application/x-nintendo-ds-rom
6618>0x00	string	>\0		\b: "%.12s"
6619>0x0C	string	x		(%.6s
6620>0x1E	byte	x		\b, Rev.%02u)
6621>0x12	byte	2		(DSi enhanced)
6622>0x12	byte	3		(DSi only)
6623# Secure Area check.
6624>0x20		lelong	<0x4000		(homebrew)
6625>0x20		lelong	>0x3FFF
6626>>0x4000	lequad	0x0000000000000000	(multiboot)
6627>>0x4000	lequad	!0x0000000000000000
6628>>>0x4000	lequad	0xE7FFDEFFE7FFDEFF	(decrypted)
6629>>>0x4000	lequad	!0xE7FFDEFFE7FFDEFF
6630>>>>0x1000	lequad	0x0000000000000000	(encrypted)
6631>>>>0x1000	lequad	!0x0000000000000000	(mask ROM)
6632
6633#------------------------------------------------------------------------------
6634# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
6635# This is also used for loading .nds files using the MSET exploit on 3DS.
6636# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp
66370xC0	bequad	0xC8604FE201708FE2	Nintendo DS Slot-2 ROM image (PassMe)
6638!:mime	application/x-nintendo-ds-rom
6639
6640#------------------------------------------------------------------------------
6641# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format.
6642# From: David Korth <gerbilsoft@gerbilsoft.com>
6643# References:
6644# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
6645# - http://www.devrs.com/ngp/files/ngpctech.txt
6646#
66470x0A	string	BY\ SNK\ CORPORATION	Neo Geo Pocket
6648!:mime	application/x-neo-geo-pocket-rom
6649>0x23	byte	0x10			Color
6650>0	byte	x			ROM image
6651>0x24	string	>\0			\b: "%.12s"
6652>0x1F	byte	0xFF			(debug mode enabled)
6653
6654#------------------------------------------------------------------------------
6655# msx: file(1) magic for MSX game cartridge dumps
6656# Too simple - MPi
6657#0 beshort 0x4142 MSX game cartridge dump
6658
6659#------------------------------------------------------------------------------
6660# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
66610	string	PS-X\ EXE	Sony Playstation executable
6662>16	lelong	x		PC=0x%08x,
6663>20	lelong	!0		GP=0x%08x,
6664>24	lelong	!0		.text=[0x%08x,
6665>>28	lelong	x		\b0x%x],
6666>32	lelong	!0		.data=[0x%08x,
6667>>36	lelong	x		\b0x%x],
6668>40	lelong	!0		.bss=[0x%08x,
6669>>44	lelong	x		\b0x%x],
6670>48	lelong	!0		Stack=0x%08x,
6671>48	lelong	=0		No Stack!,
6672>52	lelong	!0		StackSize=0x%x,
6673#>76	string	>\0		(%s)
6674#  Area:
6675>113	string	x		(%s)
6676
6677# CPE executables
66780	string	CPE		CPE executable
6679>3	byte	x		(version %d)
6680
6681#------------------------------------------------------------------------------
6682# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>)
66830       string          XBEH            XBE, Microsoft Xbox executable
6684# probabilistic checks whether signed or not
6685>0x0004 ulelong =0x0
6686>>&2    ulelong =0x0
6687>>>&2   ulelong =0x0  \b, not signed
6688>0x0004 ulelong >0
6689>>&2    ulelong >0
6690>>>&2   ulelong >0    \b, signed
6691# expect base address of 0x10000
6692>0x0104               ulelong =0x10000
6693>>(0x0118-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
6694>>(0x0118-0x0FF60)    ulelong&0x80000007  !0x80000007
6695>>>(0x0118-0x0FF60)   ulelong >0           (regions:
6696>>>>(0x0118-0x0FF60)  ulelong &0x00000001  NA
6697>>>>(0x0118-0x0FF60)  ulelong &0x00000002  Japan
6698>>>>(0x0118-0x0FF60)  ulelong &0x00000004  Rest_of_World
6699>>>>(0x0118-0x0FF60)  ulelong &0x80000000  Manufacturer
6700>>>(0x0118-0x0FF60)   ulelong >0           \b)
6701
6702# --------------------------------
6703# Microsoft Xbox data file formats
67040       string          XIP0            XIP, Microsoft Xbox data
67050       string          XTF0            XTF, Microsoft Xbox data
6706
6707# Atari Lynx cartridge dump (EXE/BLL header)
6708# From: "Stefan A. Haubenthal" <polluks@web.de>
6709
6710# Double-check that the image type matches too, 0x8008 conflicts with
6711# 8 character OMF-86 object file headers.
67120	beshort		0x8008
6713>6	string		BS93		Lynx homebrew cartridge
6714!:mime	application/x-atari-lynx-rom
6715>>2	beshort		x		\b, RAM start $%04x
6716>6	string		LYNX		Lynx cartridge
6717!:mime	application/x-atari-lynx-rom
6718>>2	beshort		x		\b, RAM start $%04x
6719
6720# Opera file system that is used on the 3DO console
6721# From: Serge van den Boom <svdb@stack.nl>
67220	string		\x01ZZZZZ\x01	3DO "Opera" file system
6723
6724# From: Alex Myczko <alex@aiei.ch>
6725# From: David Pflug <david@pflug.email>
6726# is the offset 12 or the offset 16 correct?
6727# GBS (Game Boy Sound) magic
6728# ftp://ftp.modland.com/pub/documents/format_documentation/\
6729# Gameboy%20Sound%20System%20(.gbs).txt
67300	string		GBS		Nintendo Gameboy Music/Audio Data
6731#12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
6732>16	string		>\0	("%.32s" by
6733>48	string		>\0	%.32s, copyright
6734>80	string		>\0	%.32s),
6735>3	byte		x	version %u,
6736>4	byte		x	%u tracks
6737
6738# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
6739# see http://zerosoft.zophar.net/ips.php
67400	string	PATCH			IPS patch file
6741
6742# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
67430	string	PPF30			Playstation Patch File version 3.0
6744>5	byte	0			\b, PPF 1.0 patch
6745>5	byte	1			\b, PPF 2.0 patch
6746>5	byte	2			\b, PPF 3.0 patch
6747>>56	byte	0			\b, Imagetype BIN (any)
6748>>56	byte	1			\b, Imagetype GI (PrimoDVD)
6749>>57	byte	0			\b, Blockcheck disabled
6750>>57	byte	1			\b, Blockcheck enabled
6751>>58	byte	0			\b, Undo data not available
6752>>58	byte	1			\b, Undo data available
6753>6	string	x			\b, description: %s
6754
67550	string	PPF20			Playstation Patch File version 2.0
6756>5	byte	0			\b, PPF 1.0 patch
6757>5	byte	1			\b, PPF 2.0 patch
6758>>56	lelong	>0			\b, size of file to patch %d
6759>6	string	x			\b, description: %s
6760
67610	string	PPF10			Playstation Patch File version 1.0
6762>5	byte	0			\b, Simple Encoding
6763>6	string	x			\b, description: %s
6764
6765# From: Daniel Dawson <ddawson@icehouse.net>
6766# SNES9x .smv "movie" file format.
67670		string		SMV\x1A	SNES9x input recording
6768>0x4		lelong		x	\b, version %d
6769# version 4 is latest so far
6770>0x4		lelong		<5
6771>>0x8		ledate		x	\b, recorded at %s
6772>>0xc		lelong		>0	\b, rerecorded %d times
6773>>0x10		lelong		x	\b, %d frames long
6774>>0x14		byte		>0	\b, data for controller(s):
6775>>>0x14		byte		&0x1	#1
6776>>>0x14		byte		&0x2	#2
6777>>>0x14		byte		&0x4	#3
6778>>>0x14		byte		&0x8	#4
6779>>>0x14		byte		&0x10	#5
6780>>0x15		byte		^0x1	\b, begins from snapshot
6781>>0x15		byte		&0x1	\b, begins from reset
6782>>0x15		byte		^0x2	\b, NTSC standard
6783>>0x15		byte		&0x2	\b, PAL standard
6784>>0x17		byte		&0x1    \b, settings:
6785# WIP1Timing not used as of version 4
6786>>>0x4		lelong		<4
6787>>>>0x17	byte		&0x2	WIP1Timing
6788>>>0x17		byte		&0x4	Left+Right
6789>>>0x17		byte		&0x8	VolumeEnvX
6790>>>0x17		byte		&0x10	FakeMute
6791>>>0x17		byte		&0x20	SyncSound
6792# New flag as of version 4
6793>>>0x4		lelong		>3
6794>>>>0x17	byte		&0x80	NoCPUShutdown
6795>>0x4		lelong		<4
6796>>>0x18		lelong		>0x23
6797>>>>0x20	leshort		!0
6798>>>>>0x20	lestring16	x	\b, metadata: "%s"
6799>>0x4		lelong		>3
6800>>>0x24		byte		>0	\b, port 1:
6801>>>>0x24	byte		1	joypad
6802>>>>0x24	byte		2	mouse
6803>>>>0x24	byte		3	SuperScope
6804>>>>0x24	byte		4	Justifier
6805>>>>0x24	byte		5	multitap
6806>>>0x24		byte		>0	\b, port 2:
6807>>>>0x25	byte		1	joypad
6808>>>>0x25	byte		2	mouse
6809>>>>0x25	byte		3	SuperScope
6810>>>>0x25	byte		4	Justifier
6811>>>>0x25	byte		5	multitap
6812>>>0x18		lelong		>0x43
6813>>>>0x40	leshort		!0
6814>>>>>0x40	lestring16	x	\b, metadata: "%s"
6815>>0x17		byte		&0x40   \b, ROM:
6816>>>(0x18.l-26)	lelong		x	CRC32 0x%08x
6817>>>(0x18.l-23)	string		x	"%s"
6818
6819# Type: scummVM savegame files
6820# From: Sven Hartge <debian@ds9.argh.org>
68210	string	SCVM	ScummVM savegame
6822>12	string	>\0	"%s"
6823
6824#------------------------------------------------------------------------------
6825# Nintendo GameCube / Wii file formats.
6826#
6827
6828# Type: Nintendo GameCube/Wii common disc header data.
6829# From: David Korth <gerbilsoft@gerbilsoft.com>
6830# Reference: http://wiibrew.org/wiki/Wii_Disc
68310	name	nintendo-gcn-disc-common
6832>0x20	string	x	"%.64s"
6833>0x00	string	x	(%.6s
6834>0x06	byte	>0
6835>>0x06	byte	1	\b, Disc 2
6836>>0x06	byte	2	\b, Disc 3
6837>>0x06	byte	3	\b, Disc 4
6838>0x07	byte	x	\b, Rev.%02u)
6839>0x18	belong	0x5D1C9EA3
6840>>0x60	beshort	0x0101	\b (Unencrypted)
6841
6842# Type: Nintendo GameCube disc image
6843# From: David Korth <gerbilsoft@gerbilsoft.com>
6844# Reference: http://wiibrew.org/wiki/Wii_Disc
68450x1C	belong	0xC2339F3D	Nintendo GameCube disc image:
6846!:mime	application/x-gamecube-rom
6847>0	use	nintendo-gcn-disc-common
6848
6849# Type: Nintendo GameCube embedded disc image
6850# Commonly found on demo discs.
6851# From: David Korth <gerbilsoft@gerbilsoft.com>
6852# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8
68530		belong	0xAE0F38A2
6854>0x0C		belong	0x00100000
6855>>(8.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube embedded disc image:
6856!:mime	application/x-gamecube-rom
6857>>>(8.L)	use	nintendo-gcn-disc-common
6858
6859# Type: Nintendo Wii disc image
6860# From: David Korth <gerbilsoft@gerbilsoft.com>
6861# Reference: http://wiibrew.org/wiki/Wii_Disc
68620x18	belong	0x5D1C9EA3	Nintendo Wii disc image:
6863>0	use	nintendo-gcn-disc-common
6864
6865# Type: Nintendo Wii disc image (WBFS format)
6866# From: David Korth <gerbilsoft@gerbilsoft.com>
6867# Reference: http://wiibrew.org/wiki/Wii_Disc
68680	string	WBFS
6869>0x218	belong	0x5D1C9EA3	Nintendo Wii disc image (WBFS format):
6870!:mime	application/x-wii-rom
6871>>0x200	use	nintendo-gcn-disc-common
6872
6873# Type: Nintendo GameCube/Wii disc image (CISO format)
6874# NOTE: This is NOT the same as Compact ISO or PSP CISO,
6875# though it has the same magic number.
68760		string	CISO
6877# Other fields are used to determine what type of CISO this is:
6878# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
6879# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
6880# - None of the above: Compact ISO.
6881>4		lelong	0x200000
6882>>8		byte	1
6883>>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
6884!:mime	application/x-wii-rom
6885>>>>0x8000	use	nintendo-gcn-disc-common
6886>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
6887!:mime	application/x-wii-rom
6888>>>>0x8000	use	nintendo-gcn-disc-common
6889
6890# Type: Nintendo GameCube/Wii disc image (GCZ format)
6891# Due to zlib compression, we can't get the actual disc information.
68920	lelong	0xB10BC001
6893>4	lelong	0		Nintendo GameCube disc image (GCZ format)
6894!:mime	application/x-gamecube-rom
6895>4	lelong	1		Nintendo Wii disc image (GCZ format)
6896!:mime	application/x-wii-rom
6897>4	default	x		Nintendo GameCube/Wii disc image (GCZ format)
6898
6899# Type: Nintendo GameCube/Wii disc image (WDF format)
69000		string	WII\001DISC
6901>8		belong	1
6902# WDFv1
6903>>0x54		belong	0xC2339F3D	Nintendo GameCube disc image (WDFv1 format):
6904!:mime	application/x-gamecube-rom
6905>>>0x38		use	nintendo-gcn-disc-common
6906>>0x58		belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv1 format):
6907!:mime	application/x-wii-rom
6908>>>0x38		use	nintendo-gcn-disc-common
6909>8		belong	2
6910# WDFv2
6911>>(12.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube disc image (WDFv2 format):
6912!:mime	application/x-gamecube-rom
6913>>>(12.L)	use	nintendo-gcn-disc-common
6914>>(12.L+0x18)	belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv2 format):
6915!:mime	application/x-wii-rom
6916>>>(12.L)	use	nintendo-gcn-disc-common
6917
6918# Type: Nintendo GameCube/Wii disc image (WIA format)
69190	string	WIA\001	Nintendo
6920>0x48	belong	1	GameCube
6921!:mime	application/x-gamecube-rom
6922>0x48	belong	2	Wii
6923!:mime	application/x-wii-rom
6924>0x48	default	x	GameCube/Wii
6925>0x48	belong	x	disc image (WIA format):
6926>>0x58	use	nintendo-gcn-disc-common
6927
6928# Type: Nintendo GameCube/Wii disc image (with SDK header)
6929# From: David Korth <gerbilsoft@gerbilsoft.com>
6930# Reference: http://wiibrew.org/wiki/Wii_Disc
69310		belong	0xFFFF0000
6932>0x18		belong	0x00000000
6933>>0x1C		belong	0x00000000
6934>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii SDK disc image:
6935>>>>0x8000	use	nintendo-gcn-disc-common
6936>>>0x801C	belong	0xC2339F3D	Nintendo GameCube SDK disc image:
6937>>>>0x8000	use	nintendo-gcn-disc-common
6938
6939#------------------------------------------------------------------------------
6940# Nintendo 3DS file formats.
6941#
6942
6943# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC)
6944# From: David Korth <gerbilsoft@gerbilsoft.com>
6945# Reference: https://www.3dbrew.org/wiki/NCSD
69460x100		string		NCSD
6947>0x118		lequad		0		Nintendo 3DS Game Card image
6948# NCCH header for partition 0. (game data)
6949>>0x1150	string		>\0	\b: "%.16s"
6950>>0x312		byte		x	(Rev.%02u)
6951>>0x118C	byte		2	(New3DS only)
6952>>0x18D		byte		0		(inner device)
6953>>0x18D		byte		1		(Card1)
6954>>0x18D		byte		2		(Card2)
6955>>0x18D		byte		3		(extended device)
6956>0x118		bequad		0x0102020202000000	Nintendo 3DS eMMC dump (Old3DS)
6957>0x118		bequad		0x0102020203000000	Nintendo 3DS eMMC dump (New3DS)
6958
6959# Nintendo 3DS version code.
6960# Reference: https://www.3dbrew.org/wiki/Titles
6961# Format: leshort containing three fields:
6962# - 6-bit: Major
6963# - 6-bit: Minor
6964# - 4-bit: Revision
6965# NOTE: Only supporting major/minor versions from 0-15 right now.
6966# NOTE: Should be prefixed with "v".
69670	name	nintendo-3ds-version-code
6968# Raw version.
6969>0	leshort	x	\b%u,
6970# Major version.
6971>0	leshort&0xFC00	0x0000	0
6972>0	leshort&0xFC00	0x0400	1
6973>0	leshort&0xFC00	0x0800	2
6974>0	leshort&0xFC00	0x0C00	3
6975>0	leshort&0xFC00	0x1000	4
6976>0	leshort&0xFC00	0x1400	5
6977>0	leshort&0xFC00	0x1800	6
6978>0	leshort&0xFC00	0x1C00	7
6979>0	leshort&0xFC00	0x2000	8
6980>0	leshort&0xFC00	0x2400	9
6981>0	leshort&0xFC00	0x2800	10
6982>0	leshort&0xFC00	0x2C00	11
6983>0	leshort&0xFC00	0x3000	12
6984>0	leshort&0xFC00	0x3400	13
6985>0	leshort&0xFC00	0x3800	14
6986>0	leshort&0xFC00	0x3C00	15
6987# Minor version.
6988>0	leshort&0x03F0	0x0000	\b.0
6989>0	leshort&0x03F0	0x0010	\b.1
6990>0	leshort&0x03F0	0x0020	\b.2
6991>0	leshort&0x03F0	0x0030	\b.3
6992>0	leshort&0x03F0	0x0040	\b.4
6993>0	leshort&0x03F0	0x0050	\b.5
6994>0	leshort&0x03F0	0x0060	\b.6
6995>0	leshort&0x03F0	0x0070	\b.7
6996>0	leshort&0x03F0	0x0080	\b.8
6997>0	leshort&0x03F0	0x0090	\b.9
6998>0	leshort&0x03F0	0x00A0	\b.10
6999>0	leshort&0x03F0	0x00B0	\b.11
7000>0	leshort&0x03F0	0x00C0	\b.12
7001>0	leshort&0x03F0	0x00D0	\b.13
7002>0	leshort&0x03F0	0x00E0	\b.14
7003>0	leshort&0x03F0	0x00F0	\b.15
7004# Revision.
7005>0	leshort&0x000F	x	\b.%u
7006
7007# Type: Nintendo 3DS "NCCH" container.
7008# https://www.3dbrew.org/wiki/NCCH
70090x100		string	NCCH	Nintendo 3DS
7010>0x18D		byte&2	0	File Archive (CFA)
7011>0x18D		byte&2	2	Executable Image (CXI)
7012>0x150		string	>\0	\b: "%.16s"
7013>0x18D		byte	0x05
7014>>0x10E		leshort	x	(Old3DS System Update v
7015>>0x10E		use	nintendo-3ds-version-code
7016>>0x10E		leshort	x	\b)
7017>0x18D		byte	0x15
7018>>0x10E		leshort	x	(New3DS System Update v
7019>>0x10E		use	nintendo-3ds-version-code
7020>>0x10E		leshort	x	\b)
7021>0x18D		byte	!0x05
7022>>0x18D		byte	!0x15
7023>>>0x112	byte	x	(v
7024>>>0x112	use	nintendo-3ds-version-code
7025>>>0x112	byte	x	\b)
7026>0x18C		byte	2	(New3DS only)
7027
7028# Type: Nintendo 3DS "SMDH" file. (application description)
7029# From: David Korth <gerbilsoft@gerbilsoft.com>
7030# Reference: https://3dbrew.org/wiki/SMDH
70310		string		SMDH		Nintendo 3DS SMDH file
7032>0x208		leshort		!0
7033>>0x208		lestring16	x		\b: "%.128s"
7034>>0x388		leshort		!0
7035>>>0x388	lestring16	x		by %.128s
7036>0x208		leshort		0
7037>>0x008		leshort		!0
7038>>>0x008	lestring16	x		\b: "%.128s"
7039>>>0x188	leshort		!0
7040>>>>0x188	lestring16	x		by %.128s
7041
7042# Type: Nintendo 3DS Homebrew Application.
7043# From: David Korth <gerbilsoft@gerbilsoft.com>
7044# Reference: https://3dbrew.org/wiki/3DSX_Format
70450	string	3DSX	Nintendo 3DS Homebrew Application (3DSX)
7046
7047#------------------------------------------------------------------------------
7048# a7800: file(1) magic for the Atari 7800 raw ROM format.
7049# From: David Korth <gerbilsoft@gerbilsoft.com>
7050# Reference: https://sites.google.com/site/atari7800wiki/a78-header
7051
70520	byte	>0
7053>0	byte	<3
7054>>1	string	ATARI7800	Atari 7800 ROM image
7055!:mime	application/x-atari-7800-rom
7056>>>0x11	string	>\0	\b: "%.32s"
7057# Display type.
7058>>>0x39	byte	0	(NTSC)
7059>>>0x39	byte	1	(PAL)
7060>>>0x36	byte&1	1	(POKEY)
7061
7062#------------------------------------------------------------------------------
7063# vectrex: file(1) magic for the GCE Vectrex raw ROM format.
7064# From: David Korth <gerbilsoft@gerbilsoft.com>
7065# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm
7066#
7067# NOTE: Title is terminated with 0x80, not 0.
7068# The header is terminated with a 0, so that will
7069# terminate the title as well.
7070#
70710	string	g\ GCE	Vectrex ROM image
7072>0x11	string	>\0	\b: "%.16s"
7073
7074#------------------------------------------------------------------------------
7075# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
7076# From: David Korth <gerbilsoft@gerbilsoft.com>
7077# Reference: https://www.3dbrew.org/wiki/Amiibo
70780x00		byte	0x04
7079>0x0A		beshort	0x0FE0
7080>>0x0C		belong	0xF110FFEE
7081>>>0x208	beshort	0x0100
7082>>>>0x020A	byte	0x0F
7083>>>>>0x020C	bequad	0x000000045F000000
7084>>>>>>0x5B	byte	0x02
7085>>>>>>>0x54	belong	x	Nintendo amiibo NFC dump - amiibo ID: %08X-
7086>>>>>>>0x58	belong	x	\b%08X
7087
7088#------------------------------------------------------------------------------
7089# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
7090# convex:  file(1) magic for Convex boxes
7091#
7092# Convexes are big-endian.
7093#
7094# /*\
7095#  * Below are the magic numbers and tests added for Convex.
7096#  * Added at beginning, because they are expected to be used most.
7097# \*/
70980	belong	0507	Convex old-style object
7099>16	belong	>0	not stripped
71000	belong	0513	Convex old-style demand paged executable
7101>16	belong	>0	not stripped
71020	belong	0515	Convex old-style pre-paged executable
7103>16	belong	>0	not stripped
71040	belong	0517	Convex old-style pre-paged, non-swapped executable
7105>16	belong	>0	not stripped
71060	belong	0x011257	Core file
7107#
7108# The following are a series of dump format magic numbers.  Each one
7109# corresponds to a drastically different dump format.  The first on is
7110# the original dump format on a 4.1 BSD or earlier file system.  The
7111# second marks the change between the 4.1 file system and the 4.2 file
7112# system.  The Third marks the changing of the block size from 1K
7113# to 2K to be compatible with an IDC file system.  The fourth indicates
7114# a dump that is dependent on Convex Storage Manager, because data in
7115# secondary storage is not physically contained within the dump.
7116# The restore program uses these number to determine how the data is
7117# to be extracted.
7118#
711924	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
712024	belong	=60014	dump format, Convex Storage Manager by-reference dump
7121#
7122# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
7123# If there is no `=' sign, assume just checking for whether the bit is set?
7124#
71250	belong	0601		Convex SOFF
7126>88	belong&0x000f0000	=0x00000000	c1
7127>88	belong			&0x00010000	c2
7128>88	belong			&0x00020000	c2mp
7129>88	belong			&0x00040000	parallel
7130>88	belong			&0x00080000	intrinsic
7131>88	belong			&0x00000001	demand paged
7132>88	belong			&0x00000002	pre-paged
7133>88	belong			&0x00000004	non-swapped
7134>88	belong			&0x00000008	POSIX
7135#
7136>84	belong			&0x80000000	executable
7137>84	belong			&0x40000000	object
7138>84	belong&0x20000000	=0		not stripped
7139>84	belong&0x18000000	=0x00000000	native fpmode
7140>84	belong&0x18000000	=0x10000000	ieee fpmode
7141>84	belong&0x18000000	=0x18000000	undefined fpmode
7142#
71430	belong			0605		Convex SOFF core
7144#
71450	belong			0607		Convex SOFF checkpoint
7146>88	belong&0x000f0000	=0x00000000	c1
7147>88	belong			&0x00010000	c2
7148>88	belong			&0x00020000	c2mp
7149>88	belong			&0x00040000	parallel
7150>88	belong			&0x00080000	intrinsic
7151>88	belong			&0x00000008	POSIX
7152#
7153>84	belong&0x18000000	=0x00000000	native fpmode
7154>84	belong&0x18000000	=0x10000000	ieee fpmode
7155>84	belong&0x18000000	=0x18000000	undefined fpmode
7156
7157#------------------------------------------------------------------------------
7158# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $
7159# xoverage:  file(1) magic for test coverage data
7160
7161# File formats used to store test coverage data
7162# 2016-05-21, Georg Sauthoff <mail@georg.so>
7163
7164
7165# - GCC gcno - written by GCC at compile time when compiling with
7166# 	gcc -ftest-coverage
7167# - GCC gcda - written by a program that was compiled with
7168#	gcc -fprofile-arcs
7169# - LLVM raw profiles - generated by a program compiled with
7170#	clang -fprofile-instr-generate -fcoverage-mapping ...
7171# - LLVM indexed profiles - generated by
7172#	llvm-profdata
7173# - GCOV reports, i.e. the annotated source code
7174# - LCOV trace files, i.e. aggregated GCC profiles
7175#
7176# GCC coverage tracefiles
7177# .gcno file are created during compile time,
7178# while data collected during runtime is stored in .gcda files
7179# cf. gcov-io.h
7180# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
7181# Examples:
7182# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
7183# Debian 8 PPC64/gcc-4.9.2  : 67 63 6e 6f 34 30 39 2a
71840	lelong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
7185>&3	byte	x	version %c.
7186>&1	byte	x	\b%c
7187
7188# big endian
71890	belong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
7190>&0	byte	x	version %c.
7191>&2	byte	x	\b%c (big-endian)
7192
7193# Examples:
7194# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
7195# Debian 8 PPC64/gcc-4.9.2  : 67 63 64 61 34 30 39 2a
71960	lelong	0x67636461	GCC gcda coverage (-fprofile-arcs),
7197>&3	byte	x	version %c.
7198>&1	byte	x	\b%c
7199
7200# big endian
72010	belong	0x67636461	GCC gcda coverage (-fprofile-arcs),
7202>&0	byte	x	version %c.
7203>&2	byte	x	\b%c (big-endian)
7204
7205
7206# LCOV tracefiles
7207# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
72080	string	TN:
7209>&0	search/64	\nSF:/	LCOV coverage tracefile
7210
7211
7212# Coverage reports generated by gcov
7213# i.e. source code annoted with coverage information
72140	string	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
7215>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
7216>>&0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data:	GCOV coverage report
7217
7218
7219# LLVM coverage files
7220
7221# raw data after running a program compiled with:
7222# `clang -fprofile-instr-generate -fcoverage-mapping ...`
7223# default name: default.profraw
7224# magic is: \xFF lprofr \x81
7225# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
72260	lequad	0xff6c70726f667281	LLVM raw profile data,
7227>&0	byte	x	version %d
7228
7229# big endian
72300	bequad	0xff6c70726f667281	LLVM raw profile data,
7231>&7	byte	x	version %d (big-endian)
7232
7233
7234# LLVM indexed instruction profile (as generated by llvm-profdata)
7235# magic is: reverse(\xFF lprofi \x81)
7236# cf. http://llvm.org/docs/CoverageMappingFormat.html
7237# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
7238# http://llvm.org/docs/CommandGuide/llvm-cov.html
7239# http://llvm.org/docs/CommandGuide/llvm-profdata.html
72400	lequad	0x8169666f72706cff	LLVM indexed profile data,
7241>&0	byte	x	version %d
7242
7243# big endian
72440	bequad	0x8169666f72706cff	LLVM indexed profile data,
7245>&7	byte	x	version %d (big-endian)
7246
7247
7248#------------------------------------------------------------------------------
7249# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
7250# cracklib:  file (1) magic for cracklib v2.7
7251
72520	lelong	0x70775631	Cracklib password index, little endian
7253>4	long	>0		(%i words)
7254>4	long	0		("64-bit")
7255>>8	long	>-1		(%i words)
72560	belong	0x70775631	Cracklib password index, big endian
7257>4	belong	>-1		(%i words)
7258# really bellong 0x0000000070775631
72590	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
7260>12	belong	>0		(%i words)
7261
7262# ----------------------------------------------------------------------------
7263# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
7264# ctags:  file (1) magic for Exuberant Ctags files
7265# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
72660	search/1	=!_TAG	Exuberant Ctags tag file text
7267
7268#--------------------------------------------------------------
7269# ctf:  file(1) magic for CTF (Common Trace Format) trace files
7270#
7271# Specs. available here: <http://www.efficios.com/ctf>
7272#--------------------------------------------------------------
7273
7274# CTF trace data
72750	lelong	0xc1fc1fc1	Common Trace Format (CTF) trace data (LE)
72760	belong	0xc1fc1fc1	Common Trace Format (CTF) trace data (BE)
7277
7278# CTF metadata (packetized)
72790	lelong	0x75d11d57	Common Trace Format (CTF) packetized metadata (LE)
7280>35	byte	x		\b, v%d
7281>36	byte	x		\b.%d
72820	belong	0x75d11d57	Common Trace Format (CTF) packetized metadata (BE)
7283>35	byte	x		\b, v%d
7284>36	byte	x		\b.%d
7285
7286# CTF metadata (plain text)
72870	string	/*\x20CTF\x20   Common Trace Format (CTF) plain text metadata
7288!:strength + 5			# this is to make sure we beat C
7289>&0	regex	[0-9]+\.[0-9]+	\b, v%s
7290
7291#------------------------------------------------------------------------------
7292# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
7293# file(1) magic(5) data for cubemaps  Martin Erik Werner <martinerikwerner@gmail.com>
7294#
72950	string	ACMP	Map file for the AssaultCube FPS game
72960	string	CUBE	Map file for cube and cube2 engine games
72970	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games
7298
7299#------------------------------------------------------------------------------
7300# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $
7301# Cups: file(1) magic for the cups raster file format
7302# From: Laurent Martelli <martellilaurent@gmail.com>
7303# http://www.cups.org/documentation.php/spec-raster.html
7304#
7305
73060	name		cups-le
7307>280	lelong		x		\b, %d
7308>284	lelong		x		\bx%d dpi
7309>376	lelong		x		\b, %dx
7310>380	lelong		x		\b%d pixels
7311>388	lelong		x		%d bits/color
7312>392	lelong		x		%d bits/pixel
7313>400	lelong		0		ColorOrder=Chunky
7314>400	lelong		1		ColorOrder=Banded
7315>400	lelong		2		ColorOrder=Planar
7316>404	lelong		0		ColorSpace=gray
7317>404	lelong		1		ColorSpace=RGB
7318>404	lelong		2		ColorSpace=RGBA
7319>404	lelong		3		ColorSpace=black
7320>404	lelong		4		ColorSpace=CMY
7321>404	lelong		5		ColorSpace=YMC
7322>404	lelong		6		ColorSpace=CMYK
7323>404	lelong		7		ColorSpace=YMCK
7324>404	lelong		8		ColorSpace=KCMY
7325>404	lelong		9		ColorSpace=KCMYcm
7326>404	lelong		10		ColorSpace=GMCK
7327>404	lelong		11		ColorSpace=GMCS
7328>404	lelong		12		ColorSpace=WHITE
7329>404	lelong		13		ColorSpace=GOLD
7330>404	lelong		14		ColorSpace=SILVER
7331>404	lelong		15		ColorSpace=CIE XYZ
7332>404	lelong		16		ColorSpace=CIE Lab
7333>404	lelong		17		ColorSpace=RGBW
7334>404	lelong		18		ColorSpace=sGray
7335>404	lelong		19		ColorSpace=sRGB
7336>404	lelong		20		ColorSpace=AdobeRGB
7337
7338# Cups Raster image format, Big Endian
73390	string		RaS
7340>3	string		t		Cups Raster version 1, Big Endian
7341>3	string		2		Cups Raster version 2, Big Endian
7342>3	string		3		Cups Raster version 3, Big Endian
7343!:mime	application/vnd.cups-raster
7344>0	use		\^cups-le
7345
7346
7347# Cups Raster image format, Little Endian
73481	string		SaR
7349>0	string		t		Cups Raster version 1, Little Endian
7350>0	string		2		Cups Raster version 2, Little Endian
7351>0	string		3		Cups Raster version 3, Little Endian
7352!:mime	application/vnd.cups-raster
7353>0	use		cups-le
7354
7355#------------------------------------------------------------------------------
7356# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
7357# dact:  file(1) magic for DACT compressed files
7358#
73590	long		0x444354C3	DACT compressed data
7360>4	byte		>-1		(version %i.
7361>5	byte		>-1		$BS%i.
7362>6	byte		>-1		$BS%i)
7363>7	long		>0		$BS, original size: %i bytes
7364>15	long		>30		$BS, block size: %i bytes
7365
7366#------------------------------------------------------------------------------
7367# $File: database,v 1.54 2018/06/23 16:37:21 christos Exp $
7368# database:  file(1) magic for various databases
7369#
7370# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
7371#
7372#
7373# GDBM magic numbers
7374#  Will be maintained as part of the GDBM distribution in the future.
7375#  <downsj@teeny.org>
73760	belong	0x13579acd	GNU dbm 1.x or ndbm database, big endian, 32-bit
7377!:mime	application/x-gdbm
73780	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian, old
7379!:mime	application/x-gdbm
73800	belong	0x13579acf	GNU dbm 1.x or ndbm database, big endian, 64-bit
7381!:mime	application/x-gdbm
73820	lelong	0x13579acd	GNU dbm 1.x or ndbm database, little endian, 32-bit
7383!:mime	application/x-gdbm
73840	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian, old
7385!:mime	application/x-gdbm
73860	lelong	0x13579acf	GNU dbm 1.x or ndbm database, little endian, 64-bit
7387!:mime	application/x-gdbm
73880	string	GDBM		GNU dbm 2.x database
7389!:mime	application/x-gdbm
7390#
7391# Berkeley DB
7392#
7393# Ian Darwin's file /etc/magic files: big/little-endian version.
7394#
7395# Hash 1.85/1.86 databases store metadata in network byte order.
7396# Btree 1.85/1.86 databases store the metadata in host byte order.
7397# Hash and Btree 2.X and later databases store the metadata in host byte order.
7398
73990	long	0x00061561	Berkeley DB
7400!:mime	application/x-dbm
7401>8	belong	4321
7402>>4	belong	>2		1.86
7403>>4	belong	<3		1.85
7404>>4	belong	>0		(Hash, version %d, native byte-order)
7405>8	belong	1234
7406>>4	belong	>2		1.86
7407>>4	belong	<3		1.85
7408>>4	belong	>0		(Hash, version %d, little-endian)
7409
74100	belong	0x00061561	Berkeley DB
7411>8	belong	4321
7412>>4	belong	>2		1.86
7413>>4	belong	<3		1.85
7414>>4	belong	>0		(Hash, version %d, big-endian)
7415>8	belong	1234
7416>>4	belong	>2		1.86
7417>>4	belong	<3		1.85
7418>>4	belong	>0		(Hash, version %d, native byte-order)
7419
74200	long	0x00053162	Berkeley DB 1.85/1.86
7421>4	long	>0		(Btree, version %d, native byte-order)
74220	belong	0x00053162	Berkeley DB 1.85/1.86
7423>4	belong	>0		(Btree, version %d, big-endian)
74240	lelong	0x00053162	Berkeley DB 1.85/1.86
7425>4	lelong	>0		(Btree, version %d, little-endian)
7426
742712	long	0x00061561	Berkeley DB
7428>16	long	>0		(Hash, version %d, native byte-order)
742912	belong	0x00061561	Berkeley DB
7430>16	belong	>0		(Hash, version %d, big-endian)
743112	lelong	0x00061561	Berkeley DB
7432>16	lelong	>0		(Hash, version %d, little-endian)
7433
743412	long	0x00053162	Berkeley DB
7435>16	long	>0		(Btree, version %d, native byte-order)
743612	belong	0x00053162	Berkeley DB
7437>16	belong	>0		(Btree, version %d, big-endian)
743812	lelong	0x00053162	Berkeley DB
7439>16	lelong	>0		(Btree, version %d, little-endian)
7440
744112	long	0x00042253	Berkeley DB
7442>16	long	>0		(Queue, version %d, native byte-order)
744312	belong	0x00042253	Berkeley DB
7444>16	belong	>0		(Queue, version %d, big-endian)
744512	lelong	0x00042253	Berkeley DB
7446>16	lelong	>0		(Queue, version %d, little-endian)
7447
7448# From Max Bowsher.
744912	long	0x00040988	Berkeley DB
7450>16	long	>0		(Log, version %d, native byte-order)
745112	belong	0x00040988	Berkeley DB
7452>16	belong	>0		(Log, version %d, big-endian)
745312	lelong	0x00040988	Berkeley DB
7454>16	lelong	>0		(Log, version %d, little-endian)
7455
7456#
7457#
7458# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
74590	string/b	RRD\0		RRDTool DB
7460>4	string/b	x		version %s
7461
7462>>10	short		!0		16bit aligned
7463>>>10	bedouble	8.642135e+130	big-endian
7464>>>>18	short		x		32bit long (m68k)
7465
7466>>10	short		0
7467>>>12	long		!0		32bit aligned
7468>>>>12	bedouble	8.642135e+130	big-endian
7469>>>>>20 long		0		64bit long
7470>>>>>20 long		!0		32bit long
7471>>>>12	ledouble	8.642135e+130	little-endian
7472>>>>>24 long		0		64bit long
7473>>>>>24 long		!0		32bit long (i386)
7474>>>>12	string		\x43\x2b\x1f\x5b\x2f\x25\xc0\xc7	middle-endian
7475>>>>>24 short		!0		32bit long (arm)
7476
7477>>8	quad		0		64bit aligned
7478>>>16	bedouble	8.642135e+130	big-endian
7479>>>>24	long		0		64bit long (s390x)
7480>>>>24	long		!0		32bit long (hppa/mips/ppc/s390/SPARC)
7481>>>16	ledouble	8.642135e+130	little-endian
7482>>>>28	long		0		64bit long (alpha/amd64/ia64)
7483>>>>28	long		!0		32bit long (armel/mipsel)
7484
7485#----------------------------------------------------------------------
7486# ROOT: file(1) magic for ROOT databases
7487#
74880       string  root\0  ROOT file
7489>4      belong  x       Version %d
7490>33     belong  x       (Compression: %d)
7491
7492# XXX: Weak magic.
7493# Alex Ott <ott@jet.msk.su>
7494## Paradox file formats
7495#2	  leshort	0x0800	Paradox
7496#>0x39	  byte		3	v. 3.0
7497#>0x39	  byte		4	v. 3.5
7498#>0x39	  byte		9	v. 4.x
7499#>0x39	  byte		10	v. 5.x
7500#>0x39	  byte		11	v. 5.x
7501#>0x39	  byte		12	v. 7.x
7502#>>0x04	  byte		0	indexed .DB data file
7503#>>0x04	  byte		1	primary index .PX file
7504#>>0x04	  byte		2	non-indexed .DB data file
7505#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
7506#>>0x04	  byte		4	secondary index .Ynn file
7507#>>0x04	  byte		5	incrementing secondary index .Xnn file
7508#>>0x04	  byte		6	non-incrementing secondary index .XGn file
7509#>>0x04	  byte		7	secondary index .YGn file
7510#>>>0x04	  byte		8	incrementing secondary index .XGn file
7511
7512## XBase database files
7513# updated by Joerg Jenderek at Feb 2013
7514# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
7515# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
7516# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
7517# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
75180	ubelong&0x0000FFFF		<0x00000C20
7519# skip Infocom game Z-machine
7520>2		ubyte			>0
7521# skip Androids *.xml
7522>>3		ubyte			>0
7523>>>3		ubyte			<32
7524# 1 < version VV
7525>>>>0		ubyte			>1
7526# skip HELP.CA3 by test for reserved byte ( NULL )
7527>>>>>27		ubyte			0
7528# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
7529#>>>>>30		ubeshort     		x		30NULL?%x
7530# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
7531>>>>>>24	ubelong&0xffFFFFff	>0x01302000
7532# .DBF or .MDX
7533>>>>>>24	ubelong&0xffFFFFff	<0x01302001
7534# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
7535>>>>>>>24	ubelong&0xffFFFFff	=0
7536# test for 2 reserved NULL bytes,transaction and encryption byte flag
7537>>>>>>>>12	ubelong&0xFFFFfEfE	0
7538# test for MDX flag
7539>>>>>>>>>28	ubyte			x
7540>>>>>>>>>28	ubyte&0xf8		0
7541# header size >= 32
7542>>>>>>>>>>8	uleshort		>31
7543# skip PIC15736.PCX by test for language driver name or field name
7544>>>>>>>>>>>32	ubyte			>0
7545#!:mime	application/x-dbf; charset=unknown-8bit ??
7546#!:mime	application/x-dbase
7547>>>>>>>>>>>>0	use			xbase-type
7548# database file
7549>>>>>>>>>>>>0	ubyte			x		\b DBF
7550>>>>>>>>>>>>4	lelong			0		\b, no records
7551>>>>>>>>>>>>4	lelong			>0		\b, %d record
7552# plural s appended
7553>>>>>>>>>>>>>4	lelong			>1		\bs
7554# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
7555# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
7556>>>>>>>>>>>>10	uleshort		x		* %d
7557# file size = records * record size + header size
7558>>>>>>>>>>>>1	ubyte			x		\b, update-date
7559>>>>>>>>>>>>1	use			xbase-date
7560# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
7561#>>>>>>>>>>>>29	ubyte			=0		\b, codepage ID=0x%x
7562# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
7563>>>>>>>>>>>>29	ubyte			>0		\b, codepage ID=0x%x
7564#>>>>>>>>>>>>28	ubyte&0x01		0		\b, no index file
7565>>>>>>>>>>>>28	ubyte&0x01		1		\b, with index file .MDX
7566>>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
7567>>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
7568# 1st record offset + 1 = header size
7569>>>>>>>>>>>>8	uleshort		>0
7570>>>>>>>>>>>>(8.s+1)	ubyte		>0
7571>>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
7572>>>>>>>>>>>>>(8.s+1)	ubyte		>0
7573>>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
7574# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
7575>>>>>>>24	ubelong&0x0133f7ff	>0
7576# test for reserved NULL byte
7577>>>>>>>>47	ubyte			0
7578# test for valid TAG key format (0x10 or 0)
7579>>>>>>>>>559	ubyte&0xeF		0
7580# test MM <= 12
7581>>>>>>>>>>45	ubeshort		<0x0C20
7582>>>>>>>>>>>45	ubyte			>0
7583>>>>>>>>>>>>46	ubyte			<32
7584>>>>>>>>>>>>>46	ubyte			>0
7585#!:mime	application/x-mdx
7586>>>>>>>>>>>>>>0		use		xbase-type
7587>>>>>>>>>>>>>>0		ubyte		x		\b MDX
7588>>>>>>>>>>>>>>1		ubyte		x		\b, creation-date
7589>>>>>>>>>>>>>>1		use		xbase-date
7590>>>>>>>>>>>>>>44	ubyte		x		\b, update-date
7591>>>>>>>>>>>>>>44	use		xbase-date
7592# No.of tags in use (1,2,5,12)
7593>>>>>>>>>>>>>>28	uleshort	x		\b, %d
7594# No. of entries in tag (0x30)
7595>>>>>>>>>>>>>>25	ubyte		x		\b/%d tags
7596#  Length of tag
7597>>>>>>>>>>>>>>26	ubyte		x		* %d
7598# 1st tag name_
7599>>>>>>>>>>>>>548	string		x		\b, 1st tag "%.11s"
7600# 2nd tag name
7601#>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
7602#
7603#		Print the xBase names of different version variants
76040	name				xbase-type
7605>0	ubyte		<2
7606# 1 < version
7607>0	ubyte		>1
7608>>0	ubyte		0x02		FoxBase
7609# FoxBase+/dBaseIII+, no memo
7610>>0	ubyte		0x03		FoxBase+/dBase III
7611!:mime	application/x-dbf
7612# dBASE IV no memo file
7613>>0	ubyte		0x04		dBase IV
7614!:mime	application/x-dbf
7615# dBASE V no memo file
7616>>0	ubyte		0x05		dBase V
7617!:mime	application/x-dbf
7618>>0	ubyte		0x30		Visual FoxPro
7619!:mime	application/x-dbf
7620>>0	ubyte		0x31		Visual FoxPro, autoincrement
7621!:mime	application/x-dbf
7622# Visual FoxPro, with field type Varchar or Varbinary
7623>>0	ubyte		0x32		Visual FoxPro, with field type Varchar
7624!:mime	application/x-dbf
7625# dBASE IV SQL, no memo;dbv memo var size (Flagship)
7626>>0	ubyte		0x43		dBase IV, with SQL table
7627!:mime	application/x-dbf
7628# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7629#>>0	ubyte		0x62		dBase IV, with SQL table
7630#!:mime	application/x-dbf
7631# dBASE IV, with memo!!
7632>>0	ubyte		0x7b		dBase IV, with memo
7633!:mime	application/x-dbf
7634# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7635#>>0	ubyte		0x82		dBase IV, with SQL system
7636#!:mime	application/x-dbf
7637# FoxBase+/dBaseIII+ with memo .DBT!
7638>>0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
7639!:mime	application/x-dbf
7640# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
7641>>0	ubyte		0x87		VISUAL OBJECTS, with memo file
7642!:mime	application/x-dbf
7643# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7644#>>0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
7645#!:mime	application/x-dbf
7646# dBASE IV with memo!
7647>>0	ubyte		0x8B		dBase IV, with memo .DBT
7648!:mime	application/x-dbf
7649# dBase IV with SQL Table,no memo?
7650>>0	ubyte		0x8E		dBase IV, with SQL table
7651!:mime	application/x-dbf
7652# .dbv and .dbt memo (Flagship)?
7653>>0	ubyte		0xB3		Flagship
7654# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7655#>>0	ubyte		0xCA		dBase IV with memo .DBT
7656#!:mime	application/x-dbf
7657# dBASE IV with SQL table, with memo .DBT
7658>>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
7659!:mime	application/x-dbf
7660# HiPer-Six format;Clipper SIX, with SMT memo file
7661>>0	ubyte		0xE5		Clipper SIX with memo
7662!:mime	application/x-dbf
7663# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7664#>>0	ubyte		0xF4		dBase IV, with SQL table, with memo
7665#!:mime	application/x-dbf
7666>>0	ubyte		0xF5		FoxPro with memo
7667!:mime	application/x-dbf
7668# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
7669#>>0	ubyte		0xFA		FoxPro 2.x, with memo
7670#!:mime	application/x-dbf
7671# unknown version (should not happen)
7672>>0	default		x		xBase
7673!:mime	application/x-dbf
7674>>>0	ubyte		x		(0x%x)
7675# flags in version byte
7676# DBT flag (with dBASE III memo .DBT)!!
7677# >>0	ubyte&0x80	>0		DBT_FLAG=%x
7678# memo flag ??
7679# >>0	ubyte&0x08	>0		MEMO_FLAG=%x
7680# SQL flag ??
7681# >>0	ubyte&0x70	>0		SQL_FLAG=%x
7682#		test and print the date of xBase .DBF .MDX
76830	name				xbase-date
7684# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
7685>0	ubelong		x
7686>1	ubyte		<13
7687>>1	ubyte		>0
7688>>>2	ubyte		>0
7689>>>>2	ubyte		<32
7690>>>>>0	ubyte		x
7691# YY is interpreted as 20YY or 19YY
7692>>>>>>0	ubyte		<100		\b %.2d
7693# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
7694>>>>>>0	ubyte		>99		\b %d
7695>>>>>1	ubyte		x		\b-%d
7696>>>>>2	ubyte		x		\b-%d
7697
7698#	dBase memo files .DBT or .FPT
7699# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
770016		ubyte		<4
7701>16		ubyte		!2
7702>>16		ubyte		!1
7703# next free block index is positive
7704>>>0		ulelong		>0
7705# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
7706>>>>17		ubelong&0xFFfdFE00	0x00000000
7707# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
7708>>>>>20		ubelong&0xFF01209B	0x00000000
7709# dBASE III
7710>>>>>>16	ubyte		3
7711# dBASE III DBT
7712>>>>>>>0	use		dbase3-memo-print
7713# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
7714>>>>>>16	ubyte		0
7715# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
7716>>>>>>>20	uleshort	0
7717# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
7718>>>>>>>>8	ulong		=0
7719>>>>>>>>>6	ubeshort	>0
7720# skip emacs.PIF
7721>>>>>>>>>>4	ushort		0
7722>>>>>>>>>>>0	use		foxpro-memo-print
7723# dBASE III DBT , garbage
7724>>>>>>>>>6	ubeshort	0
7725# skip MM*DD*.bin by test for for reserved NULL byte
7726>>>>>>>>>>510	ubeshort	0
7727# skip TK-DOS11.img image by looking for memo text
7728>>>>>>>>>>>512	ubelong		<0xfeffff03
7729# skip EFI executables by looking for memo text
7730>>>>>>>>>>>>512	ubelong		>0x1F202020
7731>>>>>>>>>>>>>513 ubyte		>0
7732# unusual dBASE III DBT like adressen.dbt
7733>>>>>>>>>>>>>>0	use		dbase3-memo-print
7734# dBASE III DBT like angest.dbt, or garbage PCX DBF
7735>>>>>>>>8	ubelong		!0
7736# skip PCX and some DBF by test for for reserved NULL bytes
7737>>>>>>>>>510	ubeshort	0
7738# skip some DBF by test of invalid version
7739>>>>>>>>>>0	ubyte		>5
7740>>>>>>>>>>>0	ubyte		<48
7741>>>>>>>>>>>>0	use		dbase3-memo-print
7742# dBASE IV DBT with positive block size
7743>>>>>>>20	uleshort	>0
7744# dBASE IV DBT with valid block length like 512, 1024
7745# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
7746>>>>>>>>20	uleshort&0x800f	0
7747>>>>>>>>>0	use		dbase4-memo-print
7748
7749#		Print the information of dBase III DBT memo file
77500	name				dbase3-memo-print
7751>0	ubyte			x		dBase III DBT
7752# instead 3 as version number 0 for unusual examples like biblio.dbt
7753>16	ubyte			!3		\b, version number %u
7754# Number of next available block for appending data
7755#>0	lelong			=0		\b, next free block index %u
7756>0	lelong			!0		\b, next free block index %u
7757# no positiv block length
7758#>20	uleshort		=0		\b, block length %u
7759>20	uleshort		!0		\b, block length %u
7760# dBase III memo field terminated by \032\032
7761>512	string			>\0		\b, 1st item "%s"
7762#		Print the information of dBase IV DBT memo file
77630	name				dbase4-memo-print
7764>0		lelong		x		dBase IV DBT
7765!:mime	application/x-dbt
7766!:ext dbt
7767# 8 character shorted main name of coresponding dBASE IV DBF file
7768>8		ubelong		>0x20000000
7769# skip unusual like for angest.dbt
7770>>20		uleshort	>0
7771>>>8		string		>\0		\b of %-.8s.DBF
7772# value 0 implies 512 as size
7773#>4		ulelong		=0		\b, blocks size %u
7774# size of blocks not reliable like 0x2020204C in angest.dbt
7775>4		ulelong		!0
7776>>4		ulelong&0x0000003f	0	\b, blocks size %u
7777# dBase IV DBT with positive block length (found 512 , 1024)
7778>20		uleshort	>0		\b, block length %u
7779# next available block
7780#>0		lelong		=0		\b, next free block index %u
7781>0		lelong		!0		\b, next free block index %u
7782>20		uleshort	>0
7783>>(20.s)	ubelong		x
7784>>>&-4		use		dbase4-memofield-print
7785# unusual dBase IV DBT without block length (implies 512 as length)
7786>20		uleshort	=0
7787>>512		ubelong		x
7788>>>&-4		use				dbase4-memofield-print
7789#		Print the information of dBase IV memo field
77900	name			dbase4-memofield-print
7791# free dBase IV memo field
7792>0		ubelong		!0xFFFF0800
7793>>0		lelong		x		\b, next free block %u
7794>>4		lelong		x		\b, next used block %u
7795# used dBase IV memo field
7796>0		ubelong		=0xFFFF0800
7797# length of memo field
7798>>4		lelong		x		\b, field length %d
7799>>>8		string		>\0		\b, 1st used item "%s"
7800#		Print the information of FoxPro FPT memo file
78010	name				foxpro-memo-print
7802>0		belong		x		FoxPro FPT
7803# Size of blocks for FoxPro ( 64,256 )
7804>6		ubeshort	x		\b, blocks size %u
7805# next available block
7806#>0		belong		=0		\b, next free block index %u
7807>0		belong		!0		\b, next free block index %u
7808# field type ( 0~picture, 1~memo, 2~object )
7809>512		ubelong		<3		\b, field type %u
7810# length of memo field
7811>512		ubelong		1
7812>>516		belong		>0		\b, field length %d
7813>>>520		string		>\0		\b, 1st item "%s"
7814
7815# TODO:
7816# DBASE index file *.NDX
7817# DBASE Compound Index file *.CDX
7818# dBASE IV Printer Driver *.PRF
7819## End of XBase database stuff
7820
7821# MS Access database
78224	string	Standard\ Jet\ DB	Microsoft Access Database
7823!:mime	application/x-msaccess
78244	string	Standard\ ACE\ DB	Microsoft Access Database
7825!:mime	application/x-msaccess
7826
7827# From: Joerg Jenderek
7828# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
7829# Reference: https://github.com/libyal/libesedb/archive/master.zip
7830#	libesedb-master/documentation/
7831#	Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
7832# Note: also known as "JET Blue". Used by numerous Windows components such as
7833# Windows Search, Mail, Exchange and Active Directory.
78344	ubelong		0xefcdab89
7835# unknown1
7836>132	ubelong		0		Extensible storage engine
7837!:mime	application/x-ms-ese
7838# file_type 0~database 1~stream
7839>>12	ulelong		0		DataBase
7840# Security DataBase (sdb)
7841!:ext	edb/sdb
7842>>12	ulelong		1		STreaMing
7843!:ext	stm
7844# format_version 620h
7845>>8	uleshort	x		\b, version 0x%x
7846>>10	uleshort	>0		revision 0x%4.4x
7847>>0	ubelong		x	 	\b, checksum 0x%8.8x
7848# Page size 4096 8192 32768
7849>>236	ulequad		x		\b, page size %lld
7850# database_state
7851>>52	ulelong		1		\b, JustCreated
7852>>52	ulelong		2		\b, DirtyShutdown
7853#>>52	ulelong		3		\b, CleanShutdown
7854>>52	ulelong		4		\b, BeingConverted
7855>>52	ulelong		5		\b, ForceDetach
7856# Windows�NT major version when the databases indexes were updated.
7857>>216	ulelong		x		\b, Windows version %d
7858# Windows�NT minor version
7859>>220	ulelong		x		\b.%d
7860
7861# From: Joerg Jenderek
7862# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility
7863# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
78648	string		sdbf
7865>7	ubyte		0
7866# TAG_TYPE_LIST+TAG_INDEXES
7867>>12	uleshort	0x7802		Windows application compatibility Shim DataBase
7868# version? 2 3
7869#>>>0	ulelong		x		\b, version %d
7870!:mime	application/x-ms-sdb
7871!:ext	sdb
7872
7873# TDB database from Samba et al - Martin Pool <mbp@samba.org>
78740	string	TDB\ file		TDB database
7875>32	lelong	0x2601196D		version 6, little-endian
7876>>36	lelong	x			hash size %d bytes
7877
7878# SE Linux policy database
78790       lelong  0xf97cff8c      SE Linux policy
7880>16     lelong  x               v%d
7881>20     lelong  1      MLS
7882>24     lelong  x       %d symbols
7883>28     lelong  x       %d ocons
7884
7885# ICE authority file data (Wolfram Kleff)
78862	string		ICE		ICE authority data
7887
7888# X11 Xauthority file (Wolfram Kleff)
788910	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
789011	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
789112	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
789213	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
789314	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
789415	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
789516	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
789617	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
789718	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
7898
7899# From: Maxime Henrion <mux@FreeBSD.org>
7900# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
79010	string		PGDMP		PostgreSQL custom database dump
7902>5	byte		x		- v%d
7903>6	byte		x		\b.%d
7904>5	beshort		<0x101		\b-0
7905>5	beshort		>0x100
7906>>7	byte		x		\b-%d
7907
7908# Type: Advanced Data Format (ADF) database
7909# URL:  http://www.grc.nasa.gov/WWW/cgns/adf/
7910# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
79110	string	@(#)ADF\ Database	CGNS Advanced Data Format
7912
7913# Tokyo Cabinet magic data
7914# http://tokyocabinet.sourceforge.net/index.html
79150	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
7916>14	string		x			\b (%s)
7917>32	byte		0			\b, Hash
7918!:mime	application/x-tokyocabinet-hash
7919>32	byte		1			\b, B+ tree
7920!:mime	application/x-tokyocabinet-btree
7921>32	byte		2			\b, Fixed-length
7922!:mime	application/x-tokyocabinet-fixed
7923>32	byte		3			\b, Table
7924!:mime	application/x-tokyocabinet-table
7925>33	byte		&1			\b, [open]
7926>33	byte		&2			\b, [fatal]
7927>34	byte		x			\b, apow=%d
7928>35	byte		x			\b, fpow=%d
7929>36	byte		&0x01			\b, [large]
7930>36	byte		&0x02			\b, [deflate]
7931>36	byte		&0x04			\b, [bzip]
7932>36	byte		&0x08			\b, [tcbs]
7933>36	byte		&0x10			\b, [excodec]
7934>40	lequad		x			\b, bnum=%lld
7935>48	lequad		x			\b, rnum=%lld
7936>56	lequad		x			\b, fsiz=%lld
7937
7938# Type:	QDBM Quick Database Manager
7939# From:	Benoit Sibaud <bsibaud@april.org>
79400	string		\\[depot\\]\n\f		Quick Database Manager, little endian
79410	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian
7942
7943# Type:	TokyoCabinet database
7944# URL:	http://tokyocabinet.sourceforge.net/
7945# From:	Benoit Sibaud <bsibaud@april.org>
79460	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
7947>14	string		x			(version %s)
7948
7949# From:  Stephane Blondon http://www.yaal.fr
7950# Database file for Zope (done by FileStorage)
79510	string	FS21	Zope Object Database File Storage v3 (data)
79520	string	FS30	Zope Object Database File Storage v4 (data)
7953
7954# Cache file for the database of Zope (done by ClientStorage)
79550	string		ZEC3	Zope Object Database Client Cache File (data)
7956
7957# IDA (Interactive Disassembler) database
79580	string		IDA1	IDA (Interactive Disassembler) database
7959
7960# Hopper (reverse engineering tool) http://www.hopperapp.com/
79610	string		hopperdb	Hopper database
7962
7963# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
7964# Reference: http://www.provue.com/Panorama/
7965# From: Joerg Jenderek
7966# NOTE: test only versions 4 and 6.0 with Windows
7967# length of Panorama database name
79685	ubyte				>0
7969# look after database name for "some" null bits
7970>(5.B+7)	ubelong&0xF3ffF000	0
7971# look for first keyword
7972>>&1		search/2		DESIGN		Panorama database
7973#!:mime	application/x-panorama-database
7974!:apple	KASXZEPD
7975!:ext	pan
7976# database name
7977>>>5	pstring				x		\b, "%s"
7978
7979#
7980#
7981# askSam Database by Stefan A. Haubenthal <polluks@web.de>
79820	string	askw40\0	askSam DB
7983
7984#
7985#
7986# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
79870	string	MBSTV\040	MUIbase DB
7988>6	string	x		version %s
7989
7990#
7991# CDB database
79920	string	NBCDB\012	NetBSD Constant Database
7993>7	byte	x		\b, version %d
7994>8	string	x		\b, for '%s'
7995>24	lelong	x		\b, datasize %d
7996>28	lelong	x		\b, entries %d
7997>32	lelong	x		\b, index %d
7998>36	lelong	x		\b, seed %#x
7999
8000#
8001# Redis RDB - https://redis.io/topics/persistence
80020	string	REDIS			Redis RDB file,
8003>5	regex	[0-9][0-9][0-9][0-9]	version %s
8004
8005# Mork database.
8006# Used by older versions of Mozilla Suite and Firefox,
8007# and current versions of Thunderbird.
8008# From: David Korth <gerbilsoft@gerbilsoft.com>
80090	string	//\ <!--\ <mdb:mork:z\ v="	Mozilla Mork database
8010>23	string	x		\b, version %.3s
8011
8012#------------------------------------------------------------------------------
8013# $File: dataone,v 1.1 2018/06/06 01:16:40 christos Exp $
8014#
8015# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
8016#                     Pratik Shrivastava <pratikshrivastava23@gmail.com>
8017#
8018# file formats:   https://cn.dataone.org/cn/v2/formats
8019#------------------------------------------------------------------------------
8020
8021# EML (Ecological Metadata Language Format)
80220	string	<?xml
8023>&0	regex	(eml)-[0-9].[0-9].[0-9]+	eml://ecoinformatics.org/%s
8024
8025# onedcx (DataONE Dublin Core Extended v1.0)
8026>&0	regex	(onedcx/v)[0-9].[0-9]+		http://ns.dataone.org/metadata/schema/onedcx/v1.0
8027
8028# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata,
8029# version 001-1998)
8030>&0	regex	fgdc				FGDC-STD-001-1998
8031
8032# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0)
8033>&0	regex	(mercury/terms/v)[0-9].[0-9]	http://purl.org/ornl/schema/mercury/terms/v1.0
8034
8035# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language)
8036>&0	regex	isotc211
8037>>&0	regex	eng;USA				http://www.isotc211.org/2005/gmd
8038
8039# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language)
8040>>&0	regex	gov.noaa.nodc:[0-9]+		http://www.isotc211.org/2005/gmd-noaa
8041
8042# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language
8043>>&0	regex	pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+	http://www.isotc211.org/2005/gmd-pangaea
8044!:mime	text/xml
8045
8046
8047# Object Reuse and Exchange Vocabulary
80480	string	<?xml
8049>&0	regex	rdf
8050>>&0	regex	openarchives	http://www.openarchives.org/ore/terms
8051!:mime application/rdf+xml
8052
8053
8054# Dryad Metadata Application Profile Version 3.1
80550	string	<DryadData
8056>&0	regex	(dryad-bibo/v)[0-9].[0-9]	http://datadryad.org/profile/v3.1
8057!:mime	text/xml
8058
8059#------------------------------------------------------------------------------
8060# $File: dbpf,v 1.2 2018/05/24 18:54:40 christos Exp $
8061# dppf:	Maxis Database Packed Files, the stored data file format used by all
8062#	Maxis games after the Sims: http://wiki.niotso.org/DBPF
8063# 	http://www.wiki.sc4devotion.com/index.php?title=DBPF
8064#	13 Oct 2017, Kip Warner <kip at thevertigo dot com>
80650	string	DBPF	Maxis Database Packed File
8066>4	ulelong	x	\b, version: %u.
8067>>8	ulelong	x	\b%u
8068>>>36	ulelong	x       \b, files: %u
8069>>24	ledate	!0	\b, created: %s
8070>>28	ledate	!0	\b, modified: %s
8071!:ext	dbpf/package/dat/sc4
8072!:mime	application/x-maxis-dbpf
8073#------------------------------------------------------------------------------
8074# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $
8075# der: file(1) magic for DER encoded files
8076#
8077
8078# Certificate information piece
80790	name	certinfo
8080>0	der	seq
8081>>&0	der	set
8082>>>&0	der	seq
8083>>>>&0	der	obj_id3=550406
8084>>>>&0	der	prt_str=x	\b, countryName=%s
8085>>&0	der	set
8086>>>&0	der	seq
8087>>>>&0	der	obj_id3=550408
8088>>>>&0	der	utf8_str=x	\b, stateOrProvinceName=%s
8089>>&0	der	set
8090>>>&0	der	seq
8091>>>>&0	der	obj_id3=55040a
8092>>>>&0	der	utf8_str=x	\b, organizationName=%s
8093>>&0	der	set
8094>>>&0	der	seq
8095>>>>&0	der	obj_id3=550403
8096>>>>&0	der	utf8_str=x	\b, commonName=%s
8097>>&0	der	seq
8098
8099# Certificate requests
81000	der	seq
8101>&0	der	seq
8102>>&0	der	int1=00		DER Encoded Certificate request
8103>>&0	use	certinfo
8104
8105# Key Pairs
81060	der	seq
8107>&0	der	int1=00
8108>&0	der	int65=x
8109>&0	der	int3=010001	DER Encoded Key Pair, 512 bits
8110
81110	der	seq
8112>&0	der	int1=00
8113>&0	der	int129=x
8114>&0	der	int3=010001	DER Encoded Key Pair, 1024 bits
8115
81160	der	seq
8117>&0	der	int1=00
8118>&0	der	int257=x
8119>&0	der	int3=010001	DER Encoded Key Pair, 2048 bits
8120
81210	der	seq
8122>&0	der	int1=00
8123>&0	der	int513=x
8124>&0	der	int3=010001	DER Encoded Key Pair, 4096 bits
8125
81260	der	seq
8127>&0	der	int1=00
8128>&0	der	int1025=x
8129>&0	der	int3=010001	DER Encoded Key Pair, 8192 bits
8130
81310	der	seq
8132>&0	der	int1=00
8133>&0	der	int2049=x
8134>&0	der	int3=010001	DER Encoded Key Pair, 16k bits
8135
81360	der	seq
8137>&0	der	int1=00
8138>&0	der	int4097=x
8139>&0	der	int3=010001	DER Encoded Key Pair, 32k bits
8140
8141# Certificates
81420	der	seq
8143>&0	der	seq
8144>>&0	der	int2=0dfa	DER Encoded Certificate, 512 bits
8145>>&0	der	int2=0dfb	DER Encoded Certificate, 1024 bits
8146>>&0	der	int2=0dfc	DER Encoded Certificate, 2048 bits
8147>>&0	der	int2=0dfd	DER Encoded Certificate, 4096 bits
8148>>&0	der	int2=0dfe	DER Encoded Certificate, 8192 bits
8149>>&0	der	int2=0dff	DER Encoded Certificate, 16k bits
8150>>&0	der	int2=0e04	DER Encoded Certificate, 32k bits
8151>>&0	der	int2=x		DER Encoded Certificate, ? bits (%s)
8152>>&0	der	seq
8153>>>&0	der	obj_id9=2a864886f70d010105	\b, sha1WithRSAEncryption
8154>>>&0	der	obj_id9=x			\b, ? Encryption (%s)
8155>>>&0	der	null
8156>>&0	der	seq
8157>>>&0	der	set
8158>>>>&0	der	seq
8159>>>>>&0	der	obj_id3=550406
8160>>>>>&0	der	prt_str=x	\b, countryName=%s
8161>>>&0	der	set
8162>>>>&0	der	seq
8163>>>>>&0	der	obj_id3=550408
8164>>>>>&0	der	prt_str=x	\b, stateOrProvinceName=%s
8165>>>&0	der	set
8166>>>>&0	der	seq
8167>>>>>&0	der	obj_id3=550407
8168>>>>>&0	der	prt_str=x	\b, localityName=%s
8169>>>&0	der	set
8170>>>>&0	der	seq
8171>>>>>&0	der	obj_id3=55040a
8172>>>>>&0	der	prt_str=x	\b, organizationName=%s
8173>>>&0	der	set
8174>>>>&0	der	seq
8175>>>>>&0	der	obj_id3=55040b
8176>>>>>&0	der	prt_str=x	\b, organizationUnitName=%s
8177>>>&0	der	set
8178>>>>&0	der	seq
8179>>>>>&0	der	obj_id3=550403
8180>>>>>&0	der	prt_str=x	\b, commonName=%s
8181>>>&0	der	set
8182>>>>&0	der	seq
8183>>>>>&0	der	obj_id9=2a864886f70d010901
8184>>>>>&0	der	ia5_str=x	\b, emailAddress=%s
8185>>&0	der	seq
8186>>>&0	der	utc_time=x	\b, utcTime=%s
8187>>>&0	der	utc_time=x	\b, utcTime=%s
8188>>&0	use	certinfo
8189
8190#------------------------------------------------------------------------------
8191# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
8192# diamond:  file(1) magic for Diamond system
8193#
8194# ... diamond is a multi-media mail and electronic conferencing system....
8195#
8196# XXX - I think it was either renamed Slate, or replaced by Slate....
8197#
8198#	The full deal is too long...
8199#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
82000	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
8201
8202#------------------------------------------------------------------------------
8203# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
8204# diff:  file(1) magic for diff(1) output
8205#
82060	search/1	diff\040	diff output text
8207!:mime	text/x-diff
82080	search/1	***\040 	diff output text
8209!:mime	text/x-diff
82100	search/1	Only\040in\040 	diff output text
8211!:mime	text/x-diff
82120	search/1	Common\040subdirectories:\040 	diff output text
8213!:mime	text/x-diff
8214
82150	search/1	Index:		RCS/CVS diff output text
8216!:mime	text/x-diff
8217
8218# bsdiff:  file(1) magic for bsdiff(1) output
82190	string/b		BSDIFF40	bsdiff(1) patch file
8220
8221
8222# unified diff
82230	search/4096	---\040
8224>&0	search/1024 \n
8225>>&0	search/1 +++\040
8226>>>&0	search/1024 \n
8227>>>>&0	search/1 @@	unified diff output text
8228!:mime	text/x-diff
8229!:strength + 90
8230
8231# librsync -- the library for network deltas
8232#
8233# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
8234# this file.
8235#
82360	belong		0x72730236	rdiff network-delta data
8237
82380	belong		0x72730136	rdiff network-delta signature data
8239>4	belong		x		(block length=%d,
8240>8	belong		x		signature strength=%d)
8241
8242#------------------------------------------------------------------------------
8243# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
8244#  Digital UNIX - Info
8245#
82460	string	=!<arch>\n________64E	Alpha archive
8247>22	string	X			-- out of date
8248#
8249
82500	leshort		0603
8251>24	leshort		0410		COFF format alpha pure
8252>24	leshort		0413		COFF format alpha demand paged
8253>>22	leshort&030000	!020000		executable
8254>>22	leshort&020000	!0		dynamically linked
8255>>16	lelong		!0		not stripped
8256>>16	lelong		0		stripped
8257>>27	byte		x		- version %d
8258>>26	byte		x		\b.%d
8259>>28	byte		x		\b-%d
8260>24	leshort		0407		COFF format alpha object
8261>>22	leshort&030000	020000		shared library
8262>>27	byte		x		- version %d
8263>>26	byte		x		\b.%d
8264>>28	byte		x		\b-%d
8265
8266# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
8267#
8268# The actual magic number is just "Core", followed by a 2-byte version
8269# number; however, treating any file that begins with "Core" as a Digital
8270# UNIX core dump file may produce too many false hits, so we include one
8271# byte of the version number as well; DU 5.0 appears only to be up to
8272# version 2.
8273#
82740	string		Core\001	Alpha COFF format core dump (Digital UNIX)
8275>24	string		>\0		\b, from '%s'
82760	string		Core\002	Alpha COFF format core dump (Digital UNIX)
8277>24	string		>\0		\b, from '%s'
8278#
8279# The next is incomplete, we could tell more about this format,
8280# but its not worth it.
82810	leshort		0x188	Alpha compressed COFF
82820	leshort		0x18f	Alpha u-code object
8283#
8284#
8285# Some other interesting Digital formats,
82860	string	\377\377\177		ddis/ddif
82870	string	\377\377\174		ddis/dots archive
82880	string	\377\377\176		ddis/dtif table data
82890	string	\033c\033		LN03 output
82900	long	04553207		X image
8291#
82920	string	=!<PDF>!\n		profiling data file
8293#
8294# Locale data tables (MIPS and Alpha).
8295#
82960	short		0x0501		locale data table
8297>6	short		0x24		for MIPS
8298>6	short		0x40		for Alpha
8299
8300#------------------------------------------------------------------------------
8301# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $
8302# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
8303# from http://www.atsc.org/standards/a_52a.pdf
8304# corrections, additions, etc. are always welcome!
8305#
8306# syncword
83070	beshort		0x0b77	ATSC A/52 aka AC-3 aka Dolby Digital stream,
8308# Proposed audio/ac3 RFC/4184
8309!:mime	audio/vnd.dolby.dd-raw
8310# fscod
8311>4	byte&0xc0 = 0x00	48 kHz,
8312>4	byte&0xc0 = 0x40	44.1 kHz,
8313>4	byte&0xc0 = 0x80	32 kHz,
8314# is this one used for 96 kHz?
8315>4	byte&0xc0 = 0xc0	reserved frequency,
8316#
8317>5	byte&0x07 = 0x00	\b, complete main (CM)
8318>5	byte&0x07 = 0x01	\b, music and effects (ME)
8319>5	byte&0x07 = 0x02	\b, visually impaired (VI)
8320>5	byte&0x07 = 0x03	\b, hearing impaired (HI)
8321>5	byte&0x07 = 0x04	\b, dialogue (D)
8322>5	byte&0x07 = 0x05	\b, commentary (C)
8323>5	byte&0x07 = 0x06	\b, emergency (E)
8324>5	beshort&0x07e0  0x0720	\b, voiceover (VO)
8325>5	beshort&0x07e0 >0x0720	\b, karaoke
8326# acmod
8327>6	byte&0xe0 = 0x00	1+1 front,
8328>>6	byte&0x10 = 0x10	LFE on,
8329>6	byte&0xe0 = 0x20	1 front/0 rear,
8330>>6	byte&0x10 = 0x10	LFE on,
8331>6	byte&0xe0 = 0x40	2 front/0 rear,
8332# dsurmod (for stereo only)
8333>>6	byte&0x18 = 0x00	Dolby Surround not indicated
8334>>6	byte&0x18 = 0x08	not Dolby Surround encoded
8335>>6	byte&0x18 = 0x10	Dolby Surround encoded
8336>>6	byte&0x18 = 0x18	reserved Dolby Surround mode
8337>>6	byte&0x04 = 0x04	LFE on,
8338>6	byte&0xe0 = 0x60	3 front/0 rear,
8339>>6	byte&0x04 = 0x04	LFE on,
8340>6	byte&0xe0 = 0x80	2 front/1 rear,
8341>>6	byte&0x04 = 0x04	LFE on,
8342>6	byte&0xe0 = 0xa0	3 front/1 rear,
8343>>6	byte&0x01 = 0x01	LFE on,
8344>6	byte&0xe0 = 0xc0	2 front/2 rear,
8345>>6	byte&0x04 = 0x04	LFE on,
8346>6	byte&0xe0 = 0xe0	3 front/2 rear,
8347>>6	byte&0x01 = 0x01	LFE on,
8348#
8349>4	byte&0x3e = 0x00	\b, 32 kbit/s
8350>4	byte&0x3e = 0x02	\b, 40 kbit/s
8351>4	byte&0x3e = 0x04	\b, 48 kbit/s
8352>4	byte&0x3e = 0x06	\b, 56 kbit/s
8353>4	byte&0x3e = 0x08	\b, 64 kbit/s
8354>4	byte&0x3e = 0x0a	\b, 80 kbit/s
8355>4	byte&0x3e = 0x0c	\b, 96 kbit/s
8356>4	byte&0x3e = 0x0e	\b, 112 kbit/s
8357>4	byte&0x3e = 0x10	\b, 128 kbit/s
8358>4	byte&0x3e = 0x12	\b, 160 kbit/s
8359>4	byte&0x3e = 0x14	\b, 192 kbit/s
8360>4	byte&0x3e = 0x16	\b, 224 kbit/s
8361>4	byte&0x3e = 0x18	\b, 256 kbit/s
8362>4	byte&0x3e = 0x1a	\b, 320 kbit/s
8363>4	byte&0x3e = 0x1c	\b, 384 kbit/s
8364>4	byte&0x3e = 0x1e	\b, 448 kbit/s
8365>4	byte&0x3e = 0x20	\b, 512 kbit/s
8366>4	byte&0x3e = 0x22	\b, 576 kbit/s
8367>4	byte&0x3e = 0x24	\b, 640 kbit/s
8368
8369#------------------------------------------------------------------------------
8370# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $
8371# dump:  file(1) magic for dump file format--for new and old dump filesystems
8372#
8373# We specify both byte orders in order to recognize byte-swapped dumps.
8374#
83750	name	new-dump-be
8376>4	bedate	x		This dump %s,
8377>8	bedate	x		Previous dump %s,
8378>12	belong	>0		Volume %d,
8379>692	belong	0		Level zero, type:
8380>692	belong	>0		Level %d, type:
8381>0	belong	1		tape header,
8382>0	belong	2		beginning of file record,
8383>0	belong	3		map of inodes on tape,
8384>0	belong	4		continuation of file record,
8385>0	belong	5		end of volume,
8386>0	belong	6		map of inodes deleted,
8387>0	belong	7		end of medium (for floppy),
8388>676	string	>\0		Label %s,
8389>696	string	>\0		Filesystem %s,
8390>760	string	>\0		Device %s,
8391>824	string	>\0		Host %s,
8392>888	belong	>0		Flags %x
8393
83940	name	old-dump-be
8395#>4	bedate	x		This dump %s,
8396#>8	bedate	x		Previous dump %s,
8397>12	belong	>0		Volume %d,
8398>692	belong	0		Level zero, type:
8399>692	belong	>0		Level %d, type:
8400>0	belong	1		tape header,
8401>0	belong	2		beginning of file record,
8402>0	belong	3		map of inodes on tape,
8403>0	belong	4		continuation of file record,
8404>0	belong	5		end of volume,
8405>0	belong	6		map of inodes deleted,
8406>0	belong	7		end of medium (for floppy),
8407>676	string	>\0		Label %s,
8408>696	string	>\0		Filesystem %s,
8409>760	string	>\0		Device %s,
8410>824	string	>\0		Host %s,
8411>888	belong	>0		Flags %x
8412
84130	name	ufs2-dump-be
8414>896	beqdate	x		This dump %s,
8415>904	beqdate	x		Previous dump %s,
8416>12	belong	>0		Volume %d,
8417>692	belong	0		Level zero, type:
8418>692	belong	>0		Level %d, type:
8419>0	belong	1		tape header,
8420>0	belong	2		beginning of file record,
8421>0	belong	3		map of inodes on tape,
8422>0	belong	4		continuation of file record,
8423>0	belong	5		end of volume,
8424>0	belong	6		map of inodes deleted,
8425>0	belong	7		end of medium (for floppy),
8426>676	string	>\0		Label %s,
8427>696	string	>\0		Filesystem %s,
8428>760	string	>\0		Device %s,
8429>824	string	>\0		Host %s,
8430>888	belong	>0		Flags %x
8431
843224	belong	60012		new-fs dump file (big endian),
8433>0	use	new-dump-be
8434
843524	belong	60011		old-fs dump file (big endian),
8436>0	use	old-dump-be
8437
843824	lelong	60012		new-fs dump file (little endian),
8439# to correctly recognize '*.mo' GNU message catalog (little endian)
8440!:strength - 15
8441>0	use	\^new-dump-be
8442
844324	lelong	60011		old-fs dump file (little endian),
8444>0	use	\^old-dump-be
8445
8446
844724	belong	0x19540119	new-fs dump file (ufs2, big endian),
8448>0	use	ufs2-dump-be
8449
845024	lelong	0x19540119	new-fs dump file (ufs2, little endian),
8451>0	use	\^ufs2-dump-be
8452
845318	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
8454>2	medate	x		Previous dump %s,
8455>6	medate	x		This dump %s,
8456>10	leshort	>0		Volume %d,
8457>0	leshort	1		tape header.
8458>0	leshort	2		beginning of file record.
8459>0	leshort	3		map of inodes on tape.
8460>0	leshort	4		continuation of file record.
8461>0	leshort	5		end of volume.
8462>0	leshort	6		map of inodes deleted.
8463>0	leshort	7		end of medium (for floppy).
8464
8465#------------------------------------------------------------------------------
8466# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $
8467# Dyadic: file(1) magic for Dyalog APL.
8468#
8469# updated by Joerg Jenderek at Oct 2013
8470# http://en.wikipedia.org/wiki/Dyalog_APL
8471# http://www.dyalog.com/
8472# .DXV Dyalog APL External Variable
8473# .DIN Dyalog APL Input Table
8474# .DOT Dyalog APL Output Table
8475# .DFT Dyalog APL Format File
84760	ubeshort&0xFF60	0xaa00
8477# skip biblio.dbt
8478>1	byte		!4
8479# real Dyalog APL have non zero version numbers like 7.3 or 13.4
8480>>2	ubeshort	>0x0000		Dyalog APL
8481>>>1	byte		0x00		aplcore
8482#>>>1	byte		0x00		incomplete workspace
8483# *.DCF Dyalog APL Component File
8484>>>1	byte		0x01		component file 32-bit non-journaled non-checksummed
8485#>>>1	byte		0x01		component file
8486>>>1	byte		0x02		external variable exclusive
8487#>>>1	byte		0x02		external variable
8488# *.DWS Dyalog APL Workspace
8489>>>1	byte		0x03		workspace
8490>>>>7	byte&0x28	0x00		32-bit
8491>>>>7	byte&0x28	0x20		64-bit
8492>>>>7	byte&0x0c	0x00		classic
8493>>>>7	byte&0x0c	0x04		unicode
8494>>>>7	byte&0x88	0x00		big-endian
8495>>>>7	byte&0x88	0x80		little-endian
8496>>>1	byte		0x06		external variable shared
8497# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
8498>>>1	byte		0x07		session
8499>>>1	byte		0x08		mapped file 32-bit
8500>>>1	byte		0x09		component file 64-bit non-journaled non-checksummed
8501>>>1	byte		0x0a		mapped file 64-bit
8502>>>1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
8503>>>1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
8504>>>1	byte		0x0d		component file 32-bit level 1 journaled checksummed
8505>>>1	byte		0x0e		component file 64-bit level 1 journaled checksummed
8506>>>1	byte		0x0f		component file 32-bit level 2 journaled checksummed
8507>>>1	byte		0x10		component file 64-bit level 2 journaled checksummed
8508>>>1	byte		0x11		component file 32-bit level 3 journaled checksummed
8509>>>1	byte		0x12		component file 64-bit level 3 journaled checksummed
8510>>>1	byte		0x13		component file 32-bit non-journaled checksummed
8511>>>1	byte		0x14		component file 64-bit non-journaled checksummed
8512>>>1	byte		0x15		component file under construction
8513>>>1	byte		0x16		DFS component file 64-bit level 1 journaled checksummed
8514>>>1	byte		0x17		DFS component file 64-bit level 2 journaled checksummed
8515>>>1	byte		0x18		DFS component file 64-bit level 3 journaled checksummed
8516>>>1	byte		0x19		external workspace
8517>>>1	byte		0x80		DDB
8518>>>2	byte		x		version %d
8519>>>3	byte		x		\b.%d
8520#>>>2	byte		x		type %d
8521#>>>3	byte		x		subtype %d
8522
8523# *.DXF Dyalog APL Transfer File
85240	short		0x6060		Dyalog APL transfer
8525
8526#------------------------------------------------------------------------------
8527# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $
8528# ebml:  file(1) magic for various Extensible Binary Meta Language
8529# http://www.matroska.org/technical/specs/index.html#track
85300	belong	0x1a45dfa3	EBML file
8531>4	search/b/100	\102\202
8532>>&1	string	x		\b, creator %.8s
8533
8534#------------------------------------------------------------------------------
8535# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
8536# T602 editor documents
8537# by David Necas <yeti@physics.muni.cz>
85380	string	@CT\ 	T602 document data,
8539>4	string	0	Kamenicky
8540>4	string	1	CP 852
8541>4	string	2	KOI8-CS
8542>4	string	>2	unknown encoding
8543
8544# Vi IMproved Encrypted file
8545# by David Necas <yeti@physics.muni.cz>
85460	string	VimCrypt~	Vim encrypted file data
8547
85480	name	vimnanoswap
8549>67	byte	0
8550>>107	byte	0
8551#>>>2	string	x	%s swap file
8552>>>24	ulelong	x	\b, pid %d
8553>>>28	string	>\0	\b, user %s
8554>>>68	string	>\0	\b, host %s
8555>>>108	string	>\0	\b, file %s
8556>>>1007	byte	0x55	\b, modified
8557
8558# Vi IMproved Swap file
8559# by Sven Wegener <swegener@gentoo.org>
85600	string  b0VIM\ 		Vim swap file
8561>&0	string  >\0		\b, version %s
8562>0	use	vimnanoswap
8563
8564
8565# Lock/swap file for several editors, at least
8566# Vi IMproved and nano
85670	string	b0nano		Nano swap file
8568>0	use	vimnanoswap
8569
8570# kate (K Advanced Text Editor)
85710	string	\x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00	Kate swap file
8572
8573#------------------------------------------------------------------------------
8574# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
8575# efi:  file(1) magic for Universal EFI binaries
8576
85770	lelong	0x0ef1fab9
8578>4	lelong	1		Universal EFI binary with 1 architecture
8579>>&0	lelong	7		\b, i386
8580>>&0	lelong	0x01000007	\b, x86_64
8581>4	lelong	2		Universal EFI binary with 2 architectures
8582>>&0	lelong	7		\b, i386
8583>>&0	lelong	0x01000007	\b, x86_64
8584>>&20	lelong	7		\b, i386
8585>>&20	lelong	0x01000007	\b, x86_64
8586>4	lelong	>2		Universal EFI binary with %d architectures
8587
8588#------------------------------------------------------------------------------
8589# $File: elf,v 1.74 2018/06/23 16:39:53 christos Exp $
8590# elf:  file(1) magic for ELF executables
8591#
8592# We have to check the byte order flag to see what byte order all the
8593# other stuff in the header is in.
8594#
8595# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
8596#
8597# Created by: unknown
8598# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com>
8599# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support)
8600# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support)
8601# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium)
8602# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures)
8603
86040	name		elf-mips
8605>0	lelong&0xf0000000	0x00000000	MIPS-I
8606>0	lelong&0xf0000000	0x10000000	MIPS-II
8607>0	lelong&0xf0000000	0x20000000	MIPS-III
8608>0	lelong&0xf0000000	0x30000000	MIPS-IV
8609>0	lelong&0xf0000000	0x40000000	MIPS-V
8610>0	lelong&0xf0000000	0x50000000	MIPS32
8611>0	lelong&0xf0000000	0x60000000	MIPS64
8612>0	lelong&0xf0000000	0x70000000	MIPS32 rel2
8613>0	lelong&0xf0000000	0x80000000	MIPS64 rel2
8614>0	lelong&0xf0000000	0x90000000	MIPS32 rel6
8615>0	lelong&0xf0000000	0xa0000000	MIPS64 rel6
8616
86170	name		elf-sparc
8618>0	lelong&0x00ffff00	0x00000100	V8+ Required,
8619>0	lelong&0x00ffff00	0x00000200	Sun UltraSPARC1 Extensions Required,
8620>0	lelong&0x00ffff00	0x00000400	HaL R1 Extensions Required,
8621>0	lelong&0x00ffff00	0x00000800	Sun UltraSPARC3 Extensions Required,
8622>0	lelong&0x3		0		total store ordering,
8623>0	lelong&0x3		1		partial store ordering,
8624>0	lelong&0x3		2		relaxed memory ordering,
8625
86260	name		elf-pa-risc
8627>2	leshort		0x0214		2.0
8628>0	leshort		&0x0008		(LP64)
8629
86300	name		elf-le
8631>16	leshort		0		no file type,
8632!:mime	application/octet-stream
8633>16	leshort		1		relocatable,
8634!:mime	application/x-object
8635>16	leshort		2		executable,
8636!:mime	application/x-executable
8637>16	leshort		3		${x?pie executable:shared object},
8638
8639!:mime	application/x-${x?pie-executable:sharedlib}
8640>16	leshort		4		core file,
8641!:mime	application/x-coredump
8642# OS-specific
8643>7	byte		202
8644>>16	leshort		0xFE01		executable,
8645!:mime	application/x-executable
8646# Core file detection is not reliable.
8647#>>>(0x38+0xcc) string	>\0		of '%s'
8648#>>>(0x38+0x10) lelong	>0		(signal %d),
8649>16	leshort		&0xff00		processor-specific,
8650>18	clear		x
8651>18	leshort		0		no machine,
8652>18	leshort		1		AT&T WE32100,
8653>18	leshort		2		SPARC,
8654>18	leshort		3		Intel 80386,
8655>18	leshort		4		Motorola m68k,
8656>>4	byte		1
8657>>>36	lelong		&0x01000000	68000,
8658>>>36	lelong		&0x00810000	CPU32,
8659>>>36	lelong		0		68020,
8660>18	leshort		5		Motorola m88k,
8661>18	leshort		6		Intel 80486,
8662>18	leshort		7		Intel 80860,
8663# The official e_machine number for MIPS is now #8, regardless of endianness.
8664# The second number (#10) will be deprecated later. For now, we still
8665# say something if #10 is encountered, but only gory details for #8.
8666>18	leshort		8		MIPS,
8667>>4	byte		1
8668>>>36	lelong		&0x20		N32
8669>18	leshort		10		MIPS,
8670>>4	byte		1
8671>>>36	lelong		&0x20		N32
8672>18	leshort		8
8673# only for 32-bit
8674>>4	byte		1
8675>>>36	use		elf-mips
8676# only for 64-bit
8677>>4	byte		2
8678>>>48	use		elf-mips
8679>18	leshort		9		Amdahl,
8680>18	leshort		10		MIPS (deprecated),
8681>18	leshort		11		RS6000,
8682>18	leshort		15		PA-RISC,
8683# only for 32-bit
8684>>4	byte		1
8685>>>36	use		elf-pa-risc
8686# only for 64-bit
8687>>4	byte		2
8688>>>48	use		elf-pa-risc
8689>18	leshort		16		nCUBE,
8690>18	leshort		17		Fujitsu VPP500,
8691>18	leshort		18		SPARC32PLUS,
8692# only for 32-bit
8693>>4	byte		1
8694>>>36	use		elf-sparc
8695>18	leshort		19		Intel 80960,
8696>18	leshort		20		PowerPC or cisco 4500,
8697>18	leshort		21		64-bit PowerPC or cisco 7500,
8698>18	leshort		22		IBM S/390,
8699>18	leshort		23		Cell SPU,
8700>18	leshort		24		cisco SVIP,
8701>18	leshort		25		cisco 7200,
8702>18	leshort		36		NEC V800 or cisco 12000,
8703>18	leshort		37		Fujitsu FR20,
8704>18	leshort		38		TRW RH-32,
8705>18	leshort		39		Motorola RCE,
8706>18	leshort		40		ARM,
8707>>4	byte		1
8708>>>36	lelong&0xff000000	0x04000000	EABI4
8709>>>36	lelong&0xff000000	0x05000000	EABI5
8710>>>36	lelong		&0x00800000	BE8
8711>>>36	lelong		&0x00400000	LE8
8712>18	leshort		41		Alpha,
8713>18	leshort		42		Renesas SH,
8714>18	leshort		43		SPARC V9,
8715>>4	byte		2
8716>>>48	use		elf-sparc
8717>18	leshort		44		Siemens Tricore Embedded Processor,
8718>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
8719>18	leshort		46		Renesas H8/300,
8720>18	leshort		47		Renesas H8/300H,
8721>18	leshort		48		Renesas H8S,
8722>18	leshort		49		Renesas H8/500,
8723>18	leshort		50		IA-64,
8724>18	leshort		51		Stanford MIPS-X,
8725>18	leshort		52		Motorola Coldfire,
8726>18	leshort		53		Motorola M68HC12,
8727>18	leshort		54		Fujitsu MMA,
8728>18	leshort		55		Siemens PCP,
8729>18	leshort		56		Sony nCPU,
8730>18	leshort		57		Denso NDR1,
8731>18	leshort		58		Start*Core,
8732>18	leshort		59		Toyota ME16,
8733>18	leshort		60		ST100,
8734>18	leshort		61		Tinyj emb.,
8735>18	leshort		62		x86-64,
8736>18	leshort		63		Sony DSP,
8737>18	leshort		64		DEC PDP-10,
8738>18	leshort		65		DEC PDP-11,
8739>18	leshort		66		FX66,
8740>18	leshort		67		ST9+ 8/16 bit,
8741>18	leshort		68		ST7 8 bit,
8742>18	leshort		69		MC68HC16,
8743>18	leshort		70		MC68HC11,
8744>18	leshort		71		MC68HC08,
8745>18	leshort		72		MC68HC05,
8746>18	leshort		73		SGI SVx or Cray NV1,
8747>18	leshort		74		ST19 8 bit,
8748>18	leshort		75		Digital VAX,
8749>18	leshort		76		Axis cris,
8750>18	leshort		77		Infineon 32-bit embedded,
8751>18	leshort		78		Element 14 64-bit DSP,
8752>18	leshort		79		LSI Logic 16-bit DSP,
8753>18	leshort		80		MMIX,
8754>18	leshort		81		Harvard machine-independent,
8755>18	leshort		82		SiTera Prism,
8756>18	leshort		83		Atmel AVR 8-bit,
8757>18	leshort		84		Fujitsu FR30,
8758>18	leshort		85		Mitsubishi D10V,
8759>18	leshort		86		Mitsubishi D30V,
8760>18	leshort		87		NEC v850,
8761>18	leshort		88		Renesas M32R,
8762>18	leshort		89		Matsushita MN10300,
8763>18	leshort		90		Matsushita MN10200,
8764>18	leshort		91		picoJava,
8765>18	leshort		92		OpenRISC,
8766>18	leshort		93		ARC Cores Tangent-A5,
8767>18	leshort		94		Tensilica Xtensa,
8768>18	leshort		95		Alphamosaic VideoCore,
8769>18	leshort		96		Thompson Multimedia,
8770>18	leshort		97		NatSemi 32k,
8771>18	leshort		98		Tenor Network TPC,
8772>18	leshort		99		Trebia SNP 1000,
8773>18	leshort		100		STMicroelectronics ST200,
8774>18	leshort		101		Ubicom IP2022,
8775>18	leshort		102		MAX Processor,
8776>18	leshort		103		NatSemi CompactRISC,
8777>18	leshort		104		Fujitsu F2MC16,
8778>18	leshort		105		TI msp430,
8779>18	leshort		106		Analog Devices Blackfin,
8780>18	leshort		107		S1C33 Family of Seiko Epson,
8781>18	leshort		108		Sharp embedded,
8782>18	leshort		109		Arca RISC,
8783>18	leshort		110		PKU-Unity Ltd.,
8784>18	leshort		111		eXcess: 16/32/64-bit,
8785>18	leshort		112		Icera Deep Execution Processor,
8786>18	leshort		113		Altera Nios II,
8787>18	leshort		114		NatSemi CRX,
8788>18	leshort		115		Motorola XGATE,
8789>18	leshort		116		Infineon C16x/XC16x,
8790>18	leshort		117		Renesas M16C series,
8791>18	leshort		118		Microchip dsPIC30F,
8792>18	leshort		119		Freescale RISC core,
8793>18	leshort		120		Renesas M32C series,
8794>18	leshort		131		Altium TSK3000 core,
8795>18	leshort		132		Freescale RS08,
8796>18	leshort		134		Cyan Technology eCOG2,
8797>18	leshort		135		Sunplus S+core7 RISC,
8798>18	leshort		136		New Japan Radio (NJR) 24-bit DSP,
8799>18	leshort		137		Broadcom VideoCore III,
8800>18	leshort		138		LatticeMico32,
8801>18	leshort		139		Seiko Epson C17 family,
8802>18	leshort		140		TI TMS320C6000 DSP family,
8803>18	leshort		141		TI TMS320C2000 DSP family,
8804>18	leshort		142		TI TMS320C55x DSP family,
8805>18	leshort		160		STMicroelectronics 64bit VLIW DSP,
8806>18	leshort		161		Cypress M8C,
8807>18	leshort		162		Renesas R32C series,
8808>18	leshort		163		NXP TriMedia family,
8809>18	leshort		164		QUALCOMM DSP6,
8810>18	leshort		165		Intel 8051 and variants,
8811>18	leshort		166		STMicroelectronics STxP7x family,
8812>18	leshort		167		Andes embedded RISC,
8813>18	leshort		168		Cyan eCOG1X family,
8814>18	leshort		169		Dallas MAXQ30,
8815>18	leshort		170		New Japan Radio (NJR) 16-bit DSP,
8816>18	leshort		171		M2000 Reconfigurable RISC,
8817>18	leshort		172		Cray NV2 vector architecture,
8818>18	leshort		173		Renesas RX family,
8819>18	leshort		174		META,
8820>18	leshort		175		MCST Elbrus,
8821>18	leshort		176		Cyan Technology eCOG16 family,
8822>18	leshort		177		NatSemi CompactRISC,
8823>18	leshort		178		Freescale Extended Time Processing Unit,
8824>18	leshort		179		Infineon SLE9X,
8825>18	leshort		180		Intel L1OM,
8826>18	leshort		181		Intel K1OM,
8827>18	leshort		183		ARM aarch64,
8828>18	leshort		185		Atmel 32-bit family,
8829>18	leshort		186		STMicroeletronics STM8 8-bit,
8830>18	leshort		187		Tilera TILE64,
8831>18	leshort		188		Tilera TILEPro,
8832>18	leshort		189		Xilinx MicroBlaze 32-bit RISC,
8833>18	leshort		190		NVIDIA CUDA architecture,
8834>18	leshort		191		Tilera TILE-Gx,
8835>18	leshort		197		Renesas RL78 family,
8836>18	leshort		199		Renesas 78K0R,
8837>18	leshort		200		Freescale 56800EX,
8838>18	leshort		201		Beyond BA1,
8839>18	leshort		202		Beyond BA2,
8840>18	leshort		203		XMOS xCORE,
8841>18	leshort		204		Microchip 8-bit PIC(r),
8842>18	leshort		210		KM211 KM32,
8843>18	leshort		211		KM211 KMX32,
8844>18	leshort		212		KM211 KMX16,
8845>18	leshort		213		KM211 KMX8,
8846>18	leshort		214		KM211 KVARC,
8847>18	leshort		215		Paneve CDP,
8848>18	leshort		216		Cognitive Smart Memory,
8849>18	leshort		217		iCelero CoolEngine,
8850>18	leshort		218		Nanoradio Optimized RISC,
8851>18	leshort		243		UCB RISC-V,
8852>18	leshort		0x1057		AVR (unofficial),
8853>18	leshort		0x1059		MSP430 (unofficial),
8854>18	leshort		0x1223		Adapteva Epiphany (unofficial),
8855>18	leshort		0x2530		Morpho MT (unofficial),
8856>18	leshort		0x3330		FR30 (unofficial),
8857>18	leshort		0x3426		OpenRISC (obsolete),
8858>18	leshort		0x4688		Infineon C166 (unofficial),
8859>18	leshort		0x5441		Cygnus FRV (unofficial),
8860>18	leshort		0x5aa5		DLX (unofficial),
8861>18	leshort		0x7650		Cygnus D10V (unofficial),
8862>18	leshort		0x7676		Cygnus D30V (unofficial),
8863>18	leshort		0x8217		Ubicom IP2xxx (unofficial),
8864>18	leshort		0x8472		OpenRISC (obsolete),
8865>18	leshort		0x9025		Cygnus PowerPC (unofficial),
8866>18	leshort		0x9026		Alpha (unofficial),
8867>18	leshort		0x9041		Cygnus M32R (unofficial),
8868>18	leshort		0x9080		Cygnus V850 (unofficial),
8869>18	leshort		0xa390		IBM S/390 (obsolete),
8870>18	leshort		0xabc7		Old Xtensa (unofficial),
8871>18	leshort		0xad45		xstormy16 (unofficial),
8872>18	leshort		0xbaab		Old MicroBlaze (unofficial),,
8873>18	leshort		0xbeef		Cygnus MN10300 (unofficial),
8874>18	leshort		0xdead		Cygnus MN10200 (unofficial),
8875>18	leshort		0xf00d		Toshiba MeP (unofficial),
8876>18	leshort		0xfeb0		Renesas M32C (unofficial),
8877>18	leshort		0xfeba		Vitesse IQ2000 (unofficial),
8878>18	leshort		0xfebb		NIOS (unofficial),
8879>18	leshort		0xfeed		Moxie (unofficial),
8880>18	default		x
8881>>18	leshort		x		*unknown arch 0x%x*
8882>20	lelong		0		invalid version
8883>20	lelong		1		version 1
8884
88850	string		\177ELF		ELF
8886!:strength *2
8887>4	byte		0		invalid class
8888>4	byte		1		32-bit
8889>4	byte		2		64-bit
8890>5	byte		0		invalid byte order
8891>5	byte		1		LSB
8892>>0	use		elf-le
8893>5	byte		2		MSB
8894>>0	use		\^elf-le
8895>7	byte		0		(SYSV)
8896>7	byte		1		(HP-UX)
8897>7	byte		2		(NetBSD)
8898>7	byte		3		(GNU/Linux)
8899>7	byte		4		(GNU/Hurd)
8900>7	byte		5		(86Open)
8901>7	byte		6		(Solaris)
8902>7	byte		7		(Monterey)
8903>7	byte		8		(IRIX)
8904>7	byte		9		(FreeBSD)
8905>7	byte		10		(Tru64)
8906>7	byte		11		(Novell Modesto)
8907>7	byte		12		(OpenBSD)
8908>7	byte		13		(OpenVMS)
8909>7	byte		14		(HP NonStop Kernel)
8910>7	byte		15		(AROS Research Operating System)
8911>7	byte		16		(FenixOS)
8912>7	byte		17		(Nuxi CloudABI)
8913>7	byte		97		(ARM)
8914>7	byte		202		(Cafe OS)
8915>7	byte		255		(embedded)
8916
8917#------------------------------------------------------------------------------
8918# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
8919# encore:  file(1) magic for Encore machines
8920#
8921# XXX - needs to have the byte order specified (NS32K was little-endian,
8922# dunno whether they run the 88K in little-endian mode or not).
8923#
89240	short		0x154		Encore
8925>20	short		0x107		executable
8926>20	short		0x108		pure executable
8927>20	short		0x10b		demand-paged executable
8928>20	short		0x10f		unsupported executable
8929>12	long		>0		not stripped
8930>22	short		>0		- version %d
8931>22	short		0		-
8932#>4	date		x		stamp %s
89330	short		0x155		Encore unsupported executable
8934>12	long		>0		not stripped
8935>22	short		>0		- version %d
8936>22	short		0		-
8937#>4	date		x		stamp %s
8938
8939#------------------------------------------------------------------------------
8940# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
8941# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
8942# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
8943# Useful information for improving this file can be found at:
8944# http://software.frodo.looijaard.name/psiconv/formats/Index.html
8945#------------------------------------------------------------------------------
89460	lelong		0x10000037	Psion Series 5
8947>4	lelong		0x10000039	font file
8948>4	lelong		0x1000003A	printer driver
8949>4	lelong		0x1000003B	clipboard
8950>4	lelong		0x10000042	multi-bitmap image
8951!:mime image/x-epoc-mbm
8952>4	lelong		0x1000006A	application information file
8953>4	lelong		0x1000006D
8954>>8	lelong		0x1000007D	Sketch image
8955!:mime image/x-epoc-sketch
8956>>8	lelong		0x1000007E	voice note
8957>>8	lelong		0x1000007F	Word file
8958!:mime application/x-epoc-word
8959>>8	lelong		0x10000085	OPL program (TextEd)
8960!:mime application/x-epoc-opl
8961>>8	lelong		0x10000087	Comms settings
8962>>8	lelong		0x10000088	Sheet file
8963!:mime application/x-epoc-sheet
8964>>8	lelong		0x100001C4	EasyFax initialisation file
8965>4	lelong		0x10000073	OPO module
8966!:mime application/x-epoc-opo
8967>4	lelong		0x10000074	OPL application
8968!:mime application/x-epoc-app
8969>4	lelong		0x1000008A	exported multi-bitmap image
8970>4	lelong		0x1000016D
8971>>8	lelong		0x10000087	Comms names
8972
89730	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
8974
89750	lelong		0x10000050	Psion Series 5
8976>4	lelong		0x1000006D	database
8977>>8	lelong		0x10000084	Agenda file
8978!:mime application/x-epoc-agenda
8979>>8	lelong		0x10000086	Data file
8980!:mime application/x-epoc-data
8981>>8	lelong		0x10000CEA	Jotter file
8982!:mime application/x-epoc-jotter
8983>4	lelong		0x100000E4	ini file
8984
89850	lelong		0x10000079	Psion Series 5 binary:
8986>4	lelong		0x00000000	DLL
8987>4	lelong		0x10000049	comms hardware library
8988>4	lelong		0x1000004A	comms protocol library
8989>4	lelong		0x1000005D	OPX
8990>4	lelong		0x1000006C	application
8991>4	lelong		0x1000008D	DLL
8992>4	lelong		0x100000AC	logical device driver
8993>4	lelong		0x100000AD	physical device driver
8994>4	lelong		0x100000E5	file transfer protocol
8995>4	lelong		0x100000E5	file transfer protocol
8996>4	lelong		0x10000140	printer definition
8997>4	lelong		0x10000141	printer definition
8998
89990	lelong		0x1000007A	Psion Series 5 executable
9000
9001#------------------------------------------------------------------------------
9002# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $
9003# erlang:  file(1) magic for Erlang JAM and BEAM files
9004# URL:  http://www.erlang.org/faq/x779.html#AEN812
9005
9006# OTP R3-R4
90070	string	\0177BEAM!	Old Erlang BEAM file
9008>6	short	>0		- version %d
9009
9010# OTP R5 and onwards
90110	string	FOR1
9012>8	string	BEAM		Erlang BEAM file
9013
9014# 4.2 version may have a copyright notice!
90154	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
901679	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
9017
90184	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3
9019
90200	bequad	0x0000000000ABCDEF	Erlang DETS file
9021
9022#------------------------------------------------------------------------------
9023# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $
9024# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
9025# Based on info from
9026# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
90270	belong	9994	ESRI Shapefile
9028>4	belong	=0
9029>8	belong	=0
9030>12	belong	=0
9031>16	belong	=0
9032>20	belong	=0
9033>28	lelong	x	version %d
9034>24	belong	x	length %d
9035>32	lelong	=0	type Null Shape
9036>32	lelong	=1	type Point
9037>32	lelong	=3	type PolyLine
9038>32	lelong	=5	type Polygon
9039>32	lelong	=8	type MultiPoint
9040>32	lelong	=11	type PointZ
9041>32	lelong	=13	type PolyLineZ
9042>32	lelong	=15	type PolygonZ
9043>32	lelong	=18	type MultiPointZ
9044>32	lelong	=21	type PointM
9045>32	lelong	=23	type PolyLineM
9046>32	lelong	=25	type PolygonM
9047>32	lelong	=28	type MultiPointM
9048>32	lelong	=31	type MultiPatch
9049
9050#------------------------------------------------------------------------------
9051# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
9052# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
9053# From Roger Leigh <roger@whinlatter.uklinux.net>
90540       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
90550       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
90560       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
9057
9058#------------------------------------------------------------------------------
9059# $File: filesystems,v 1.124 2018/01/12 12:35:30 christos Exp $
9060# filesystems:  file(1) magic for different filesystems
9061#
90620	name	partid
9063>0	ubyte	0x00	Unused
9064>0	ubyte	0x01	12-bit FAT
9065>0	ubyte	0x02	XENIX /
9066>0	ubyte	0x03	XENIX /usr
9067>0	ubyte	0x04	16-bit FAT, less than 32M
9068>0	ubyte	0x05	extended partition
9069>0	ubyte	0x06	16-bit FAT, more than 32M
9070>0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
9071>0	ubyte	0x08	AIX or os, or etc.
9072>0	ubyte	0x09	AIX boot partition or Coherent
9073>0	ubyte	0x0a	O/2 boot manager or Coherent swap
9074>0	ubyte	0x0b	32-bit FAT
9075>0	ubyte	0x0c	32-bit FAT, LBA-mapped
9076>0	ubyte	0x0d	7XXX, LBA-mapped
9077>0	ubyte	0x0e	16-bit FAT, LBA-mapped
9078>0	ubyte	0x0f	extended partition, LBA-mapped
9079>0	ubyte	0x10	OPUS
9080>0	ubyte	0x11 	OS/2 DOS 12-bit FAT
9081>0	ubyte	0x12 	Compaq diagnostics
9082>0	ubyte	0x14 	OS/2 DOS 16-bit FAT <32M
9083>0	ubyte	0x16 	OS/2 DOS 16-bit FAT >=32M
9084>0	ubyte	0x17 	OS/2 hidden IFS
9085>0	ubyte	0x18 	AST Windows swapfile
9086>0	ubyte	0x19 	Willowtech Photon coS
9087>0	ubyte	0x1b 	hidden win95 fat 32
9088>0	ubyte	0x1c 	hidden win95 fat 32 lba
9089>0	ubyte	0x1d	hidden win95 fat 16 lba
9090>0	ubyte	0x20 	Willowsoft OFS1
9091>0	ubyte	0x21 	reserved
9092>0	ubyte	0x23 	reserved
9093>0	ubyte	0x24	NEC DOS
9094>0	ubyte	0x26 	reserved
9095>0	ubyte	0x31 	reserved
9096>0	ubyte	0x32	Alien Internet Services NOS
9097>0	ubyte	0x33 	reserved
9098>0	ubyte	0x34 	reserved
9099>0	ubyte	0x35 	JFS on OS2
9100>0	ubyte	0x36 	reserved
9101>0	ubyte	0x38 	Theos
9102>0	ubyte	0x39 	Plan 9, or Theos spanned
9103>0	ubyte	0x3a 	Theos ver 4 4gb partition
9104>0	ubyte	0x3b 	Theos ve 4 extended partition
9105>0	ubyte	0x3c 	PartitionMagic recovery
9106>0	ubyte	0x3d 	Hidden Netware
9107>0	ubyte	0x40 	VENIX 286 or LynxOS
9108>0	ubyte	0x41	PReP
9109>0	ubyte	0x42	linux swap sharing DRDOS disk
9110>0	ubyte	0x43	linux sharing DRDOS disk
9111>0	ubyte	0x44	GoBack change utility
9112>0	ubyte	0x45	Boot US Boot manager
9113>0	ubyte	0x46	EUMEL/Elan or Ergos 3
9114>0	ubyte	0x47	EUMEL/Elan or Ergos 3
9115>0	ubyte	0x48	EUMEL/Elan or Ergos 3
9116>0	ubyte	0x4a	ALFX/THIN filesystem for DOS
9117>0	ubyte	0x4c	Oberon partition
9118>0	ubyte	0x4d 	QNX4.x
9119>0	ubyte	0x4e 	QNX4.x 2nd part
9120>0	ubyte	0x4f 	QNX4.x 3rd part
9121>0	ubyte	0x50 	DM (disk manager)
9122>0	ubyte	0x51 	DM6 Aux1 (or Novell)
9123>0	ubyte	0x52 	CP/M or Microport SysV/AT
9124>0	ubyte	0x53 	DM6 Aux3
9125>0	ubyte	0x54	DM6 DDO
9126>0	ubyte	0x55	EZ-Drive (disk manager)
9127>0	ubyte	0x56	Golden Bow (disk manager)
9128>0	ubyte	0x57	Drive PRO
9129>0	ubyte	0x5c	Priam Edisk (disk manager)
9130>0	ubyte	0x61	SpeedStor
9131>0	ubyte	0x63	GNU HURD or Mach or Sys V/386
9132>0	ubyte	0x64	Novell Netware 2.xx or Speedstore
9133>0	ubyte	0x65	Novell Netware 3.xx
9134>0	ubyte	0x66	Novell 386 Netware
9135>0	ubyte	0x67	Novell
9136>0	ubyte	0x68	Novell
9137>0	ubyte	0x69	Novell
9138>0	ubyte	0x70	DiskSecure Multi-Boot
9139>0	ubyte	0x71	reserved
9140>0	ubyte	0x73	reserved
9141>0	ubyte	0x74	reserved
9142>0	ubyte	0x75	PC/IX
9143>0	ubyte	0x76	reserved
9144>0	ubyte	0x77	M2FS/M2CS partition
9145>0	ubyte	0x78	XOSL boot loader filesystem
9146>0	ubyte	0x80	MINIX until 1.4a
9147>0	ubyte	0x81	MINIX since 1.4b
9148>0	ubyte	0x82	Linux swap or Solaris
9149>0	ubyte	0x83	Linux native
9150>0	ubyte	0x84	OS/2 hidden C: drive
9151>0	ubyte	0x85	Linux extended partition
9152>0	ubyte	0x86	NT FAT volume set
9153>0	ubyte	0x87	NTFS volume set or HPFS mirrored
9154>0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
9155>0	ubyte	0x8b	Legacy Fault tolerant FAT32
9156>0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
9157>0	ubyte	0x8d	Hidden free FDISK FAT12
9158>0	ubyte	0x8e	Linux Logical Volume Manager
9159>0	ubyte	0x90	Hidden free FDISK FAT16
9160>0	ubyte	0x91	Hidden free FDISK DOS EXT
9161>0	ubyte	0x92	Hidden free FDISK FAT16 Big
9162>0	ubyte	0x93	Amoeba filesystem
9163>0	ubyte	0x94	Amoeba bad block table
9164>0	ubyte	0x95	MIT EXOPC native partitions
9165>0	ubyte	0x97	Hidden free FDISK FAT32
9166>0	ubyte	0x98	Datalight ROM-DOS Super-Boot
9167>0	ubyte	0x99	Mylex EISA SCSI
9168>0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
9169>0	ubyte	0x9b	Hidden free FDISK EXT LBA
9170>0	ubyte	0x9f	BSDI?
9171>0	ubyte	0xa0	IBM Thinkpad hibernation
9172>0	ubyte	0xa1	HP Volume expansion (SpeedStor)
9173>0	ubyte	0xa3	HP Volume expansion (SpeedStor)
9174>0	ubyte	0xa4	HP Volume expansion (SpeedStor)
9175>0	ubyte	0xa5	386BSD partition type
9176>0	ubyte	0xa6	OpenBSD partition type
9177>0	ubyte	0xa7	NeXTSTEP 486
9178>0	ubyte	0xa8	Apple UFS
9179>0	ubyte	0xa9	NetBSD partition type
9180>0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
9181>0	ubyte	0xab	Apple Boot
9182>0	ubyte	0xae	SHAG OS filesystem
9183>0	ubyte	0xaf	Apple HFS
9184>0	ubyte	0xb0	BootStar Dummy
9185>0	ubyte	0xb1	reserved
9186>0	ubyte	0xb3	reserved
9187>0	ubyte	0xb4	reserved
9188>0	ubyte	0xb6	reserved
9189>0	ubyte	0xb7	BSDI BSD/386 filesystem
9190>0	ubyte	0xb8	BSDI BSD/386 swap
9191>0	ubyte	0xbb	Boot Wizard Hidden
9192>0	ubyte	0xbe	Solaris 8 partition type
9193>0	ubyte	0xbf	Solaris partition type
9194>0	ubyte	0xc0 	CTOS
9195>0	ubyte	0xc1 	DRDOS/sec (FAT-12)
9196>0	ubyte	0xc2 	Hidden Linux
9197>0	ubyte	0xc3 	Hidden Linux swap
9198>0	ubyte	0xc4 	DRDOS/sec (FAT-16, < 32M)
9199>0	ubyte	0xc5 	DRDOS/sec (EXT)
9200>0	ubyte	0xc6 	DRDOS/sec (FAT-16, >= 32M)
9201>0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
9202>0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
9203>0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
9204>0	ubyte	0xca 	Reserved for DR-DOS 8.0+
9205>0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
9206>0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
9207>0	ubyte	0xcd	CTOS Memdump
9208>0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
9209>0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
9210>0	ubyte	0xd0 	REAL/32 secure big partition
9211>0	ubyte	0xd1 	Old Multiuser DOS FAT12
9212>0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
9213>0	ubyte	0xd5 	Old Multiuser DOS Extended
9214>0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
9215>0	ubyte	0xd8 	CP/M 86
9216>0	ubyte	0xdb 	CP/M or Concurrent CP/M
9217>0	ubyte	0xdd 	Hidden CTOS Memdump
9218>0	ubyte	0xde 	Dell PowerEdge Server utilities
9219>0	ubyte	0xdf 	DG/UX virtual disk manager
9220>0	ubyte	0xe0 	STMicroelectronics ST AVFS
9221>0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
9222>0	ubyte	0xe3 	DOS R/O or Storage Dimensions
9223>0	ubyte	0xe4 	SpeedStor 16-bit FAT < 1024 cyl.
9224>0	ubyte	0xe5	reserved
9225>0	ubyte	0xe6	reserved
9226>0	ubyte	0xeb 	BeOS
9227>0	ubyte	0xee	GPT Protective MBR
9228>0	ubyte	0xef	EFI system partition
9229>0	ubyte	0xf0 	Linux PA-RISC boot loader
9230>0	ubyte	0xf1 	SpeedStor or Storage Dimensions
9231>0	ubyte	0xf2 	DOS 3.3+ Secondary
9232>0	ubyte	0xf3	reserved
9233>0	ubyte	0xf4	SpeedStor large partition
9234>0	ubyte	0xf5	Prologue multi-volumen partition
9235>0	ubyte	0xf6 	reserved
9236>0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
9237>0	ubyte	0xfa 	Bochs x86 emulator
9238>0	ubyte	0xfb 	VMware File System
9239>0	ubyte	0xfc 	VMware Swap
9240>0	ubyte	0xfd 	Linux RAID partition persistent sb
9241>0	ubyte	0xfe	LANstep or IBM PS/2 IML
9242>0	ubyte	0xff 	Xenix Bad Block Table
9243
92440	string	\366\366\366\366	PC formatted floppy with no filesystem
9245# Sun disk labels
9246# From /usr/include/sun/dklabel.h:
92470774	beshort		0xdabe
9248# modified by Joerg Jenderek, because original test
9249# succeeds for Cabinet archive dao360.dl_ with negative blocks
9250>0770	long		>0		Sun disk label
9251>>0	string		x		'%s
9252>>>31	string		>\0		\b%s
9253>>>>63	string		>\0		\b%s
9254>>>>>95	string		>\0		\b%s
9255>>0	string		x		\b'
9256>>0734	short		>0		%d rpm,
9257>>0736	short		>0		%d phys cys,
9258>>0740	short		>0		%d alts/cyl,
9259>>0746	short		>0		%d interleave,
9260>>0750	short		>0		%d data cyls,
9261>>0752	short		>0		%d alt cyls,
9262>>0754	short		>0		%d heads/partition,
9263>>0756	short		>0		%d sectors/track,
9264>>0764	long		>0		start cyl %d,
9265>>0770	long		x		%d blocks
9266# Is there a boot block written 1 sector in?
9267>512    belong&077777777	0600407	\b, boot block present
9268
9269# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
9270# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
92710		string	SBMBAKUP_	Smart Boot Manager backup file
9272>9		string	x		\b, version %-5.5s
9273>>14		string	=_
9274>>>15		string	x		%-.1s
9275>>>>16		string	=_		\b.
9276>>>>>17		string	x		\b%-.1s
9277>>>>>>18	string	=_		\b.
9278>>>>>>>19	string	x		\b%-.1s
9279>>>22		ubyte	0
9280>>>>21		ubyte	x		\b, from drive 0x%x
9281>>>22		ubyte	>0
9282>>>>21		string	x		\b, from drive %s
9283>>>535		search/17	\x55\xAA
9284>>>>&-512	indirect	x	\b; contains
9285
9286# updated by Joerg Jenderek at Nov 2012
9287# DOS Emulator image is 128 byte, null right padded header + harddisc image
92880	string	DOSEMU\0
9289>0x27E	leshort	0xAA55
9290#offset is 128
9291>>19	ubyte	128
9292>>>(19.b-1)	ubyte	0x0	DOS Emulator image
9293>>>>7	ulelong	>0		\b, %u heads
9294>>>>11	ulelong	>0		\b, %d sectors/track
9295>>>>15	ulelong	>0		\b, %d cylinders
9296>>>>128	indirect	x	\b; contains
9297
9298# added by Joerg Jenderek at Nov 2012
9299# http://www.thenakedpc.com/articles/v04/08/0408-05.html
9300# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
93010	string	PNCIHISK\0		Norton Utilities disc image data
9302# real x86 boot sector with jump instruction
9303>509	search/1026	\x55\xAA\xeb
9304>>&-1	indirect	x		\b; contains
9305# http://file-extension.net/seeker/file_extension_dat
93060	string	PNCIUNDO		Norton Disk Doctor UnDo file
9307#
9308
9309# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
9310# for any allowed sector sizes
931130		search/481	\x55\xAA
9312# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
9313# DOS BPB information (70) and after DOS floppy (120) like in previous file version
9314!:strength +65
9315# for sector sizes < 512 Bytes
9316>11		uleshort	<512
9317>>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
9318# for sector sizes with 512 or more Bytes
9319>0x1FE		leshort		0xAA55		DOS/MBR boot sector
9320
9321# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
9322# only for sector sizes with 512 or more Bytes
93230x1FE          leshort         0xAA55         	DOS/MBR boot sector
9324#
9325# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
9326!:strength +65
9327>2		string		OSBS		OS/BS MBR
9328# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
9329# and http://en.wikipedia.org/wiki/Master_Boot_Record
9330# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
9331# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
9332>0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
9333# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
9334# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
9335>>8	ubequad		0x8bf45007501ffbfc
9336# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
9337>>>0x16	ubyte		0xF3				\b,DOS 2
9338>>>>219	regex		Author\ -\ 			Author:
9339# found "David Litton" , "A Pehrsson  "
9340>>>>>&0	string		x				"%s"
9341>>>0x16	ubyte		0xF2
9342# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
9343# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
9344>>>>0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
9345# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
9346>>>>0x22	default	x				\b,D0S version 3.3-7.0
9347# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
9348# where nn is string offset varying for different languages
9349# "Invalid partition table"				nn=0x8b for english version
9350>>>>>(0x49.b)	string		Invalid\ partition\ table		english
9351>>>>>(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
9352>>>>>(0x49.b)	string		Table\ de\ partition\ invalide		french
9353>>>>>(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
9354>>>>>(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
9355>>>>>(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
9356>>>>>0x49	ubyte		>0			at offset 0x%x
9357>>>>>>(0x49.b)	string		>\0			"%s"
9358# "Error loading operating system"			nn=0xa3 for english version
9359# "Fehler beim Laden des Betriebssystems"		nn=0xa7 for german version
9360# "Erreur en chargeant syst\212me d'exploitation"	nn=0xa7 for french version
9361# "Erro na inicializa\207ao do sistema operacional"	nn=0xa7 for portuguese Brazilian version
9362# "Error al cargar sistema operativo"			nn=0xa8 for spanish version
9363# "Errore durante il caricamento del sistema operativo"	nn=0xae for italian version
9364>>>>>0x74	ubyte		>0			at offset 0x%x
9365>>>>>>(0x74.b)	string		>\0			"%s"
9366# "Missing operating system"				nn=0xc2 for english version
9367# "Betriebssystem fehlt"				nn=0xcd for german version
9368# "Syst\212me d'exploitation absent"			nn=0xd2 for french version
9369# "Sistema operacional nao encontrado"			nn=0xd4 for portuguese Brazilian version
9370# "Falta sistema operativo"				nn=0xca for spanish version
9371# "Sistema operativo mancante"				nn=0xe2 for italian version
9372>>>>>0x79	ubyte		>0			at offset 0x%x
9373>>>>>>(0x79.b)	string		>\0			"%s"
9374# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
9375# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
9376>>8	ubequad		0x5007501ffcbe1b7c
9377# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
9378>>>24		ubequad	0xf3a4cbbebe07b104		9M
9379# "Invalid partition table"				nn=0x10F for english version
9380# "Ung\201ltige Partitionstabelle"				nn=0x10F for german version
9381# "Table de partition erron\202e"				nn=0x10F for french version
9382# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x10F for russian version
9383>>>>(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
9384>>>>(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
9385>>>>(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
9386>>>>(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
9387>>>>0x3C		ubyte	x			at offset 0x%x+0xFF
9388>>>>(0x3C.b+0x0FF)	string	>\0			"%s"
9389# "Error loading operating system"			nn=0x127 for english version
9390# "Fehler beim Laden des Betriebssystems"		nn=0x12b for german version
9391# "Erreur lors du chargement du syst\212me d'exploitation"	nn=0x12a for french version
9392# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353"	nn=0x12d for russian version
9393>>>>0xBD		ubyte	x			at offset 0x1%x
9394>>>>(0xBD.b+0x100)	string	>\0			"%s"
9395# "Missing operating system"				nn=0x146 for english version
9396# "Betriebssystem fehlt"				nn=0x151 for german version
9397# "Syst\212me d'exploitation manquant"			nn=0x15e for french version
9398# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240"	nn=0x156 for russian version
9399>>>>0xA9		ubyte	x			at offset 0x1%x
9400>>>>(0xA9.b+0x100)	string	>\0			"%s"
9401# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
9402# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
9403>>>24		ubequad	0xf3a4cbbdbe07b104		XP
9404# where xxyyzz are lower bits from offsets of error messages varying for different languages
9405>>>>0x1B4	ubelong&0x00FFFFFF	0x002c4463	english
9406>>>>0x1B4	ubelong&0x00FFFFFF	0x002c486e	german
9407# "Invalid partition table"				xx=0x12C for english version
9408# "Ung\201ltige Partitionstabelle"				xx=0x12C for german version
9409>>>>0x1b5	ubyte		>0			at offset 0x1%x
9410>>>>(0x1b5.b+0x100)	string	>\0			"%s"
9411# "Error loading operating system"			yy=0x144 for english version
9412# "Fehler beim Laden des Betriebssystems"		yy=0x148 for german version
9413>>>>0x1b6	ubyte		>0			at offset 0x1%x
9414>>>>(0x1b6.b+0x100)	string	>\0			"%s"
9415# "Missing operating system"				zz=0x163 for english version
9416# "Betriebssystem nicht vorhanden"			zz=0x16e for german version
9417>>>>0x1b7	ubyte		>0			at offset 0x1%x
9418>>>>(0x1b7.b+0x100)	string	>\0			"%s"
9419# Microsoft Windows Vista or 7
9420# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
9421>>8	ubequad		0xc08ed8be007cbf00
9422# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
9423# assembler instructions: jnz 0729;cmp ebx,"TCPA"
9424>>>0xEC		ubequad	0x753b6681fb544350		Vista
9425# where xxyyzz are lower bits from offsets of error messages varying for different languages
9426>>>>0x1B4	ubelong&0x00FFFFFF	0x00627a99	english
9427#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
9428# "Invalid partition table"				xx=0x162 for english version
9429# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
9430>>>>0x1b5	ubyte		>0			at offset 0x1%x
9431>>>>(0x1b5.b+0x100)	string	>\0			"%s"
9432# "Error loading operating system"			yy=0x17a for english version
9433# "Fehler beim Laden des Betriebssystems"		yy= 0x1?? for german version
9434>>>>0x1b6	ubyte		>0			at offset 0x1%x
9435>>>>(0x1b6.b+0x100)	string	>\0			"%s"
9436# "Missing operating system"				zz=0x199 for english version
9437# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
9438>>>>0x1b7	ubyte		>0			at offset 0x1%x
9439>>>>(0x1b7.b+0x100)	string	>\0			"%s"
9440# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
9441# assembler instructions: cmp ebx,"TCPA";cmp
9442>>>0xEC		ubequad	0x6681fb5443504175		Windows 7
9443# where xxyyzz are lower bits from offsets of error messages varying for different languages
9444>>>>0x1B4	ubelong&0x00FFFFFF	0x00637b9a	english
9445#>>>>0x1B4	ubelong&0x00FFFFFF	?		german
9446# "Invalid partition table"				xx=0x163 for english version
9447# "Ung\201ltige Partitionstabelle"				xx=0x1?? for german version
9448>>>>0x1b5	ubyte		>0			at offset 0x1%x
9449>>>>(0x1b5.b+0x100)	string	>\0			"%s"
9450# "Error loading operating system"			yy=0x17b for english version
9451# "Fehler beim Laden des Betriebssystems"		yy=0x1?? for german version
9452>>>>0x1b6	ubyte		>0			at offset 0x1%x
9453>>>>(0x1b6.b+0x100)	string	>\0			"%s"
9454# "Missing operating system"				zz=0x19a for english version
9455# "Betriebssystem nicht vorhanden"			zz=0x1?? for german version
9456>>>>0x1b7	ubyte		>0			at offset 0x1%x
9457>>>>(0x1b7.b+0x100)	string	>\0			"%s"
9458# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
9459# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
9460>>0x1b8	ulelong		>0				\b, disk signature 0x%-.4x
9461# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
9462>>0xDA	uleshort		0
9463>>>0xDC 	ulelong		>0			\b, created
9464# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
9465>>>>0xDC	ubyte		x			with driveID 0x%x
9466# hours, minutes and seconds
9467>>>>0xDf	ubyte		x			at %x
9468>>>>0xDe	ubyte		x			\b:%x
9469>>>>0xDd	ubyte		x			\b:%x
9470# special case for Microsoft MS-DOS 3.21 spanish
9471# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
9472>0	ubequad		0xfab830008ed0bc00
9473# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
9474>>8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
9475# Microsoft MBR IPL end
9476
9477# dr-dos with some upper-, lowercase variants
9478>0x9D	string	Invalid\ partition\ table$
9479>>181	string	No\ Operating\ System$
9480>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
9481>0x9D	string	Invalid\ partition\ table$
9482>>181	string	No\ operating\ system$
9483>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
9484>342	string	Invalid\ partition\ table$
9485>>366	string	No\ operating\ system$
9486>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
9487>295	string	NEWLDR\0
9488>>302	string	Bad\ PT\ $
9489>>>310	string	No\ OS\ $
9490>>>>317	string	OS\ load\ err$
9491>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
9492>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$
9493>>>>>>>387	string	Copyright\ (c)\ 1984,1998
9494>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
9495#
9496# tests for different MS-DOS Master Boot Records (MBR) moved and merged
9497#
9498#>0x145	string	Default:\ F				\b, FREE-DOS MBR
9499#>0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
9500>0x145	search/7	Default:\ F			\b, FREE-DOS MBR
9501#>>313		string	F0\ .\ .\ .
9502#>>>322		string	disk\ 1
9503#>>>>382	string	FAT3
9504>64	string	no\ active\ partition\ found
9505>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
9506# Ranish Partition Manager http://www.ranish.com/part/
9507>387	search/4	\0\ Error!\r
9508>>378	search/7	Virus!
9509>>>397	search/4	Booting\040
9510>>>>408	search/4	HD1/\0	 			\b, Ranish MBR (
9511>>>>>416	string	Writing\ changes...		\b2.37
9512>>>>>>438	ubyte		x			\b,0x%x dots
9513>>>>>>440	ubyte		>0			\b,virus check
9514>>>>>>441	ubyte		>0			\b,partition %c
9515#2.38,2.42,2.44
9516>>>>>416	string	!Writing\ changes...		\b
9517>>>>>>418	ubyte	1				\bvirus check,
9518>>>>>>419	ubyte	x				\b0x%x seconds
9519>>>>>>420	ubyte&0x0F	>0			\b,partition
9520>>>>>>>420	ubyte&0x0F	<5			\b %x
9521>>>>>>>420	ubyte&0x0F	0Xf			\b ask
9522>>>>>420	ubyte		x			\b)
9523#
9524# SYSLINUX MBR moved
9525# http://www.acronis.de/
9526>362	string	MBR\ Error\ \0\r
9527>>376	string	ress\ any\ key\ to\040
9528>>>392	string	boot\ from\ floppy...\0			\b, Acronis MBR
9529# added by Joerg Jenderek
9530# http://www.visopsys.org/
9531# http://partitionlogic.org.uk/
9532>309	string	No\ bootable\ partition\ found\r
9533>>339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
9534>349	string	No\ bootable\ partition\ found\r
9535>>379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
9536# bootloader, bootmanager
9537>0x40	string	SBML
9538# label with 11 characters of FAT 12 bit filesystem
9539>>43	string	SMART\ BTMGR
9540>>>430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
9541# OEM-ID not always "SBM"
9542#>>>>3	strings	SBM
9543>>>>6	string	>\0                             \b, version %s
9544>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
9545>6	string	LILO				\b, LInux i386 boot LOader
9546>>120	string	LILO				\b, version 22.3.4 SuSe
9547>>172	string	LILO				\b, version 22.5.8 Debian
9548# updated by Joerg Jenderek at Oct 2008
9549# variables according to grub-0.97/stage1/stage1.S or
9550# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
9551# usual values are marked with comments to get only informations of strange GRUB loaders
9552>342		search/60	\0Geom\0
9553#>0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
9554>>0x41		ubyte		<2
9555>>>0x3E		ubyte		>2		\b; GRand Unified Bootloader
9556# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
9557>>>>0x3E	ubyte		x		\b, stage1 version 0x%x
9558#If it is 0xFF, use a drive passed by BIOS
9559>>>>0x40	ubyte		<0xFF		\b, boot drive 0x%x
9560# in most case 0,1,0x2e for GRUB 0.5.95
9561>>>>0x41	ubyte		>0		\b, LBA flag 0x%x
9562>>>>0x42	uleshort	<0x8000		\b, stage2 address 0x%x
9563#>>>>0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
9564>>>>0x42	uleshort	>0x8000		\b, stage2 address 0x%x
9565#>>>>0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
9566>>>>0x44	ulelong		>1		\b, 1st sector stage2 0x%x
9567>>>>0x48	uleshort	<0x800		\b, stage2 segment 0x%x
9568#>>>>0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
9569>>>>0x48	uleshort	>0x800		\b, stage2 segment 0x%x
9570>>>>402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
9571>>>>>394	string	stage1			\b, GRUB version 0.5.95
9572>>>>382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
9573>>>>>376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
9574>>>>383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
9575>>>>>377	string	GRUB\ \0		\b, GRUB version 0.94
9576>>>>385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
9577>>>>>379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
9578>>>>391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
9579>>>>>385	string	GRUB\ \0		\b, GRUB version 0.97
9580# unknown version
9581>>>343		string	Geom\0Read\0\ Error\0
9582>>>>321		string	Loading\ stage1.5	\b, GRUB version x.y
9583>>>380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
9584>>>>374		string	GRUB\ \0		\b, GRUB version n.m
9585# SYSLINUX bootloader moved
9586>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
9587# http://www.bcdwb.de/bcdw/index_e.htm
9588>3	string	BCDL
9589>>498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
9590# mbr partition table entries updated by Joerg Jenderek at Sep 2013
9591# skip Norton Utilities disc image data
9592>3		string		!IHISK
9593# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
9594>>0		belong		!0xb8c0078e
9595# not Linux kernel
9596>>>514		string		!HdrS
9597# not BeOS
9598>>>>422		string		!Be\ Boot\ Loader
9599# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
9600>>>>>0		ubelong&0xFD000000	=0xE9000000
9601# AdvanceMAME mbr
9602>>>>>>(1.b+2)	ubequad		0xfa31c08ed88ec08e
9603>>>>>>>446	use		partition-table
9604# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
9605>>>>>0		ubelong&0xFD000000	!0xE9000000
9606# skip FSInfosector
9607>>>>>>0		string		!RRaA
9608# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
9609# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
9610>>>>>>>0	ubequad		!0xfa660fb64610668b
9611# skip 13rd sector of MS x86 bootloader
9612>>>>>>>>0	ubequad		!0x660fb64610668b4e
9613# skip sector starting with DOS new line
9614>>>>>>>>>0	string		!\r\n
9615# allowed active flag 0,80h-FFh
9616>>>>>>>>>>446	ubyte		0
9617>>>>>>>>>>>446	use		partition-table
9618>>>>>>>>>>446	ubyte		>0x7F
9619>>>>>>>>>>>446	use		partition-table
9620# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
9621# mbr partition table entries end
9622# http://www.acronis.de/
9623#FAT label=ACRONIS\ SZ
9624#OEM-ID=BOOTWIZ0
9625>442	string	Non-system\ disk,\040
9626>>459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
9627# updated by Joerg Jenderek at Nov 2012, Sep 2013
9628# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
9629# display 1 space
9630>>>447	ubyte	x		\b
9631>>>477	use	DOS-filename
9632#
9633>185	string	FDBOOT\ Version\040
9634>>204	string	\rNo\ Systemdisk.\040
9635>>>220	string	Booting\ from\ harddisk.\n\r
9636>>>245	string	Cannot\ load\ from\ harddisk.\n\r
9637>>>>273 string	Insert\ Systemdisk\040
9638>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
9639>>>>>>200 string	>\0                             \b, version %-3s
9640>242	string	Bootsector\ from\ C.H.\ Hochst\204
9641# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
9642# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
9643# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut
9644>242	search/127	Bootsector\ from\ C.H.\ Hochst
9645>>278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
9646# followed by variants with point,CR-NL or NL-CR
9647>>>208	search/261	Cannot\ load\ from\ harddisk.
9648# followed by variants CR-NL or NL-CR
9649>>>>236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
9650# followed by variants with point,CR-NL or NL-CR
9651>>>>>180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
9652# followed by string like "6.50 (c) 1993-2004 Gilles Vollant"
9653>>>>>>&0	string		x 					\b, version %-4.4s
9654>(1.b+2)	ubyte		0xe
9655>>(1.b+3)	ubyte		0x1f
9656>>>(1.b+4)	ubyte		0xbe
9657# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
9658>>>>(1.b+5)	ubyte&0xd3	0x53
9659>>>>>(1.b+6)	ubyte		0x7c
9660# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
9661>>>>>>(1.b+7)	ubyte		0xac
9662>>>>>>>(1.b+8)	ubyte		0x22
9663>>>>>>>>(1.b+9)	ubyte		0xc0
9664>>>>>>>>>(1.b+10)	ubyte	0x74
9665>>>>>>>>>>(1.b+11)	ubyte	0x0b
9666>>>>>>>>>>>(1.b+12)	ubyte	0x56
9667>>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
9668# FAT1X version
9669>>>>>>>>>>>>>(1.b+5)	ubyte	0x5b
9670>>>>>>>>>>>>>>0x5b	string	>\0			"%-s"
9671# FAT32 version
9672>>>>>>>>>>>>>(1.b+5)	ubyte	0x77
9673>>>>>>>>>>>>>>0x77	string	>\0			"%-s"
9674>214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
9675#>>244	string	from\ dosemu-freedos-*-bin.tgz\r
9676#>>>170	string	Sorry,\ could\ not\ load\ an\040
9677#>>>>195	string	operating\ system.\r\n
9678#
9679>103	string	This\ is\ not\ a\ bootable\ disk.\040
9680>>132	string	Please\ insert\ a\ bootable\040
9681>>>157	string	floppy\ and\r\n
9682>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
9683#
9684>66	string	Solaris\ Boot\ Sector
9685>>99	string	Incomplete\ MDBoot\ load.
9686>>>89	string	Version 				\b, Sun Solaris Bootloader
9687>>>>97	byte	x					version %c
9688#
9689>408	string	OS/2\ !!\ SYS01475\r\0
9690>>429	string	OS/2\ !!\ SYS02025\r\0
9691>>>450	string	OS/2\ !!\ SYS02027\r\0
9692>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
9693#
9694>409	string	OS/2\ !!\ SYS01475\r\0
9695>>430	string	OS/2\ !!\ SYS02025\r\0
9696>>>451	string	OS/2\ !!\ SYS02027\r\0
9697>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
9698>112		string	This\ disk\ is\ not\ bootable\r
9699>>142		string	If\ you\ wish\ to\ make\ it\ bootable
9700>>>176		string	run\ the\ DOS\ program\ SYS\040
9701>>>200		string	after\ the\r
9702>>>>216		string	system\ has\ been\ loaded\r\n
9703>>>>>242	string	Please\ insert\ a\ DOS\ diskette\040
9704>>>>>271	string	into\r\n\ the\ drive\ and\040
9705>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
9706# XP
9707>430	string	NTLDR\ is\ missing\xFF\r\n
9708>>449	string	Disk\ error\xFF\r\n
9709>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
9710# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
9711>>>>417		ubyte&0xDF	>0
9712>>>>>417	string		x			%-.5s
9713>>>>>>422	ubyte&0xDF	>0
9714>>>>>>>422	string		x 			\b%-.3s
9715>>>>>425	ubyte&0xDF	>0
9716>>>>>>425	string		>\ 			\b.%-.3s
9717#
9718>>>>371		ubyte		>0x20
9719>>>>>368	ubyte&0xDF	>0
9720>>>>>>368	string		x 			%-.5s
9721>>>>>>>373	ubyte&0xDF	>0
9722>>>>>>>>373	string		x 			\b%-.3s
9723>>>>>>376	ubyte&0xDF	>0
9724>>>>>>>376	string		x 			\b.%-.3s
9725#
9726>430	string	NTLDR\ nicht\ gefunden\xFF\r\n
9727>>453	string	Datentr\204gerfehler\xFF\r\n
9728>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
9729>>>>417		ubyte&0xDF	>0
9730>>>>>417	string		x			%-.5s
9731>>>>>>422	ubyte&0xDF	>0
9732>>>>>>>422	string		x 			\b%-.3s
9733>>>>>425	ubyte&0xDF	>0
9734>>>>>>425	string		>\ 			\b.%-.3s
9735# offset variant
9736>>>>379	string	\0
9737>>>>>368	ubyte&0xDF	>0
9738>>>>>>368	string		x 			%-.5s
9739>>>>>>>373	ubyte&0xDF	>0
9740>>>>>>>>373	string		x 			\b%-.3s
9741#
9742>430	string	NTLDR\ fehlt\xFF\r\n
9743>>444	string	Datentr\204gerfehler\xFF\r\n
9744>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
9745>>>>417		ubyte&0xDF	>0
9746>>>>>417	string		x			%-.5s
9747>>>>>>422	ubyte&0xDF	>0
9748>>>>>>>422	string		x 			\b%-.3s
9749>>>>>425	ubyte&0xDF	>0
9750>>>>>>425	string		>\ 			\b.%-.3s
9751# variant
9752>>>>371		ubyte		>0x20
9753>>>>>368	ubyte&0xDF	>0
9754>>>>>>368	string		x 			%-.5s
9755>>>>>>>373	ubyte&0xDF	>0
9756>>>>>>>>373	string		x 			\b%-.3s
9757>>>>>>376	ubyte&0xDF	>0
9758>>>>>>>376	string		x 			\b.%-.3s
9759#
9760>430	string	NTLDR\ fehlt\xFF\r\n
9761>>444	string	Medienfehler\xFF\r\n
9762>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
9763>>>>371		ubyte		>0x20
9764>>>>>368	ubyte&0xDF	>0
9765>>>>>>368	string		x 			%-.5s
9766>>>>>>>373	ubyte&0xDF	>0
9767>>>>>>>>373	string		x 			\b%-.3s
9768>>>>>>376	ubyte&0xDF	>0
9769>>>>>>>376	string		x 			\b.%-.3s
9770# variant
9771>>>>417		ubyte&0xDF	>0
9772>>>>>417	string		x			%-.5s
9773>>>>>>422	ubyte&0xDF	>0
9774>>>>>>>422	string		x 			\b%-.3s
9775>>>>>425	ubyte&0xDF	>0
9776>>>>>>425	string		>\ 			\b.%-.3s
9777#
9778>430	string	Datentr\204ger\ entfernen\xFF\r\n
9779>>454	string	Medienfehler\xFF\r\n
9780>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
9781>>>>379		string		\0
9782>>>>>368	ubyte&0xDF	>0
9783>>>>>>368	string		x 			%-.5s
9784>>>>>>>373	ubyte&0xDF	>0
9785>>>>>>>>373	string		x 			\b%-.3s
9786>>>>>>376	ubyte&0xDF	>0
9787>>>>>>>376	string		x 			\b.%-.3s
9788# variant
9789>>>>417		ubyte&0xDF	>0
9790>>>>>417	string		x			%-.5s
9791>>>>>>422	ubyte&0xDF	>0
9792>>>>>>>422	string		x 			\b%-.3s
9793>>>>>425	ubyte&0xDF	>0
9794>>>>>>425	string		>\ 			\b.%-.3s
9795#
9796
9797#>3	string	NTFS\ \ \ \040
9798>389	string	Fehler\ beim\ Lesen\040
9799>>407	string	des\ Datentr\204gers
9800>>>426	string	NTLDR\ fehlt
9801>>>>440	string	NTLDR\ ist\ komprimiert
9802>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
9803#>3	string	NTFS\ \ \ \040
9804>313	string	A\ disk\ read\ error\ occurred.\r
9805>>345	string	A\ kernel\ file\ is\ missing\040
9806>>>370	string	from\ the\ disk.\r
9807>>>>484	string	NTLDR\ is\ compressed
9808>>>>>429 string	Insert\ a\ system\ diskette\040
9809>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
9810# DOS loader variants different languages,offsets
9811>472	ubyte&0xDF	>0
9812>>389	string	Invalid\ system\ disk\xFF\r\n
9813>>>411	string	Disk\ I/O\ error
9814>>>>428	string	Replace\ the\ disk,\ and\040
9815>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
9816#IO.SYS
9817>>>>>>472	ubyte&0xDF	>0
9818>>>>>>>472	string		x 			\b %-.2s
9819>>>>>>>>474	ubyte&0xDF	>0
9820>>>>>>>>>474	string		x 			\b%-.5s
9821>>>>>>>>>>479	ubyte&0xDF	>0
9822>>>>>>>>>>>479 string		x 			\b%-.1s
9823>>>>>>>480	ubyte&0xDF	>0
9824>>>>>>>>480	string		x 			\b.%-.3s
9825#MSDOS.SYS
9826>>>>>>>483	ubyte&0xDF	>0			\b+
9827>>>>>>>>483	string		x 			\b%-.5s
9828>>>>>>>>>488	ubyte&0xDF	>0
9829>>>>>>>>>>488	string		x 			\b%-.3s
9830>>>>>>>>491	ubyte&0xDF	>0
9831>>>>>>>>>491	string		x 			\b.%-.3s
9832#
9833>>390	string	Invalid\ system\ disk\xFF\r\n
9834>>>412	string	Disk\ I/O\ error\xFF\r\n
9835>>>>429	string	Replace\ the\ disk,\ and\040
9836>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
9837>>388	string	Ungueltiges\ System\ \xFF\r\n
9838>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n
9839>>>>427	string	Datentraeger\ wechseln\ und\040
9840>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
9841#WINBOOT.SYS only not spaces (0xDF)
9842>>>>>>497	ubyte&0xDF	>0
9843>>>>>>>497	string		x 			%-.5s
9844>>>>>>>>502	ubyte&0xDF	>0
9845>>>>>>>>>502	string		x 			\b%-.1s
9846>>>>>>>>>>503	ubyte&0xDF	>0
9847>>>>>>>>>>>503	string		x 			\b%-.1s
9848>>>>>>>>>>>>504	ubyte&0xDF	>0
9849>>>>>>>>>>>>>504 string		x 			\b%-.1s
9850>>>>>>505	ubyte&0xDF	>0
9851>>>>>>>505	string		x 			\b.%-.3s
9852#IO.SYS
9853>>>>>>472	ubyte&0xDF	>0			or
9854>>>>>>>472	string		x 			\b %-.2s
9855>>>>>>>>474	ubyte&0xDF	>0
9856>>>>>>>>>474	string		x 			\b%-.5s
9857>>>>>>>>>>479	ubyte&0xDF	>0
9858>>>>>>>>>>>479 string		x 			\b%-.1s
9859>>>>>>>480	ubyte&0xDF	>0
9860>>>>>>>>480	string		x 			\b.%-.3s
9861#MSDOS.SYS
9862>>>>>>>483	ubyte&0xDF	>0			\b+
9863>>>>>>>>483	string		x 			\b%-.5s
9864>>>>>>>>>488	ubyte&0xDF	>0
9865>>>>>>>>>>488	string		x 			\b%-.3s
9866>>>>>>>>491	ubyte&0xDF	>0
9867>>>>>>>>>491	string		x 			\b.%-.3s
9868#
9869>>390	string	Ungueltiges\ System\ \xFF\r\n
9870>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n
9871>>>>429	string	Datentraeger\ wechseln\ und\040
9872>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
9873#WINBOOT.SYS only not spaces (0xDF)
9874>>>>>>497	ubyte&0xDF	>0
9875>>>>>>>497	string		x 			%-.7s
9876>>>>>>>>504	ubyte&0xDF	>0
9877>>>>>>>>>504	string		x 			\b%-.1s
9878>>>>>>505	ubyte&0xDF	>0
9879>>>>>>>505	string		x 			\b.%-.3s
9880#IO.SYS
9881>>>>>>472	ubyte&0xDF	>0			or
9882>>>>>>>472	string		x 			\b %-.2s
9883>>>>>>>>474	ubyte&0xDF	>0
9884>>>>>>>>>474	string		x 			\b%-.6s
9885>>>>>>>480	ubyte&0xDF	>0
9886>>>>>>>>480	string		x 			\b.%-.3s
9887#MSDOS.SYS
9888>>>>>>>483	ubyte&0xDF	>0			\b+
9889>>>>>>>>483	string		x 			\b%-.5s
9890>>>>>>>>>488	ubyte&0xDF	>0
9891>>>>>>>>>>488	string		x 			\b%-.3s
9892>>>>>>>>491	ubyte&0xDF	>0
9893>>>>>>>>>491	string		x 			\b.%-.3s
9894#
9895>>389	string	Ungueltiges\ System\ \xFF\r\n
9896>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n
9897>>>>428	string	Datentraeger\ wechseln\ und\040
9898>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
9899# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
9900>>>>>>472	string		x 			%-.2s
9901>>>>>>>474	ubyte&0xDF	>0
9902>>>>>>>>474	string		x 			\b%-.5s
9903>>>>>>>>479	ubyte&0xDF	>0
9904>>>>>>>>>479	string		x 			\b%-.1s
9905>>>>>>480	ubyte&0xDF	>0
9906>>>>>>>480	string		x 			\b.%-.3s
9907>>>>>>483	ubyte&0xDF	>0			\b+
9908>>>>>>>483	string		x 			\b%-.5s
9909>>>>>>>488	ubyte&0xDF	>0
9910>>>>>>>>488	string		x 			\b%-.2s
9911>>>>>>>>490	ubyte&0xDF	>0
9912>>>>>>>>>490	string		x 			\b%-.1s
9913>>>>>>>491	ubyte&0xDF	>0
9914>>>>>>>>491	string		x 			\b.%-.3s
9915>479	ubyte&0xDF	>0
9916>>416	string	Kein\ System\ oder\040
9917>>>433	string	Laufwerksfehler
9918>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
9919#IO.SYS
9920>>>>>479	string		x 			\b %-.2s
9921>>>>>>481	ubyte&0xDF	>0
9922>>>>>>>481	string		x 			\b%-.6s
9923>>>>>487	ubyte&0xDF	>0
9924>>>>>>487	string		x 			\b.%-.3s
9925#MSDOS.SYS
9926>>>>>>490	ubyte&0xDF	>0			\b+
9927>>>>>>>490	string		x 			\b%-.5s
9928>>>>>>>>495	ubyte&0xDF	>0
9929>>>>>>>>>495	string		x 			\b%-.3s
9930>>>>>>>498	ubyte&0xDF	>0
9931>>>>>>>>498	string		x 			\b.%-.3s
9932#
9933>376	search/41	Non-System\ disk\ or\040
9934>>395	search/41	disk\ error\r
9935>>>407	search/41	Replace\ and\040
9936>>>>419	search/41	press\ 				\b,
9937>>>>419	search/41	strike\ 			\b, old
9938>>>>426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
9939#449			Disk\ Boot\ failure\r		MS 3.21
9940#466			Boot\ Failure\r			MS 3.30
9941>>>>>468 search/18	\0
9942#IO.SYS,IBMBIO.COM
9943>>>>>>&0	string		x 			\b %-.2s
9944>>>>>>>&-20	ubyte&0xDF	>0
9945>>>>>>>>&-1	string		x 			\b%-.4s
9946>>>>>>>>>&-16	ubyte&0xDF	>0
9947>>>>>>>>>>&-1	string		x 			\b%-.2s
9948>>>>>>&8	ubyte&0xDF	>0			\b.
9949>>>>>>>&-1	string		x 			\b%-.3s
9950#MSDOS.SYS,IBMDOS.COM
9951>>>>>>&11	ubyte&0xDF	>0			\b+
9952>>>>>>>&-1	string		x 			\b%-.5s
9953>>>>>>>>&-6	ubyte&0xDF	>0
9954>>>>>>>>>&-1	string		x 			\b%-.1s
9955>>>>>>>>>>&-5	ubyte&0xDF	>0
9956>>>>>>>>>>>&-1	string		x 			\b%-.2s
9957>>>>>>>&7	ubyte&0xDF	>0			\b.
9958>>>>>>>>&-1	string		x 			\b%-.3s
9959>441	string	Cannot\ load\ from\ harddisk.\n\r
9960>>469	string	Insert\ Systemdisk\040
9961>>>487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
9962#>43	string	\224R-LOADER\ \ SYS			=label
9963>54	string	SYS
9964>>324	string	VASKK
9965>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
9966#
9967>98	string	Press\ a\ key\ to\ retry\0\r
9968>>120	string	Cannot\ find\ file\ \0\r
9969>>>139	string	Disk\ read\ error\0\r
9970>>>>156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
9971#DRBIOS.SYS
9972>>>>>44		ubyte&0xDF	>0
9973>>>>>>44	string		x			\b %-.6s
9974>>>>>>>50	ubyte&0xDF	>0
9975>>>>>>>>50	string		x 			\b%-.2s
9976>>>>>>52	ubyte&0xDF	>0
9977>>>>>>>52	string		x 			\b.%-.3s
9978#
9979>70	string	IBMBIO\ \ COM
9980>>472	string	Cannot\ load\ DOS!\040
9981>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
9982>>471	string	Cannot\ load\ DOS\040
9983>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
9984#??
9985>444	string	KERNEL\ \ SYS
9986>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
9987>499	string	KERNEL\ \ SYS
9988>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
9989>449	string	KERNEL\ \ SYS
9990>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
9991#
9992>449	string	Loading\ FreeDOS
9993>>0x1AF		ulelong		>0			\b, FREE-DOS 0.95,1.0 Bootloader
9994>>>497		ubyte&0xDF	>0
9995>>>>497		string		x 			\b %-.6s
9996>>>>>503	ubyte&0xDF	>0
9997>>>>>>503	string		x 			\b%-.1s
9998>>>>>>>504	ubyte&0xDF	>0
9999>>>>>>>>504	string		x 			\b%-.1s
10000>>>>505		ubyte&0xDF	>0
10001>>>>>505	string		x 			\b.%-.3s
10002#
10003>331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
10004#
10005>125	string	Loading\ FreeDOS...\r
10006>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
10007>>>441		ubyte&0xDF	>0
10008>>>>441		string		x 			\b %-.6s
10009>>>>>447	ubyte&0xDF	>0
10010>>>>>>447	string		x 			\b%-.1s
10011>>>>>>>448	ubyte&0xDF	>0
10012>>>>>>>>448	string		x 			\b%-.1s
10013>>>>449		ubyte&0xDF	>0
10014>>>>>449	string		x 			\b.%-.3s
10015>124	string	FreeDOS\0
10016>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
10017# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
10018>>>497		ubyte&0xDF	>0
10019>>>>497		string		x 			\b %-.6s
10020>>>>>503	ubyte&0xDF	>0
10021>>>>>>503	string		x 			\b%-.1s
10022>>>>>>>504	ubyte&0xDF	>0
10023>>>>>>>>504	string		x 			\b%-.1s
10024>>>>505		ubyte&0xDF	>0
10025>>>>>505	string		x 			\b.%-.3s
10026>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
10027>>>497		ubyte&0xDF	>0
10028>>>>497		string		x 			\b %-.6s
10029>>>>>503	ubyte&0xDF	>0
10030>>>>>>503	string		x 			\b%-.1s
10031>>>>>>>504	ubyte&0xDF	>0
10032>>>>>>>>504	string		x 			\b%-.1s
10033>>>>505		ubyte&0xDF	>0
10034>>>>>505	string		x 			\b.%-.3s
10035>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
10036>>>497		ubyte&0xDF	>0
10037>>>>497		string		x 			\b %-.6s
10038>>>>>503	ubyte&0xDF	>0
10039>>>>>>503	string		x 			\b%-.1s
10040>>>>>>>504	ubyte&0xDF	>0
10041>>>>>>>>504	string		x 			\b%-.1s
10042>>>>505		ubyte&0xDF	>0
10043>>>>>505	string		x 			\b.%-.3s
10044>336	string	Error!\040
10045>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
10046>>>497		ubyte&0xDF	>0
10047>>>>497		string		x 			\b %-.6s
10048>>>>>503	ubyte&0xDF	>0
10049>>>>>>503	string		x 			\b%-.1s
10050>>>>>>>504	ubyte&0xDF	>0
10051>>>>>>>>504	string		x 			\b%-.1s
10052>>>>505		ubyte&0xDF	>0
10053>>>>>505	string		x 			\b.%-.3s
10054# added by Joerg Jenderek
10055# http://www.visopsys.org/
10056# http://partitionlogic.org.uk/
10057# OEM-ID=Visopsys
10058>478		ulelong	0
10059>>(1.b+326)	string	I/O\ Error\ reading\040
10060>>>(1.b+344)	string	Visopsys\ loader\r
10061>>>>(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
10062# http://alexfru.chat.ru/epm.html#bootprog
10063>494	ubyte	>0x4D
10064>>495	string	>E
10065>>>495	string	<S
10066#OEM-ID is not reliable
10067>>>>3	string	BootProg
10068# It just looks for a program file name at the root directory
10069# and loads corresponding file with following execution.
10070# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
10071>>>>499			ubyte&0xDF	>0		\b, COM/EXE Bootloader
10072>>>>>499		use		DOS-filename
10073#If the boot sector fails to read any other sector,
10074#it prints a very short message ("RE") to the screen and hangs the computer.
10075#If the boot sector fails to find needed program in the root directory,
10076#it also hangs with another message ("NF").
10077>>>>>492		string		RENF		\b, FAT (12 bit)
10078>>>>>495		string		RENF		\b, FAT (16 bit)
10079#If the boot sector fails to read any other sector,
10080#it prints a very short message ("RE") to the screen and hangs the computer.
10081# x86 bootloader end
10082
10083# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
10084# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
10085>0		string		RRaA
10086>>0x1E4		string		rrAa		\b, FSInfosector
10087#>>0x1FC	uleshort	=0		SHOULD BE ZERO
10088>>>0x1E8	ulelong		<0xffffffff	\b, %u free clusters
10089>>>0x1EC	ulelong		<0xffffffff	\b, last allocated cluster %u
10090
10091# updated by Joerg Jenderek at Sep 2007
10092>3	ubyte	0
10093#no active flag
10094>>446	ubyte	0
10095# partition 1 not empty
10096>>>450	ubyte	>0
10097# partitions 3,4 empty
10098>>>>482		ubyte	0
10099>>>>>498	ubyte	0
10100# partition 2 ID=0,5,15
10101>>>>>>466	ubyte	<0x10
10102>>>>>>>466	ubyte	0x05			\b, extended partition table
10103>>>>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
10104>>>>>>>466	ubyte	0x0			\b, extended partition table (last)
10105
10106# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
10107
10108>0x200	lelong	0x82564557		\b, BSD disklabel
10109
10110# by Joerg Jenderek at Apr 2013
10111#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
10112#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
101130	name			DOS-filename
10114# space=0x20 (00100000b) means empty
10115>0			ubyte&0xDF	>0
10116>>0			ubyte		x 		\b%c
10117>>>1			ubyte&0xDF	>0
10118>>>>1			ubyte		x 		\b%c
10119>>>>>2			ubyte&0xDF	>0
10120>>>>>>2			ubyte		x 		\b%c
10121>>>>>>>3		ubyte&0xDF	>0
10122>>>>>>>>3		ubyte		x 		\b%c
10123>>>>>>>>>4		ubyte&0xDF	>0
10124>>>>>>>>>>4		ubyte		x 		\b%c
10125>>>>>>>>>>>5		ubyte&0xDF	>0
10126>>>>>>>>>>>>5		ubyte		x 		\b%c
10127>>>>>>>>>>>>>6		ubyte&0xDF	>0
10128>>>>>>>>>>>>>>6		ubyte		x 		\b%c
10129>>>>>>>>>>>>>>>7	ubyte&0xDF	>0
10130>>>>>>>>>>>>>>>>7	ubyte		x 		\b%c
10131# DOS filename extension
10132>>8			ubyte&0xDF	>0		\b.
10133>>>8			ubyte		x 		\b%c
10134>>>>9			ubyte&0xDF	>0
10135>>>>>9			ubyte		x 		\b%c
10136>>>>>>10		ubyte&0xDF	>0
10137>>>>>>>10		ubyte		x 		\b%c
10138#	Print 2 following DOS filenames from directory entry form
10139#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
101400	name			2xDOS-filename
10141# display 1 space
10142>0			ubyte		x		\b
10143>0			use		DOS-filename
10144>11			ubyte		x		\b+
10145>11			use		DOS-filename
10146
10147# http://en.wikipedia.org/wiki/Master_boot_record#PTE
10148# display standard partition table
101490	name				partition-table
10150#>0		ubyte		x	PARTITION-TABLE
10151# test and display 1st til 4th partition table entry
10152>0		use			partition-entry-test
10153>16		use			partition-entry-test
10154>32		use			partition-entry-test
10155>48		use			partition-entry-test
10156#		test for entry of partition table
101570	name				partition-entry-test
10158# partition type ID > 0
10159>4		ubyte		>0
10160# active flag 0
10161>>0		ubyte		0
10162>>>0		use		partition-entry
10163# active flag 0x80, 0x81, ...
10164>>0		ubyte		>0x7F
10165>>>0		use		partition-entry
10166#		Print entry of partition table
101670	name				partition-entry
10168# partition type ID > 0
10169>4		ubyte		>0	\b; partition
10170>>64		leshort		0xAA55	1
10171>>48		leshort		0xAA55	2
10172>>32		leshort		0xAA55	3
10173>>16		leshort		0xAA55	4
10174>>4		ubyte		x	: ID=0x%x
10175>>0		ubyte&0x80	0x80	\b, active
10176>>0		ubyte		>0x80	0x%x
10177>>1		ubyte		x	\b, start-CHS (
10178>>1		use		partition-chs
10179>>5		ubyte		x	\b), end-CHS (
10180>>5		use		partition-chs
10181>>8		ulelong		x	\b), startsector %u
10182>>12		ulelong		x	\b, %u sectors
10183#		Print cylinder,head,sector (CHS) of partition entry
101840	name				partition-chs
10185# cylinder
10186>1		ubyte		x	\b0x
10187>1		ubyte&0xC0	0x40	\b1
10188>1		ubyte&0xC0	0x80	\b2
10189>1		ubyte&0xC0	0xC0	\b3
10190>2		ubyte		x	\b%x
10191# head
10192>0		ubyte		x	\b,%u
10193# sector
10194>1		ubyte&0x3F	x	\b,%u
10195
10196# FATX
101970		string		FATX		FATX filesystem data
10198
10199# romfs filesystems - Juan Cespedes <cespedes@debian.org>
102000	string		-rom1fs-	romfs filesystem, version 1
10201>8	belong	x			%d bytes,
10202>16	string	x			named %s.
10203
10204# netboot image - Juan Cespedes <cespedes@debian.org>
102050	lelong		0x1b031336L	Netboot image,
10206>4	lelong&0xFFFFFF00	0
10207>>4	lelong&0x100	0x000		mode 2
10208>>4	lelong&0x100	0x100		mode 3
10209>4	lelong&0xFFFFFF00	!0	unknown mode
10210
102110x18b	string	OS/2	OS/2 Boot Manager
10212
10213# updated by Joerg Jenderek at Oct 2008 and Sep 2012
10214# http://syslinux.zytor.com/iso.php
10215# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
10216# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
102170	ulequad&0x909000007cc0eafa	0x909000007c40eafa
10218>631	search/689	ISOLINUX\ 	isolinux Loader
10219>>&0	string		x		(version %-4.4s)
10220# http://syslinux.zytor.com/pxe.php
10221# assembler instructions: jmp 7C05
102220	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
10223# assembler instructions: pushfd;pushad
102240	ulelong	0x60669c66		pxelinux loader
10225# assembler instructions: jmp 05
102260	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
10227# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
102280	string	LDLINUX\ SYS\ 		SYSLINUX loader
10229>12	string	x			(older version %-4.4s)
102300	string	\r\nSYSLINUX\ 		SYSLINUX loader
10231>11	string	x			(version %-4.4s)
10232# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
10233# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX"
102340	ulelong&0x80909bEB	0x009018EB
10235# OEM-ID not always "SYSLINUX"
10236>434	search/47	Boot\ failed
10237# followed by \r\n\0 or :\
10238>>482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
10239>>1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
10240>459	search/30	Boot\ error\r\n\0
10241>>1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
10242# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012
10243# assembler instructions: mov di,0600h;mov cx,0100h
1024416	search/4	\xbf\x00\x06\xb9\x00\x01
10245# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
10246!:strength +36
10247>94	search/249	Missing\ operating\ system
10248# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
10249# skip Ranish MBR
10250>>408	search/4	HD1/\0
10251>>408	default		x
10252>>>250	search/118	\0Operating\ system\ load		SYSLINUX MBR
10253# followed by "ing " or space
10254>>>>292	search/98	error
10255>>>>>&0	string		\r		    			(version 3.35 or older)
10256>>>>>&0	string		.\r					(version 3.52 or newer)
10257>>>>>&0	default		x					(version 3.36-3.51 )
10258>368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
10259>>156	search/10	\0Boot\ partition\ not\ found\r\n
10260>>>270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
10261>>174	search/10	\0Missing\ OS\r\n
10262>>>189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
10263# SYSLINUX END
10264
10265# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
10266# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
102670	ubequad		0x31c08ed0bc007c8e
10268# mbr_bootsel magic before partition table not reliable with small ipl fragments
10269#>444	uleshort	0xb5e1
10270>0004	uleshort	x
10271# ERRorTeXT
10272>>181	search/166		Error\ \0\r\n				NetBSD mbr
10273# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
10274>>>0x1B8	ubelong		>0					\b,Serial 0x%-.8x
10275# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
10276>>>0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
10277# BOOT_EXTENDED definitions contains assembler instructions:
10278# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
10279>>>0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
10280# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
10281>>>0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
10282# not TERSE_ERROR
10283>>>196		search/106	No\ active\ partition\0
10284>>>>&0		string		Disk\ read\ error\0
10285>>>>>&0		string		No\ operating\ system\0			\b,verbose
10286# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
10287>>>0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
10288# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
10289>>>0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
10290# assembler instructions: movw nametab,bx
10291>>>0x26	    search/21	\xBB\x94\x07
10292# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
10293>>>>&-9	ubequad&0xBE00f0E800febb94	0xBE0000E80000bb94
10294>>>>>181	search/166		Error\ \0
10295# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
10296>>>>>>&3	string			x				\b,"%s"
10297>>>446	use		partition-table
10298# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
10299# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
10300# assembler instructions: jmp short 0x58;nop;ASCII
103010	ubequad&0xeb58908000000000	0xeb58900000000000
10302# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
10303>(1.b+2)	ubequad			0xfa31c08ed88ec08e
10304# Error messages at end of code
10305>>376		string	No\ operating\ system\r\n\0
10306>>>398		string	Disk\ error\r\n\0FDD\0HDD\0
10307>>>>419		string	\ EBIOS\r\n\0				AdvanceMAME mbr
10308
10309# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
10310# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
10311# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
10312# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
103130	ulequad&0xcE1b40D48EC031FC	0x8E0000D08EC031FC
10314# pointer to the data starting with Neil Turton signature string
10315>(0x1BC.s)		string		NDTmbr
10316>>&-14			string		1234F\0			Turton mbr (
10317# parameters also viewed by install-mbr --list
10318>>>(0x1BC.s+7)		ubyte		x			\b%u<=
10319>>>(0x1BC.s+9)		ubyte		x			\bVersion<=%u
10320#>>>(0x1BC.s+8)		ubyte		x			asm_flag_%x
10321>>>(0x1BC.s+8)		ubyte&1		1			\b,Y2K-Fix
10322# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
10323>>>(0x1BC.s+8)		ubyte&2		2			\b,TestDisk
10324#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
10325#>>>(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
10326#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
10327#>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
10328# for older versions
10329>>>(0x1BC.s+9)		ubyte		<2
10330#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
10331>>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
10332# floppy A: or B:
10333>>>>(0x1BC.s+13)	ubyte		<2			\b,floppy 0x%x
10334>>>>(0x1BC.s+13)	ubyte		>1
10335# 1st hard disc
10336#>>>>>(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
10337# not 1st hard disc
10338>>>>>(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
10339# for version >= 2 maximal timeout can be 65534
10340>>>(0x1BC.s+9)		ubyte		>1
10341#>>>>(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
10342>>>>(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
10343# floppy A: or B:
10344>>>>(0x1BC.s+14)	ubyte		<2			\b,floppy 0x%x
10345>>>>(0x1BC.s+14)	ubyte		>1
10346# 1st hard disc
10347#>>>>>(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
10348# not 1st hard disc
10349>>>>>(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
10350>>>0	ubyte		x					\b)
10351
10352# added by Joerg Jenderek
10353# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
10354# grub-1.94/kern/i386/pc/startup.S
10355# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
10356# usual values are marked with comments to get only informations of strange GRUB loaders
103570x200	uleshort		0x70EA
10358# found only version 3.{1,2}
10359>0x206		ubeshort	>0x0300
10360# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
10361>>0x212 	ubyte		>0x29
10362>>>0x213 	ubyte		>0x29
10363# not iso9660_stage1_5
10364#>>>0	ulelong&0x00BE5652	0x00BE5652
10365>>>>0x213 	ubyte		>0x29		GRand Unified Bootloader
10366# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
10367>>>>0x217 	ubyte		0xFF		stage1_5
10368>>>>0x217 	ubyte		<0xFF		stage2
10369>>>>0x206	ubyte		x		\b version %u
10370>>>>0x207	ubyte		x		\b.%u
10371# module_size for 1.94
10372>>>>0x208	ulelong		<0xffffff	\b, installed partition %u
10373#>>>>0x208	ulelong		=0xffffff	\b, %lu (default)
10374>>>>0x208	ulelong		>0xffffff	\b, installed partition %u
10375# GRUB 0.5.95 unofficial
10376>>>>0x20C	ulelong&0x2E300000 0x2E300000
10377# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
10378>>>>>0x20C	ubyte		x		\b, identifier 0x%x
10379#>>>>>0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
10380>>>>>0x20D	ubyte		>0		\b, LBA flag 0x%x
10381# GRUB version as string
10382>>>>>0x20E 	string		>\0		\b, GRUB version %-s
10383# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
10384>>>>>>0x215 	ulong		0xffffffff
10385>>>>>>>0x219 	string		>\0		\b, configuration file %-s
10386>>>>>>0x215 	ulong		!0xffffffff
10387>>>>>>>0x215 	string		>\0		\b, configuration file %-s
10388# newer GRUB versions
10389>>>>0x20C	ulelong&0x2E300000 !0x2E300000
10390##>>>>>0x20C	ulelong		=0		\b, saved entry %d (usual)
10391>>>>>0x20C	ulelong		>0		\b, saved entry %d
10392# for 1.94 contains kernel image size
10393# for 0.93,0.94,0.96,0.97
10394# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
10395>>>>>0x210	ubyte		x		\b, identifier 0x%x
10396# The flag for LBA forcing is in most cases 0
10397#>>>>>0x211	ubyte		=0		\b, LBA flag 0x%x (default)
10398>>>>>0x211	ubyte		>0		\b, LBA flag 0x%x
10399# GRUB version as string
10400>>>>>0x212 	string		>\0		\b, GRUB version %-s
10401# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
10402>>>>>0x217 	ulong		0xffffffff
10403>>>>>>0x21b 	string		>\0		\b, configuration file %-s
10404>>>>>0x217 	ulong		!0xffffffff
10405>>>>>>0x217 	string		>\0		\b, configuration file %-s
10406
10407# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
10408# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
10409# over BIOS parameter block (BPB)
10410# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
10411# older drives may use Near JuMP instruction E9 xx xx
10412# minimal short forward jump found 0x29 for bootloaders or 0x0
10413# maximal short forward jump is 0x7f
10414# OEM-ID is empty or contain readable bytes
104150		ulelong&0x804000E9	0x000000E9
10416!:strength	+60
10417# mtools-3.9.8/msdos.h
10418# usual values are marked with comments to get only informations of strange FAT systems
10419# valid sectorsize must be a power of 2 from 32 to 32768
10420>11		uleshort&0x001f	0
10421>>11		uleshort	<32769
10422>>>11		uleshort	>31
10423>>>>21		ubyte&0xf0	0xF0
10424>>>>>0		ubyte		0xEB		DOS/MBR boot sector
10425>>>>>>1		ubyte		x		\b, code offset 0x%x+2
10426>>>>>0		ubyte		0xE9
10427>>>>>>1		uleshort	x		\b, code offset 0x%x+3
10428>>>>>3		string		>\0		\b, OEM-ID "%-.8s"
10429#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
10430>>>>>>8		string		IHC		\b cached by Windows 9M
10431>>>>>11		uleshort	>512		\b, Bytes/sector %u
10432#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
10433>>>>>11		uleshort	<512		\b, Bytes/sector %u
10434>>>>>13		ubyte		>1		\b, sectors/cluster %u
10435#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
10436# for lazy FAT32 implementation like Transcend digital photo frame PF830
10437>>>>>82		string/c	fat32
10438>>>>>>14	uleshort	!32		\b, reserved sectors %u
10439#>>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
10440>>>>>82		string/c	!fat32
10441>>>>>>14	uleshort	>1		\b, reserved sectors %u
10442#>>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
10443#>>>>>>14	uleshort	0		\b, reserved sectors %u (usual NTFS)
10444>>>>>16		ubyte		>2		\b, FATs %u
10445#>>>>>16	ubyte		=2		\b, FATs %u (usual)
10446>>>>>16		ubyte		=1		\b, FAT  %u
10447>>>>>16		ubyte		>0
10448>>>>>17		uleshort	>0		\b, root entries %u
10449#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
10450>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
10451#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
10452>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
10453#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
10454>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
10455>>>>>22		uleshort	>0		\b, sectors/FAT %u
10456#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
10457>>>>>24		uleshort	x		\b, sectors/track %u
10458>>>>>26		ubyte		>2		\b, heads %u
10459#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
10460>>>>>26		ubyte		=1		\b, heads %u
10461# valid only for sector sizes with more then 32 Bytes
10462>>>>>11		uleshort	>32
10463# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
10464# skip for values 2,2Ah,70h,73h,DFh
10465# and continue for extended boot signature values 0,28h,29h,80h
10466>>>>>>38	ubyte&0x56	=0
10467>>>>>>>28	ulelong		>0		\b, hidden sectors %u
10468#>>>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
10469>>>>>>>32	ulelong		>0		\b, sectors %u (volumes > 32 MB)
10470#>>>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB)
10471# FAT<32 bit specific
10472>>>>>>>82	string/c	!fat32
10473#>>>>>>>>36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
10474#>>>>>>>>36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
10475>>>>>>>>36	ubyte		!0x80
10476>>>>>>>>>36	ubyte		!0		\b, physical drive 0x%x
10477# VGA-copy CRC or
10478# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
10479>>>>>>>>37	ubyte		>0		\b, reserved 0x%x
10480#>>>>>>>>37	ubyte		=0		\b, reserved 0x%x
10481# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
10482>>>>>>>>38	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
10483>>>>>>>>38	ubyte&0xFE	=0x28
10484>>>>>>>>>39	ulelong		x		\b, serial number 0x%x
10485>>>>>>>>38	ubyte		=0x29
10486>>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
10487>>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
10488>>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
10489# there exist some old floppies without word FAT at offset 54
10490# a word like "FATnm   " is only a hint for a FAT size on nm-bits
10491# Normally the number of clusters is calculated by the values of BPP.
10492# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
10493# otherwise FAT is 16 bit.
10494# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
10495>>>>>82		string/c	!fat32
10496>>>>>>54	string		FAT12		\b, FAT (12 bit)
10497>>>>>>54	string		FAT16		\b, FAT (16 bit)
10498>>>>>>54	default		x
10499# determinate FAT bit size by media descriptor
10500# small floppies implies FAT12
10501>>>>>>>21	ubyte		<0xF0		\b, FAT (12 bit by descriptor)
10502# with media descriptor F0h floppy or maybe superfloppy with FAT16
10503>>>>>>>21	ubyte		=0xF0
10504# superfloppy (many sectors) implies FAT16
10505>>>>>>>>32	ulelong		>0xFFFF		\b, FAT (16 bit by descriptor+sectors)
10506# no superfloppy with media descriptor F0h implies FAT12
10507>>>>>>>>32	default		x		\b, FAT (12 bit by descriptor+sectors)
10508# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
10509>>>>>>>21	ubyte		=0xF8
10510# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
10511>>>>>>>>19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
10512# hard disc with FAT12 or FAT16
10513>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
10514# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
10515>>>>>>>21	ubyte		=0xFA
10516# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
10517>>>>>>>>19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
10518# RAM disc with FAT12 or FAT16 or Tandy hard disc
10519>>>>>>>>19	default		x		\b, FAT (1Y bit by descriptor)
10520# others are floppy
10521>>>>>>>21	default		x		\b, FAT (12 bit by descriptor)
10522# FAT32 bit specific
10523>>>>>82		string/c	fat32		\b, FAT (32 bit)
10524>>>>>>36	ulelong		x		\b, sectors/FAT %u
10525# http://technet.microsoft.com/en-us/library/cc977221.aspx
10526>>>>>>40	uleshort	>0		\b, extension flags 0x%x
10527#>>>>>>40	uleshort	=0		\b, extension flags %hu
10528>>>>>>42	uleshort	>0		\b, fsVersion %u
10529#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
10530>>>>>>44	ulelong		>2		\b, rootdir cluster %u
10531#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
10532#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
10533>>>>>>48	uleshort	>1		\b, infoSector %u
10534#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
10535>>>>>>48	uleshort	<1		\b, infoSector %u
10536# 0 or 0xFFFF instead of usual 6 means no backup sector
10537>>>>>>50	uleshort	=0xFFFF		\b, no Backup boot sector
10538>>>>>>50	uleshort	=0		\b, no Backup boot sector
10539#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual)
10540>>>>>>50	default		x
10541>>>>>>>50	uleshort	x		\b, Backup boot sector %u
10542# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
10543>>>>>>52	ulelong		>0		\b, reserved1 0x%x
10544>>>>>>56	ulelong		>0		\b, reserved2 0x%x
10545>>>>>>60	ulelong		>0		\b, reserved3 0x%x
10546# same structure as FAT1X
10547#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
10548#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
10549>>>>>>64	ubyte		!0x80
10550>>>>>>>64	ubyte		>0		\b, physical drive 0x%x
10551# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
10552>>>>>>65	ubyte		>0		\b, reserved 0x%x
10553>>>>>>66	ubyte		!0x29		\b, dos < 4.0 BootSector (0x%x)
10554>>>>>>66	ubyte		=0x29
10555>>>>>>>67	ulelong		x		\b, serial number 0x%x
10556>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
10557>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
10558>>>>>>>71	string		=NO\ NAME	\b, unlabeled
10559# additional tests for floppy image added by Joerg Jenderek
10560# no fixed disk
10561>>>>>21		ubyte		!0xF8
10562# floppy media with 12 bit FAT
10563>>>>>>54	string		!FAT16
10564# test for FAT after bootsector
10565>>>>>>>(11.s)	ulelong&0x00ffffF0	0x00ffffF0	\b, followed by FAT
10566# floppy image
10567!:mime application/x-ima
10568# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
10569# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
10570# 0 FATs
10571>>>>>16	ubyte		=0
10572# 0 root entries
10573>>>>>>17	uleshort	=0
10574# 0 DOS sectors
10575>>>>>>>19	uleshort	=0
10576# 0 sectors/FAT
10577# dos < 4.0 BootSector value found is 0x80
10578#38	ubyte		=0x80			\b, dos < 4.0 BootSector (0x%x)
10579>>>>>>>>22	uleshort	=0		\b; NTFS
10580>>>>>>>>>24	uleshort	>0		\b, sectors/track %u
10581>>>>>>>>>36	ulelong		!0x800080	\b, physical drive 0x%x
10582>>>>>>>>>40	ulequad		>0		\b, sectors %lld
10583>>>>>>>>>48	ulequad		>0		\b, $MFT start cluster %lld
10584>>>>>>>>>56	ulequad		>0		\b, $MFTMirror start cluster %lld
10585# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
10586# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
10587>>>>>>>>>64	lelong		<256
10588>>>>>>>>>>64	lelong		<128		\b, clusters/RecordSegment %d
10589>>>>>>>>>>64	ubyte		>127		\b, bytes/RecordSegment 2^(-1*%i)
10590# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
10591# Values 128 to 255 represent index block sizes of 2^(256-N) byte
10592>>>>>>>>>68	ulelong		<256
10593>>>>>>>>>>68	ulelong		<128		\b, clusters/index block %d
10594#>>>>>>>>>>68	ulelong		>127		\b, bytes/index block 2^(256-%d)
10595>>>>>>>>>>68	ubyte		>127		\b, bytes/index block 2^(-1*%i)
10596>>>>>>>>>72	ulequad		x		\b, serial number 0%llx
10597>>>>>>>>>80	ulelong		>0		\b, checksum 0x%x
10598#>>>>>>>>>80	ulelong		=0		\b, checksum 0x%x=0 (usual)
10599>>>>>>>>>0x258	ulelong&0x00009090	=0x00009090
10600>>>>>>>>>>&-92		indirect	x	\b; contains
10601# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
10602# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
10603# unused assembler instructions JMP y2;NOP;NOP
106040x056		ulelong&0xFFFF0FFF	0x909002EB
10605# unicode loadername terminated by CTRL-D
10606>(0.s*2)	ulelong&0xFFFFFF00	0x00040000
10607# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
10608>>0x002		lestring16	x	Microsoft Windows XP/VISTA bootloader %-5.5s
10609>>0x12		string		$
10610>>>0x0c		lestring16	x	\b%-2.2s
10611### DOS,NTFS boot sectors end
10612
10613# ntfsclone-image is a special save format for NTFS volumes,
10614# created and restored by the ntfsclone program
106150	string	\0ntfsclone-image	ntfsclone image,
10616>0x10	byte	x			version %d.
10617>0x11	byte	x			\b%d,
10618>0x12	lelong	x			cluster size %d,
10619>0x16	lequad	x			device size %lld,
10620>0x1e	lequad	x			%lld total clusters,
10621>0x26	lequad	x			%lld clusters in use
10622
106239564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
10624>8404	string		x		last mounted on %s,
10625#>9504	ledate		x		last checked at %s,
10626>8224	ledate		x		last written at %s,
10627>8401	byte		x		clean flag %d,
10628>8228	lelong		x		number of blocks %d,
10629>8232	lelong		x		number of data blocks %d,
10630>8236	lelong		x		number of cylinder groups %d,
10631>8240	lelong		x		block size %d,
10632>8244	lelong		x		fragment size %d,
10633>8252	lelong		x		minimum percentage of free blocks %d,
10634>8256	lelong		x		rotational delay %dms,
10635>8260	lelong		x		disk rotational speed %drps,
10636>8320	lelong		0		TIME optimization
10637>8320	lelong		1		SPACE optimization
10638
1063942332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
10640>&-1164	string		x		last mounted on %s,
10641>&-696	string		>\0		volume name %s,
10642>&-304	leqldate	x		last written at %s,
10643>&-1167	byte		x		clean flag %d,
10644>&-1168	byte		x		readonly flag %d,
10645>&-296	lequad		x		number of blocks %lld,
10646>&-288	lequad		x		number of data blocks %lld,
10647>&-1332	lelong		x		number of cylinder groups %d,
10648>&-1328	lelong		x		block size %d,
10649>&-1324	lelong		x		fragment size %d,
10650>&-180	lelong		x		average file size %d,
10651>&-176	lelong		x		average number of files in dir %d,
10652>&-272	lequad		x		pending blocks to free %lld,
10653>&-264	lelong		x		pending inodes to free %d,
10654>&-664	lequad		x		system-wide uuid %0llx,
10655>&-1316	lelong		x		minimum percentage of free blocks %d,
10656>&-1248	lelong		0		TIME optimization
10657>&-1248	lelong		1		SPACE optimization
10658
1065966908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
10660>&-1164	string		x		last mounted on %s,
10661>&-696	string		>\0		volume name %s,
10662>&-304	leqldate	x		last written at %s,
10663>&-1167	byte		x		clean flag %d,
10664>&-1168	byte		x		readonly flag %d,
10665>&-296	lequad		x		number of blocks %lld,
10666>&-288	lequad		x		number of data blocks %lld,
10667>&-1332	lelong		x		number of cylinder groups %d,
10668>&-1328	lelong		x		block size %d,
10669>&-1324	lelong		x		fragment size %d,
10670>&-180	lelong		x		average file size %d,
10671>&-176	lelong		x		average number of files in dir %d,
10672>&-272	lequad		x		pending blocks to free %lld,
10673>&-264	lelong		x		pending inodes to free %d,
10674>&-664	lequad		x		system-wide uuid %0llx,
10675>&-1316	lelong		x		minimum percentage of free blocks %d,
10676>&-1248	lelong		0		TIME optimization
10677>&-1248	lelong		1		SPACE optimization
10678
106799564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
10680>7168   belong		0x4c41424c	Apple UFS Volume
10681>>7186  string		x		named %s,
10682>>7176  belong		x		volume label version %d,
10683>>7180  bedate		x		created on %s,
10684>8404	string		x		last mounted on %s,
10685#>9504	bedate		x		last checked at %s,
10686>8224	bedate		x		last written at %s,
10687>8401	byte		x		clean flag %d,
10688>8228	belong		x		number of blocks %d,
10689>8232	belong		x		number of data blocks %d,
10690>8236	belong		x		number of cylinder groups %d,
10691>8240	belong		x		block size %d,
10692>8244	belong		x		fragment size %d,
10693>8252	belong		x		minimum percentage of free blocks %d,
10694>8256	belong		x		rotational delay %dms,
10695>8260	belong		x		disk rotational speed %drps,
10696>8320	belong		0		TIME optimization
10697>8320	belong		1		SPACE optimization
10698
1069942332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
10700>&-1164	string		x		last mounted on %s,
10701>&-696	string		>\0		volume name %s,
10702>&-304	beqldate	x		last written at %s,
10703>&-1167	byte		x		clean flag %d,
10704>&-1168	byte		x		readonly flag %d,
10705>&-296	bequad		x		number of blocks %lld,
10706>&-288	bequad		x		number of data blocks %lld,
10707>&-1332	belong		x		number of cylinder groups %d,
10708>&-1328	belong		x		block size %d,
10709>&-1324	belong		x		fragment size %d,
10710>&-180	belong		x		average file size %d,
10711>&-176	belong		x		average number of files in dir %d,
10712>&-272	bequad		x		pending blocks to free %lld,
10713>&-264	belong		x		pending inodes to free %d,
10714>&-664	bequad		x		system-wide uuid %0llx,
10715>&-1316	belong		x		minimum percentage of free blocks %d,
10716>&-1248	belong		0		TIME optimization
10717>&-1248	belong		1		SPACE optimization
10718
1071966908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
10720>&-1164	string		x		last mounted on %s,
10721>&-696	string		>\0		volume name %s,
10722>&-304	beqldate	x		last written at %s,
10723>&-1167	byte		x		clean flag %d,
10724>&-1168	byte		x		readonly flag %d,
10725>&-296	bequad		x		number of blocks %lld,
10726>&-288	bequad		x		number of data blocks %lld,
10727>&-1332	belong		x		number of cylinder groups %d,
10728>&-1328	belong		x		block size %d,
10729>&-1324	belong		x		fragment size %d,
10730>&-180	belong		x		average file size %d,
10731>&-176	belong		x		average number of files in dir %d,
10732>&-272	bequad		x		pending blocks to free %lld,
10733>&-264	belong		x		pending inodes to free %d,
10734>&-664	bequad		x		system-wide uuid %0llx,
10735>&-1316	belong		x		minimum percentage of free blocks %d,
10736>&-1248	belong		0		TIME optimization
10737>&-1248	belong		1		SPACE optimization
10738
107390	ulequad		0xc8414d4dc5523031	HAMMER filesystem (little-endian),
10740>0x90	lelong+1	x			volume %d
10741>0x94	lelong		x			(of %d),
10742>0x50	string		x			name %s,
10743>0x98	ulelong		x			version %u,
10744>0xa0	ulelong		x			flags 0x%x
10745
10746# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca>
10747# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net>
10748# volume label and UUID Russell Coker
10749# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
107500x438   leshort         0xEF53          Linux
10751>0x44c  lelong          x               rev %d
10752>0x43e  leshort         x               \b.%d
10753# No journal?  ext2
10754>0x45c  lelong          ^0x0000004      ext2 filesystem data
10755>>0x43a leshort         ^0x0000001      (mounted or unclean)
10756# Has a journal?  ext3 or ext4
10757>0x45c  lelong          &0x0000004
10758#  and small INCOMPAT?
10759>>0x460 lelong          <0x0000040
10760#   and small RO_COMPAT?
10761>>>0x464 lelong         <0x0000008      ext3 filesystem data
10762#   else large RO_COMPAT?
10763>>>0x464 lelong         >0x0000007      ext4 filesystem data
10764#  else large INCOMPAT?
10765>>0x460	lelong          >0x000003f      ext4 filesystem data
10766>0x468	belong		x		\b, UUID=%08x
10767>0x46c	beshort		x		\b-%04x
10768>0x46e	beshort		x		\b-%04x
10769>0x470	beshort		x		\b-%04x
10770>0x472	belong		x		\b-%08x
10771>0x476	beshort		x		\b%04x
10772>0x478	string		>0		\b, volume name "%s"
10773# General flags for any ext* fs
10774>0x460	lelong          &0x0000004      (needs journal recovery)
10775>0x43a	leshort         &0x0000002      (errors)
10776# INCOMPAT flags
10777>0x460	lelong          &0x0000001      (compressed)
10778#>0x460	lelong          &0x0000002      (filetype)
10779#>0x460	lelong          &0x0000010      (meta bg)
10780>0x460	lelong          &0x0000040      (extents)
10781>0x460	lelong          &0x0000080      (64bit)
10782#>0x460	lelong          &0x0000100      (mmp)
10783#>0x460	lelong          &0x0000200      (flex bg)
10784# RO_INCOMPAT flags
10785#>0x464	lelong          &0x0000001      (sparse super)
10786>0x464	lelong          &0x0000002      (large files)
10787>0x464	lelong          &0x0000008      (huge files)
10788#>0x464	lelong          &0x0000010      (gdt checksum)
10789#>0x464	lelong          &0x0000020      (many subdirs)
10790#>0x463	lelong          &0x0000040      (extra isize)
10791
10792# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
107930x400	lelong		0xF2F52010	F2FS filesystem
10794>0x46c	belong		x		\b, UUID=%08x
10795>0x470	beshort		x		\b-%04x
10796>0x472	beshort		x		\b-%04x
10797>0x474	beshort		x		\b-%04x
10798>0x476	belong		x		\b-%08x
10799>0x47a	beshort		x		\b%04x
10800>0x147c	lestring16	x		\b, volume name "%s"
10801
10802# Minix filesystems - Juan Cespedes <cespedes@debian.org>
108030x410	leshort		0x137f
10804!:strength / 2
10805>0x402	beshort		< 100
10806>0x402	beshort		> -1		Minix filesystem, V1, 14 char names, %d zones
10807>0x1e	string		minix		\b, bootable
108080x410	beshort		0x137f
10809!:strength / 2
10810>0x402	beshort		< 100
10811>0x402	beshort		> -1		Minix filesystem, V1 (big endian), %d zones
10812>0x1e	string		minix		\b, bootable
108130x410	leshort		0x138f
10814!:strength / 2
10815>0x402	beshort		< 100
10816>0x402	beshort		> -1		Minix filesystem, V1, 30 char names, %d zones
10817>0x1e	string		minix		\b, bootable
108180x410	beshort		0x138f
10819!:strength / 2
10820>0x402	beshort		< 100
10821>0x402	beshort		> -1		Minix filesystem, V1, 30 char names (big endian), %d zones
10822>0x1e	string		minix		\b, bootable
10823# Weak Magic: this is $x
10824#0x410	leshort		0x2468
10825#>0x402	beshort		< 100
10826#>>0x402	beshort		> -1		Minix filesystem, V2, 14 char names
10827#>0x1e	string		minix		\b, bootable
10828#0x410	beshort		0x2468
10829#>0x402	beshort		< 100
10830#>0x402	beshort		> -1		Minix filesystem, V2 (big endian)
10831#>0x1e	string		minix		\b, bootable
10832#0x410	leshort		0x2478
10833#>0x402	beshort		< 100
10834#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
10835#>0x1e	string		minix		\b, bootable
10836#0x410	leshort		0x2478
10837#>0x402	beshort		< 100
10838#>0x402	beshort		> -1		Minix filesystem, V2, 30 char names
10839#>0x1e	string		minix		\b, bootable
10840#0x410	beshort		0x2478
10841#>0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian)
10842#>0x1e	string		minix		\b, bootable
10843# Weak Magic! this is MD
10844#0x418	leshort		0x4d5a
10845#>0x402	beshort		<100
10846#>>0x402	beshort		> -1		Minix filesystem, V3, 60 char names
10847
10848# SGI disk labels - Nathan Scott <nathans@debian.org>
108490	belong		0x0BE5A941	SGI disk label (volume header)
10850
10851# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
108520	belong		0x58465342	SGI XFS filesystem data
10853>0x4	belong		x		(blksz %d,
10854>0x68	beshort		x		inosz %d,
10855>0x64	beshort		^0x2004		v1 dirs)
10856>0x64	beshort		&0x2004		v2 dirs)
10857
10858############################################################################
10859# Minix-ST kernel floppy
108600x800	belong		0x46fc2700	Atari-ST Minix kernel image
10861# http://en.wikipedia.org/wiki/BIOS_parameter_block
10862# floppies with valid BPB and any instruction at beginning
10863>19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
10864>19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy
10865
10866############################################################################
10867# Hmmm, is this a better way of detecting _standard_ floppy images ?
1086819	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
10869>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1087019	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
10871>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1087219	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
10873>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
10874
1087519	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
10876>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
1087719	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
10878>0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
10879
1088019	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
1088119	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
10882#			|       |   |     |     |
10883#			|       |   |     |     heads
10884#			|       |   |     sectors/track
10885#			|       |   sectors/FAT
10886#			|       media descriptor
10887#		BPB:	sectors
10888
10889#  Valid media descriptor bytes for MS-DOS:
10890#
10891#     Byte   Capacity   Media Size and Type
10892#     -------------------------------------------------
10893#
10894#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
10895#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
10896#     F9     720K       3.5-inch, 2-sided, 9-sector
10897#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
10898#     FD     360K       5.25-inch, 2-sided, 9-sector
10899#     FF     320K       5.25-inch, 2-sided, 8-sector
10900#     FC     180K       5.25-inch, 1-sided, 9-sector
10901#     FE     160K       5.25-inch, 1-sided, 8-sector
10902#     FE     250K       8-inch, 1-sided, single-density
10903#     FD     500K       8-inch, 2-sided, single-density
10904#     FE     1.2 MB     8-inch, 2-sided, double-density
10905#     F8     -----      Fixed disk
10906#
10907#     FC     xxxK       Apricot 70x1x9 boot disk.
10908#
10909# Originally a bitmap:
10910#  xxxxxxx0	Not two sided
10911#  xxxxxxx1	Double sided
10912#  xxxxxx0x	Not 8 SPT
10913#  xxxxxx1x	8 SPT
10914#  xxxxx0xx	Not Removable drive
10915#  xxxxx1xx	Removable drive
10916#  11111xxx	Must be one.
10917#
10918# But now it's rather random:
10919#  111111xx	Low density disk
10920#        00	SS, Not 8 SPT
10921#        01	DS, Not 8 SPT
10922#        10	SS, 8 SPT
10923#        11	DS, 8 SPT
10924#
10925#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
10926#  11110000	High density 3 1/2 floppy disk
10927#  11111000	Hard disk any format
10928#
10929
10930# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
10931# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
10932# Too Weak.
10933#512		ubelong&0xE0ffff00	0xE0ffff00
10934# without valid Media descriptor in place of BPB, cases with are done at other places
10935#>21		ubyte			<0xE5			floppy with old FAT filesystem
10936# but valid Media descriptor at begin of FAT
10937#>>512		ubyte			=0xed			720k
10938#>>512		ubyte			=0xf0			1440k
10939#>>512		ubyte			=0xf8			720k
10940#>>512		ubyte			=0xf9			1220k
10941#>>512		ubyte			=0xfa			320k
10942#>>512		ubyte			=0xfb			640k
10943#>>512		ubyte			=0xfc			180k
10944# look like an an old DOS directory entry
10945#>>>0xA0E	ubequad			0
10946#>>>>0xA00	ubequad			!0
10947#!:mime application/x-ima
10948#>>512		ubyte			=0xfd
10949# look for 2nd FAT at different location to distinguish between 360k and 500k
10950#>>>0x600	ubelong&0xE0ffff00	0xE0ffff00		360k
10951#>>>0x500	ubelong&0xE0ffff00	0xE0ffff00		500k
10952#>>>0xA0E	ubequad			0
10953#!:mime application/x-ima
10954#>>512		ubyte			=0xfe
10955#>>>0x400	ubelong&0xE0ffff00	0xE0ffff00		160k
10956#>>>>0x60E	ubequad			0
10957#>>>>>0x600	ubequad			!0
10958#!:mime application/x-ima
10959#>>>0xC00	ubelong&0xE0ffff00	0xE0ffff00		1200k
10960#>>512		ubyte			=0xff			320k
10961#>>>0x60E	ubequad			0
10962#>>>>0x600	ubequad			!0
10963#!:mime application/x-ima
10964#>>512		ubyte			x			\b, Media descriptor 0x%x
10965# without x86 jump instruction
10966#>>0		ulelong&0x804000E9	!0x000000E9
10967# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
10968#>>>0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
10969# IOSYS.COM+MSDOS.COM
10970#>>>>0xc4	use			2xDOS-filename
10971#>>0		ulelong&0x804000E9	=0x000000E9
10972# only x86 short jump instruction found
10973#>>>0		ubyte			=0xEB
10974#>>>>1		ubyte			x			\b, code offset 0x%x+2
10975# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
10976# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
10977#>>>>(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
10978# ibmbio.com+ibmdos.com
10979#>>>>>0x176	use			DOS-filename
10980#>>>>>0x181	ubyte			x			\b+
10981#>>>>>0x182	use			DOS-filename
10982# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
10983# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
10984#>>>>(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
10985# ibmbio.com+ibmdos.com
10986#>>>>>0x18b	use			DOS-filename
10987#>>>>>0x196	ubyte			x			\b+
10988#>>>>>0x197	use			DOS-filename
10989# http://en.wikipedia.org/wiki/Zenith_Data_Systems
10990# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
10991#>>>>(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
10992# IO.SYS+MSDOS.SYS
10993#>>>>>0x20	use			2xDOS-filename
10994# http://en.wikipedia.org/wiki/Corona_Data_Systems
10995# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
10996#>>>>(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
10997# IO.SYS+MSDOS.SYS
10998#>>>>>0x69	use			2xDOS-filename
10999# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
11000#>>>>(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
11001# defect IO.SYS+MSDOS.SYS ?
11002#>>>>>0x162	use			2xDOS-filename
11003
110040	name				cdrom
11005>38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
11006!:mime	application/x-iso9660-image
11007!:ext	iso/iso9660
11008>38913	string    NSR0      UDF filesystem data
11009!:mime	application/x-iso9660-image
11010!:ext	iso/udf
11011>>38917	string    1         (version 1.0)
11012>>38917	string    2         (version 1.5)
11013>>38917	string    3         (version 2.0)
11014>>38917	byte     >0x33      (unknown version, ID 0x%X)
11015>>38917	byte     <0x31      (unknown version, ID 0x%X)
11016# The next line is not necessary because the MBR staff is done looking for boot signature
11017>0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
11018# "application id" which appears to be used as a volume label
11019>32808	string/T  >\0       '%s'
11020>34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
1102137633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
11022!:mime	application/x-iso9660-image
1102332777	string    CDROM     High Sierra CD-ROM filesystem data
11024
11025# CDROM Filesystems
11026# https://en.wikipedia.org/wiki/ISO_9660
11027# Modified for UDF by gerardo.cacciari@gmail.com
1102832769	string    CD001
11029# mime line at that position does not work
11030# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
11031#!:strength -11
11032# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
11033!:strength +34
11034>0	use	cdrom
11035
11036# URL: https://en.wikipedia.org/wiki/NRG_(file_format)
11037# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
11038#	11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
11039# From: Joerg Jenderek
11040# Note:	Only for nero disc with once (DAO) type after 300 KB header
11041339969	string    CD001	Nero CD image at 0x4B000
11042!:mime	application/x-nrg
11043!:ext	nrg
11044>307200	use cdrom
11045
11046# .cso files
11047# Reference: http://pismotec.com/ciso/ciso.h
11048# NOTE: There are two other formats with the same magic but
11049# completely incompatible specifications:
11050# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
11051# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
110520    string    CISO
11053# Other fields are used to determine what type of CISO this is:
11054# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
11055# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
11056# - None of the above: Compact ISO.
11057>4	lelong	!0
11058>>4	lelong	!0x200000
11059>>>0x10	lelong	!0x800		Compressed ISO CD image
11060
11061# cramfs filesystem - russell@coker.com.au
110620       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
11063>4      lelong  x size %u
11064>8      lelong  &1 version #2
11065>8      lelong  &2 sorted_dirs
11066>8      lelong  &4 hole_support
11067>32     lelong  x CRC 0x%x,
11068>36     lelong  x edition %u,
11069>40     lelong  x %u blocks,
11070>44     lelong  x %u files
11071
110720       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
11073>4      belong  x size %u
11074>8      belong  &1 version #2
11075>8      belong  &2 sorted_dirs
11076>8      belong  &4 hole_support
11077>32     belong  x CRC 0x%x,
11078>36     belong  x edition %u,
11079>40     belong  x %u blocks,
11080>44     belong  x %u files
11081
11082# reiserfs - russell@coker.com.au
110830x10034		string	ReIsErFs	ReiserFS V3.5
110840x10034		string	ReIsEr2Fs	ReiserFS V3.6
110850x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
11086>0x1002c 	leshort	x		block size %d
11087>0x10032	leshort	&2		(mounted or unclean)
11088>0x10000	lelong	x		num blocks %d
11089>0x10040	lelong	1		tea hash
11090>0x10040	lelong	2		yura hash
11091>0x10040	lelong	3		r5 hash
11092
11093# JFFS - russell@coker.com.au
110940	lelong	0x34383931	Linux Journalled Flash File system, little endian
110950	belong	0x34383931	Linux Journalled Flash File system, big endian
11096
11097# EST flat binary format (which isn't, but anyway)
11098# From: Mark Brown <broonie@sirena.org.uk>
110990	string	ESTFBINR	EST flat binary
11100
11101# Aculab VoIP firmware
11102# From: Mark Brown <broonie@sirena.org.uk>
111030	string	VoIP\ Startup\ and	Aculab VoIP firmware
11104>35	string	x	format %s
11105
11106# From: Mark Brown <broonie@sirena.org.uk> [old]
11107# From: Behan Webster <behanw@websterwood.com>
111080	belong	0x27051956	u-boot legacy uImage,
11109>32	string	x		%s,
11110>28	byte	0		Invalid os/
11111>28	byte	1		OpenBSD/
11112>28	byte	2		NetBSD/
11113>28	byte	3		FreeBSD/
11114>28	byte	4		4.4BSD/
11115>28	byte	5		Linux/
11116>28	byte	6		SVR4/
11117>28	byte	7		Esix/
11118>28	byte	8		Solaris/
11119>28	byte	9		Irix/
11120>28	byte	10		SCO/
11121>28	byte	11		Dell/
11122>28	byte	12		NCR/
11123>28	byte	13		LynxOS/
11124>28	byte	14		VxWorks/
11125>28	byte	15		pSOS/
11126>28	byte	16		QNX/
11127>28	byte	17		Firmware/
11128>28	byte	18		RTEMS/
11129>28	byte	19		ARTOS/
11130>28	byte	20		Unity OS/
11131>28	byte	21		INTEGRITY/
11132>29	byte	0		\bInvalid CPU,
11133>29	byte	1		\bAlpha,
11134>29	byte	2		\bARM,
11135>29	byte	3		\bIntel x86,
11136>29	byte	4		\bIA64,
11137>29	byte	5		\bMIPS,
11138>29	byte	6		\bMIPS 64-bit,
11139>29	byte	7		\bPowerPC,
11140>29	byte	8		\bIBM S390,
11141>29	byte	9		\bSuperH,
11142>29	byte	10		\bSparc,
11143>29	byte	11		\bSparc 64-bit,
11144>29	byte	12		\bM68K,
11145>29	byte	13		\bNios-32,
11146>29	byte	14		\bMicroBlaze,
11147>29	byte	15		\bNios-II,
11148>29	byte	16		\bBlackfin,
11149>29	byte	17		\bAVR32,
11150>29	byte	18		\bSTMicroelectronics ST200,
11151>29	byte	19		\bSandbox architecture,
11152>29	byte	20		\bANDES Technology NDS32,
11153>29	byte	21		\bOpenRISC 1000,
11154>29	byte	22		\bARM 64-bit,
11155>29	byte	23		\bDesignWare ARC,
11156>29	byte	24		\bx86_64,
11157>29	byte	25		\bXtensa,
11158>30	byte	0		Invalid Image
11159>30	byte	1		Standalone Program
11160>30	byte	2		OS Kernel Image
11161>30	byte	3		RAMDisk Image
11162>30	byte	4		Multi-File Image
11163>30	byte	5		Firmware Image
11164>30	byte	6		Script File
11165>30	byte	7		Filesystem Image (any type)
11166>30	byte	8		Binary Flat Device Tree BLOB
11167>31	byte	0		(Not compressed),
11168>31	byte	1		(gzip),
11169>31	byte	2		(bzip2),
11170>31	byte	3		(lzma),
11171>12	belong	x		%d bytes,
11172>8	bedate	x		%s,
11173>16	belong	x		Load Address: 0x%08X,
11174>20	belong	x		Entry Point: 0x%08X,
11175>4	belong	x		Header CRC: 0x%08X,
11176>24	belong	x		Data CRC: 0x%08X
11177
11178# JFFS2 file system
111790	leshort	0x1984		Linux old jffs2 filesystem data little endian
111800	leshort	0x1985		Linux jffs2 filesystem data little endian
11181
11182# Squashfs
111830	string	sqsh	Squashfs filesystem, big endian,
11184>28	beshort	x	version %d.
11185>30	beshort x	\b%d,
11186>28	beshort <3
11187>>8	belong	x	%d bytes,
11188>28	beshort >2
11189>>28 beshort <4
11190>>>63	bequad x	%lld bytes,
11191>>28 beshort >3
11192>>>40	bequad x	%lld bytes,
11193#>>67	belong	x	%d bytes,
11194>4	belong	x	%d inodes,
11195>28	beshort <2
11196>>32	beshort	x	blocksize: %d bytes,
11197>28	beshort >1
11198>>28 beshort <4
11199>>>51	belong	x	blocksize: %d bytes,
11200>>28 beshort >3
11201>>>12	belong	x	blocksize: %d bytes,
11202>28 beshort <4
11203>>39	bedate	x	created: %s
11204>28 beshort >3
11205>>8	bedate	x	created: %s
112060	string	hsqs	Squashfs filesystem, little endian,
11207>28	leshort	x	version %d.
11208>30	leshort	x	\b%d,
11209>28	leshort <3
11210>>8	lelong	x	%d bytes,
11211>28	leshort >2
11212>>28 leshort <4
11213>>>63	lequad x	%lld bytes,
11214>>28 leshort >3
11215>>>40	lequad x	%lld bytes,
11216#>>63	lelong	x	%d bytes,
11217>4	lelong	x	%d inodes,
11218>28	leshort <2
11219>>32	leshort	x	blocksize: %d bytes,
11220>28	leshort >1
11221>>28 leshort <4
11222>>>51	lelong	x	blocksize: %d bytes,
11223>>28 leshort >3
11224>>>12	lelong	x	blocksize: %d bytes,
11225>28 leshort <4
11226>>39	ledate	x	created: %s
11227>28 leshort >3
11228>>8	ledate	x	created: %s
11229
11230# AFS Dump Magic
11231# From: Ty Sarna <tsarna@sarna.org>
112320       string                  \x01\xb3\xa1\x13\x22    AFS Dump
11233>&0     belong                  x                       (v%d)
11234>>&0    byte                    0x76
11235>>>&0   belong                  x                       Vol %d,
11236>>>>&0  byte                    0x6e
11237>>>>>&0 string                  x                       %s
11238>>>>>>&1        byte            0x74
11239>>>>>>>&0       beshort         2
11240>>>>>>>>&4      bedate          x                       on: %s
11241>>>>>>>>&0      bedate          =0                      full dump
11242>>>>>>>>&0      bedate          !0                      incremental since: %s
11243
11244#----------------------------------------------------------
11245#delta ISO    Daniel Novotny (dnovotny@redhat.com)
112460	string  DISO	Delta ISO data
11247!:strength +50
11248>4	belong  x	version %d
11249
11250# VMS backup savesets - gerardo.cacciari@gmail.com
11251#
112524            string  \x01\x00\x01\x00\x01\x00
11253>(0.s+16)    string  \x01\x01
11254>>&(&0.b+8)  byte    0x42       OpenVMS backup saveset data
11255>>>40        lelong  x          (block size %d,
11256>>>49        string  >\0        original name '%s',
11257>>>2         short   1024       VAX generated)
11258>>>2         short   2048       AXP generated)
11259>>>2         short   4096       I64 generated)
11260
11261# Summary: Oracle Clustered Filesystem
11262# Created by: Aaron Botsis <redhat@digitalmafia.org>
112638	string		OracleCFS	Oracle Clustered Filesystem,
11264>4	long		x		rev %d
11265>0	long		x		\b.%d,
11266>560	string		x		label: %.64s,
11267>136	string		x		mountpoint: %.128s
11268
11269# Summary: Oracle ASM tagged volume
11270# Created by: Aaron Botsis <redhat@digitalmafia.org>
1127132	string		ORCLDISK	Oracle ASM Volume,
11272>40	string		x		Disk Name: %0.12s
1127332	string		ORCLCLRD	Oracle ASM Volume (cleared),
11274>40	string		x		Disk Name: %0.12s
11275
11276# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
112778	string		OracleCFS	Oracle Clustered Filesystem,
11278>4	long		x		rev %d
11279>0	long		x		\b.%d,
11280>560	string		x		label: %.64s,
11281>136	string		x		mountpoint: %.128s
11282
11283# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
1128432	string		ORCLDISK	Oracle ASM Volume,
11285>40	string		x		Disk Name: %0.12s
1128632	string		ORCLCLRD	Oracle ASM Volume (cleared),
11287>40	string		x		Disk Name: %0.12s
11288
11289# Compaq/HP RILOE floppy image
11290# From: Dirk Jagdmann <doj@cubic.org>
112910	string	CPQRFBLO	Compaq/HP RILOE floppy image
11292
11293#------------------------------------------------------------------------------
11294# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
11295# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
11296# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
11297#
112981008    string          DECFILE11       Files-11 On-Disk Structure
11299>525    byte            x               (ODS-%d);
11300>1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
11301>1017   string          B
11302>>525   byte            2               VAX/VMS or OpenVMS file system;
11303>>525   byte            5               OpenVMS Alpha or Itanium file system;
11304>984    string          x               volume label is '%-12.12s'
11305
11306# From: Thomas Klausner <wiz@NetBSD.org>
11307# http://filext.com/file-extension/DAA
11308# describes the daa file format. The magic would be:
113090	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive
11310
11311# From Albert Cahalan <acahalan@gmail.com>
11312# really le32 operation,destination,payloadsize (but quite predictable)
11313# 01 00 00 00 00 00 00 c0 00 02 00 00
113140	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware
11315
11316# From Eric Sandeen
11317# GFS2
113180x10000         belong          0x01161970
11319>0x10018        belong          0x0000051d      GFS1 Filesystem
11320>>0x10024        belong          x               (blocksize %d,
11321>>0x10060        string          >\0             lockproto %s)
11322>0x10018        belong          0x00000709      GFS2 Filesystem
11323>>0x10024        belong          x               (blocksize %d,
11324>>0x10060        string          >\0             lockproto %s)
11325
11326# Russell Coker <russell@coker.com.au>
113270x10040		string	_BHRfS_M	BTRFS Filesystem
11328>0x1012b	string	>\0		label "%s",
11329>0x10090	lelong	x		sectorsize %d,
11330>0x10094	lelong	x		nodesize %d,
11331>0x10098	lelong	x		leafsize %d,
11332>0x10020	belong	x		UUID=%08x-
11333>0x10024	beshort	x		\b%04x-
11334>0x10026	beshort	x		\b%04x-
11335>0x10028	beshort	x		\b%04x-
11336>0x1002a	beshort	x		\b%04x
11337>0x1002c	belong	x		\b%08x,
11338>0x10078	lequad	x		%lld/
11339>0x10070	lequad	x		\b%lld bytes used,
11340>0x10088	lequad	x		%lld devices
11341
11342# dvdisaster's .ecc
11343# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
113440	string	*dvdisaster*	dvdisaster error correction file
11345
11346# xfs metadump image
11347# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
11348# but can we do the << ?  For now it's always 512 (0x200) anyway.
113490	string XFSM
11350>0x200	string XFSB	XFS filesystem metadump image
11351
11352# Type:	CROM filesystem
11353# From:	Werner Fink <werner@suse.de>
113540	string	CROMFS	CROMFS
11355>6	string	>\0	\b version %2.2s,
11356>8	ulequad	>0	\b block data at %lld,
11357>16	ulequad	>0	\b fblock table at %lld,
11358>24	ulequad	>0	\b inode table at %lld,
11359>32	ulequad	>0	\b root at %lld,
11360>40	ulelong	>0	\b fblock size = %d,
11361>44	ulelong	>0	\b block size = %d,
11362>48	ulequad	>0	\b bytes = %lld
11363
11364# Type:	xfs metadump image
11365# From:	Daniel Novotny <dnovotny@redhat.com>
11366# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
11367# but can we do the << ? For now it's always 512 (0x200) anyway.
113680	string	XFSM
11369>0x200	string	XFSB	XFS filesystem metadump image
11370
11371# Type:	delta ISO
11372# From:	Daniel Novotny <dnovotny@redhat.com>
113730	string	DISO	Delta ISO data,
11374>4	belong	x	version %d
11375
11376# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
11377# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
11378# From: Adam Buchbinder <adam.buchbinder@gmail.com>
113790x8000	string	JFS1
11380# Because it's text-only magic, check a binary value (version) to be sure.
11381# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
11382# mountable.
11383>&0	lelong	<3	JFS2 filesystem image
11384# Label is followed by a UUID; we have to limit string length to avoid
11385# appending the UUID in the case of a 16-byte label.
11386>>&144	regex	[\x20-\x7E]{1,16}	(label "%s")
11387>>&0	lequad	x	\b, %lld blocks
11388>>&8	lelong	x	\b, blocksize %d
11389>>&32	lelong&0x00000006	>0	(dirty)
11390>>&36	lelong	>0	(compressed)
11391
11392# LFS
113930	lelong	0x070162	LFS filesystem image
11394>4	lelong	1		version 1,
11395>>8	lelong	x		\b blocks %u,
11396>>12	lelong	x		\b blocks per segment %u,
11397>4	lelong	2		version 2,
11398>>8	lelong	x		\b fragments %u,
11399>>12	lelong	x		\b bytes per segment %u,
11400>16	lelong	x		\b disk blocks %u,
11401>20	lelong	x		\b block size %u,
11402>24	lelong	x		\b fragment size %u,
11403>28	lelong	x		\b fragments per block %u,
11404>32	lelong	x		\b start for free list %u,
11405>36	lelong	x		\b number of free blocks %d,
11406>40	lelong	x		\b number of files %u,
11407>44	lelong	x		\b blocks available for writing %d,
11408>48	lelong	x		\b inodes in cache %d,
11409>52	lelong	x		\b inode file disk address 0x%x,
11410>56	lelong	x		\b inode file inode number %u,
11411>60	lelong	x		\b address of last segment written 0x%x,
11412>64	lelong	x		\b address of next segment to write 0x%x,
11413>68	lelong	x		\b address of current segment written 0x%x
11414
114150	string	td\000		floppy image data (TeleDisk, compressed)
114160	string	TD\000		floppy image data (TeleDisk)
11417
114180	string	CQ\024		floppy image data (CopyQM,
11419>16	leshort	x		%d sectors,
11420>18	leshort	x		%d heads.)
11421
114220	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)
11423
114240	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
114250	beshort	0xAA59		floppy image data (IBM SaveDskF)
114260	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)
11427
114280	string	\074CPM_Disk\076	disk image data (YAZE)
11429
11430# ReFS
11431# Richard W.M. Jones <rjones@redhat.com>
114320	string	\0\0\0ReFS\0	ReFS filesystem image
11433
11434# EFW encase image file format:
11435# Gregoire Passault
11436# http://www.forensicswiki.org/wiki/Encase_image_file_format
114370	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format
11438
11439# UBIfs
11440# Linux kernel sources: fs/ubifs/ubifs-media.h
114410	lelong	0x06101831
11442>0x16	leshort	0		UBIfs image
11443>0x08	lequad	x		\b, sequence number %llu
11444>0x10	leshort x		\b, length %u
11445>0x04	lelong	x		\b, CRC 0x%08x
11446
114470	lelong	0x23494255
11448>0x04	leshort	<2
11449>0x05	string	\0\0\0
11450>0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
11451>0x04	leshort	x		UBI image, version %u
11452
11453# NEC PC-88 2D disk image
11454# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
114550x20		ulelong&0xFFFFFEFF	0x2A0
11456>0x10		string			\0\0\0\0\0\0\0\0\0\0
11457>>0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
11458>>>0x1A		ubyte&0xEF		0
11459>>>>0x1B	ubyte&0x8F		0
11460>>>>>0x1B	ubyte&70		<0x40
11461>>>>>>0x1C	ulelong			>0x21
11462>>>>>>>0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
11463>>>>>>>>0x1B	ubyte	0		\b, media=2D
11464>>>>>>>>0x1B	ubyte	0x10		\b, media=2DD
11465>>>>>>>>0x1B	ubyte	0x20		\b, media=2HD
11466>>>>>>>>0x1B	ubyte	0x30		\b, media=1D
11467>>>>>>>>0x1B	ubyte	0x40		\b, media=1DD
11468>>>>>>>>0x1A	ubyte	0x10		\b, write-protected
11469
11470# HDD Raw Copy Tool disk image, file extension: .imgc
11471# From Benjamin Vanheuverzwijn <bvanheu@gmail.com>
114720	pstring	HDD\ Raw\ Copy\ Tool	%s
11473>0x100	pstring	x			%s
11474>0x200	pstring	x			- HD model: %s
11475#>0x300	pstring	x			unknown %s
11476>0x400	pstring	x			serial: %s
11477#>0x500	pstring	x			unknown: %s
11478!:ext	imgc
11479
11480#------------------------------------------------------------------------------
11481# $File: finger,v 1.2 2015/10/07 02:37:57 christos Exp $
11482# fingerprint:  file(1) magic for fingerprint data
11483# XPM bitmaps)
11484#
11485
11486# http://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c
11487
114880	string	FP1		libfprint fingerprint data V1
11489>3	beshort	x		\b, driver_id %x
11490>5	belong	x		\b, devtype %x
11491
114920	string	FP2		libfprint fingerprint data V2
11493>3	beshort	x		\b, driver_id %x
11494>5	belong	x		\b, devtype %x
11495
11496#------------------------------------------------------------------------------
11497# $File: flash,v 1.14 2017/05/25 20:09:55 christos Exp $
11498# flash:	file(1) magic for Macromedia Flash file format
11499#
11500# See
11501#
11502#	http://www.macromedia.com/software/flash/open/
11503#	http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
11504#	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
11505#
11506
115070   name	swf-details
11508
11509>0	string		F
11510>>8	byte&0xfd	0x08		Macromedia Flash data
11511!:mime	application/x-shockwave-flash
11512>>>3	byte		x		\b, version %d
11513>>8	byte&0xfe	0x10		Macromedia Flash data
11514!:mime	application/x-shockwave-flash
11515>>>3	byte		x		\b, version %d
11516>>8	byte		0x18		Macromedia Flash data
11517!:mime	application/x-shockwave-flash
11518>>>3	byte		x		\b, version %d
11519>>8	beshort&0xff87	0x2000		Macromedia Flash data
11520!:mime	application/x-shockwave-flash
11521>>>3	byte		x		\b, version %d
11522>>8	beshort&0xffe0	0x3000		Macromedia Flash data
11523!:mime	application/x-shockwave-flash
11524>>>3	byte		x		\b, version %d
11525>>8	byte&0x7	0
11526>>>8	ubyte		>0x2f
11527>>>>9	ubyte		<0x20		Macromedia Flash data
11528!:mime	application/x-shockwave-flash
11529>>>>>3	byte		x		\b, version %d
11530
11531>0	string		C
11532>>8	byte		0x78		Macromedia Flash data (compressed)
11533!:mime	application/x-shockwave-flash
11534>>>3	byte		x		\b, version %d
11535
11536>0	string		Z
11537>>8	byte		0x5d		Macromedia Flash data (lzma compressed)
11538!:mime	application/x-shockwave-flash
11539>>>3	byte		x		\b, version %d
11540
11541
115421	string		WS
11543>4	ulelong		>14
11544>>3	ubyte		!0
11545>>>0	use		swf-details
11546
11547# From: Cal Peake <cp@absolutedigital.net>
115480	string		FLV\x01		Macromedia Flash Video
11549!:mime	video/x-flv
11550
11551#
11552# Yosu Gomez
115530	string	AGD2\xbe\xb8\xbb\xcd\x00	Macromedia Freehand 7 Document
115540	string	AGD3\xbe\xb8\xbb\xcc\x00	Macromedia Freehand 8 Document
11555# From Dave Wilson
115560	string	AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
11557
11558#------------------------------------------------------------------------------
11559#	$File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $
11560#	flif:	Magic	data	for	file(1)	command.
11561#	FLIF	(Free	Lossless	Image	Format)
11562
115630	string	FLIF	FLIF
11564>4	string	<H	image data
11565>>6	beshort	x	\b, %u
11566>>8	beshort	x	\bx%u
11567>>5	string	1	\b, 8-bit/color,
11568>>5	string	2	\b, 16-bit/color,
11569>>4	string	1	\b, grayscale, non-interlaced
11570>>4	string	3	\b, RGB, non-interlaced
11571>>4	string	4	\b, RGBA, non-interlaced
11572>>4	string	A	\b, grayscale
11573>>4	string	C	\b, RGB, interlaced
11574>>4	string	D	\b, RGBA, interlaced
11575>4	string	>H	\b, animation data
11576>>5	ubyte	<255	\b, %i frames
11577>>>7	beshort	x	\b, %u
11578>>>9	beshort	x	\bx%u
11579>>>6	string	=1	\b, 8-bit/color
11580>>>6	string	=2	\b, 16-bit/color
11581>>5	ubyte	0xFF
11582>>>6	beshort	x	\b, %i frames,
11583>>>9	beshort	x	\b, %u
11584>>>11	beshort	x	\bx%u
11585>>>8	string	=1	\b, 8-bit/color
11586>>>8	string	=2	\b, 16-bit/color
11587>>4	string	=Q	\b, grayscale, non-interlaced
11588>>4	string	=S	\b, RGB, non-interlaced
11589>>4	string	=T	\b, RGBA, non-interlaced
11590>>4	string	=a	\b, grayscale
11591>>4	string	=c	\b, RGB, interlaced
11592>>4	string	=d	\b, RGBA, interlaced
11593
11594#------------------------------------------------------------------------------
11595# $File: fonts,v 1.38 2017/11/14 15:48:36 christos Exp $
11596# fonts:  file(1) magic for font data
11597#
115980	search/1	FONT		ASCII vfont text
115990	short		0436		Berkeley vfont data
116000	short		017001		byte-swapped Berkeley vfont data
11601
11602# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
116030	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
11604>20	string		>\0			(%s)
116056	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
116060	string		%!FontType1	PostScript Type 1 font program data
116076	string		%!FontType1	PostScript Type 1 font program data
116080	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text
11609
11610# Summary:	PostScript Type 1 Printer Font Metrics
11611# URL:		https://en.wikipedia.org/wiki/PostScript_fonts
11612# Reference:	http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
11613# Modified by:	Joerg Jenderek
11614# Note:		moved from ./msdos magic
11615# dfVersion 256=0100h
116160		uleshort	0x0100
11617# GRR: line above is too general as it catches also TrueType font,
11618# raw G3 data FAX, WhatsApp encrypted and Panorama database
11619# dfType 129=0081h
11620>66		uleshort	0x0081
11621# dfVertRes 300=012Ch not needed as additional test
11622#>>70		uleshort	0x012c
11623# dfHorizRes 300=012Ch
11624#>>>72		uleshort	0x012c
11625# dfDriverInfo points to postscript information section
11626>>(101.l)	string/c	Postscript	Printer Font Metrics
11627# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
11628!:mime	application/x-font-pfm
11629# AppleShare Print Server
11630#!:apple	ASPS????
11631!:ext	pfm
11632# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
11633#>>>6		string		>\060		- %-.60s
11634# dfDriverInfo
11635>>>139		ulelong		>0
11636# often abbreviated and same as filename
11637>>>>(139.l)	string		x		%s
11638# dfSize
11639>>>2		ulelong		x		\b, %d bytes
11640# dfFace 210=D2h 9Eh
11641>>>105		ulelong		>0
11642# Windows font name
11643>>>>(105.l)	string		x		\b, %s
11644# dfItalic
11645>>>80		ubyte		1		italic
11646# dfUnderline
11647>>>81		ubyte		1		underline
11648# dfStrikeOut
11649>>>82		ubyte		1		strikeout
11650# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc
11651>>>83		uleshort	>699		bold
11652# dfPitchAndFamily 16 17 48 49 64 65
11653>>>90		ubyte		16		serif
11654>>>90		ubyte		17		serif proportional
11655#>>>90		ubyte		48		other
11656>>>90		ubyte		49		proportional
11657>>>90		ubyte		64		script
11658>>>90		ubyte		65		script proportional
11659
11660# X11 font files in SNF (Server Natural Format) format
11661# updated by Joerg Jenderek at Feb 2013
11662# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
116630	belong		00000004		X11 SNF font data, MSB first
11664#>104	belong		00000004		X11 SNF font data, MSB first
11665!:mime	application/x-font-sfn
11666# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
116670	lelong		00000004
11668>104	lelong		00000004		X11 SNF font data, LSB first
11669!:mime	application/x-font-sfn
11670
11671# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
116720	search/1	STARTFONT\ 		X11 BDF font text
11673
11674# From: Joerg Jenderek
11675# URL: http://grub.gibibit.com/New_font_format
11676# Reference: util/grub-mkfont.c
11677#		include/grub/fontformat.h
11678# FONT_FORMAT_SECTION_NAMES_FILE
116790			string		FILE
11680# FONT_FORMAT_PFF2_MAGIC
11681>8			string		PFF2
11682# leng 4 only at the moment
11683>>4			ubelong		4
11684# FONT_FORMAT_SECTION_NAMES_FONT_NAME
11685>>>12			string		NAME		GRUB2 font
11686!:mime			application/x-font-pf2
11687!:ext			pf2
11688# length of font_name
11689>>>>16			ubelong		>0
11690# font_name
11691>>>>>20			string		>\0		"%-s"
11692
11693# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
11694# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
116950	string		\001fcp			X11 Portable Compiled Font data,
11696>12	lelong		^0x08			bit: LSB,
11697>12	lelong		&0x08			bit: MSB,
11698>12	lelong		^0x04			byte: LSB first
11699>12	lelong		&0x04			byte: MSB first
117000	string		D1.0\015		X11 Speedo font data
11701
11702#------------------------------------------------------------------------------
11703# FIGlet fonts and controlfiles
11704# From figmagic supplied with Figlet version 2.2
11705# "David E. O'Brien" <obrien@FreeBSD.ORG>
117060	string		flf		FIGlet font
11707>3	string		>2a		version %-2.2s
117080	string		flc		FIGlet controlfile
11709>3	string		>2a		version %-2.2s
11710
11711# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
11712# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
117130	belong		0x14025919	libGrx font data,
11714>8	leshort		x		%dx
11715>10	leshort		x		\b%d
11716>40	string		x		%s
11717# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
117180	belong		0xff464f4e	DOS code page font data collection
117197	belong		0x00454741	DOS code page font data
117207	belong		0x00564944	DOS code page font data (from Linux?)
117214098	string		DOSFONT		DOSFONT2 encrypted font data
11722
11723# downloadable fonts for browser (prints type) anthon@mnt.org
11724# https://tools.ietf.org/html/rfc3073
117250	string		PFR1		Portable Font Resource font data (new)
11726>102	string		>0		\b: %s
117270	string		PFR0		Portable Font Resource font data (old)
11728>4	beshort		>0		version %d
11729
11730# True Type fonts
11731# Modified by: Joerg Jenderek
11732# URL: https://en.wikipedia.org/wiki/TrueType
11733# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
11734#
11735# sfnt version "typ1" used by some Apple, but no example found
117360	string	typ1
11737>0	use		sfnt-font
11738>0	use		sfnt-names
11739# sfnt version "true" used by some Apple
117400	string	true
11741>0	use		sfnt-font
11742>0	use		sfnt-names
11743# GRR: below test is too general
11744# sfnt version often 0x00010000
117450	string	\000\001\000\000
11746>0	use		sfnt-font
11747>0	use		sfnt-names
11748#	validate and display sfnt font data like number of tables
117490	name		sfnt-font
11750# file 5.30 version assumes 00FFh as maximal number of tables
11751#>4	ubeshort	<0x0100
11752# maximal 27 tables found like in Skia.ttf
11753# 46 different table names mentioned on Apple specification
11754# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
11755>4	ubeshort	<47
11756# skip bad examples with garbage table names like in a5.show HYPERC MAC
11757# tag names consist of up to four characters padded with spaces at end like
11758# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
11759>>12	regex/4l	\^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]
11760#>>>0	ubelong	x	\b, sfnt version 0x%x
11761>>>0	ubelong	!0x4f54544f	TrueType
11762!:mime	application/font-sfnt
11763#!:mime	font/ttf
11764!:apple	????tfil
11765# .ttf for TrueType font
11766# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
11767!:ext	ttf/tte
11768# sfnt version 4F54544Fh~OTTO
11769>>>0	ubelong	=0x4f54544f	OpenType
11770!:mime	application/font-sfnt
11771#!:mime	font/otf
11772!:apple	????OTTO
11773!:ext	otf
11774>>>0	ubelong	x		Font data
11775# DSIG=44454947h table name implies a digitally signed font
11776# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432
11777>>>12	search/432	DSIG		\b, digitally signed
11778>>>4	ubeshort	x		\b, %d tables
11779# minimal 9 tables found like in NISC18030.ttf
11780#>>>4	ubeshort	<10		TMIN
11781#>>>4	ubeshort	>24		TBIG
11782# table directory entries
11783>>>12	string		x		\b, 1st "%4.4s"
11784
11785#	search and display 1st name in sfnt font which is often copyright text
11786#	does not work inside font collections
117870	name		sfnt-names
11788# search for naming table
11789>12	search/432/s	name
11790# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
11791#>>>>&8	ubelong		>0x0100bd27	BIGGEST OFFSET
11792>>&8	ubelong		>0x00100000
11793# offset of name table
11794>>>&-4	ubelong		x		\b, name offset 0x%x
11795# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
11796>>&8	ubelong		<0x00100000
11797>>>&-16	ubelong		x
11798# name table
11799>>>>(&8.L)	ubequad	x
11800# invalid format selector
11801#>>>>>&-8	ubeshort	!0	\b, invalid selector %x
11802# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
11803# maximal 1227 name records found like in Apple Chancery.ttf
11804#>>>>>&-6	ubeshort	<0x4	mincount
11805#>>>>>&-6	ubeshort	>130	maxcount
11806>>>>>&-6	ubeshort	x	\b, %d names
11807# offset to start of string storage from start of table
11808#>>>>>&-4	ubeshort	x	\b, record offset %d
11809# 1st name record
11810# string offset from start of storage area
11811#>>>>>&8		ubeshort	x	\b, string offset %d
11812# string length
11813#>>>>>&6		ubeshort	x	\b, string length %d
11814# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
11815# also found 0 like in SWZCONLN.TTF
11816#>>>>>&6		ubeshort	<8	MIN STRING
11817# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
11818#>>>>>&6		ubeshort	>805	MAX STRING
11819# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
11820#>>>>>&-2	ubeshort	>3	BAD PLATFORM
11821>>>>>&-2	ubeshort	0	\b, Unicode
11822>>>>>&-2	ubeshort	1	\b, Macintosh
11823>>>>>&-2	ubeshort	3	\b, Microsoft
11824# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
11825>>>>>&2		ubeshort	>0	\b, language 0x%x
11826# name identifiers
11827# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
11828>>>>>&4		ubeshort	>0	\b, type %d string
11829# platform specific encoding:
11830# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
11831#>>>>>&0		ubeshort	x	\b, %d encoding
11832>>>>>&0		ubeshort	0
11833# handle only name string offset 0 because do not know how to add 2 relative offsets
11834>>>>>>&6		ubeshort	0
11835>>>>>>>&(&-14.S-18)	ubyte		!0
11836# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
11837# often copyright string that starts like \251 2006 The Monotype Corporation
11838>>>>>>>>&-1		string		x	\b, %-11.96s
11839# test for unicode string
11840>>>>>>>&(&-14.S-18)	ubyte		0
11841>>>>>>>>&0		lestring16	x	\b, %-11.96s
11842# unicode encoding
11843>>>>>&0		ubeshort	>0
11844>>>>>>&6		ubeshort	0
11845>>>>>>>&(&-14.S-17)	lestring16	x	\b, %-11.96s
11846
118470	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
118480	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
11849
11850# TrueType/OpenType font collections (.ttc)
11851# URL: https://en.wikipedia.org/wiki/OpenType
11852# http://www.microsoft.com/typography/otspec/otff.htm
11853# Modified by: Joerg Jenderek
11854# Note:	container for TrueType, OpenType font
118550	string		ttcf
11856# skip ASCII text
11857>4	ubyte		0
11858# sfnt version often 0x00010000 of 1st table is TrueType
11859>>(12.L)	ubelong	!0x4f54544f	TrueType
11860#!:mime	font/ttf
11861!:apple	????tfil
11862!:ext	ttc
11863# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font
11864>>(12.L)	ubelong	=0x4f54544f	OpenType
11865#!:mime	font/otf
11866!:apple	????OTTO
11867# no example found for otc
11868!:ext	ttc/otc
11869>>4	ubyte		x		font collection data
11870!:mime	application/font-sfnt
11871#!:mime	font/collection
11872# TCC version
11873>>4	belong		0x00010000	\b, 1.0
11874>>4	belong		0x00020000	\b, 2.0
11875>>8	ubelong		>0		\b, %d fonts
11876# array offset size = fonts * offsetsize = fonts * 4
11877>>(8.L*4) ubequad	x
11878# 0x44454947 = 'DSIG'
11879>>>&4	belong		0x44534947	\b, digitally signed
11880# offset to 1st font
11881>>12	ubelong		x		\b, at 0x%x
11882# point to 1st font that starts with sfnt version
11883>>(12.L) use		sfnt-font
11884
11885# Opentype font data from Avi Bercovich
118860	string		OTTO		OpenType font data
11887!:mime application/vnd.ms-opentype
11888
11889# From: Alex Myczko <alex@aiei.ch>
118900	string		SplineFontDB:	Spline Font Database
11891!:mime application/vnd.font-fontforge-sfd
11892>14	string		x		version %s
11893
11894# EOT
118950x40	string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
11896>0x22	string		LP		Embedded OpenType (EOT)
11897# workaround until there's lepstring16
11898# >>0x52	lepstring16/h	>\0		\b, %s family
11899>>0x52	short	!0
11900>>>0x54	lestring16	x		\b, %s family
11901!:mime application/vnd.ms-fontobject
11902
11903# Web Open Font Format (.woff)
119040	name		woff
11905>4	belong		0x00010000	\b, TrueType
11906>4	belong		0x4F54544F	\b, CFF
11907>4	belong		0x74727565	\b, TrueType
11908>4	default		x
11909>>4	belong		x		\b, flavor %d
11910>8	belong		x		\b, length %d
11911#>12	beshort		x		\b, numTables %d
11912#>14	beshort		x		\b, reserved %d
11913#>16	belong		x		\b, totalSfntSize %d
11914
11915# http://www.w3.org/TR/WOFF/
119160	string		wOFF	Web Open Font Format
11917>0	use		woff
11918>20	beshort		x	\b, version %d
11919>22	beshort		x	\b.%d
11920# http://www.w3.org/TR/WOFF2/
119210	string		wOF2	Web Open Font Format (Version 2)
11922>0	use		woff
11923#>20	belong		x	\b, totalCompressedSize %d
11924>24	beshort		x	\b, version %d
11925>26	beshort		x	\b.%d
11926
11927#------------------------------------------------------------------------------
11928# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $
11929# FORTRAN source
11930# Check that the first 100 lines start with C or whitespace first.
119310       regex/100l      !\^[^Cc\ \t].*$
11932>0	regex/100l	\^[Cc][\ \t]	FORTRAN program text
11933!:mime	text/x-fortran
11934!:strength - 5
11935
11936#------------------------------------------------------------------------------
11937# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $
11938# frame:  file(1) magic for FrameMaker files
11939#
11940# This stuff came on a FrameMaker demo tape, most of which is
11941# copyright, but this file is "published" as witness the following:
11942#
11943# Note that this is the Framemaker Maker Interchange Format, not the
11944# Normal format which would be application/vnd.framemaker.
11945#
119460	string		\<MakerFile	FrameMaker document
11947!:mime	application/x-mif
11948>11	string		5.5		 (5.5
11949>11	string		5.0		 (5.0
11950>11	string		4.0		 (4.0
11951>11	string		3.0		 (3.0
11952>11	string		2.0		 (2.0
11953>11	string		1.0		 (1.0
11954>14	byte		x		  %c)
119550	string		\<MIFFile	FrameMaker MIF (ASCII) file
11956!:mime	application/x-mif
11957>9	string		4.0		 (4.0)
11958>9	string		3.0		 (3.0)
11959>9	string		2.0		 (2.0)
11960>9	string		1.0		 (1.x)
119610	search/1	\<MakerDictionary	FrameMaker Dictionary text
11962!:mime	application/x-mif
11963>17	string		3.0		 (3.0)
11964>17	string		2.0		 (2.0)
11965>17	string		1.0		 (1.x)
119660	string		\<MakerScreenFont	FrameMaker Font file
11967!:mime	application/x-mif
11968>17	string		1.01		 (%s)
119690	string		\<MML		FrameMaker MML file
11970!:mime	application/x-mif
119710	string		\<BookFile	FrameMaker Book file
11972!:mime	application/x-mif
11973>10	string		3.0		 (3.0
11974>10	string		2.0		 (2.0
11975>10	string		1.0		 (1.0
11976>13	byte		x		  %c)
11977# XXX - this book entry should be verified, if you find one, uncomment this
11978#0	string		\<Book\040 	FrameMaker Book (ASCII) file
11979#!:mime	application/x-mif
11980#>6	string		3.0		 (3.0)
11981#>6	string		2.0		 (2.0)
11982#>6	string		1.0		 (1.0)
119830	string		\<Maker\040Intermediate\040Print\040File	FrameMaker IPL file
11984!:mime	application/x-mif
11985
11986#------------------------------------------------------------------------------
11987# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
11988# freebsd:  file(1) magic for FreeBSD objects
11989#
11990# All new-style FreeBSD magic numbers are in host byte order (i.e.,
11991# little-endian on x86).
11992#
11993# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
11994# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
11995# schemes for distinguishing between executable images, shared libraries,
11996# and object files.
11997#
11998# FreeBSD says:
11999#
12000#    Regardless of whether it's pure, demand-paged, or none of the
12001#    above:
12002#
12003#	if the entry point is < 4096, then it's a shared library if
12004#	the "has run-time loader information" bit is set, and is
12005#	position-independent if the "is position-independent" bit
12006#	is set;
12007#
12008#	if the entry point is >= 4096 (or >4095, same thing), then it's
12009#	an executable, and is dynamically-linked if the "has run-time
12010#	loader information" bit is set.
12011#
12012# On x86, NetBSD says:
12013#
12014#    If it's neither pure nor demand-paged:
12015#
12016#	if it has the "has run-time loader information" bit set, it's
12017#	a dynamically-linked executable;
12018#
12019#	if it doesn't have that bit set, then:
12020#
12021#	    if it has the "is position-independent" bit set, it's
12022#	    position-independent;
12023#
12024#	    if the entry point is non-zero, it's an executable, otherwise
12025#	    it's an object file.
12026#
12027#    If it's pure:
12028#
12029#	if it has the "has run-time loader information" bit set, it's
12030#	a dynamically-linked executable, otherwise it's just an
12031#	executable.
12032#
12033#    If it's demand-paged:
12034#
12035#	if it has the "has run-time loader information" bit set,
12036#	then:
12037#
12038#	    if the entry point is < 4096, it's a shared library;
12039#
12040#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
12041#	    it's a dynamically-linked executable);
12042#
12043#	if it doesn't have the "has run-time loader information" bit
12044#	set, then it's just an executable.
12045#
12046# (On non-x86, NetBSD does much the same thing, except that it uses
12047# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
12048# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
12049# had 8K pages; dunno about MIPS.)
12050#
12051# I suspect the two will differ only in perverse and uninteresting cases
12052# ("shared" libraries that aren't demand-paged and whose pages probably
12053# won't actually be shared, executables with entry points <4096).
12054#
12055# I leave it to those more familiar with FreeBSD and NetBSD to figure out
12056# what the right answer is (although using ">4095", FreeBSD-style, is
12057# probably better than separately checking for "=4096" and ">4096",
12058# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
12059# executables using the NetBSD technique.)
12060#
120610	lelong&0377777777	041400407	FreeBSD/i386
12062>20	lelong			<4096
12063>>3	byte&0xC0		&0x80		shared library
12064>>3	byte&0xC0		0x40		PIC object
12065>>3	byte&0xC0		0x00		object
12066>20	lelong			>4095
12067>>3	byte&0x80		0x80		dynamically linked executable
12068>>3	byte&0x80		0x00		executable
12069>16	lelong			>0		not stripped
12070
120710	lelong&0377777777	041400410	FreeBSD/i386 pure
12072>20	lelong			<4096
12073>>3	byte&0xC0		&0x80		shared library
12074>>3	byte&0xC0		0x40		PIC object
12075>>3	byte&0xC0		0x00		object
12076>20	lelong			>4095
12077>>3	byte&0x80		0x80		dynamically linked executable
12078>>3	byte&0x80		0x00		executable
12079>16	lelong			>0		not stripped
12080
120810	lelong&0377777777	041400413	FreeBSD/i386 demand paged
12082>20	lelong			<4096
12083>>3	byte&0xC0		&0x80		shared library
12084>>3	byte&0xC0		0x40		PIC object
12085>>3	byte&0xC0		0x00		object
12086>20	lelong			>4095
12087>>3	byte&0x80		0x80		dynamically linked executable
12088>>3	byte&0x80		0x00		executable
12089>16	lelong			>0		not stripped
12090
120910	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
12092>20	lelong			<4096
12093>>3	byte&0xC0		&0x80		shared library
12094>>3	byte&0xC0		0x40		PIC object
12095>>3	byte&0xC0		0x00		object
12096>20	lelong			>4095
12097>>3	byte&0x80		0x80		dynamically linked executable
12098>>3	byte&0x80		0x00		executable
12099>16	lelong			>0		not stripped
12100
12101# XXX gross hack to identify core files
12102# cores start with a struct tss; we take advantage of the following:
12103# byte 7:     highest byte of the kernel stack pointer, always 0xfe
12104#      8/9:   kernel (ring 0) ss value, always 0x0010
12105#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
12106#      28:    low order byte of the current PTD entry, always 0 since the
12107#             PTD is page-aligned
12108#
121097	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
12110>1039	string	>\0	from '%s'
12111
12112# /var/run/ld.so.hints
12113# What are you laughing about?
121140	lelong			011421044151	ld.so hints file (Little Endian
12115>4	lelong			>0		\b, version %d)
12116>4	belong			<1		\b)
121170	belong			011421044151	ld.so hints file (Big Endian
12118>4	belong			>0		\b, version %d)
12119>4	belong			<1		\b)
12120
12121#
12122# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
12123#
121240	string	SCRSHOT_	scrshot(1) screenshot,
12125>8	byte	x		version %d,
12126>9	byte	2		%d bytes in header,
12127>>10	byte	x		%d chars wide by
12128>>11	byte	x		%d chars high
12129
12130#------------------------------------------------------------------------------
12131# $File: fsav,v 1.15 2018/07/16 12:30:41 christos Exp $
12132# fsav:  file(1) magic for datafellows fsav virus definition files
12133# Anthon van der Neut (anthon@mnt.org)
12134
12135# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
121360	beshort		0x1575		fsav macro virus signatures
12137>8	leshort		>0		(%d-
12138>11	byte		>0		\b%02d-
12139>10	byte		>0		\b%02d)
12140# ftp://ftp.f-prot.com/pub/sign.zip
12141#10	ubyte		<12
12142#>9	ubyte		<32
12143#>>8	ubyte		0x0a
12144#>>>12	ubyte		0x07
12145#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
12146#>>>>10	byte		0		\b01-
12147#>>>>10	byte		1		\b02-
12148#>>>>10	byte		2		\b03-
12149#>>>>10	byte		3		\b04-
12150#>>>>10	byte		4		\b05-
12151#>>>>10	byte		5		\b06-
12152#>>>>10	byte		6		\b07-
12153#>>>>10	byte		7		\b08-
12154#>>>>10	byte		8		\b09-
12155#>>>>10	byte		9		\b10-
12156#>>>>10	byte		10		\b11-
12157#>>>>10	byte		11		\b12-
12158#>>>>9	ubyte		>0		\b%02d)
12159# ftp://ftp.f-prot.com/pub/sign2.zip
12160#0	ubyte		0x62
12161#>1	ubyte		0xF5
12162#>>2	ubyte		0x1
12163#>>>3	ubyte		0x1
12164#>>>>4	ubyte		0x0e
12165#>>>>>13		ubyte	>0		fsav virus signatures
12166#>>>>>>11	ubyte	x		size 0x%02x
12167#>>>>>>12	ubyte	x		\b%02x
12168#>>>>>>13	ubyte	x		\b%02x bytes
12169
12170# Joerg Jenderek: joerg dot jenderek at web dot de
12171# http://www.clamav.net/doc/latest/html/node45.html
12172# .cvd files start with a 512 bytes colon separated header
12173# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
12174# + gzipped tarball files
121750	string		ClamAV-VDB:
12176>11	string		>\0		Clam AntiVirus database %-.23s
12177>>34	string		:
12178>>>35		string		!:	\b, version
12179>>>>35		string		x 	\b %-.1s
12180>>>>>36		string		!:
12181>>>>>>36	string		x 	\b%-.1s
12182>>>>>>>37	string		!:
12183>>>>>>>>37	string		x 	\b%-.1s
12184>>>>>>>>>38	string		!:
12185>>>>>>>>>>38	string		x 	\b%-.1s
12186>>>>>>>>>>>39	string		!:
12187>>>>>>>>>>>>39	string		x 	\b%-.1s
12188>512	string		\037\213	\b, gzipped
12189>769	string		ustar\0		\b, tarred
12190
12191# Type: Grisoft AVG AntiVirus
12192# From: David Newgas <david@newgas.net>
121930	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data
12194
121950	string	X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
12196>33	string	-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*	EICAR virus test files
12197
12198#------------------------------------------------------------------------------
12199# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
12200# fusecompress:   file(1) magic for fusecompress
122010	string	\037\135\211	FuseCompress(ed) data
12202>3	byte	0x00	(none format)
12203>3	byte	0x01	(bz2 format)
12204>3	byte	0x02	(gz format)
12205>3	byte	0x03	(lzo format)
12206>3	byte	0x04	(xor format)
12207>3	byte	>0x04	(unknown format)
12208>4	long	x	uncompressed size: %d
12209
12210#------------------------------------------------------------------------------
12211# $File: games,v 1.16 2017/10/19 16:40:37 christos Exp $
12212# games:  file(1) for games
12213
12214# Fabio Bonelli <fabiobonelli@libero.it>
12215# Quake II - III data files
122160       string  IDP2        	Quake II 3D Model file,
12217>20     long    x               %u skin(s),
12218>8      long    x               (%u x
12219>12     long    x 		%u),
12220>40     long    x               %u frame(s),
12221>16     long    x               Frame size %u bytes,
12222>24     long  	x               %u vertices/frame,
12223>28     long    x            	%u texture coordinates,
12224>32     long    x               %u triangles/frame
12225
122260       string  IBSP            Quake
12227>4      long    0x26            II Map file (BSP)
12228>4      long    0x2E      	III Map file (BSP)
12229
122300       string  IDS2            Quake II SP2 sprite file
12231
12232#---------------------------------------------------------------------------
12233# Doom and Quake
12234# submitted by Nicolas Patrois
12235
122360       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
12237# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
12238
1223924      string  LxD\ 203        Linuxdoom save
12240>0      string  x       , name=%s
12241>44     string  x       , world=%s
12242
12243# Quake
12244
12245# Update: Joerg Jenderek
12246# URL: http://fileformats.archiveteam.org/wiki/PAK
12247# reference: https://quakewiki.org/wiki/.pak
12248# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
12249# and Git pack ./revision
122500       string  PACK
12251# real Quake examples like pak0.pak have only some hundreds like 150 files
12252# So test for few files
12253>8	ulelong <0x01000000
12254# in file version 5.32 test for null terminator is only true for
12255# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h
12256# look for null terminator of 1st entry name
12257>>(4.l+55)	ubyte	0	Quake I or II world or extension
12258!:mime	application/x-dzip
12259!:ext	pak
12260#>>>8	ulelong	x	\b, table size %u
12261# dividing this by entry size (64) gives number of files
12262>>>8	ulelong/64 x	\b, %u files
12263# offset to the beginning of the file table
12264>>>4	ulelong	x	\b, offset 0x%x
12265# 1st file entry
12266>>>(4.l)	use	pak-entry
12267# 2nd file entry
12268#>>>4	ulelong+64	x	\b, offset 0x%x
12269#>>>(4.l+64)	use	pak-entry
12270#
12271#	display file table entry of Quake PAK archive
122720	name		pak-entry
12273# normally entry start after header which implies offset 12 or higher
12274>56	ulelong	>11
12275# the offset from the beginning of pak to beginning of this entry file contents
12276>>56	ulelong	x	at 0x%x
12277# the size of file for this entry
12278>>60	ulelong	x	%u bytes
12279# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
12280>>0	string	x	'%-.56s'
12281# inspect entry content by jumping to entry offset
12282>>(56)	indirect x	\b:
12283
12284#0       string  -1\x0a  Quake I demo
12285#>30     string  x        version %.4s
12286#>61     string  x        level %s
12287
12288#0       string  5\x0a   Quake I save
12289
12290# The levels
12291
12292# Quake 1
12293
122940	string	5\x0aIntroduction             Quake I save: start Introduction
122950	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
122960	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
122970	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
122980	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
122990	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
123000	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
123010	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
123020	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
123030	string	5\x0athe_Installation         Quake I save: e2m1 The installation
123040	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
123050	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
123060	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
123070	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
123080	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
123090	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
123100	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
123110	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
123120	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
123130	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
123140	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
123150	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
123160	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
123170	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
123180	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
123190	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
123200	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
123210	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
123220	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
123230	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
123240	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
123250	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
12326
12327# Quake DeathMatch levels
12328
123290	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
123300	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
123310	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
123320	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
123330	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
123340	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
12335
12336# Scourge of Armagon
12337
123380	string	5\x0aCommand_HQ               Quake I save: start Command HQ
123390	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
123400	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
123410	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
123420	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
123430	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
123440	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
123450	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
123460	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
123470	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
123480	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
123490	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
123500	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
123510	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
123520	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
123530	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
123540	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
123550	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
12356
12357# Malice
12358
123590	string	5\x0aThe_Academy      Quake I save: start The academy
123600	string	5\x0aThe_Lab          Quake I save: d1 The lab
123610	string	5\x0aArea_33          Quake I save: d1b Area 33
123620	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
123630	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
123640	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
123650	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
123660	string	5\x0aArea44           Quake I save: d1c Area 44
123670	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
123680	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
123690	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
123700	string	5\x0aThe_Flood        Quake I save: d5 The flood
123710	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
123720	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
123730	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
123740	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
123750	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
123760	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
123770	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
123780	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
123790	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
12380
12381# Malice DeathMatch levels
12382
123830	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
123840	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
123850	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
123860	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
123870	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
123880	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
123890	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
12390
12391
123920	string	MComprHD	MAME CHD compressed hard disk image,
12393>12	belong	x		version %u
12394
12395# doom - submitted by Jon Dowland
12396
123970	string	=IWAD		doom main IWAD data
12398>4	lelong	x		containing %d lumps
123990	string	=PWAD		doom patch PWAD data
12400>4	lelong	x		containing %d lumps
12401
12402# Build engine group files (Duke Nukem, Shadow Warrior, ...)
12403# Extension: .grp
12404# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org>
124050	string	KenSilverman	Build engine group file
12406>12	lelong	x		containing %d files
12407
12408# Summary: Warcraft 3 save
12409# Extension: .w3g
12410# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
124110	string		Warcraft\ III\ recorded\ game	%s
12412
12413
12414# Summary: Warcraft 3 map
12415# Extension: .w3m
12416# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com>
124170	string		HM3W		Warcraft III map file
12418
12419
12420# Summary: SGF Smart Game Format
12421# Extension: .sgf
12422# Reference: http://www.red-bean.com/sgf/
12423# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
12424# Modified by (1): Abel Cheung (regex, more game format)
12425# FIXME: Some games don't have GM (game type)
124260	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
12427>2	search/0x200/b	GM[
12428>>&0	string		1]	(Go)
12429>>&0	string		2]	(Othello)
12430>>&0	string		3]	(chess)
12431>>&0	string		4]	(Gomoku+Renju)
12432>>&0	string		5]	(Nine Men's Morris)
12433>>&0	string		6]	(Backgammon)
12434>>&0	string		7]	(Chinese chess)
12435>>&0	string		8]	(Shogi)
12436>>&0	string		9]	(Lines of Action)
12437>>&0	string		10]	(Ataxx)
12438>>&0	string		11]	(Hex)
12439>>&0	string		12]	(Jungle)
12440>>&0	string		13]	(Neutron)
12441>>&0	string		14]	(Philosopher's Football)
12442>>&0	string		15]	(Quadrature)
12443>>&0	string		16]	(Trax)
12444>>&0	string		17]	(Tantrix)
12445>>&0	string		18]	(Amazons)
12446>>&0	string		19]	(Octi)
12447>>&0	string		20]	(Gess)
12448>>&0	string		21]	(Twixt)
12449>>&0	string		22]	(Zertz)
12450>>&0	string		23]	(Plateau)
12451>>&0	string		24]	(Yinsh)
12452>>&0	string		25]	(Punct)
12453>>&0	string		26]	(Gobblet)
12454>>&0	string		27]	(hive)
12455>>&0	string		28]	(Exxit)
12456>>&0	string		29]	(Hnefatal)
12457>>&0	string		30]	(Kuba)
12458>>&0	string		31]	(Tripples)
12459>>&0	string		32]	(Chase)
12460>>&0	string		33]	(Tumbling Down)
12461>>&0	string		34]	(Sahara)
12462>>&0	string		35]	(Byte)
12463>>&0	string		36]	(Focus)
12464>>&0	string		37]	(Dvonn)
12465>>&0	string		38]	(Tamsk)
12466>>&0	string		39]	(Gipf)
12467>>&0	string		40]	(Kropki)
12468
12469##############################################
12470# NetImmerse/Gamebryo game engine entries
12471
12472# Summary: Gamebryo game engine file
12473# Extension: .nif, .kf
12474# Created by: Abel Cheung <abelcheung@gmail.com>
124750		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
12476>&0		regex		[0-9a-z.]+				\b, version %s
12477
12478# Summary: Gamebryo game engine file
12479# Extension: .kfm
12480# Created by: Abel Cheung <abelcheung@gmail.com>
124810		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
12482>&0		regex		[0-9a-z.]+				\b, version %s
12483
12484# Summary: NetImmerse game engine file
12485# Extension .nif
12486# Created by: Abel Cheung <abelcheung@gmail.com>
124870		string		NetImmerse\ File\ Format,\ Versio
12488>&0		string		n\ 					NetImmerse game engine file
12489>>&0		regex		[0-9a-z.]+				\b, version %s
12490
12491# Type:	SGF Smart Game Format
12492# URL:	http://www.red-bean.com/sgf/
12493# From:	Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar>
124942	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
12495>2	regex/c	GM\\[1\\]			- Go Game
12496>2	regex/c	GM\\[6\\]			- BackGammon Game
12497>2	regex/c	GM\\[11\\]			- Hex Game
12498>2	regex/c	GM\\[18\\]			- Amazons Game
12499>2	regex/c	GM\\[19\\]			- Octi Game
12500>2	regex/c	GM\\[20\\]			- Gess Game
12501>2	regex/c	GM\\[21\\]			- twix Game
12502
12503# Epic Games/Unreal Engine Package
12504#
125050	lelong		0x9E2A83C1	Unreal Engine Package,
12506>4	leshort		x		version: %i
12507>12	lelong		!0		\b, names: %i
12508>28	lelong		!0		\b, imports: %i
12509>20	lelong		!0		\b, exports: %i
12510
12511#------------------------------------------------------------------------------
12512# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $
12513# gcc:  file(1) magic for GCC special files
12514#
125150	string		gpch		GCC precompiled header
12516
12517# The version field is annoying.  It's 3 characters, not zero-terminated.
12518>5	byte		x			(version %c
12519>6	byte		x			\b%c
12520>7	byte		x			\b%c)
12521
12522# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
12523>4	byte		67			for C
12524>4	byte		111			for Objective-C
12525>4	byte		43			for C++
12526>4	byte		79			for Objective-C++
12527
12528#------------------------------------------------------------------------------
12529# $File: gconv
12530# gconv: file(1) magic for iconv/gconv module configuration cache
12531#
12532# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
12533#
12534# From: Marek Cermak <macermak@redhat.com>
12535#
125360		lelong		0x20010324 	gconv module configuration cache data
12537
12538#------------------------------------------------------------------------------
12539# $File: geo,v 1.6 2018/03/11 00:48:16 christos Exp $
12540# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
12541
12542######################################################################
12543#
12544# Acoustic Doppler Current Profilers (ADCP)
12545#
12546######################################################################
12547
125480	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)
12549
12550######################################################################
12551#
12552# Metadata
12553#
12554######################################################################
12555
125560	string	Identification_Information	FGDC ASCII metadata
12557
12558######################################################################
12559#
12560# Seimsic / Subbottom
12561#
12562######################################################################
12563
12564# Knudsen subbottom chirp profiler - Binary File Format: B9
12565# KEB D409-03167 V1.75 Huffman
125660	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
12567>4	regex	[-A-Z0-9]*	Software: %s
12568>>&1	regex	V[0-9]*\.[0-9]*	version %s
12569
12570######################################################################
12571#
12572# LIDAR - Laser altimetry or bathy
12573#
12574######################################################################
12575
12576
12577# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
125780	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
12579>4	regex [0-9]*\.[0-9]*	version %s
12580
125810	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
12582>3      byte    x	version %d .
12583>4	byte	x	%d
12584
12585
12586######################################################################
12587#
12588# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
12589#
12590######################################################################
12591
12592# GeoAcoustics - GeoSwath Plus
125934	beshort	0x2002	GeoSwath RDF
125940	string	Start:-	GeoSwatch auf text file
12595
12596# Seabeam 2100
12597# mbsystem code mb41
125980	string SB2100	SeaBeam 2100 multibeam sonar
125990	string SB2100DR	SeaBeam 2100 DR multibeam sonar
126000	string SB2100PR SeaBeam 2100 PR multibeam sonar
12601
12602# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
12603# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
126040    string $HSF    XSE multibeam
12605
12606# mb121 http://www.saic.com/maritime/gsf/
126078	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
12608>&0	regex [0-9]*\.[0-9]*	version %s
12609
12610# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
12611# mb161
126129	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format
12613
12614# MBSystem processing caches the mbinfo output
126151	string	Swath\ Data\ File:	mbsystem info cache
12616
12617# Caris John Hughes Clark format
126180	string	HDCS	Caris multibeam sonar related data
126191	string	Start/Stop\ parameter\ header:	Caris ASCII project summary
12620
12621######################################################################
12622#
12623# Visualization and 3D modeling
12624#
12625######################################################################
12626
12627# IVS - IVS3d.com Tagged Data Represetation
126280	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file
12629
12630# http://www.ecma-international.org/publications/standards/Ecma-363.htm
12631# 3D in PDFs
126320	string	U3D	ECMA-363, Universal 3D
12633
12634######################################################################
12635#
12636# Support files
12637#
12638######################################################################
12639
12640# https://midas.psi.ch/elog/
126410	string	$@MID@$	elog journal entry
12642
12643# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
126440	string		DSBB	Surfer 6 binary grid file
12645>4	leshort		x	\b, %d
12646>6	leshort		x	\bx%d
12647>8	ledouble	x	\b, minx=%g
12648>16	ledouble	x	\b, maxx=%g
12649>24	ledouble	x	\b, miny=%g
12650>32	ledouble	x	\b, maxy=%g
12651>40	ledouble	x	\b, minz=%g
12652>48	ledouble	x	\b, maxz=%g
12653
12654# magic for LAS format files
12655# alex myczko <alex@aiei.ch>
12656# http://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf
126570	string		LASF	LIDAR point data records
12658>24	byte		>0	\b, version %u
12659>25	byte		>0	\b.%u
12660>26	string		>\0	\b, SYSID %s
12661>58	string		>\0	\b, Generating Software %s
12662
12663# magic for PCD format files
12664# alex myczko <alex@aiei.ch>
12665# http://pointclouds.org/documentation/tutorials/pcd_file_format.php
126660	string		#\ .PCD	Point Cloud Data
12667
12668#------------------------------------------------------------------------------
12669# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
12670# GEOS files (Vidar Madsen, vidar@gimp.org)
12671# semi-commonly used in embedded and handheld systems.
126720	belong	0xc745c153	GEOS
12673>40	byte	1	executable
12674>40	byte	2	VMFile
12675>40	byte	3	binary
12676>40	byte	4	directory label
12677>40	byte	<1	unknown
12678>40	byte	>4	unknown
12679>4	string	>\0	\b, name "%s"
12680#>44	short	x	\b, version %d
12681#>46	short	x	\b.%d
12682#>48	short	x	\b, rev %d
12683#>50	short	x	\b.%d
12684#>52	short	x	\b, proto %d
12685#>54	short	x	\br%d
12686#>168	string	>\0	\b, copyright "%s"
12687
12688#------------------------------------------------------------------------------
12689# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $
12690# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr)
12691# by Federico Mena <federico@nuclecu.unam.mx>
12692
126930       string/t        GIMP\ Gradient  GIMP gradient data
12694
12695# GIMP palette (.gpl)
12696# From: Markus Heidelberg <markus.heidelberg@web.de>
126970       string/t        GIMP\ Palette   GIMP palette data
12698
12699#------------------------------------------------------------------------------
12700# XCF:  file(1) magic for the XCF image format used in the GIMP (.xcf) developed
12701#       by Spencer Kimball and Peter Mattis
12702#       ('Bucky' LaDieu, nega@vt.edu)
12703
127040	string		gimp\ xcf	GIMP XCF image data,
12705!:mime	image/x-xcf
12706>9	string		file		version 0,
12707>9	string		v		version
12708>>10	string		>\0		%s,
12709>14	belong		x		%u x
12710>18	belong		x		%u,
12711>22     belong          0               RGB Color
12712>22     belong          1               Greyscale
12713>22     belong          2               Indexed Color
12714>22	belong		>2		Unknown Image Type.
12715
12716#------------------------------------------------------------------------------
12717# XCF:  file(1) magic for the patterns used in the GIMP (.pat), developed
12718#       by Spencer Kimball and Peter Mattis
12719#       ('Bucky' LaDieu, nega@vt.edu)
12720
1272120      string          GPAT            GIMP pattern data,
12722>24     string          x               %s
12723
12724#------------------------------------------------------------------------------
12725# XCF:  file(1) magic for the brushes used in the GIMP (.gbr), developed
12726#       by Spencer Kimball and Peter Mattis
12727#       ('Bucky' LaDieu, nega@vt.edu)
12728
1272920      string          GIMP            GIMP brush data
12730
12731# GIMP Curves File
12732# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
127330	string	#\040GIMP\040Curves\040File	GIMP curve file
12734
12735#------------------------------------------------------------------------------
12736# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $
12737# GNOME related files
12738
12739# Contributed by Josh Triplett
12740# FIXME: Could be simplified if pstring supported two-byte counts
127410         string   GnomeKeyring\n\r\0\n GNOME keyring
12742>&0       ubyte    0                    \b, major version 0
12743>>&0      ubyte    0                    \b, minor version 0
12744>>>&0     ubyte    0                    \b, crypto type 0 (AES)
12745>>>&0     ubyte    >0                   \b, crypto type %u (unknown)
12746>>>&1     ubyte    0                    \b, hash type 0 (MD5)
12747>>>&1     ubyte    >0                   \b, hash type %u (unknown)
12748>>>&2     ubelong  0xFFFFFFFF           \b, name NULL
12749>>>&2     ubelong  !0xFFFFFFFF
12750>>>>&-4   ubelong  >255                 \b, name too long for file's pstring type
12751>>>>&-4   ubelong  <256
12752>>>>>&-1  pstring  x                    \b, name "%s"
12753>>>>>>&0  ubeqdate x                    \b, last modified %s
12754>>>>>>&8  ubeqdate x                    \b, created %s
12755>>>>>>&16 ubelong  &1
12756>>>>>>>&0 ubelong  x                    \b, locked if idle for %u seconds
12757>>>>>>&16 ubelong  ^1                   \b, not locked if idle
12758>>>>>>&24 ubelong  x                    \b, hash iterations %u
12759>>>>>>&28 ubequad  x                    \b, salt %llu
12760>>>>>>&52 ubelong  x                    \b, %u item(s)
12761
12762# From: Alex Beregszaszi <alex@fsn.hu>
127634	string	gtktalog		GNOME Catalogue (gtktalog)
12764>13	string	>\0			version %s
12765
12766# Summary: GStreamer binary registry
12767# Extension: .bin
12768# Submitted by: Josh Triplett <josh@joshtriplett.org>
127690	belong	0xc0def00d		GStreamer binary registry
12770>4	string	x			\b, version %s
12771
12772# GVariant Database file
12773# By Elan Ruusamae <glen@delfi.ee>
12774# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
12775# It's always "GVariant", it's byte swapped on incompatible archs
12776# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
12777# file_builder_serialise()
12778# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
127790	string	GVariant	GVariant Database file,
12780# version is never filled. probably future extension
12781>8	lelong	x		version %d
12782# not sure are these usable, so commented out
12783#>>16	lelong	x		start %d,
12784#>>>20	lelong	x		end %d
12785
12786# G-IR database made by gobject-introspect toolset,
12787# http://live.gnome.org/GObjectIntrospection
127880	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
12789>16	byte		x			\b, v%d
12790>17	byte		x			\b.%d
12791>20	leshort		x			\b, %d entries
12792>22	leshort		x			\b/%d local
12793
12794#------------------------------------------------------------------------------
12795# $File: gnu,v 1.20 2018/02/24 16:11:23 christos Exp $
12796# gnu:  file(1) magic for various GNU tools
12797#
12798# GNU nlsutils message catalog file format
12799#
12800# GNU message catalog (.mo and .gmo files)
12801
12802# Update: Joerg Jenderek
12803# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
12804# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
12805#	gettext-0.19.8.1/gettext-runtime/intl/gmo.h
12806# Note: maybe call it like "GNU translation gettext machine object"
128070	string		\336\22\4\225	GNU message catalog (little endian),
12808#0	ulelong	0x950412DE		GNU-format message catalog data
12809# TODO: write lines in such a way that code can also be called for big endian variant
12810#>0	use		gettext-object
12811#0	name		gettext-object
12812>4	ulelong		x		revision
12813!:mime	application/x-gettext-translation
12814# mo extension is also used for Easeus Partition Master PE32 executable module
12815# like ConvertFatToNTFS.mo
12816!:ext	gmo/mo
12817# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
12818# major revision
12819>4	ulelong/0xFFff	x		%u.
12820# minor revision
12821>4	ulelong&0x0000FFff	x	\b%u
12822>>8	ulelong		x		\b, %u message
12823# plural s
12824>>8	ulelong		>1		\bs
12825# size of hashing table
12826#>20	ulelong		x		\b, %u hash
12827#>20	ulelong		>1		\bes
12828#>24	ulelong		x		at 0x%x
12829# for revsion x.0 offset of table with originals is 1Ch if directly after header
12830>4	ulelong&0x0000FFff	=0
12831>>12	ulelong		!0x1C		\b, at 0x%x string table
12832# but for x.1 table offset i found is 30h. That means directly after bigger header
12833>4	ulelong&0x0000FFff	>0
12834>>12	ulelong		!0x30		\b, at 0x%x string table
12835# The following variables are only used in .mo files with minor revision >= 1
12836# number of system dependent segments
12837#>>28	ulelong		x		\b, %u segment
12838#>>28	ulelong		>1		\bs
12839# offset of table describing system dependent segments
12840#>>32	ulelong		x		at 0x%x
12841# number of system dependent strings pairs
12842>>36	ulelong		x		\b, %u sysdep message
12843>>36	ulelong		>1		\bs
12844# offset of table with start offsets of original sysdep strings
12845#>>40	ulelong		x		\b, at 0x%x sysdep strings
12846# offset of table with start offsets of translated sysdep strings
12847#>>44	ulelong		x		\b, at 0x%x sysdep translations
12848# >>(44.l)	ulelong	x		0x%x chars
12849# >>>&0		ulelong	x		at 0x%x
12850# >>>>(&-4)	string	x		"%s"
12851# string table after big header
12852#>>48	ubequad		x		\b, string table 0x%llx
12853#
12854# 0th string length seems to be always 0
12855#>(12.l)	ulelong	x		\b, %u chars
12856#>>&0		ulelong	x		at 0x%x
12857# if 1st string length positiv inspect offset and string
12858#>(12.l+8)	ulelong	>0		\b, %u chars
12859#>>&0		ulelong	x		at 0x%x
12860# if 2nd string length positiv inspect offset and string
12861# >(12.l+16)	ulelong	>0		\b, %u chars
12862# >>&0		ulelong	x		at 0x%x
12863# skip newline byte
12864#>>>(&-4)	ubyte	=0x0A
12865#>>>>&0		string	x		"%s"
12866#>>>(&-4)	ubyte	!0x0A
12867#>>>>&-1		string	x		'%s'
12868# offset of table with translation strings
12869#>16	ulelong		x		\b, at 0x%x translation table
12870# check translation 0 length and offset
12871>(16.l)		ulelong	>0
12872>>&0		ulelong	x
12873# translation 0 seems to be often Project-Id with name and version
12874>>>(&-4)	string	x		\b, %s
12875# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
12876>(16.l+8)	ulelong	>1
12877>>&0		ulelong	x
12878>>>(&-4)	ubyte	!0x0A
12879>>>>&-1		string	x		'%s'
12880# 1 New Line like in tar-1.29\po\de.gmo
12881>>>(&-4)	ubyte	=0x0A
12882>>>>&0		ubyte	!0x0A
12883>>>>>&-1	string	x		'%s'
12884# 2nd New Line like in parted-3.1\po\de.gmo
12885>>>>&0		ubyte	=0x0A
12886>>>>>&0		string	x		'%s'
12887
128880	string		\225\4\22\336	GNU message catalog (big endian),
12889#0	ubelong	0x950412DE		GNU-format message catalog data
12890!:mime	application/x-gettext-translation
12891!:ext	gmo/mo
12892# TODO: for big endian use same code as for little endian
12893#>0	use		\^gettext-object
12894# DEBUG code
12895#>16	ubelong		x		\b, at 0x%x translation table
12896#>(16.L)		ubelong	x		0x%x chars
12897#>>&0		ubelong	x		at 0x%x
12898# unexpected value HERE!
12899#>>>(&-4)	ubequad	x		0x%llx
12900#
12901>4	beshort		x		revision %d.
12902>6	beshort		>0		\b%d,
12903>>8	belong		x		%d messages,
12904>>36	belong		x		%d sysdep messages
12905>6	beshort		=0		\b%d,
12906>>8	belong		x		%d messages
12907
12908
12909# GnuPG
12910# The format is very similar to pgp
129110	string          \001gpg                 GPG key trust database
12912>4	byte            x                       version %d
12913# Note: magic.mime had 0x8501 for the next line instead of 0x8502
129140	beshort		0x8502			GPG encrypted data
12915!:mime	text/PGP # encoding: data
12916
12917# Update: Joerg Jenderek
12918# Note:	PGP and GPG use same data structure.
12919#	So recognition is now done by ./pgp with start test for byte 0x99
12920# This magic is not particularly good, as the keyrings don't have true
12921# magic. Nevertheless, it covers many keyrings.
12922# 0	ubeshort-0x9901	<2
12923# >3	byte		4
12924# >>4	bedate		x		GPG key public ring, created %s
12925# !:mime application/x-gnupg-keyring
12926
12927# Symmetric encryption
129280	leshort		0x0d8c
12929>4	leshort		0x0203
12930>>2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
12931>>2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
12932>>2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
12933>>2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
12934>>2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
12935>>2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
12936>>2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
12937>>2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
12938>>2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
12939>>2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)
12940
12941
12942# GnuPG Keybox file
12943# <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
12944# From: Philipp Hahn <hahn@univention.de>
129450	belong	32
12946>4	byte	1
12947>>8	string	KBXf	GPG keybox database
12948>>>5	byte	1	version %d
12949>>>16	bedate	x	\b, created-at %s
12950>>>20	bedate	x	\b, last-maintained %s
12951
12952
12953# Gnumeric spreadsheet
12954# This entry is only semi-helpful, as Gnumeric compresses its files, so
12955# they will ordinarily reported as "compressed", but at least -z helps
1295639      string          =<gmr:Workbook           Gnumeric spreadsheet
12957
12958# From: James Youngman <jay@gnu.org>
12959# gnu find magic
129600	string	\0LOCATE	GNU findutils locate database data
12961>7	string	>\0		\b, format %s
12962>7	string	02		\b (frcode)
12963
12964# Files produced by GNU gettext
12965
12966# gettext message catalogue
129670	search/1024	\nmsgid
12968>&0	search/1024	\nmsgstr	GNU gettext message catalogue text
12969!:strength +100
12970!:mime text/x-po
12971
12972#------------------------------------------------------------------------------
12973# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
12974# gnumeric:  file(1) magic for Gnumeric spreadsheet
12975# This entry is only semi-helpful, as Gnumeric compresses its files, so
12976# they will ordinarily reported as "compressed", but at least -z helps
1297739	string	=<gmr:Workbook	Gnumeric spreadsheet
12978!:mime	application/x-gnumeric
12979
12980#------------------------------------------------------------------------------
12981# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
12982#
12983# GPT Partition table patterns.
12984# Author: Rogier Goossens (goossens.rogier@gmail.com)
12985# Note that a GPT-formatted disk must contain an MBR as well.
12986#
12987
12988# The initial segment (up to >>>>>>>>422) was copied from the X86
12989# partition table code (aka MBR).
12990# This is kept separate, so that MBR partitions are not reported as well.
12991# (use -k if you do want them as well)
12992
12993# First, detect the MBR partiton table
12994# If more than one GPT protective MBR partition exists, don't print anything
12995# (the other MBR detection code will then just print the MBR partition table)
129960x1FE			leshort		0xAA55
12997>3			string		!MS
12998>>3			string		!SYSLINUX
12999>>>3			string		!MTOOL
13000>>>>3			string		!NEWLDR
13001>>>>>5			string		!DOS
13002# not FAT (32 bit)
13003>>>>>>82		string		!FAT32
13004#not Linux kernel
13005>>>>>>>514		string		!HdrS
13006#not BeOS
13007>>>>>>>>422		string		!Be\ Boot\ Loader
13008# GPT with protective MBR entry in partition 1 (only)
13009>>>>>>>>>450		ubyte		0xee
13010>>>>>>>>>>466		ubyte		!0xee
13011>>>>>>>>>>>482		ubyte		!0xee
13012>>>>>>>>>>>>498		ubyte		!0xee
13013#>>>>>>>>>>>>>446	use		gpt-mbr-partition
13014>>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
13015>>>>>>>>>>>>>>0			use		gpt-mbr-type
13016>>>>>>>>>>>>>>&-8		use		gpt-table
13017>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
13018>>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
13019>>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
13020>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13021>>>>>>>>>>>>>>>&-8		use		gpt-table
13022>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
13023>>>>>>>>>>>>>>(454.l*4096)	string		!EFI\ PART
13024>>>>>>>>>>>>>>>(454.l*2048)	string		EFI\ PART	GPT partition table
13025>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13026>>>>>>>>>>>>>>>>&-8		use		gpt-table
13027>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
13028>>>>>>>>>>>>>>>(454.l*2048)	string		!EFI\ PART
13029>>>>>>>>>>>>>>>>(454.l*1024)	string		EFI\ PART	GPT partition table
13030>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13031>>>>>>>>>>>>>>>>>&-8		use		gpt-table
13032>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
13033>>>>>>>>>>>>>>>>(454.l*1024)	string		!EFI\ PART
13034>>>>>>>>>>>>>>>>>(454.l*512)	string		EFI\ PART	GPT partition table
13035>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13036>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
13037>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
13038# GPT with protective MBR entry in partition 2 (only)
13039>>>>>>>>>450		ubyte		!0xee
13040>>>>>>>>>>466		ubyte		0xee
13041>>>>>>>>>>>482		ubyte		!0xee
13042>>>>>>>>>>>>498		ubyte		!0xee
13043#>>>>>>>>>>>>>462	use		gpt-mbr-partition
13044>>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
13045>>>>>>>>>>>>>>0			use		gpt-mbr-type
13046>>>>>>>>>>>>>>&-8		use		gpt-table
13047>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
13048>>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
13049>>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
13050>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13051>>>>>>>>>>>>>>>&-8		use		gpt-table
13052>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
13053>>>>>>>>>>>>>>(470.l*4096)	string		!EFI\ PART
13054>>>>>>>>>>>>>>>(470.l*2048)	string		EFI\ PART	GPT partition table
13055>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13056>>>>>>>>>>>>>>>>&-8		use		gpt-table
13057>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
13058>>>>>>>>>>>>>>>(470.l*2048)	string		!EFI\ PART
13059>>>>>>>>>>>>>>>>(470.l*1024)	string		EFI\ PART	GPT partition table
13060>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13061>>>>>>>>>>>>>>>>>&-8		use		gpt-table
13062>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
13063>>>>>>>>>>>>>>>>(470.l*1024)	string		!EFI\ PART
13064>>>>>>>>>>>>>>>>>(470.l*512)	string		EFI\ PART	GPT partition table
13065>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13066>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
13067>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
13068# GPT with protective MBR entry in partition 3 (only)
13069>>>>>>>>>450		ubyte		!0xee
13070>>>>>>>>>>466		ubyte		!0xee
13071>>>>>>>>>>>482		ubyte		0xee
13072>>>>>>>>>>>>498		ubyte		!0xee
13073#>>>>>>>>>>>>>478	use		gpt-mbr-partition
13074>>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
13075>>>>>>>>>>>>>>0			use		gpt-mbr-type
13076>>>>>>>>>>>>>>&-8		use		gpt-table
13077>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
13078>>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
13079>>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
13080>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13081>>>>>>>>>>>>>>>&-8		use		gpt-table
13082>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
13083>>>>>>>>>>>>>>(486.l*4096)	string		!EFI\ PART
13084>>>>>>>>>>>>>>>(486.l*2048)	string		EFI\ PART	GPT partition table
13085>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13086>>>>>>>>>>>>>>>>&-8		use		gpt-table
13087>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
13088>>>>>>>>>>>>>>>(486.l*2048)	string		!EFI\ PART
13089>>>>>>>>>>>>>>>>(486.l*1024)	string		EFI\ PART	GPT partition table
13090>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13091>>>>>>>>>>>>>>>>>&-8		use		gpt-table
13092>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
13093>>>>>>>>>>>>>>>>(486.l*1024)	string		!EFI\ PART
13094>>>>>>>>>>>>>>>>>(486.l*512)	string		EFI\ PART	GPT partition table
13095>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13096>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
13097>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
13098# GPT with protective MBR entry in partition 4 (only)
13099>>>>>>>>>450		ubyte		!0xee
13100>>>>>>>>>>466		ubyte		!0xee
13101>>>>>>>>>>>482		ubyte		!0xee
13102>>>>>>>>>>>>498		ubyte		0xee
13103#>>>>>>>>>>>>>494	use		gpt-mbr-partition
13104>>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
13105>>>>>>>>>>>>>>0			use		gpt-mbr-type
13106>>>>>>>>>>>>>>&-8		use		gpt-table
13107>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
13108>>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
13109>>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
13110>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13111>>>>>>>>>>>>>>>&-8		use		gpt-table
13112>>>>>>>>>>>>>>>0		ubyte		x		of 4096 bytes
13113>>>>>>>>>>>>>>(502.l*4096)	string		!EFI\ PART
13114>>>>>>>>>>>>>>>(502.l*2048)	string		EFI\ PART	GPT partition table
13115>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13116>>>>>>>>>>>>>>>>&-8		use		gpt-table
13117>>>>>>>>>>>>>>>>0		ubyte		x		of 2048 bytes
13118>>>>>>>>>>>>>>>(502.l*2048)	string		!EFI\ PART
13119>>>>>>>>>>>>>>>>(502.l*1024)	string		EFI\ PART	GPT partition table
13120>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13121>>>>>>>>>>>>>>>>>&-8		use		gpt-table
13122>>>>>>>>>>>>>>>>>0		ubyte		x		of 1024 bytes
13123>>>>>>>>>>>>>>>>(502.l*1024)	string		!EFI\ PART
13124>>>>>>>>>>>>>>>>>(502.l*512)	string		EFI\ PART	GPT partition table
13125>>>>>>>>>>>>>>>>>>0		use		gpt-mbr-type
13126>>>>>>>>>>>>>>>>>>&-8		use		gpt-table
13127>>>>>>>>>>>>>>>>>>0		ubyte		x		of 512 bytes
13128
13129# The following code does GPT detection and processing, including
13130# sector size detection.
13131# It has to be duplicated above because the top-level pattern
13132# (i.e. not called using 'use') must print *something* for file
13133# to count it as a match. Text only printed in named patterns is
13134# not counted, and causes file to continue, and try and match
13135# other patterns.
13136#
13137# Unfortunately, when assuming sector sizes >=16k, if the sector size
13138# happens to be 512 instead, we may find confusing data after the GPT
13139# table...  If the GPT table has less than 128 entries, this may even
13140# happen for assumed sector sizes as small as 4k
13141# This could be solved by checking for the presence of the backup GPT
13142# header as well, but that makes the logic extremely complex
13143##0		name		gpt-mbr-partition
13144##>(8.l*8192)	string		EFI\ PART
13145##>>(8.l*8192)	use		gpt-mbr-type
13146##>>&-8		use		gpt-table
13147##>>0		ubyte		x		of 8192 bytes
13148##>(8.l*8192)	string		!EFI\ PART
13149##>>(8.l*4096)	string		EFI\ PART	GPT partition table
13150##>>>0		use		gpt-mbr-type
13151##>>>&-8		use		gpt-table
13152##>>>0		ubyte		x		of 4096 bytes
13153##>>(8.l*4096)	string		!EFI\ PART
13154##>>>(8.l*2048)	string		EFI\ PART	GPT partition table
13155##>>>>0		use		gpt-mbr-type
13156##>>>>&-8		use		gpt-table
13157##>>>>0		ubyte		x		of 2048 bytes
13158##>>>(8.l*2048)	string		!EFI\ PART
13159##>>>>(8.l*1024)	string		EFI\ PART	GPT partition table
13160##>>>>>0		use		gpt-mbr-type
13161##>>>>>&-8	use		gpt-table
13162##>>>>>0		ubyte		x		of 1024 bytes
13163##>>>>(8.l*1024)	string		!EFI\ PART
13164##>>>>>(8.l*512)	string		EFI\ PART	GPT partition table
13165##>>>>>>0		use		gpt-mbr-type
13166##>>>>>>&-8	use		gpt-table
13167##>>>>>>0		ubyte		x		of 512 bytes
13168
13169# Print details of MBR type for a GPT-disk
13170# Calling code ensures that there is only one 0xee partition.
131710		name		gpt-mbr-type
13172# GPT with protective MBR entry in partition 1
13173>450		ubyte		0xee
13174>>454		ulelong		1
13175>>>462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
13176>>454		ulelong		!1													\b (nonstandard: not at LBA 1)
13177# GPT with protective MBR entry in partition 2
13178>466		ubyte		0xee
13179>>470		ulelong		1
13180>>>478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
13181>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
13182>>>478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
13183>>470		ulelong		!1									\b (nonstandard: not at LBA 1)
13184# GPT with protective MBR entry in partition 3
13185>482		ubyte		0xee
13186>>486		ulelong		1
13187>>>494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
13188>>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
13189>>>494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
13190>>486		ulelong		!1									\b (nonstandard: not at LBA 1)
13191# GPT with protective MBR entry in partition 4
13192>498		ubyte		0xee
13193>>502		ulelong		1
13194>>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
13195>>502		ulelong		!1													\b (nonstandard: not at LBA 1)
13196
13197# Print the information from a GPT partition table structure
131980		name		gpt-table
13199>10		uleshort	x		\b, version %u
13200>8		uleshort	x		\b.%u
13201>56		ulelong		x		\b, GUID: %08x
13202>60		uleshort	x		\b-%04x
13203>62		uleshort	x		\b-%04x
13204>64		ubeshort	x		\b-%04x
13205>66		ubeshort	x		\b-%04x
13206>68		ubelong		x		\b%08x
13207#>80		uleshort	x		\b, %d partition entries
13208>32		ulequad+1	x		\b, disk size: %lld sectors
13209
13210# In case a GPT data-structure is at LBA 0, report it as well
13211# This covers systems which are not GPT-aware, and which show
13212# and allow access to the protective partition. This code will
13213# detect the contents of such a partition.
132140		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
13215>0		use		gpt-table
13216>0		ubyte		x		(sector size unknown)
13217
13218
13219
13220#------------------------------------------------------------------------------
13221# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
13222# gpu: file(1) magic for GPU input files
13223
13224# Standard Portable Intermediate Representation (SPIR)
13225# Documentation: https://www.khronos.org/spir
13226# Typical file extension: .spv
13227
132280	belong	0x07230203	Khronos SPIR-V binary, big-endian
13229>4	belong	x		\b, version 0x%08x
13230>8	belong	x		\b, generator 0x%08x
13231
132320	lelong	0x07230203      Khronos SPIR-V binary, little-endian
13233>4	lelong	x		\b, version 0x%08x
13234>8	lelong	x		\b, generator 0x%08x
13235
13236# Vulkan Trace file
13237# Documentation:
13238# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
13239# vktrace_trace_packet_identifiers.h
13240# Typical file extension: .vktrace
13241
132428	lequad  0xABADD068ADEAFD0C	Vulkan trace file, little-endian
13243>0	leshort	x			\b, version %d
13244
132458	bequad  0xABADD068ADEAFD0C	Vulkan trace file, big-endian
13246>0	beshort	x			\b, version %d
13247
13248#------------------------------------------------------------------------------
13249# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
13250# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
13251#
13252# ACE/gr binary
132530	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
13254>39	byte	>0			- version %c
13255# ACE/gr ascii
132560	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
132570	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
132580	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
13259# Grace projects
132600	string	#\ Grace\ project\ file		Grace project file
13261>23	string	@version\  			(version
13262>>32	byte	>0 				%c
13263>>33	string	>\0 				\b.%.2s
13264>>35	string	>\0 				\b.%.2s)
13265# ACE/gr fit description files
132660	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
13267# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
13268
13269#------------------------------------------------------------------------------
13270# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $
13271# graphviz:  file(1) magic for http://www.graphviz.org/
13272
13273# FIXME: These patterns match too generally. For example, the first
13274# line matches a LaTeX file containing the word "graph" (with a {
13275# following later) and the second line matches this file.
13276#0	regex/100l	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
13277#!:mime	text/vnd.graphviz
13278#0	regex/100l	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
13279#!:mime	text/vnd.graphviz
13280
13281#------------------------------------------------------------------------------
13282# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
13283# gringotts:  file(1) magic for Gringotts
13284# http://devel.pluto.linux.it/projects/Gringotts/
13285# author: Germano Rizzo <mano@pluto.linux.it>
13286#GRG3????Y
132870	string	GRG		Gringotts data file
13288#file format 1
13289>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
13290#file format 2
13291>3	string		2		v.2, MCRYPT S2K,
13292>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
13293>>8	byte&0x70	0x10		SERPENT crypt,
13294>>8	byte&0x70	0x20		TWOFISH crypt,
13295>>8	byte&0x70	0x30		CAST-256 crypt,
13296>>8	byte&0x70	0x40		SAFER+ crypt,
13297>>8	byte&0x70	0x50		LOKI97 crypt,
13298>>8	byte&0x70	0x60		3DES crypt,
13299>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
13300>>8	byte&0x08	0x00		SHA1 hash,
13301>>8	byte&0x08	0x08		RIPEMD-160 hash,
13302>>8	byte&0x04	0x00		ZLib
13303>>8	byte&0x04	0x04		BZip2
13304>>8	byte&0x03	0x00		lvl.0
13305>>8	byte&0x03	0x01		lvl.3
13306>>8	byte&0x03	0x02		lvl.6
13307>>8	byte&0x03	0x03		lvl.9
13308#file format 3
13309>3	string		3		v.3, OpenPGP S2K,
13310>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
13311>>8	byte&0x70	0x10		SERPENT crypt,
13312>>8	byte&0x70	0x20		TWOFISH crypt,
13313>>8	byte&0x70	0x30		CAST-256 crypt,
13314>>8	byte&0x70	0x40		SAFER+ crypt,
13315>>8	byte&0x70	0x50		LOKI97 crypt,
13316>>8	byte&0x70	0x60		3DES crypt,
13317>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
13318>>8	byte&0x08	0x00		SHA1 hash,
13319>>8	byte&0x08	0x08		RIPEMD-160 hash,
13320>>8	byte&0x04	0x00		ZLib
13321>>8	byte&0x04	0x04		BZip2
13322>>8	byte&0x03	0x00		lvl.0
13323>>8	byte&0x03	0x01		lvl.3
13324>>8	byte&0x03	0x02		lvl.6
13325>>8	byte&0x03	0x03		lvl.9
13326#file format >3
13327>3	string		>3		v.%.1s (unknown details)
13328
13329#------------------------------------------------------------------------------
13330# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $
13331# Guile file magic from <dalepsmith@gmail.com>
13332# http://www.gnu.org/s/guile/
13333# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250
13334
133350	string	GOOF----	Guile Object
13336>8	string	LE		\b, little endian
13337>8	string	BE		\b, big endian
13338>11	string	4		\b, 32bit
13339>11	string	8		\b, 64bit
13340>13	regex	.\..		\b, bytecode v%s
13341
13342#------------------------------------------------------------------------------
13343# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $
13344# hitach-sh: file(1) magic for Hitachi Super-H
13345#
13346# Super-H COFF
13347#
13348# updated by Joerg Jenderek at Oct 2015
13349# https://en.wikipedia.org/wiki/COFF
13350# https://de.wikipedia.org/wiki/Common_Object_File_Format
13351# http://www.delorie.com/djgpp/doc/coff/filhdr.html
13352# below test line conflicts with 2nd NTFS filesystem sector
13353# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
13354# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
133550	beshort		0x0500
13356# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
13357>18	ubeshort&0x8E80	0
13358# use big endian variant of subroutine to display name+variables+flags
13359# for common object formated files
13360>>0	use				\^display-coff
13361
133620	leshort		0x0550
13363# test for unused flag bits in f_flags
13364>18	uleshort&0x8E80	0
13365# use little endian variant of subroutine to
13366# display name+variables+flags for common object formated files
13367>>0	use				display-coff
13368
13369
13370#------------------------------------------------------------------------------
13371# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $
13372# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
13373#
13374# XXX - somebody should figure out whether any byte order needs to be
13375# applied to the "TML" stuff; I'm assuming the Apollo stuff is
13376# big-endian as it was mostly 68K-based.
13377#
13378# I think the 500 series was the old stack-based machines, running a
13379# UNIX environment atop the "SUN kernel"; dunno whether it was
13380# big-endian or little-endian.
13381#
13382# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
13383# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
13384# HP magic is useful for reference, but using "long" magic is a better
13385# practice in order to avoid collisions.
13386#
13387# Guy Harris (guy@netapp.com): some additions to this list came from
13388# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
13389# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
13390# "/etc/magic", though, except for the "archive file relocatable library"
13391# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
13392# used in executables, or have they just not yet updated "/etc/magic"
13393# completely?
13394#
13395# 0	beshort		200		hp200 (68010) BSD binary
13396# 0	beshort		300		hp300 (68020+68881) BSD binary
13397# 0	beshort		0x20c		hp200/300 HP-UX binary
13398# 0	beshort		0x20d		hp400 (68030) HP-UX binary
13399# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
13400# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
13401# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
13402# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
13403# 0	beshort		0x214		PA-RISC2.0 HP-UX binary
13404
13405#
13406# The "misc" stuff needs a byte order; the archives look suspiciously
13407# like the old 177545 archives (0xff65 = 0177545).
13408#
13409#### Old Apollo stuff
134100	beshort		0627		Apollo m68k COFF executable
13411>18	beshort		^040000		not stripped
13412>22	beshort		>0		- version %d
134130	beshort		0624		apollo a88k COFF executable
13414>18	beshort		^040000		not stripped
13415>22	beshort		>0		- version %d
134160       long            01203604016     TML 0123 byte-order format
134170       long            01702407010     TML 1032 byte-order format
134180       long            01003405017     TML 2301 byte-order format
134190       long            01602007412     TML 3210 byte-order format
13420#### PA-RISC 1.1
134210	belong 		0x02100106	PA-RISC1.1 relocatable object
134220	belong 		0x02100107	PA-RISC1.1 executable
13423>168	belong		&0x00000004	dynamically linked
13424>(144)	belong		0x054ef630	dynamically linked
13425>96	belong		>0		- not stripped
13426
134270	belong 		0x02100108	PA-RISC1.1 shared executable
13428>168	belong&0x4	0x4		dynamically linked
13429>(144)	belong		0x054ef630	dynamically linked
13430>96	belong		>0		- not stripped
13431
134320	belong 		0x0210010b	PA-RISC1.1 demand-load executable
13433>168	belong&0x4	0x4		dynamically linked
13434>(144)	belong		0x054ef630	dynamically linked
13435>96	belong		>0		- not stripped
13436
134370	belong 		0x0210010e	PA-RISC1.1 shared library
13438>96	belong		>0		- not stripped
13439
134400	belong 		0x0210010d	PA-RISC1.1 dynamic load library
13441>96	belong		>0		- not stripped
13442
13443#### PA-RISC 2.0
134440	belong		0x02140106	PA-RISC2.0 relocatable object
13445
134460       belong		0x02140107	PA-RISC2.0 executable
13447>168	belong		&0x00000004	dynamically linked
13448>(144)	belong		0x054ef630	dynamically linked
13449>96	belong		>0		- not stripped
13450
134510       belong		0x02140108	PA-RISC2.0 shared executable
13452>168	belong		&0x00000004	dynamically linked
13453>(144)	belong		0x054ef630	dynamically linked
13454>96	belong		>0		- not stripped
13455
134560       belong		0x0214010b	PA-RISC2.0 demand-load executable
13457>168	belong		&0x00000004	dynamically linked
13458>(144)	belong		0x054ef630	dynamically linked
13459>96	belong		>0		- not stripped
13460
134610       belong		0x0214010e	PA-RISC2.0 shared library
13462>96	belong		>0		- not stripped
13463
134640       belong		0x0214010d	PA-RISC2.0 dynamic load library
13465>96	belong		>0		- not stripped
13466
13467#### 800
134680	belong 		0x020b0106	PA-RISC1.0 relocatable object
13469
134700	belong 		0x020b0107	PA-RISC1.0 executable
13471>168	belong&0x4	0x4		dynamically linked
13472>(144)	belong		0x054ef630	dynamically linked
13473>96	belong		>0		- not stripped
13474
134750	belong 		0x020b0108	PA-RISC1.0 shared executable
13476>168	belong&0x4	0x4		dynamically linked
13477>(144)	belong		0x054ef630	dynamically linked
13478>96	belong		>0		- not stripped
13479
134800	belong 		0x020b010b	PA-RISC1.0 demand-load executable
13481>168	belong&0x4	0x4		dynamically linked
13482>(144)	belong		0x054ef630	dynamically linked
13483>96	belong		>0		- not stripped
13484
134850	belong 		0x020b010e	PA-RISC1.0 shared library
13486>96	belong		>0		- not stripped
13487
134880	belong 		0x020b010d	PA-RISC1.0 dynamic load library
13489>96	belong		>0		- not stripped
13490
134910	belong		0x213c6172	archive file
13492>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
13493>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
13494>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
13495>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
13496
13497#### 500
134980	long		0x02080106	HP s500 relocatable executable
13499>16	long		>0		- version %d
13500
135010	long		0x02080107	HP s500 executable
13502>16	long		>0		- version %d
13503
135040	long		0x02080108	HP s500 pure executable
13505>16	long		>0		- version %d
13506
13507#### 200
135080	belong 		0x020c0108	HP s200 pure executable
13509>4	beshort		>0		- version %d
13510>8	belong		&0x80000000	save fp regs
13511>8	belong		&0x40000000	dynamically linked
13512>8	belong		&0x20000000	debuggable
13513>36	belong		>0		not stripped
13514
135150	belong		0x020c0107	HP s200 executable
13516>4	beshort		>0		- version %d
13517>8	belong		&0x80000000	save fp regs
13518>8	belong		&0x40000000	dynamically linked
13519>8	belong		&0x20000000	debuggable
13520>36	belong		>0		not stripped
13521
135220	belong		0x020c010b	HP s200 demand-load executable
13523>4	beshort		>0		- version %d
13524>8	belong		&0x80000000	save fp regs
13525>8	belong		&0x40000000	dynamically linked
13526>8	belong		&0x20000000	debuggable
13527>36	belong		>0		not stripped
13528
135290	belong		0x020c0106	HP s200 relocatable executable
13530>4	beshort		>0		- version %d
13531>6	beshort		>0		- highwater %d
13532>8	belong		&0x80000000	save fp regs
13533>8	belong		&0x20000000	debuggable
13534>8	belong		&0x10000000	PIC
13535
135360	belong 		0x020a0108	HP s200 (2.x release) pure executable
13537>4	beshort		>0		- version %d
13538>36	belong		>0		not stripped
13539
135400	belong		0x020a0107	HP s200 (2.x release) executable
13541>4	beshort		>0		- version %d
13542>36	belong		>0		not stripped
13543
135440	belong		0x020c010e	HP s200 shared library
13545>4	beshort		>0		- version %d
13546>6	beshort		>0		- highwater %d
13547>36	belong		>0		not stripped
13548
135490	belong		0x020c010d	HP s200 dynamic load library
13550>4	beshort		>0		- version %d
13551>6	beshort		>0		- highwater %d
13552>36	belong		>0		not stripped
13553
13554#### MISC
135550	long		0x0000ff65	HP old archive
135560	long		0x020aff65	HP s200 old archive
135570	long		0x020cff65	HP s200 old archive
135580	long		0x0208ff65	HP s500 old archive
13559
135600	long		0x015821a6	HP core file
13561
135620	long		0x4da7eee8	HP-WINDOWS font
13563>8	byte		>0		- version %d
135640	string		Bitmapfile	HP Bitmapfile
13565
135660	string		IMGfile	CIS 	compimg HP Bitmapfile
13567# XXX - see "lif"
13568#0	short		0x8000		lif file
135690	long		0x020c010c	compiled Lisp
13570
135710	string		msgcat01	HP NLS message catalog,
13572>8	long		>0		%d messages
13573
13574# Summary: HP-48/49 calculator
13575# Created by: phk@data.fls.dk
13576# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk>
13577# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support)
135780	string		HPHP		HP
13579>4	string		48		48 binary
13580>4	string		49		49 binary
13581>7	byte		>64		- Rev %c
13582>8	leshort		0x2911		(ADR)
13583>8	leshort		0x2933		(REAL)
13584>8	leshort		0x2955		(LREAL)
13585>8	leshort		0x2977		(COMPLX)
13586>8	leshort		0x299d		(LCOMPLX)
13587>8	leshort		0x29bf		(CHAR)
13588>8	leshort		0x29e8		(ARRAY)
13589>8	leshort		0x2a0a		(LNKARRAY)
13590>8	leshort		0x2a2c		(STRING)
13591>8	leshort		0x2a4e		(HXS)
13592>8	leshort		0x2a74		(LIST)
13593>8	leshort		0x2a96		(DIR)
13594>8	leshort		0x2ab8		(ALG)
13595>8	leshort		0x2ada		(UNIT)
13596>8	leshort		0x2afc		(TAGGED)
13597>8	leshort		0x2b1e		(GROB)
13598>8	leshort		0x2b40		(LIB)
13599>8	leshort		0x2b62		(BACKUP)
13600>8	leshort		0x2b88		(LIBDATA)
13601>8	leshort		0x2d9d		(PROG)
13602>8	leshort		0x2dcc		(CODE)
13603>8	leshort		0x2e48		(GNAME)
13604>8	leshort		0x2e6d		(LNAME)
13605>8	leshort		0x2e92		(XLIB)
13606
136070	string		%%HP:		HP text
13608>6	string		T(0)		- T(0)
13609>6	string		T(1)		- T(1)
13610>6	string		T(2)		- T(2)
13611>6	string		T(3)		- T(3)
13612>10	string		A(D)		A(D)
13613>10	string		A(R)		A(R)
13614>10	string		A(G)		A(G)
13615>14	string		F(.)		F(.);
13616>14	string		F(,)		F(,);
13617
13618
13619# Summary: HP-38/39 calculator
13620# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
136210	string		HP3
13622>3	string		8		HP 38
13623>3	string		9		HP 39
13624>4	string		Bin		binary
13625>4	string		Asc		ASCII
13626>7	string		A		(Directory List)
13627>7	string		B		(Zaplet)
13628>7	string		C		(Note)
13629>7	string		D		(Program)
13630>7	string		E		(Variable)
13631>7	string		F		(List)
13632>7	string		G		(Matrix)
13633>7	string		H		(Library)
13634>7	string		I		(Target List)
13635>7	string		J		(ASCII Vector specification)
13636>7	string		K		(wildcard)
13637
13638# Summary: HP-38/39 calculator
13639# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
136400	string		HP3
13641>3	string		8		HP 38
13642>3	string		9		HP 39
13643>4	string		Bin		binary
13644>4	string		Asc		ASCII
13645>7	string		A		(Directory List)
13646>7	string		B		(Zaplet)
13647>7	string		C		(Note)
13648>7	string		D		(Program)
13649>7	string		E		(Variable)
13650>7	string		F		(List)
13651>7	string		G		(Matrix)
13652>7	string		H		(Library)
13653>7	string		I		(Target List)
13654>7	string		J		(ASCII Vector specification)
13655>7	string		K		(wildcard)
13656
13657# hpBSD magic numbers
136580	beshort		200		hp200 (68010) BSD
13659>2	beshort		0407		impure binary
13660>2	beshort		0410		read-only binary
13661>2	beshort		0413		demand paged binary
136620	beshort		300		hp300 (68020+68881) BSD
13663>2	beshort		0407		impure binary
13664>2	beshort		0410		read-only binary
13665>2	beshort		0413		demand paged binary
13666#
13667# From David Gero <dgero@nortelnetworks.com>
13668# HP-UX 10.20 core file format from /usr/include/sys/core.h
13669# Unfortunately, HP-UX uses corehead blocks without specifying the order
13670# There are four we care about:
13671#     CORE_KERNEL, which starts with the string "HP-UX"
13672#     CORE_EXEC, which contains the name of the command
13673#     CORE_PROC, which contains the signal number that caused the core dump
13674#     CORE_FORMAT, which contains the version of the core file format (== 1)
13675# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
13676# but we include all 6 variations of the order of the first 3, and
13677# assume that PROC will always be last
13678# Order 1: KERNEL, EXEC, FORMAT, PROC
136790x10		string	HP-UX
13680>0		belong	2
13681>>0xC		belong	0x3C
13682>>>0x4C		belong	0x100
13683>>>>0x58	belong	0x44
13684>>>>>0xA0	belong	1
13685>>>>>>0xAC	belong	4
13686>>>>>>>0xB0	belong	1
13687>>>>>>>>0xB4	belong	4		core file
13688>>>>>>>>>0x90	string	>\0		from '%s'
13689>>>>>>>>>0xC4	belong	3		- received SIGQUIT
13690>>>>>>>>>0xC4	belong	4		- received SIGILL
13691>>>>>>>>>0xC4	belong	5		- received SIGTRAP
13692>>>>>>>>>0xC4	belong	6		- received SIGABRT
13693>>>>>>>>>0xC4	belong	7		- received SIGEMT
13694>>>>>>>>>0xC4	belong	8		- received SIGFPE
13695>>>>>>>>>0xC4	belong	10		- received SIGBUS
13696>>>>>>>>>0xC4	belong	11		- received SIGSEGV
13697>>>>>>>>>0xC4	belong	12		- received SIGSYS
13698>>>>>>>>>0xC4	belong	33		- received SIGXCPU
13699>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
13700# Order 2: KERNEL, FORMAT, EXEC, PROC
13701>>>0x4C		belong	1
13702>>>>0x58	belong	4
13703>>>>>0x5C	belong	1
13704>>>>>>0x60	belong	0x100
13705>>>>>>>0x6C	belong	0x44
13706>>>>>>>>0xB4	belong	4		core file
13707>>>>>>>>>0xA4	string	>\0		from '%s'
13708>>>>>>>>>0xC4	belong	3		- received SIGQUIT
13709>>>>>>>>>0xC4	belong	4		- received SIGILL
13710>>>>>>>>>0xC4	belong	5		- received SIGTRAP
13711>>>>>>>>>0xC4	belong	6		- received SIGABRT
13712>>>>>>>>>0xC4	belong	7		- received SIGEMT
13713>>>>>>>>>0xC4	belong	8		- received SIGFPE
13714>>>>>>>>>0xC4	belong	10		- received SIGBUS
13715>>>>>>>>>0xC4	belong	11		- received SIGSEGV
13716>>>>>>>>>0xC4	belong	12		- received SIGSYS
13717>>>>>>>>>0xC4	belong	33		- received SIGXCPU
13718>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
13719# Order 3: FORMAT, KERNEL, EXEC, PROC
137200x24		string	HP-UX
13721>0		belong	1
13722>>0xC		belong	4
13723>>>0x10		belong	1
13724>>>>0x14	belong	2
13725>>>>>0x20	belong	0x3C
13726>>>>>>0x60	belong	0x100
13727>>>>>>>0x6C	belong	0x44
13728>>>>>>>>0xB4	belong	4		core file
13729>>>>>>>>>0xA4	string	>\0		from '%s'
13730>>>>>>>>>0xC4	belong	3		- received SIGQUIT
13731>>>>>>>>>0xC4	belong	4		- received SIGILL
13732>>>>>>>>>0xC4	belong	5		- received SIGTRAP
13733>>>>>>>>>0xC4	belong	6		- received SIGABRT
13734>>>>>>>>>0xC4	belong	7		- received SIGEMT
13735>>>>>>>>>0xC4	belong	8		- received SIGFPE
13736>>>>>>>>>0xC4	belong	10		- received SIGBUS
13737>>>>>>>>>0xC4	belong	11		- received SIGSEGV
13738>>>>>>>>>0xC4	belong	12		- received SIGSYS
13739>>>>>>>>>0xC4	belong	33		- received SIGXCPU
13740>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
13741# Order 4: EXEC, KERNEL, FORMAT, PROC
137420x64		string	HP-UX
13743>0		belong	0x100
13744>>0xC		belong	0x44
13745>>>0x54		belong	2
13746>>>>0x60	belong	0x3C
13747>>>>>0xA0	belong	1
13748>>>>>>0xAC	belong	4
13749>>>>>>>0xB0	belong	1
13750>>>>>>>>0xB4	belong	4		core file
13751>>>>>>>>>0x44	string	>\0		from '%s'
13752>>>>>>>>>0xC4	belong	3		- received SIGQUIT
13753>>>>>>>>>0xC4	belong	4		- received SIGILL
13754>>>>>>>>>0xC4	belong	5		- received SIGTRAP
13755>>>>>>>>>0xC4	belong	6		- received SIGABRT
13756>>>>>>>>>0xC4	belong	7		- received SIGEMT
13757>>>>>>>>>0xC4	belong	8		- received SIGFPE
13758>>>>>>>>>0xC4	belong	10		- received SIGBUS
13759>>>>>>>>>0xC4	belong	11		- received SIGSEGV
13760>>>>>>>>>0xC4	belong	12		- received SIGSYS
13761>>>>>>>>>0xC4	belong	33		- received SIGXCPU
13762>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
13763# Order 5: FORMAT, EXEC, KERNEL, PROC
137640x78		string	HP-UX
13765>0		belong	1
13766>>0xC		belong	4
13767>>>0x10		belong	1
13768>>>>0x14	belong	0x100
13769>>>>>0x20	belong	0x44
13770>>>>>>0x68	belong	2
13771>>>>>>>0x74	belong	0x3C
13772>>>>>>>>0xB4	belong	4		core file
13773>>>>>>>>>0x58	string	>\0		from '%s'
13774>>>>>>>>>0xC4	belong	3		- received SIGQUIT
13775>>>>>>>>>0xC4	belong	4		- received SIGILL
13776>>>>>>>>>0xC4	belong	5		- received SIGTRAP
13777>>>>>>>>>0xC4	belong	6		- received SIGABRT
13778>>>>>>>>>0xC4	belong	7		- received SIGEMT
13779>>>>>>>>>0xC4	belong	8		- received SIGFPE
13780>>>>>>>>>0xC4	belong	10		- received SIGBUS
13781>>>>>>>>>0xC4	belong	11		- received SIGSEGV
13782>>>>>>>>>0xC4	belong	12		- received SIGSYS
13783>>>>>>>>>0xC4	belong	33		- received SIGXCPU
13784>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
13785# Order 6: EXEC, FORMAT, KERNEL, PROC
13786>0		belong	0x100
13787>>0xC		belong	0x44
13788>>>0x54		belong	1
13789>>>>0x60	belong	4
13790>>>>>0x64	belong	1
13791>>>>>>0x68	belong	2
13792>>>>>>>0x74	belong	0x2C
13793>>>>>>>>0xB4	belong	4		core file
13794>>>>>>>>>0x44	string	>\0		from '%s'
13795>>>>>>>>>0xC4	belong	3		- received SIGQUIT
13796>>>>>>>>>0xC4	belong	4		- received SIGILL
13797>>>>>>>>>0xC4	belong	5		- received SIGTRAP
13798>>>>>>>>>0xC4	belong	6		- received SIGABRT
13799>>>>>>>>>0xC4	belong	7		- received SIGEMT
13800>>>>>>>>>0xC4	belong	8		- received SIGFPE
13801>>>>>>>>>0xC4	belong	10		- received SIGBUS
13802>>>>>>>>>0xC4	belong	11		- received SIGSEGV
13803>>>>>>>>>0xC4	belong	12		- received SIGSYS
13804>>>>>>>>>0xC4	belong	33		- received SIGXCPU
13805>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
13806
13807
13808
13809#------------------------------------------------------------------------------
13810# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
13811# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
13812# Magic too short!
13813#0		string	HU		Human68k
13814#>68		string	LZX		LZX compressed
13815#>>72		string	>\0		(version %s)
13816#>(8.L+74)	string	LZX		LZX compressed
13817#>>(8.L+78)	string	>\0		(version %s)
13818#>60		belong	>0		binded
13819#>(8.L+66)	string	#HUPAIR		hupair
13820#>0		string	HU		X executable
13821#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
13822#>4		belong	>0		- base address 0x%x
13823#>28		belong	>0		not stripped
13824#>32		belong	>0		with debug information
13825#0		beshort	0x601a		Human68k Z executable
13826#0		beshort	0x6000		Human68k object file
13827#0		belong	0xd1000000	Human68k ar binary archive
13828#0		belong	0xd1010000	Human68k ar ascii archive
13829#0		beshort	0x0068		Human68k lib archive
13830#4		string	LZX		Human68k LZX compressed
13831#>8		string	>\0		(version %s)
13832#>4		string	LZX		R executable
13833#2		string	#HUPAIR		Human68k hupair R executable
13834
13835#------------------------------------------------------------------------------
13836# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
13837# ibm370:  file(1) magic for IBM 370 and compatibles.
13838#
13839# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
13840# What the heck *is* "USS/370"?
13841# AIX 4.1's "/etc/magic" has
13842#
13843#	0	short		0535		370 sysV executable
13844#	>12	long		>0		not stripped
13845#	>22	short		>0		- version %d
13846#	>30	long		>0		- 5.2 format
13847#	0	short		0530		370 sysV pure executable
13848#	>12	long		>0		not stripped
13849#	>22	short		>0		- version %d
13850#	>30	long		>0		- 5.2 format
13851#
13852# instead of the "USS/370" versions of the same magic numbers.
13853#
138540	beshort		0537		370 XA sysV executable
13855>12	belong		>0		not stripped
13856>22	beshort		>0		- version %d
13857>30	belong		>0		- 5.2 format
138580	beshort		0532		370 XA sysV pure executable
13859>12	belong		>0		not stripped
13860>22	beshort		>0		- version %d
13861>30	belong		>0		- 5.2 format
138620	beshort		054001		370 sysV pure executable
13863>12	belong		>0		not stripped
138640	beshort		055001		370 XA sysV pure executable
13865>12	belong		>0		not stripped
138660	beshort		056401		370 sysV executable
13867>12	belong		>0		not stripped
138680	beshort		057401		370 XA sysV executable
13869>12	belong		>0		not stripped
138700       beshort		0531		SVR2 executable (Amdahl-UTS)
13871>12	belong		>0		not stripped
13872>24     belong		>0		- version %d
138730	beshort		0534		SVR2 pure executable (Amdahl-UTS)
13874>12	belong		>0		not stripped
13875>24	belong		>0		- version %d
138760	beshort		0530		SVR2 pure executable (USS/370)
13877>12	belong		>0		not stripped
13878>24	belong		>0		- version %d
138790	beshort		0535		SVR2 executable (USS/370)
13880>12	belong		>0		not stripped
13881>24	belong		>0		- version %d
13882
13883#------------------------------------------------------------------------------
13884# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $
13885# ibm6000:  file(1) magic for RS/6000 and the RT PC.
13886#
138870	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
13888>12	belong		>0		not stripped
13889# Breaks sun4 statically linked execs.
13890#0      beshort		0x0103		executable (RT Version 2) or obj module
13891#>2	byte		0x50		pure
13892#>28	belong		>0		not stripped
13893#>6	beshort		>0		- version %ld
138940	beshort		0x0104		shared library
138950	beshort		0x0105		ctab data
138960	beshort		0xfe04		structured file
138970	string		0xabcdef	AIX message catalog
138980	belong		0x000001f9	AIX compiled message catalog
138990	string		\<aiaff>	archive
139000	string		\<bigaf>	archive (big format)
13901
139020	beshort		0x01f7		64-bit XCOFF executable or object module
13903>20	belong		0		not stripped
13904# GRR: this test is still too general as it catches also many FATs of DOS filesystems
139054	belong		&0x0feeddb0
13906# real core dump could not be 32-bit and 64-bit together
13907>7	byte&0x03	!3		AIX core file
13908>>1	byte		&0x01		fulldump
13909>>7	byte		&0x01		32-bit
13910>>>0x6e0	string	>\0		\b, %s
13911>>7	byte		&0x02		64-bit
13912>>>0x524	string	>\0		\b, %s
13913
13914#------------------------------------------------------------------------------
13915# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $
13916# icc:  file(1) magic for International Color Consortium file formats
13917
13918#
13919# Color profiles as per the ICC's "Image technology colour management -
13920# Architecture, profile format, and data structure" specification.
13921# See
13922#
13923#	http://www.color.org/specification/ICC1v43_2010-12.pdf
13924#
13925# for Specification ICC.1:2010 (Profile version 4.3.0.0).
13926# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
13927# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
13928# Update: Joerg Jenderek
13929#
13930# Bytes 36 to 39 contain a generic profile file signature of "acsp";
13931# bytes 40 to 43 "may be used to identify the primary platform/operating
13932# system framework for which the profile was created".
13933#
13934#	check and display ICC/ICM color profile
139350	name	color-profile
13936>36	string		acsp
13937# skip ASCII like Cognacspirit.txt by month <= 12
13938>>26	ubeshort	<13
13939# platform/operating system. Only 5 mentioned
13940
13941#
13942# This appears to be what's used for Apple ColorSync profiles.
13943# Instead of adding that, Apple just changed the generic "acsp" entry
13944# to be for "ColorSync ICC Color Profile" rather than "Kodak Color
13945# Management System, ICC Profile".
13946# Yes, it's "APPL", not "AAPL"; see the spec.
13947>>>40	string		APPL		ColorSync
13948
13949# Microsoft ICM color profile
13950>>>40	string		MSFT		Microsoft
13951
13952# Yes, that's a blank after "SGI".
13953>>>40	string		SGI\ 		SGI
13954
13955# XXX - is this what's used for the Sun KCMS or not?  The standard file
13956# uses just "acsp" for that, but Apple's file uses it for "ColorSync",
13957# and there *is* an identified "primary platform" value of SUNW.
13958>>>40	string		SUNW		Sun KCMS
13959
13960# 5th platform
13961>>>40	string		TGNT		Taligent
13962
13963# remaining "l" "e" of "color profile" printed later to avoid error
13964>>>40	string		x 		color profi
13965#>>>40	string		x		(%.4s)
13966!:mime	application/vnd.iccprofile
13967# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
13968>>>8	ubyte		=2
13969# do not use empty message text to a avoid error like
13970# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
13971# file.exe: could not find any valid magic files!
13972>>>>9	ubyte		!0		\ble
13973!:ext	icc/icm
13974# minor version
13975>>>>9	ubyte		=0		\bl
13976# Kodak colour management system
13977>>>>>4	string		=KCMS		\be
13978!:ext	icc/icm/cc
13979>>>>>4	string		!KCMS		\be
13980!:ext	icc/icm
13981>>>8	ubyte		!2		\ble
13982!:ext	icc
13983# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
13984>>>8	ubyte		x		%u
13985>>>9	ubyte/16	x		\b.%u
13986# reserved and shall be null but 205.205 in umx1220u.icm
13987>>>10	ubyte		>0		\b.%u
13988>>>>11	ubyte		>0		\b.%u
13989# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF  "
13990# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
13991>>>4	string		>\ 		\b, type %.2s
13992>>>>6	string		>\  		\b%.1s
13993>>>>>7	string		>\  		\b%.1s
13994# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
13995>>>16	string		x		\b, %.3s
13996>>>19	string		>\  		\b%.1s
13997# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
13998# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
13999>>>20	string		>\0		\b/%.3s
14000>>>>23	string		>\ 		\b%.1s
14001# eleven device classes
14002>>>12	string		x		\b-%.4s device
14003# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
14004>>>52	string		>\040
14005# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
14006>>>>52	ubelong		!0x6e6f6e65
14007# device manufacturer field like "HP  " "IBM " EPSO
14008>>>>>48	string		x		\b, %.2s
14009>>>>>50	string		>\  		\b%.1s
14010>>>>>51	string		>\  		\b%.1s
14011# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
14012>>>>>52	string		>\ \  		\b/%.3s
14013>>>>>>55 string		>\  		\b%.1s
14014>>>>>52	string		x		model
14015# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
14016>>>80	string		>\0		by %.2s
14017>>>>82	string		>\  		\b%.1s
14018>>>>>83	string		>\  		\b%.1s
14019# profile size
14020>>>0	ubelong		x		\b, %u bytes
14021# skip invalid date 0 like in linearSRGB.icc
14022>>>24	ubequad		!0
14023# datetime dd-mm-yyyy hh:mm:ss
14024>>>>28	ubeshort	x		\b, %u
14025# month <= 12
14026>>>>26	ubeshort	x		\b-%u
14027# year
14028>>>>24	ubeshort	x		\b-%u
14029# do not display midnight time like in CNHP8308.ICC
14030>>>>30	ubequad&0xFFffFFffFFff0000	!0
14031# hour <= 24
14032>>>>>30	ubeshort	x		%u
14033# minutes <= 59
14034>>>>>32	ubeshort	x		\b:%.2u
14035# seconds <= 59
14036>>>>>34	ubeshort	x		\b:%.2u
14037# vendor specific flags like 2 in HPCLJ5.ICM
14038>>>44	ubeshort	>0		\b, 0x%x vendor flags
14039# profile flags bits 0-2 of least 16 used by ICC
14040#>>>44	ubelong		>0		\b, 0x%x flags
14041# icEmbeddedProfileTrue
14042>>>44	ubelong		&1		\b, embedded
14043# icEmbeddedProfileFalse
14044#>>>44	ubelong		^1		\b, not embedded
14045# icUseWithEmbeddedDataOnly
14046>>>44	ubelong		&2		\b, dependently
14047# icUseAnywhere
14048#>>>44	ubelong		^2		\b, independently
14049>>>44	ubelong		&4		\b, MCS
14050#>>>44	ubelong		^4		\b, no MCS
14051# vendor specific device attributes 1~srgb.icc
14052# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
14053>>>56	ubelong		>0		\b, 0x%x vendor attribute
14054# ICC device attributes bits 0-7 used
14055#>>>60	ubelong		x		\b, 0x%x attribute
14056# http://www.color.org/icc34.h
14057>>>60	ubelong		&0x01		\b, transparent
14058#>>>60	ubelong		^0x01		\b, reflective
14059>>>60	ubelong		&0x02		\b, matte
14060#>>>60	ubelong		^0x02		\b, glossy
14061>>>60	ubelong		&0x04		\b, negative
14062#>>>60	ubelong		^0x04		\b, positive
14063>>>60	ubelong		&0x08		\b, black&white
14064#>>>60	ubelong		^0x08		\b, colour
14065>>>60	ubelong		&0x10		\b, non-paper
14066#>>>60	ubelong		^0x10		\b, paper
14067>>>60	ubelong		&0x20		\b, non-textured
14068#>>>60	ubelong		^0x20		\b, textured
14069>>>60	ubelong		&0x40		\b, non-isotropic
14070#>>>60	ubelong		^0x40		\b, isotropic
14071>>>60	ubelong		&0x80		\b, self-luminous
14072#>>>60	ubelong		^0x80		\b, non-self-luminous
14073# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
14074>>>64	ubelong		>3		\b, 0x%x rendering intent
14075#>>>64	ubelong		=0		\b, perceptual
14076>>>64	ubelong		=1		\b, relative colorimetric
14077>>>64	ubelong		=2		\b, saturation
14078>>>64	ubelong		=3		\b, absolute colorimetric
14079# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
14080>>>71	ubequad		!0xd6000100000000d3	\b, PCS
14081# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
14082# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
14083>>>>68	ubelong			!0x0000f6d5	X=0x%x
14084# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
14085>>>>72	ubelong			!0x00010000	Y=0x%x
14086# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
14087# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
14088>>>>76	ubelong			!0x0000d32d	Z=0x%x
14089# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
14090>>>84	ubequad		>0		\b, 0x%llx MD5
14091# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
14092#>>100	ubequad		x		\b 0x%llx reserved
14093# tag table
14094# 6 <= tags count <= 43
14095#>>>128	ubelong		>43		\b, %u tags
14096>>>128	ubelong		x
14097# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
14098# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
14099>>>>132	search/508	cprt
14100# but no copyright tag in linearSRGB.icc
14101# beneath /System/Library/Frameworks/WebKit.framework/
14102# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
14103>>>>132	default		x		\b, no copyright tag
14104# 1st tag
14105#>>>132	string		x		\b, 1st tag %.4s
14106#>>>136	ubelong		x		0x%x offset
14107#>>>140	ubelong		x		0x%x len
14108# 2nd tag,...
14109# look also for profileDescriptionTag "desc"
14110>>>132	search/508	desc
14111# look further for TextDescriptionType "desc" signature
14112>>>>(&0.L)	string		=desc
14113>>>>>&4		pstring/l	x	"%s"
14114# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
14115>>>>(&0.L)	string		=mluc
14116>>>>>&(&8.L)	ubequad		x
14117>>>>>>&4	bestring16	x	'%s'
14118
14119# Any other profile.
14120# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
14121# and use "acsp" for everything else and dump the "primary platform"
14122# string in those cases?
1412336	string		acsp
14124>0	use		color-profile
14125
14126
14127
14128#------------------------------------------------------------------------------
14129# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $
14130# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
14131#
14132# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
14133# Arts for file interchange.  It has also been used by Apple, SGI, and
14134# especially Commodore-Amiga.
14135#
14136# IFF files begin with an 8 byte FORM header, followed by a 4 character
14137# FORM type, which is followed by the first chunk in the FORM.
14138
141390	string		FORM		IFF data
14140#>4	belong		x		\b, FORM is %d bytes long
14141# audio formats
14142>8	string		AIFF		\b, AIFF audio
14143!:mime	audio/x-aiff
14144>8	string		AIFC		\b, AIFF-C compressed audio
14145!:mime	audio/x-aiff
14146>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
14147!:mime	audio/x-aiff
14148>8	string		16SV		\b, 16SV 16-bit sampled sound voice
14149>8	string		SAMP		\b, SAMP sampled audio
14150>8	string		MAUD		\b, MAUD MacroSystem audio
14151>8	string		SMUS		\b, SMUS simple music
14152>8	string		CMUS		\b, CMUS complex music
14153# image formats
14154>8	string		ILBMBMHD	\b, ILBM interleaved image
14155>>20	beshort		x		\b, %d x
14156>>22	beshort		x		%d
14157>8	string		RGBN		\b, RGBN 12-bit RGB image
14158>8	string		RGB8		\b, RGB8 24-bit RGB image
14159>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
14160>8	string		DR2D		\b, DR2D 2-D object
14161>8	string		TDDD		\b, TDDD 3-D rendering
14162>8	string		LWOB		\b, LWOB 3-D object
14163>8	string		LWO2		\b, LWO2 3-D object, v2
14164>8	string		LWLO		\b, LWLO 3-D layered object
14165>8	string		REAL		\b, REAL Real3D rendering
14166>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
14167>8	string		ANIM		\b, ANIM animation
14168>8	string		YAFA		\b, YAFA animation
14169>8	string		SSA\ 		\b, SSA super smooth animation
14170>8	string		ACBM		\b, ACBM continuous image
14171>8	string		FAXX		\b, FAXX fax image
14172# other formats
14173>8	string		FTXT		\b, FTXT formatted text
14174>8	string		CTLG		\b, CTLG message catalog
14175>8	string		PREF		\b, PREF preferences
14176>8	string		DTYP		\b, DTYP datatype description
14177>8	string		PTCH		\b, PTCH binary patch
14178>8	string		AMFF		\b, AMFF AmigaMetaFile format
14179>8	string		WZRD		\b, WZRD StormWIZARD resource
14180>8	string		DOC\ 		\b, DOC desktop publishing document
14181>8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
14182>>24	leshort		x		%d video frames,
14183>>26	leshort		x		%d x
14184>>28	leshort		x		%d
14185>8	string		MOVE		\b, Wing Commander III Video
14186>>12	string		_PC_		\b, PC version
14187>>12	string		3DO_		\b, 3DO version
14188
14189# These go at the end of the iff rules
14190#
14191# David Griffith <dave@661.org>
14192# I don't see why these might collide with anything else.
14193#
14194# Interactive Fiction related formats
14195#
14196>8	string		IFRS		\b, Blorb Interactive Fiction
14197>>24	string		Exec		with executable chunk
14198>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
14199!:mime	application/x-blorb
14200
14201#------------------------------------------------------------------------------
14202# $File: images,v 1.146 2018/07/03 20:55:37 christos Exp $
14203# images:  file(1) magic for image formats (see also "iff", and "c-lang" for
14204# XPM bitmaps)
14205#
14206# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
14207# additions by janl@ifi.uio.no as well as others. Jan also suggested
14208# merging several one- and two-line files into here.
14209#
14210# little magic: PCX (first byte is 0x0a)
14211
14212# Targa - matches `povray', `ppmtotga' and `xv' outputs
14213# by Philippe De Muyter <phdm@macqel.be>
14214# URL: http://justsolve.archiveteam.org/wiki/TGA
14215# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
14216# Update: Joerg Jenderek
14217# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
14218#	,32 or 33 (both not observed)
14219# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
14220#	or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications
14221# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
14222# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
14223# `tgatoppm' recognizes a superset (Index may be anything)
14224#
14225# test of Color Map Type 0~no 1~color map
14226# and Image Type 1 2 3 9 10 11 32 33
14227# and Color Map Entry Size 0 15 16 24 32
142280	ubequad&0x00FeC400000000C0	0
14229# skip more garbage like *.iso by looking for positive image type
14230>2	ubyte			>0
14231# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33
14232>>2	ubyte			<34
14233# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
14234>>>16	ubyte			1
14235>>>>0		use		tga-image
14236>>>16	ubyte			8
14237>>>>0		use		tga-image
14238>>>16	ubyte			15
14239>>>>0		use		tga-image
14240>>>16	ubyte			16
14241>>>>0		use		tga-image
14242>>>16	ubyte			24
14243>>>>0		use		tga-image
14244>>>16	ubyte			32
14245>>>>0		use		tga-image
14246#	display tga bitmap image information
142470	name				tga-image
14248>2	ubyte		<34		Targa image data
14249!:mime	image/x-tga
14250!:apple	????TPIC
14251# normal extension .tga but some Truevision products used others:
14252# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
14253!:ext	tga/tpic/icb/vda/vst
14254# image type 1 2 3 9 10 11 32 33
14255>2	ubyte&0xF7	1		- Map
14256>2	ubyte&0xF7	2		- RGB
14257# alpha channel
14258>>17	ubyte&0x0F	>0		\bA
14259>2	ubyte&0xF7	3		- Mono
14260# type not found, but by http://www.fileformat.info/format/tga/corion.htm
14261# Compressed color-mapped data, using Huffman, Delta, and runlength encoding
14262>2	ubyte		32		- Color
14263# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process
14264>2	ubyte		33		- Color
14265# Color Map Type 0~no 1~color map
14266>1	ubyte		1		(
14267# first color map entry, 0 normal
14268>>3	uleshort	>0		\b%d-
14269# color map length 0 2 1dh 3bh d9h 100h
14270>>5	uleshort	x		\b%d)
14271# 8~run length encoding bit
14272>2	ubyte&0x08	8		- RLE
14273# gimp can create big pictures!
14274>12	uleshort	>0		%d x
14275>12	uleshort	=0		65536 x
14276# image height. 0 interpreted as 65536
14277>14	uleshort	>0		%d
14278>14	uleshort	=0		65536
14279# Image Pixel depth 1 8 15 16 24 32
14280>16	ubyte		x		x %d
14281# X origin of image. 0 normal
14282>8	uleshort	>0		+%d
14283# Y origin of image. 0 normal; positive for top
14284>10	uleshort	>0		+%d
14285# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
14286>17	ubyte&0x0F	>0		- %d-bit alpha
14287# bits 5-4 give direction. normal bottom left
14288>17	ubyte		&0x20		- top
14289#>17	ubyte		^0x20		- bottom
14290>17	ubyte		&0x10		- right
14291#>17	ubyte		^0x10		- left
14292# some info say other bits 6-7 should be zero
14293# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
14294# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
14295#>17	ubyte&0xC0	0x00		- no interleave
14296>17	ubyte&0xC0	0x40		- interleave
14297>17	ubyte&0xC0	0x80		- four way interleave
14298>17	ubyte&0xC0	0xC0		- reserved
14299# positive length implies identification field
14300>0	ubyte		>0
14301>>18	string		x		"%s"
14302# last 18 bytes of newer tga file footer signature
14303>18	search/4261301/s	TRUEVISION-XFILE.\0
14304# extension area offset if not 0
14305>>&-8		ulelong			>0
14306# length of the extension area. normal 495 for version 2.0
14307>>>(&-4.l)	uleshort		0x01EF
14308# AuthorName[41]
14309>>>>&0		string			>\0		- author "%-.40s"
14310# Comment[324]=4 * 80 null terminated
14311>>>>&41		string			>\0		- comment "%-.80s"
14312# date
14313>>>>&365	ubequad&0xffffFFFFffff0000	!0
14314# Day
14315>>>>>&-6		uleshort		x		%d
14316# Month
14317>>>>>&-8		uleshort		x		\b-%d
14318# Year
14319>>>>>&-4		uleshort		x		\b-%d
14320# time
14321>>>>&371	ubequad&0xffffFFFFffff0000	!0
14322# hour
14323>>>>>&-8		uleshort		x		%d
14324# minutes
14325>>>>>&-6		uleshort		x		\b:%.2d
14326# second
14327>>>>>&-4		uleshort		x		\b:%.2d
14328# JobName[41]
14329>>>>&377		string			>\0		- job "%-.40s"
14330# JobHour Jobminute Jobsecond
14331>>>>&418	ubequad&0xffffFFFFffff0000	!0
14332>>>>>&-8		uleshort		x		%d
14333>>>>>&-6		uleshort		x		\b:%.2d
14334>>>>>&-4		uleshort		x		\b:%.2d
14335# SoftwareId[41]
14336>>>>&424		string			>\0		- %-.40s
14337# SoftwareVersionNumber
14338>>>>&424	ubyte				>0
14339>>>>>&40		uleshort/100		x		%d
14340>>>>>&40		uleshort%100		x		\b.%d
14341# VersionLetter
14342>>>>>&42		ubyte			>0x20		\b%c
14343# KeyColor
14344>>>>&468		ulelong			>0		- keycolor 0x%8.8x
14345# Denominator of Pixel ratio. 0~no pixel aspect
14346>>>>&474	uleshort			>0
14347# Numerator
14348>>>>>&-4		uleshort		>0		- aspect %d
14349>>>>>&-2		uleshort		x		\b/%d
14350# Denominator of Gamma ratio. 0~no Gamma value
14351>>>>&478	uleshort			>0
14352# Numerator
14353>>>>>&-4		uleshort		>0		- gamma %d
14354>>>>>&-2		uleshort		x		\b/%d
14355# ColorOffset
14356#>>>>&480	ulelong			x		- col offset 0x%8.8x
14357# StampOffset
14358#>>>>&484	ulelong			x		- stamp offset 0x%8.8x
14359# ScanOffset
14360#>>>>&488	ulelong			x		- scan offset 0x%8.8x
14361# AttributesType
14362#>>>>&492	ubyte			x		- Attributes 0x%x
14363## EndOfTGA
14364
14365# PBMPLUS images
14366# The next byte following the magic is always whitespace.
14367# strength is changed to try these patterns before "x86 boot sector"
143680	name		netpbm
14369>3	regex/s		=[0-9]{1,50}\ [0-9]{1,50}	Netpbm image data
14370>>&0	regex		=[0-9]{1,50} 			\b, size = %s x
14371>>>&0	regex		=[0-9]{1,50}			\b %s
14372
143730	search/1	P1
14374>0	regex/4		P1[\040\t\f\r\n]
14375>>0	use		netpbm
14376>>>0	string		x	\b, bitmap
14377!:strength + 45
14378!:mime	image/x-portable-bitmap
14379
143800	search/1	P2
14381>0	regex/4		P2[\040\t\f\r\n]
14382>>0	use		netpbm
14383>>>0	string		x	\b, greymap
14384!:strength + 45
14385!:mime	image/x-portable-greymap
14386
143870	search/1	P3
14388>0	regex/4		P3[\040\t\f\r\n]
14389>>0	use		netpbm
14390>>>0	string		x	\b, pixmap
14391!:strength + 45
14392!:mime	image/x-portable-pixmap
14393
143940	string		P4
14395>0	regex/4		P4[\040\t\f\r\n]
14396>>0	use		netpbm
14397>>>0	string		x	\b, rawbits, bitmap
14398!:strength + 45
14399!:mime	image/x-portable-bitmap
14400
144010	string		P5
14402>0	regex/4		P5[\040\t\f\r\n]
14403>>0	use		netpbm
14404>>>0	string		x	\b, rawbits, greymap
14405!:strength + 45
14406!:mime	image/x-portable-greymap
14407
144080	string		P6
14409>0	regex/4		P6[\040\t\f\r\n]
14410>>0	use		netpbm
14411>>>0	string		x	\b, rawbits, pixmap
14412!:strength + 45
14413!:mime	image/x-portable-pixmap
14414
144150	string		P7		Netpbm PAM image file
14416!:mime	image/x-portable-pixmap
14417
14418# From: bryanh@giraffe-data.com (Bryan Henderson)
144190	string		\117\072	Solitaire Image Recorder format
14420>4	string		\013		MGI Type 11
14421>4	string		\021		MGI Type 17
144220	string		.MDA		MicroDesign data
14423>21	byte		48		version 2
14424>21	byte		51		version 3
144250	string		.MDP		MicroDesign page data
14426>21	byte		48		version 2
14427>21	byte		51		version 3
14428
14429# NIFF (Navy Interchange File Format, a modification of TIFF) images
14430# [GRR:  this *must* go before TIFF]
144310	string		IIN1		NIFF image data
14432!:mime	image/x-niff
14433
14434# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
14435# (CIFF) file. These are apparently all little-endian.
14436# From: Adam Buchbinder <adam.buchbinder@gmail.com>
14437# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
144380	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
14439!:mime	image/x-canon-crw
14440>16	leshort		x	\b, version %d.
14441>14	leshort		x	\b%d
14442
14443# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
14444# number. Put this above the TIFF test to make sure we detect them.
14445# These are apparently all little-endian.
14446# From: Adam Buchbinder <adam.buchbinder@gmail.com>
14447# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
144480	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
14449!:mime	image/x-canon-cr2
14450>10	byte		x	\b, version %d.
14451>11	byte		x	\b%d
14452
14453# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
14454# The second word of TIFF files is the TIFF version number, 42, which has
14455# never changed.  The TIFF specification recommends testing for it.
144560	string		MM\x00\x2a	TIFF image data, big-endian
14457!:strength +70
14458!:mime	image/tiff
14459>(4.L)	use		\^tiff_ifd
144600	string		II\x2a\x00	TIFF image data, little-endian
14461!:mime	image/tiff
14462!:strength +70
14463>(4.l)	use		tiff_ifd
14464
144650	name		tiff_ifd
14466>0	leshort		x		\b, direntries=%d
14467>2	use		tiff_entry
14468
144690	name		tiff_entry
14470# NewSubFileType
14471>0	leshort		0xfe
14472>>12	use		tiff_entry
14473>0	leshort		0x100
14474>>4	lelong		1
14475>>>12	use		tiff_entry
14476>>>8	leshort		x		\b, width=%d
14477>0	leshort		0x101
14478>>4	lelong		1
14479>>>8	leshort		x		\b, height=%d
14480>>>12	use		tiff_entry
14481>0	leshort		0x102
14482>>8	leshort		x		\b, bps=%d
14483>>12	use		tiff_entry
14484>0	leshort		0x103
14485>>4	lelong		1		\b, compression=
14486>>>8	leshort		1		\bnone
14487>>>8	leshort		2		\bhuffman
14488>>>8	leshort		3		\bbi-level group 3
14489>>>8	leshort		4		\bbi-level group 4
14490>>>8	leshort		5		\bLZW
14491>>>8	leshort		6		\bJPEG (old)
14492>>>8	leshort		7		\bJPEG
14493>>>8	leshort		8		\bdeflate
14494>>>8	leshort		9		\bJBIG, ITU-T T.85
14495>>>8	leshort		0xa		\bJBIG, ITU-T T.43
14496>>>8	leshort		0x7ffe		\bNeXT RLE 2-bit
14497>>>8	leshort		0x8005		\bPackBits (Macintosh RLE)
14498>>>8	leshort		0x8029		\bThunderscan RLE
14499>>>8	leshort		0x807f		\bRasterPadding (CT or MP)
14500>>>8	leshort		0x8080		\bRLE (Line Work)
14501>>>8	leshort		0x8081		\bRLE (High-Res Cont-Tone)
14502>>>8	leshort		0x8082		\bRLE (Binary Line Work)
14503>>>8	leshort		0x80b2		\bDeflate (PKZIP)
14504>>>8	leshort		0x80b3		\bKodak DCS
14505>>>8	leshort		0x8765		\bJBIG
14506>>>8	leshort		0x8798		\bJPEG2000
14507>>>8	leshort		0x8799		\bNikon NEF Compressed
14508>>>8	default		x
14509>>>>8	leshort		x		\b(unknown 0x%x)
14510>>>12	use		tiff_entry
14511>0	leshort		0x106		\b, PhotometricIntepretation=
14512>>8	clear		x
14513>>8	leshort		0		\bWhiteIsZero
14514>>8	leshort		1		\bBlackIsZero
14515>>8	leshort		2		\bRGB
14516>>8	leshort		3		\bRGB Palette
14517>>8	leshort		4		\bTransparency Mask
14518>>8	leshort		5		\bCMYK
14519>>8	leshort		6		\bYCbCr
14520>>8	leshort		8		\bCIELab
14521>>8	default		x
14522>>>8	leshort		x		\b(unknown=0x%x)
14523>>12	use		tiff_entry
14524# FillOrder
14525>0	leshort		0x10a
14526>>4	lelong		1
14527>>>12	use		tiff_entry
14528# DocumentName
14529>0	leshort		0x10d
14530>>(8.l)	string		x		\b, name=%s
14531>>>12	use		tiff_entry
14532# ImageDescription
14533>0	leshort		0x10e
14534>>(8.l)	string		x		\b, description=%s
14535>>>12	use		tiff_entry
14536# Make
14537>0	leshort		0x10f
14538>>(8.l)	string		x		\b, manufacturer=%s
14539>>>12	use		tiff_entry
14540# Model
14541>0	leshort		0x110
14542>>(8.l)	string		x		\b, model=%s
14543>>>12	use		tiff_entry
14544# StripOffsets
14545>0	leshort		0x111
14546>>12	use		tiff_entry
14547# Orientation
14548>0	leshort		0x112		\b, orientation=
14549>>8	leshort		1		\bupper-left
14550>>8	leshort		3		\blower-right
14551>>8	leshort		6		\bupper-right
14552>>8	leshort		8		\blower-left
14553>>8	leshort		9		\bundefined
14554>>8	default		x
14555>>>8	leshort		x		\b[*%d*]
14556>>12	use		tiff_entry
14557# XResolution
14558>0	leshort		0x11a
14559>>8	lelong		x		\b, xresolution=%d
14560>>12	use		tiff_entry
14561# YResolution
14562>0	leshort		0x11b
14563>>8	lelong		x		\b, yresolution=%d
14564>>12	use		tiff_entry
14565# ResolutionUnit
14566>0	leshort		0x128
14567>>8	leshort		x		\b, resolutionunit=%d
14568>>12	use		tiff_entry
14569# Software
14570>0	leshort		0x131
14571>>(8.l)	string		x		\b, software=%s
14572>>12	use		tiff_entry
14573# Datetime
14574>0	leshort		0x132
14575>>(8.l)	string		x		\b, datetime=%s
14576>>12	use		tiff_entry
14577# HostComputer
14578>0	leshort		0x13c
14579>>(8.l)	string		x		\b, hostcomputer=%s
14580>>12	use		tiff_entry
14581# WhitePoint
14582>0	leshort		0x13e
14583>>12	use		tiff_entry
14584# PrimaryChromaticities
14585>0	leshort		0x13f
14586>>12	use		tiff_entry
14587# YCbCrCoefficients
14588>0	leshort		0x211
14589>>12	use		tiff_entry
14590# YCbCrPositioning
14591>0	leshort		0x213
14592>>12	use		tiff_entry
14593# ReferenceBlackWhite
14594>0	leshort		0x214
14595>>12	use		tiff_entry
14596# Copyright
14597>0	leshort		0x8298
14598>>(8.l)	string		x		\b, copyright=%s
14599>>12	use		tiff_entry
14600# ExifOffset
14601>0	leshort		0x8769
14602>>12	use		tiff_entry
14603# GPS IFD
14604>0	leshort		0x8825		\b, GPS-Data
14605>>12	use		tiff_entry
14606
14607#>0	leshort		x		\b, unknown=0x%x
14608#>>12	use		tiff_entry
14609
146100	string		MM\x00\x2b	Big TIFF image data, big-endian
14611!:mime	image/tiff
146120	string		II\x2b\x00	Big TIFF image data, little-endian
14613!:mime	image/tiff
14614
14615# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
14616# (Greg Roelofs, newt@uchicago.edu)
14617# (Albert Cahalan, acahalan@cs.uml.edu)
14618#
14619# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
14620#
14621
14622# IHDR parser
146230	name		png-ihdr
14624>0	belong		x		\b, %d x
14625>4	belong		x		%d,
14626>8	byte		x		%d-bit
14627>9	byte		0		grayscale,
14628>9	byte		2		\b/color RGB,
14629>9	byte		3		colormap,
14630>9	byte		4		gray+alpha,
14631>9	byte		6		\b/color RGBA,
14632#>10	byte		0		deflate/32K,
14633>12	byte		0		non-interlaced
14634>12	byte		1		interlaced
14635
14636# Standard PNG image.
146370	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR	PNG image data
14638!:mime	image/png
14639!:strength +10
14640>16	use		png-ihdr
14641
14642# Apple CgBI PNG image.
146430	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
14644>24	string  	\x00\x00\x00\x0DIHDR	PNG image data (CgBI)
14645!:mime	image/png
14646!:strength +10
14647>>32	use		png-ihdr
14648
14649# possible GIF replacements; none yet released!
14650# (Greg Roelofs, newt@uchicago.edu)
14651#
14652# GRR 950115:  this was mine ("Zip GIF"):
146530	string		GIF94z		ZIF image (GIF+deflate alpha)
14654!:mime	image/x-unknown
14655#
14656# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
14657#
146580	string		FGF95a		FGF image (GIF+deflate beta)
14659!:mime	image/x-unknown
14660#
14661# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
14662# (best; not yet implemented):
14663#
146640	string		PBF		PBF image (deflate compression)
14665!:mime	image/x-unknown
14666
14667# GIF
14668# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
146690	string		GIF8		GIF image data
14670!:strength +80
14671!:mime	image/gif
14672!:apple	8BIMGIFf
14673>4	string		7a		\b, version 8%s,
14674>4	string		9a		\b, version 8%s,
14675>6	leshort		>0		%d x
14676>8	leshort		>0		%d
14677#>10	byte		&0x80		color mapped,
14678#>10	byte&0x07	=0x00		2 colors
14679#>10	byte&0x07	=0x01		4 colors
14680#>10	byte&0x07	=0x02		8 colors
14681#>10	byte&0x07	=0x03		16 colors
14682#>10	byte&0x07	=0x04		32 colors
14683#>10	byte&0x07	=0x05		64 colors
14684#>10	byte&0x07	=0x06		128 colors
14685#>10	byte&0x07	=0x07		256 colors
14686
14687# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
14688# 1 plane, no encoding.
146890	string		\361\0\100\273	CMU window manager raster image data
14690>4	lelong		>0		%d x
14691>8	lelong		>0		%d,
14692>12	lelong		>0		%d-bit
14693
14694# Magick Image File Format
146950	string		id=ImageMagick	MIFF image data
14696
14697# Artisan
146980	long		1123028772	Artisan image data
14699>4	long		1		\b, rectangular 24-bit
14700>4	long		2		\b, rectangular 8-bit with colormap
14701>4	long		3		\b, rectangular 32-bit (24-bit with matte)
14702
14703# FIG (Facility for Interactive Generation of figures), an object-based format
147040	search/1	#FIG		FIG image text
14705>5	string		x		\b, version %.3s
14706
14707# PHIGS
147080	string		ARF_BEGARF		PHIGS clear text archive
147090	string		@(#)SunPHIGS		SunPHIGS
14710# version number follows, in the form m.n
14711>40	string		SunBin			binary
14712>32	string		archive			archive
14713
14714# GKS (Graphics Kernel System)
147150	string		GKSM		GKS Metafile
14716>24	string		SunGKS		\b, SunGKS
14717
14718# CGM image files
147190	string		BEGMF		clear text Computer Graphics Metafile
14720
14721# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
147220	string	yz	MGR bitmap, modern format, 8-bit aligned
147230	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
147240	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
147250	string	yx	MGR bitmap, modern format, squeezed
14726
14727# Fuzzy Bitmap (FBM) images
147280	string		%bitmap\0	FBM image data
14729>30	long		0x31		\b, mono
14730>30	long		0x33		\b, color
14731
14732# facsimile data
147331	string		PC\ Research,\ Inc	group 3 fax data
14734>29	byte		0		\b, normal resolution (204x98 DPI)
14735>29	byte		1		\b, fine resolution (204x196 DPI)
14736# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
147370	string		Sfff		structured fax file
14738
14739# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
14740# most files with the extension .EPA and some with .BMP
147410	string		\x11\x06	Award BIOS Logo, 136 x 84
14742!:mime	image/x-award-bioslogo
147430	string		\x11\x09	Award BIOS Logo, 136 x 126
14744!:mime	image/x-award-bioslogo
14745#0	string		\x07\x1f	BIOS Logo corrupted?
14746# http://www.blackfiveservices.co.uk/awbmtools.shtml
14747# http://biosgfx.narod.ru/v3/
14748# http://biosgfx.narod.ru/abr-2/
147490	string		AWBM
14750>4	leshort		<1981		Award BIOS bitmap
14751!:mime	image/x-award-bmp
14752# image width is a multiple of 4
14753>>4	leshort&0x0003	0
14754>>>4		leshort	x		\b, %d
14755>>>6		leshort	x		x %d
14756>>4	leshort&0x0003	>0		\b,
14757>>>4	leshort&0x0003	=1
14758>>>>4		leshort	x		%d+3
14759>>>4	leshort&0x0003	=2
14760>>>>4		leshort	x		%d+2
14761>>>4	leshort&0x0003	=3
14762>>>>4		leshort	x		%d+1
14763>>>6		leshort	x		x %d
14764# at offset 8 starts imagedata followed by "RGB " marker
14765
14766# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
14767# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
14768# 28bitmap_information_header.29
147690	string		BM
14770>14	leshort		12		PC bitmap, OS/2 1.x format
14771!:mime	image/x-ms-bmp
14772>>18	leshort		x		\b, %d x
14773>>20	leshort		x		%d
14774>14	leshort		64		PC bitmap, OS/2 2.x format
14775!:mime	image/x-ms-bmp
14776>>18	leshort		x		\b, %d x
14777>>20	leshort		x		%d
14778>14	leshort		40		PC bitmap, Windows 3.x format
14779!:mime	image/x-ms-bmp
14780>>18	lelong		x		\b, %d x
14781>>22	lelong		x		%d x
14782>>28	leshort		x		%d
14783>14	leshort		124		PC bitmap, Windows 98/2000 and newer format
14784!:mime	image/x-ms-bmp
14785>>18	lelong		x		\b, %d x
14786>>22	lelong		x		%d x
14787>>28	leshort		x		%d
14788>14	leshort		108		PC bitmap, Windows 95/NT4 and newer format
14789!:mime	image/x-ms-bmp
14790>>18	lelong		x		\b, %d x
14791>>22	lelong		x		%d x
14792>>28	leshort		x		%d
14793>14	leshort		128		PC bitmap, Windows NT/2000 format
14794!:mime	image/x-ms-bmp
14795>>18	lelong		x		\b, %d x
14796>>22	lelong		x		%d x
14797>>28	leshort		x		%d
14798# Too simple - MPi
14799#0	string		IC		PC icon data
14800#0	string		PI		PC pointer image data
14801#0	string		CI		PC color icon data
14802#0	string		CP		PC color pointer image data
14803# Conflicts with other entries [BABYL]
14804#0	string		BA		PC bitmap array data
14805
14806# XPM icons (Greg Roelofs, newt@uchicago.edu)
148070	search/1	/*\ XPM\ */	X pixmap image text
14808!:mime	image/x-xpmi
14809
14810# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
148110	leshort		0xcc52		RLE image data,
14812>6	leshort		x		%d x
14813>8	leshort		x		%d
14814>2	leshort		>0		\b, lower left corner: %d
14815>4	leshort		>0		\b, lower right corner: %d
14816>10	byte&0x1	=0x1		\b, clear first
14817>10	byte&0x2	=0x2		\b, no background
14818>10	byte&0x4	=0x4		\b, alpha channel
14819>10	byte&0x8	=0x8		\b, comment
14820>11	byte		>0		\b, %d color channels
14821>12	byte		>0		\b, %d bits per pixel
14822>13	byte		>0		\b, %d color map channels
14823
14824# image file format (Robert Potter, potter@cs.rochester.edu)
148250	string		Imagefile\ version-	iff image data
14826# this adds the whole header (inc. version number), informative but longish
14827>10	string		>\0		%s
14828
14829# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
148300	belong		0x59a66a95	Sun raster image data
14831>4	belong		>0		\b, %d x
14832>8	belong		>0		%d,
14833>12	belong		>0		%d-bit,
14834#>16	belong		>0		%d bytes long,
14835>20	belong		0		old format,
14836#>20	belong		1		standard,
14837>20	belong		2		compressed,
14838>20	belong		3		RGB,
14839>20	belong		4		TIFF,
14840>20	belong		5		IFF,
14841>20	belong		0xffff		reserved for testing,
14842>24	belong		0		no colormap
14843>24	belong		1		RGB colormap
14844>24	belong		2		raw colormap
14845#>28	belong		>0		colormap is %d bytes long
14846
14847# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
14848#
14849# See
14850#	http://reality.sgi.com/grafica/sgiimage.html
14851#
148520	beshort		474		SGI image data
14853#>2	byte		0		\b, verbatim
14854>2	byte		1		\b, RLE
14855#>3	byte		1		\b, normal precision
14856>3	byte		2		\b, high precision
14857>4	beshort		x		\b, %d-D
14858>6	beshort		x		\b, %d x
14859>8	beshort		x		%d
14860>10	beshort		x		\b, %d channel
14861>10	beshort		!1		\bs
14862>80	string		>0		\b, "%s"
14863
148640	string		IT01		FIT image data
14865>4	belong		x		\b, %d x
14866>8	belong		x		%d x
14867>12	belong		x		%d
14868#
148690	string		IT02		FIT image data
14870>4	belong		x		\b, %d x
14871>8	belong		x		%d x
14872>12	belong		x		%d
14873#
148742048	string		PCD_IPI		Kodak Photo CD image pack file
14875>0xe02	byte&0x03	0x00		, landscape mode
14876>0xe02	byte&0x03	0x01		, portrait mode
14877>0xe02	byte&0x03	0x02		, landscape mode
14878>0xe02	byte&0x03	0x03		, portrait mode
148790	string		PCD_OPA		Kodak Photo CD overview pack file
14880
14881# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
14882# FITS is the Flexible Image Transport System, the de facto standard for
14883# data and image transfer, storage, etc., for the astronomical community.
14884# (FITS floating point formats are big-endian.)
148850	string	SIMPLE\ \ =	FITS image data
14886!:mime	image/fits
14887!:ext	fits/fts
14888>109	string	8		\b, 8-bit, character or unsigned binary integer
14889>108	string	16		\b, 16-bit, two's complement binary integer
14890>107	string	\ 32		\b, 32-bit, two's complement binary integer
14891>107	string	-32		\b, 32-bit, floating point, single precision
14892>107	string	-64		\b, 64-bit, floating point, double precision
14893
14894# other images
148950	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
14896
14897# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
14898# stuff.
14899#
149000	beshort		0x1010		PEX Binary Archive
14901
14902# DICOM medical imaging data
14903# URL:		https://en.wikipedia.org/wiki/DICOM#Data_format
14904# Note:		"dcm" is the official file name extension
14905# 		XnView mention also "dc3" and "acr" as file name extension
14906128	string	DICM			DICOM medical imaging data
14907!:mime	application/dicom
14908!:ext dcm/dicom/dic
14909
14910# XWD - X Window Dump file.
14911#   As described in /usr/X11R6/include/X11/XWDFile.h
14912#   used by the xwd program.
14913#   Bradford Castalia, idaeim, 1/01
14914#   updated by Adam Buchbinder, 2/09
14915# The following assumes version 7 of the format; the first long is the length
14916# of the header, which is at least 25 4-byte longs, and the one at offset 8
14917# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
14918# which is a maximum of 32.
149190	belong	>100
14920>8	belong	<3
14921>>12	belong	<33
14922>>>4	belong	7			XWD X Window Dump image data
14923!:mime	image/x-xwindowdump
14924>>>>100	string	>\0			\b, "%s"
14925>>>>16	belong	x			\b, %dx
14926>>>>20	belong	x			\b%dx
14927>>>>12	belong	x			\b%d
14928
14929# PDS - Planetary Data System
14930#   These files use Parameter Value Language in the header section.
14931#   Unfortunately, there is no certain magic, but the following
14932#   strings have been found to be most likely.
149330	string	NJPL1I00		PDS (JPL) image data
149342	string	NJPL1I			PDS (JPL) image data
149350	string	CCSD3ZF			PDS (CCSD) image data
149362	string	CCSD3Z			PDS (CCSD) image data
149370	string	PDS_			PDS image data
149380	string	LBLSIZE=		PDS (VICAR) image data
14939
14940# pM8x: ATARI STAD compressed bitmap format
14941#
14942# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
14943# p M 8 5/6 xx yy zz data...
14944# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
14945# bytes either run horizontally (pM85) or vertically (pM86). yy is the
14946# most frequent byte, xx and zz are runlength escape codes, where xx is
14947# used for runs of yy.
14948#
149490	string	pM85		Atari ST STAD bitmap image data (hor)
14950>5	byte	0x00		(white background)
14951>5	byte	0xFF		(black background)
149520	string	pM86		Atari ST STAD bitmap image data (vert)
14953>5	byte	0x00		(white background)
14954>5	byte	0xFF		(black background)
14955
14956# From: Alex Myczko <alex@aiei.ch>
14957# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
149580	leshort	0x0296		Atari ATR image
14959
14960# XXX:
14961# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
14962# magic.
14963# SGI RICE image file <mpruett@sgi.com>
14964#0	beshort	0x5249		RICE image
14965#>2	beshort	x		v%d
14966#>4	beshort	x		(%d x
14967#>6	beshort	x		%d)
14968#>8	beshort	0		8 bit
14969#>8	beshort	1		10 bit
14970#>8	beshort	2		12 bit
14971#>8	beshort	3		13 bit
14972#>10	beshort	0		4:2:2
14973#>10	beshort	1		4:2:2:4
14974#>10	beshort	2		4:4:4
14975#>10	beshort	3		4:4:4:4
14976#>12	beshort	1		RGB
14977#>12	beshort	2		CCIR601
14978#>12	beshort	3		RP175
14979#>12	beshort	4		YUV
14980
14981# PCX image files
14982# From: Dan Fandrich <dan@coneharvesters.com>
14983# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
14984# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
14985# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
14986# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
149870	ubelong&0xffF8fe00	0x0a000000
14988# for PCX bit depth > 0
14989>3	ubyte		>0
14990# test for valid versions
14991>>1	ubyte		<6
14992>>>1	ubyte		!1	PCX
14993!:mime	image/x-pcx
14994#!:mime	image/pcx
14995>>>>1	ubyte		0	ver. 2.5 image data
14996>>>>1	ubyte		2	ver. 2.8 image data, with palette
14997>>>>1	ubyte		3	ver. 2.8 image data, without palette
14998>>>>1	ubyte		4	for Windows image data
14999>>>>1	ubyte		5	ver. 3.0 image data
15000>>>>4	uleshort	x	bounding box [%d,
15001>>>>6	uleshort	x	%d] -
15002>>>>8	uleshort	x	[%d,
15003>>>>10	uleshort	x	%d],
15004>>>>65	ubyte		>1	%d planes each of
15005>>>>3	ubyte		x	%d-bit
15006>>>>68	byte		1	colour,
15007>>>>68	byte		2	grayscale,
15008# this should not happen
15009>>>>68	default		x	image,
15010>>>>12	leshort		>0	%d x
15011>>>>>14	uleshort	x	%d dpi,
15012>>>>2	byte		0	uncompressed
15013>>>>2	byte		1	RLE compressed
15014
15015# Adobe Photoshop
15016# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
150170	string		8BPS Adobe Photoshop Image
15018!:mime	image/vnd.adobe.photoshop
15019>4   beshort 2 (PSB)
15020>18  belong  x \b, %d x
15021>14  belong  x %d,
15022>24  beshort 0 bitmap
15023>24  beshort 1 grayscale
15024>>12 beshort 2 with alpha
15025>24  beshort 2 indexed
15026>24  beshort 3 RGB
15027>>12 beshort 4 \bA
15028>24  beshort 4 CMYK
15029>>12 beshort 5 \bA
15030>24  beshort 7 multichannel
15031>24  beshort 8 duotone
15032>24  beshort 9 lab
15033>12  beshort > 1
15034>>12  beshort x \b, %dx
15035>12  beshort 1 \b,
15036>22  beshort x %d-bit channel
15037>12  beshort > 1 \bs
15038
15039# XV thumbnail indicator (ThMO)
150400	string		P7\ 332		XV thumbnail image data
15041
15042# NITF is defined by United States MIL-STD-2500A
150430	string	NITF	National Imagery Transmission Format
15044>25	string	>\0	dated %.14s
15045
15046# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
15047# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
15048# Update: Joerg Jenderek
15049# See http://fileformats.archiveteam.org/wiki/GEM_Raster
15050# For variations, also see:
15051#    http://www.seasip.info/Gem/ff_img.html (Ventura)
15052#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
15053#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
15054#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
150550       beshort     0x0001
15056# header_size
15057>2      beshort     0x0008
15058>>0     use gem_info
15059>2      beshort     0x0009
15060>>0     use gem_info
15061# no example for NOSIG
15062>2      beshort     24
15063>>0     use gem_info
15064# no example for HYPERPAINT
15065>2      beshort     25
15066>>0     use gem_info
1506716      string      XIMG\0
15068>0      use gem_info
15069# no example
1507016      string      STTT\0\x10
15071>0      use gem_info
15072# no example or description
1507316      string      TIMG\0
15074>0      use gem_info
15075
150760   name        gem_info
15077# version is 2 for some XIMG and 1 for all others
15078>0	beshort		<0x0003		GEM
15079# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
15080!:mime	image/x-gem
15081# header_size 24 25 27 59 779 words for colored bitmaps
15082>>2	beshort		>9
15083>>>16	string		STTT\0\x10	STTT
15084>>>16	string		TIMG\0		TIMG
15085# HYPERPAINT or NOSIG variant
15086>>>16	string		\0\x80
15087>>>>2	beshort		=24		NOSIG
15088>>>>2	beshort		!24		HYPERPAINT
15089# NOSIG or XIMG variant
15090>>>16	default		x
15091>>>>16	string		!XIMG\0		NOSIG
15092>>16	string		=XIMG\0		XIMG Image data
15093!:ext	img/ximg
15094# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type
15095>>16	string		!XIMG\0		Image data
15096!:ext	img
15097# header_size is 9 for Ventura files and 8 for other GEM Paint files
15098>>2	beshort		9		(Ventura)
15099#>>2	beshort		8		(Paint)
15100>>12	beshort		x		%d x
15101>>14	beshort		x		%d,
15102# 1 4 8
15103>>4	beshort		x		%d planes,
15104# in tenths of a millimetre
15105>>8	beshort		x		%d x
15106>>10	beshort		x		%d pixelsize
15107# pattern_size 1-8. 2 for GEM Paint
15108>>6	beshort		!2		\b, pattern size %d
15109
15110# GEM Metafile (Wolfram Kleff)
151110	lelong		0x0018FFFF	GEM Metafile data
15112>4	leshort		x		version %d
15113
15114#
15115# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
15116# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
15117#
151180	string	\0\nSMJPEG	SMJPEG
15119>8	belong	x		%d.x data
15120# According to the specification you could find any number of _TXT
15121# headers here, but I can't think of any way of handling that. None of
15122# the SMJPEG files I tried it on used this feature. Even if such a
15123# file is encountered the output should still be reasonable.
15124>16	string	_SND		\b,
15125>>24	beshort	>0		%d Hz
15126>>26	byte	8		8-bit
15127>>26	byte	16		16-bit
15128>>28	string	NONE		uncompressed
15129# >>28	string	APCM		ADPCM compressed
15130>>27	byte	1		mono
15131>>28	byte	2		stereo
15132# Help! Isn't there any way to avoid writing this part twice?
15133>>32	string	_VID		\b,
15134# >>>48	string	JFIF		JPEG
15135>>>40	belong	>0		%d frames
15136>>>44	beshort	>0		(%d x
15137>>>46	beshort	>0		%d)
15138>16	string	_VID		\b,
15139# >>32	string	JFIF		JPEG
15140>>24	belong	>0		%d frames
15141>>28	beshort	>0		(%d x
15142>>30	beshort	>0		%d)
15143
151440	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
15145
15146# "thumbnail file" (icon)
15147# descended from "xv", but in use by other applications as well (Wolfram Kleff)
151480       string          P7\ 332         XV "thumbnail file" (icon) data
15149
15150# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
151510       string          KiSS            KISS/GS
15152>4      byte            16              color
15153>>5     byte            x               %d bit
15154>>8     leshort         x               %d colors
15155>>10    leshort         x               %d groups
15156>4      byte            32              cell
15157>>5     byte            x               %d bit
15158>>8     leshort         x               %d x
15159>>10    leshort         x               %d
15160>>12    leshort         x               +%d
15161>>14    leshort         x               +%d
15162
15163# Webshots (www.webshots.com), by John Harrison
151640       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
15165
15166# Hercules DASD image files
15167# From Jan Jaeger <jj@septa.nl>
151680       string  CKD_P370        Hercules CKD DASD image file
15169>8      long    x               \b, %d heads per cylinder
15170>12     long    x               \b, track size %d bytes
15171>16     byte    x               \b, device type 33%2.2X
15172
151730       string  CKD_C370        Hercules compressed CKD DASD image file
15174>8      long    x               \b, %d heads per cylinder
15175>12     long    x               \b, track size %d bytes
15176>16     byte    x               \b, device type 33%2.2X
15177
151780       string  CKD_S370        Hercules CKD DASD shadow file
15179>8      long    x               \b, %d heads per cylinder
15180>12     long    x               \b, track size %d bytes
15181>16     byte    x               \b, device type 33%2.2X
15182
15183# Squeak images and programs - etoffi@softhome.net
151840	string		\146\031\0\0	Squeak image data
151850	search/1	'From\040Squeak	Squeak program text
15186
15187# partimage: file(1) magic for PartImage files (experimental, incomplete)
15188# Author: Hans-Joachim Baader <hjb@pro-linux.de>
151890		string	PaRtImAgE-VoLuMe	PartImage
15190>0x0020		string	0.6.1		file version %s
15191>>0x0060	lelong	>-1		volume %d
15192#>>0x0064 8 byte identifier
15193#>>0x007c reserved
15194>>0x0200	string	>\0		type %s
15195>>0x1400	string	>\0		device %s,
15196>>0x1600	string	>\0		original filename %s,
15197# Some fields omitted
15198>>0x2744	lelong	0		not compressed
15199>>0x2744	lelong	1		gzip compressed
15200>>0x2744	lelong	2		bzip2 compressed
15201>>0x2744	lelong	>2		compressed with unknown algorithm
15202>0x0020		string	>0.6.1		file version %s
15203>0x0020		string	<0.6.1		file version %s
15204
15205# DCX is multi-page PCX, using a simple header of up to 1024
15206# offsets for the respective PCX components.
15207# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
152080	lelong	987654321	DCX multi-page PCX image data
15209
15210# Simon Walton <simonw@matteworld.com>
15211# Kodak Cineon format for scanned negatives
15212# http://www.kodak.com/US/en/motion/support/dlad/
152130	lelong  0xd75f2a80	Cineon image data
15214>200	belong  >0		\b, %d x
15215>204	belong  >0		%d
15216
15217
15218# Bio-Rad .PIC is an image format used by microscope control systems
15219# and related image processing software used by biologists.
15220# From: Vebjorn Ljosa <vebjorn@ljosa.com>
15221# BOOL values are two-byte integers; use them to rule out false positives.
15222# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
15223# Samples: http://www.loci.wisc.edu/software/sample-data
1522414	leshort <2
15225>62	leshort <2
15226>>54	leshort 12345		Bio-Rad .PIC Image File
15227>>>0	leshort >0		%d x
15228>>>2	leshort >0		%d,
15229>>>4	leshort =1		1 image in file
15230>>>4	leshort >1		%d images in file
15231
15232# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
15233# The description of *.mrw format can be found at
15234# http://www.dalibor.cz/minolta/raw_file_format.htm
152350	string	\000MRM			Minolta Dimage camera raw image data
15236
15237# Summary: DjVu image / document
15238# Extension: .djvu
15239# Reference: http://djvu.org/docs/DjVu3Spec.djvu
15240# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
15241# Modified by (1): Abel Cheung <abelcheung@gmail.com>
152420	string	AT&TFORM
15243>12	string	DJVM		DjVu multiple page document
15244!:mime	image/vnd.djvu
15245>12	string	DJVU		DjVu image or single page document
15246!:mime	image/vnd.djvu
15247>12	string	DJVI		DjVu shared document
15248!:mime	image/vnd.djvu
15249>12	string	THUM		DjVu page thumbnails
15250!:mime	image/vnd.djvu
15251
15252# Originally by Marc Espie
15253# Modified by Robert Minsk <robertminsk at yahoo.com>
15254# http://www.openexr.com/openexrfilelayout.pdf
152550	lelong		20000630	OpenEXR image data,
15256!:mime image/x-exr
15257>4	lelong&0x000000ff x		version %d,
15258>4	lelong		^0x00000200	storage: scanline
15259>4	lelong		&0x00000200	storage: tiled
15260>8	search/0x1000	compression\0	\b, compression:
15261>>&16	byte		0		none
15262>>&16	byte		1		rle
15263>>&16	byte		2		zips
15264>>&16	byte		3		zip
15265>>&16	byte		4		piz
15266>>&16	byte		5		pxr24
15267>>&16	byte		6		b44
15268>>&16	byte		7		b44a
15269>>&16	byte		8		dwaa
15270>>&16	byte		9		dwab
15271>>&16	byte		>9		unknown
15272>8	 search/0x1000	dataWindow\0	\b, dataWindow:
15273>>&10	lelong		x		(%d
15274>>&14	lelong		x		%d)-
15275>>&18	lelong		x		\b(%d
15276>>&22	lelong		x		%d)
15277>8	search/0x1000	displayWindow\0	\b, displayWindow:
15278>>&10	lelong		x		(%d
15279>>&14	lelong		x		%d)-
15280>>&18	lelong		x		\b(%d
15281>>&22	lelong		x		%d)
15282>8	search/0x1000	lineOrder\0	 \b, lineOrder:
15283>>&14	byte		0		increasing y
15284>>&14	byte		1		decreasing y
15285>>&14	byte		2		random y
15286>>&14	byte		>2		unknown
15287
15288# SMPTE Digital Picture Exchange Format, SMPTE DPX
15289#
15290# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
15291# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
15292# Robert Minsk <robertminsk at yahoo.com>
15293# Modified by Harry Mallon <hjmallon at gmail.com>
152940	string		SDPX	DPX image data, big-endian,
15295!:mime image/x-dpx
15296>0	use		dpx_info
152970	string		XPDS	DPX image data, little-endian,
15298!:mime image/x-dpx
15299>0	use		\^dpx_info
15300
153010	name		dpx_info
15302>768	beshort		<4
15303>>772	belong		x	%dx
15304>>776	belong		x	\b%d,
15305>768	beshort		>3
15306>>776	belong		x	%dx
15307>>772	belong		x	\b%d,
15308>768	beshort		0	left to right/top to bottom
15309>768	beshort		1	right to left/top to bottom
15310>768	beshort		2	left to right/bottom to top
15311>768	beshort		3	right to left/bottom to top
15312>768	beshort		4	top to bottom/left to right
15313>768	beshort		5	top to bottom/right to left
15314>768	beshort		6	bottom to top/left to right
15315>768	beshort		7	bottom to top/right to left
15316
15317# From: Tom Hilinski <tom.hilinski@comcast.net>
15318# http://www.unidata.ucar.edu/packages/netcdf/
153190	string	CDF\001			NetCDF Data Format data
15320
15321#-----------------------------------------------------------------------
15322# Hierarchical Data Format, used to facilitate scientific data exchange
15323# specifications at http://hdf.ncsa.uiuc.edu/
153240	belong	0x0e031301	Hierarchical Data Format (version 4) data
15325!:mime	application/x-hdf
153260	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
15327!:mime	application/x-hdf
15328512	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 512 bytes user block
15329!:mime	application/x-hdf
153301024	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 1k user block
15331!:mime	application/x-hdf
153322048	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 2k user block
15333!:mime	application/x-hdf
153344096	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 4k user block
15335!:mime	application/x-hdf
15336
15337
15338# From: Tobias Burnus <burnus@net-b.de>
15339# Xara (for a while: Corel Xara) is a graphic package, see
15340# http://www.xara.com/ for Windows and as GPL application for Linux
153410	string	XARA\243\243	Xara graphics file
15342
15343# http://www.cartesianinc.com/Tech/
153440	string	CPC\262		Cartesian Perceptual Compression image
15345!:mime	image/x-cpi
15346
15347# From Albert Cahalan <acahalan@gmail.com>
15348# puredigital used it for the CVS disposable camcorder
15349#8       lelong  4       ZBM bitmap image data
15350#>4      leshort x       %u x
15351#>6      leshort x       %u
15352
15353# From Albert Cahalan <acahalan@gmail.com>
15354# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
153550       string C565     OLPC firmware icon image data
15356>4      leshort x       %u x
15357>6      leshort x       %u
15358
15359# Applied Images - Image files from Cytovision
15360# Gustavo Junior Alves <gjalves@gjalves.com.br>
153610	string	\xce\xda\xde\xfa	Cytovision Metaphases file
153620	string	\xed\xad\xef\xac	Cytovision Karyotype file
153630	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
153640	string	\xed\xfe\xda\xbe	Cytovision FLEX file
153650	string	\xed\xab\xed\xfe	Cytovision FLEX file
153660	string	\xad\xfd\xea\xad	Cytovision RATS file
15367
15368# Wavelet Scalar Quantization format used in gray-scale fingerprint images
15369# From Tano M Fotang <mfotang@quanteq.com>
153700	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data
15371
15372# Type:		PCO B16 image files
15373# URL:		http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
15374# From:		Florian Philipp <florian.philipp@binarywings.net>
15375# Extension:	.b16
15376# Description:	Pixel image format produced by PCO Camware, typically used
15377#		together with PCO cameras.
15378# Note:		Different versions exist for e.g. 8 bit and 16 bit images.
15379#		Documentation is incomplete.
153800	string/b	PCO-	PCO B16 image data
15381>12	lelong		x	\b, %dx
15382>16	lelong		x	\b%d
15383>20	lelong		0	\b, short header
15384>20	lelong		-1	\b, extended header
15385>>24	lelong		0	\b, grayscale
15386>>>36	lelong		0	linear LUT
15387>>>36	lelong		1	logarithmic LUT
15388>>>28	lelong		x	[%d
15389>>>32	lelong		x	\b,%d]
15390>>24	lelong		1	\b, color
15391>>>64	lelong		0	linear LUT
15392>>>64	lelong		1	logarithmic LUT
15393>>>40	lelong		x	r[%d
15394>>>44	lelong		x	\b,%d]
15395>>>48	lelong		x	g[%d
15396>>>52	lelong		x	\b,%d]
15397>>>56	lelong		x	b[%d
15398>>>60	lelong		x	\b,%d]
15399
15400# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
15401# From: Markus Heidelberg <markus.heidelberg at web.de>
154020	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
15403!:mime	image/x-polar-monitor-bitmap
15404
15405# From: Rick Richardson <rickrich@gmail.com>
15406# updated by: Joerg Jenderek
15407# URL: http://techmods.net/nuvi/
154080	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
15409# extension is also used for
15410# Sony SRF raw image (image/x-sony-srf)
15411# SRF map
15412# Terragen Surface Map (http://www.planetside.co.uk/terragen)
15413# FileLocator Pro search criteria file (http://www.mythicsoft.com/filelocatorpro)
15414!:ext srf
15415#!:mime	image/x-garmin-srf
15416# version 1.00,2.00,2.10,2.40,2.50
15417>0x2f	string		>0		\b, version %4.4s
15418# width (2880,2881,3240)
15419>0x55	uleshort	>0		\b, %dx
15420# height (80,90)
15421>>0x53	uleshort	x		\b%d
15422
15423# Type:	Ulead Photo Explorer5 (.pe5)
15424# URL:	http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
15425# From:	Simon Horman <horms@debian.org>
154260	string	IIO2H			Ulead Photo Explorer5
15427
15428# Type:	X11 cursor
15429# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
15430# From:	Mathias Brodala <info@noctus.net>
154310	string	Xcur			X11 cursor
15432
15433# Type:	Olympus ORF raw images.
15434# URL:	http://libopenraw.freedesktop.org/wiki/Olympus_ORF
15435# From:	Adam Buchbinder <adam.buchbinder@gmail.com>
154360	string		MMOR		Olympus ORF raw image data, big-endian
15437!:mime	image/x-olympus-orf
154380	string		IIRO		Olympus ORF raw image data, little-endian
15439!:mime	image/x-olympus-orf
154400	string		IIRS		Olympus ORF raw image data, little-endian
15441!:mime	image/x-olympus-orf
15442
15443# Type: files used in modern AVCHD camcoders to store clip information
15444# Extension: .cpi
15445# From: Alexander Danilov <alexander.a.danilov@gmail.com>
154460	string	HDMV0100	AVCHD Clip Information
15447
15448# From: Adam Buchbinder <adam.buchbinder@gmail.com>
15449# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
15450# Radiance HDR; usually has .pic or .hdr extension.
154510	string	#?RADIANCE\n	Radiance HDR image data
15452#!mime	image/vnd.radiance
15453
15454# From: Adam Buchbinder <adam.buchbinder@gmail.com>
15455# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
15456# Used by the pfstools packages. The regex matches for the image size could
15457# probably use some work. The MIME type is made up; if there's one in
15458# actual common use, it should replace the one below.
154590	string	PFS1\x0a	PFS HDR image data
15460#!mime	image/x-pfs
15461>1	regex	[0-9]*\ 		\b, %s
15462>>1	regex	\ [0-9]{4}		\bx%s
15463
15464# Type: Foveon X3F
15465# URL:  http://www.photofo.com/downloads/x3f-raw-format.pdf
15466# From: Adam Buchbinder <adam.buchbinder@gmail.com>
15467# Note that the MIME type isn't defined anywhere that I can find; if
15468# there's a canonical type for this format, it should replace this one.
154690	string	FOVb	Foveon X3F raw image data
15470!:mime	image/x-x3f
15471>6	leshort	x	\b, version %d.
15472>4	leshort	x	\b%d
15473>28	lelong	x	\b, %dx
15474>32	lelong	x	\b%d
15475
15476# Paint.NET file
15477# From Adam Buchbinder <adam.buchbinder@gmail.com>
154780	string	PDN3	Paint.NET image data
15479!:mime	image/x-paintnet
15480
15481# Not really an image.
15482# From: "Tano M. Fotang" <mfotang@quanteq.com>
154830	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)
15484
15485# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
15486# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
1548790	bequad		0x574D50484F544F00	JPEG-XR Image
15488>98	byte&0x08	=0x08			\b, hard tiling
15489>99	byte&0x80	=0x80			\b, tiling present
15490>99	byte&0x40	=0x40			\b, codestream present
15491>99	byte&0x38	x			\b, spatial xform=
15492>99	byte&0x38	0x00			\bTL
15493>99	byte&0x38	0x08			\bBL
15494>99	byte&0x38	0x10			\bTR
15495>99	byte&0x38	0x18			\bBR
15496>99	byte&0x38	0x20			\bBT
15497>99	byte&0x38	0x28			\bRB
15498>99	byte&0x38	0x30			\bLT
15499>99	byte&0x38	0x38			\bLB
15500>100	byte&0x80	=0x80			\b, short header
15501>>102	beshort+1	x			\b, %d
15502>>104	beshort+1	x			\bx%d
15503>100	byte&0x80	=0x00			\b, long header
15504>>102	belong+1	x			\b, %x
15505>>106	belong+1	x			\bx%x
15506>101	beshort&0xf	x			\b, bitdepth=
15507>>101	beshort&0xf	0x0			\b1-WHITE=1
15508>>101	beshort&0xf	0x1			\b8
15509>>101	beshort&0xf	0x2			\b16
15510>>101	beshort&0xf	0x3			\b16-SIGNED
15511>>101	beshort&0xf	0x4			\b16-FLOAT
15512>>101	beshort&0xf	0x5			\b(reserved 5)
15513>>101	beshort&0xf	0x6			\b32-SIGNED
15514>>101	beshort&0xf	0x7			\b32-FLOAT
15515>>101	beshort&0xf	0x8			\b5
15516>>101	beshort&0xf	0x9			\b10
15517>>101	beshort&0xf	0xa			\b5-6-5
15518>>101	beshort&0xf	0xb			\b(reserved %d)
15519>>101	beshort&0xf	0xc			\b(reserved %d)
15520>>101	beshort&0xf	0xd			\b(reserved %d)
15521>>101	beshort&0xf	0xe			\b(reserved %d)
15522>>101	beshort&0xf	0xf			\b1-BLACK=1
15523>101	beshort&0xf0	x			\b, colorfmt=
15524>>101	beshort&0xf0	0x00			\bYONLY
15525>>101	beshort&0xf0	0x10			\bYUV240
15526>>101	beshort&0xf0	0x20			\bYWV422
15527>>101	beshort&0xf0	0x30			\bYWV444
15528>>101	beshort&0xf0	0x40			\bCMYK
15529>>101	beshort&0xf0	0x50			\bCMYKDIRECT
15530>>101	beshort&0xf0	0x60			\bNCOMPONENT
15531>>101	beshort&0xf0	0x70			\bRGB
15532>>101	beshort&0xf0	0x80			\bRGBE
15533>>101	beshort&0xf0	>0x80			\b(reserved 0x%x)
15534
15535# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
15536#
15537# BPG (Better Portable Graphics) format
15538# http://bellard.org/bpg/
15539# http://fileformats.archiveteam.org/wiki/BPG
15540#
155410	string	\x42\x50\x47\xFB	BPG (Better Portable Graphics)
15542!:mime  image/bpg
15543
15544# From: Joerg Jenderek
15545# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format
155460	string		icns		Mac OS X icon
15547!:mime	image/x-icns
15548!:apple	????icns
15549!:ext icns
15550>4	ubelong		>0
15551# file size
15552>>4	ubelong		x		\b, %d bytes
15553# icon type
15554>>8	string		x		\b, "%4.4s" type
15555
15556# TIM images
155570		lelong		0x00000010	TIM image,
15558>4		lelong  	0x8		4-Bit,
15559>4		lelong  	0x9		8-Bit,
15560>4		lelong  	0x2		15-Bit,
15561>4		lelong  	0x3		24-Bit,
15562>4		lelong 		&8
15563>>(8.l+12)	leshort		x		Pixel at (%d,
15564>>(8.l+14)	leshort		x		\b%d)
15565>>(8.l+16)	leshort		x		Size=%dx
15566>>(8.l+18)	leshort		x		\b%d,
15567>>4		lelong 		0x8		16 CLUT Entries at
15568>>4		lelong 		0x9		256 CLUT Entries at
15569>>12		leshort		x		(%d,
15570>>14		leshort		x		\b%d)
15571>4		lelong		^8
15572>>12		leshort		x		Pixel at (%d,
15573>>14		leshort		x		\b%d)
15574>>16		leshort		x		Size=%dx
15575>>18		leshort		x		\b%d
15576
15577# MDEC streams
155780		lelong		0x80010160	MDEC video stream,
15579>16		leshort		x		%dx
15580>18		leshort		x		\b%d
15581#>8		lelong		x		%d frames
15582#>4		leshort		x		secCount=%d;
15583#>6		leshort		x		nSectors=%d;
15584#>12		lelong		x		frameSize=%d;
15585
15586# BS encoded bitstreams
155872		leshort		0x3800		BS image,
15588>6		leshort		x		Version %d,
15589>4		leshort		x		Quantization %d,
15590>0		leshort		x		(Decompresses to %d words)
15591
15592# Type: farbfeld image.
15593# Url: http://tools.suckless.org/farbfeld/
15594# From: Ian D. Scott <ian@iandouglasscott.com>
15595#
155960		string		farbfeld	farbfeld image data,
15597>8		ubelong		x		%dx
15598>12		ubelong		x		\b%d
15599
15600# Type: Microsoft DirectDraw Surface (common data)
15601# URL:	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
15602# From: Morten Hustveit <morten@debian.org>
15603# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
156040	name	ms-directdraw-surface
15605>0x10	ulelong	x			%u x
15606>0x0C	ulelong	x			%u
15607# Color depth.
15608>0x58	ulelong	>0			\b, %u-bit color
15609# Determine the pixel format.
15610>0x50	ulelong&0x4	4
15611# FIXME: Handle DX10 and XBOX formats.
15612>>0x54	string	x			\b, compressed using %.4s
15613>0x50	ulelong&0x2	0x2		\b, alpha only
15614>0x50	ulelong&0x200	0x200		\b, YUV
15615>0x50	ulelong&0x20000	0x20000		\b, luminance
15616# RGB pixel format
15617>0x50	ulelong&0x40	0x40
15618
15619# Determine the RGB format using the color masks.
15620# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB
15621
15622>>0x58		ulelong	16
15623
15624# NOTE: 15-bit color formats usually have 16-bit listed as the color depth.
15625>>>0x5C		ulequad	0x000003E000007C00
15626>>>>0x64	ulequad 0x000000000000001F	\b, RGB555
15627>>>0x5C		ulequad	0x000003E000001F00
15628>>>>0x64	ulequad 0x000000000000007C	\b, BGR555
15629
15630>>>0x5C		ulequad	0x000007E00000F800
15631>>>>0x64	ulequad 0x000000000000001F	\b, RGB565
15632>>>0x5C		ulequad	0x000007E000001F00
15633>>>>0x64	ulequad 0x00000000000000F8	\b, BGR565
15634
15635>>>0x5C		ulequad	0x000000F000000F00
15636>>>>0x64	ulequad 0x0000F0000000000F	\b, ARGB4444
15637>>>0x5C		ulequad	0x000000F00000000F
15638>>>>0x64	ulequad 0x0000F00000000F00	\b, ABGR4444
15639
15640>>>0x5C		ulequad	0x00000F000000F000
15641>>>>0x64	ulequad 0x0000000F000000F0	\b, RGBA4444
15642>>>0x5C		ulequad	0x00000F00000000F0
15643>>>>0x64	ulequad 0x0000000F0000F000	\b, BGRA4444
15644
15645>>>0x5C		ulequad	0x000000F000000F00
15646>>>>0x64	ulequad 0x000000000000000F	\b, xRGB4444
15647>>>0x5C		ulequad	0x000000F00000000F
15648>>>>0x64	ulequad 0x0000000000000F00	\b, xBGR4444
15649
15650>>>0x5C		ulequad	0x00000F000000F000
15651>>>>0x64	ulequad 0x00000000000000F0	\b, RGBx4444
15652>>>0x5C		ulequad	0x00000F00000000F0
15653>>>>0x64	ulequad 0x000000000000F000	\b, BGRx4444
15654
15655>>>0x5C		ulequad	0x000003E000007C00
15656>>>>0x64	ulequad 0x000080000000001F	\b, ARGB1555
15657>>>0x5C		ulequad	0x000003E000001F00
15658>>>>0x64	ulequad 0x000080000000007C	\b, ABGR1555
15659>>>0x5C		ulequad	0x000007C00000F800
15660>>>>0x64	ulequad 0x000000010000003E	\b, RGBA5551
15661>>>0x5C		ulequad	0x000007C00000003E
15662>>>>0x64	ulequad 0x000000010000F800	\b, BGRA5551
15663
15664>>88		ulelong 24
15665>>>0x5C		ulequad	0x0000FF0000FF0000
15666>>>>0x64	ulequad 0x00000000000000FF	\b, RGB888
15667>>>0x5C		ulequad	0x0000FF00000000FF
15668>>>>0x64	ulequad 0x0000000000FF0000	\b, BGR888
15669
15670>>88		ulelong 32
15671>>>0x5C		ulequad	0x0000FF0000FF0000
15672>>>>0x64	ulequad 0xFF000000000000FF	\b, ARGB8888
15673>>>0x5C		ulequad	0x0000FF00000000FF
15674>>>>0x64	ulequad 0xFF00000000FF0000	\b, ABGR8888
15675
15676>>>0x5C		ulequad	0x00FF0000FF000000
15677>>>>0x64	ulequad 0x000000FF0000FF00	\b, RGBA8888
15678>>>0x5C		ulequad	0x00FF00000000FF00
15679>>>>0x64	ulequad 0x000000FFFF000000	\b, BGBA8888
15680
15681>>>0x5C		ulequad	0x0000FF0000FF0000
15682>>>>0x64	ulequad 0x00000000000000FF	\b, xRGB8888
15683>>>0x5C		ulequad	0x0000FF00000000FF
15684>>>>0x64	ulequad 0x0000000000FF0000	\b, xBGR8888
15685
15686>>>0x5C		ulequad	0x00FF0000FF000000
15687>>>>0x64	ulequad 0x000000000000FF00	\b, RGBx8888
15688>>>0x5C		ulequad	0x00FF00000000FF00
15689>>>>0x64	ulequad 0x00000000FF000000	\b, BGBx8888
15690
15691# Less common 32-bit color formats.
15692>>>0x5C		ulequad	0xFFFF00000000FFFF
15693>>>>0x64	ulequad 0x0000000000000000	\b, G16R16
15694>>>0x5C		ulequad	0x0000FFFFFFFF0000
15695>>>>0x64	ulequad 0x0000000000000000	\b, R16G16
15696
15697>>>0x5C		ulequad	0x000FFC003FF00000
15698>>>>0x64	ulequad 0xC0000000000003FF	\b, A2R10G10B10
15699>>>0x5C		ulequad	0x000FFC00000003FF
15700>>>>0x64	ulequad 0xC00000003FF00000	\b, A2B10G10R10
15701
15702# Type: Microsoft DirectDraw Surface
15703# URL:	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
15704# From: Morten Hustveit <morten@debian.org>
15705# Updated by: David Korth <gerbilsoft@gerbilsoft.com>
157060	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS):
15707>0	use	ms-directdraw-surface
15708
15709# Type: Sega PVR image.
15710# From: David Korth <gerbilsoft@gerbilsoft.com>
15711# References:
15712# - http://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
15713# - https://github.com/yazgoo/pvrx2png
15714# - https://github.com/nickworonekin/puyotools
15715
15716# Sega PVR header.
157170	name	sega-pvr-image-header
15718>0x0C	leshort	x	%u x
15719>0x0E	leshort	x	%u
15720# Image format.
15721>0x08	byte	0	\b, ARGB1555
15722>0x08	byte	1	\b, RGB565
15723>0x08	byte	2	\b, ARGB4444
15724>0x08	byte	3	\b, YUV442
15725>0x08	byte	4	\b, Bump
15726>0x08	byte	5	\b, 4bpp
15727>0x08	byte	6	\b, 8bpp
15728# Image data type.
15729>0x09	byte	0x01	\b, square twiddled
15730>0x09	byte	0x02	\b, square twiddled & mipmap
15731>0x09	byte	0x03	\b, VQ
15732>0x09	byte	0x04	\b, VQ & mipmap
15733>0x09	byte	0x05	\b, 8-bit CLUT twiddled
15734>0x09	byte	0x06	\b, 4-bit CLUT twiddled
15735>0x09	byte	0x07	\b, 8-bit direct twiddled
15736>0x09	byte	0x08	\b, 4-bit direct twiddled
15737>0x09	byte	0x09	\b, rectangle
15738>0x09	byte	0x0B	\b, rectangular stride
15739>0x09	byte	0x0D	\b, rectangular twiddled
15740>0x09	byte	0x10	\b, small VQ
15741>0x09	byte	0x11	\b, small VQ & mipmap
15742>0x09	byte	0x12	\b, square twiddled & mipmap
15743
15744# Sega PVR image.
157450	string	PVRT
15746>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
15747>>0x20	use	ms-directdraw-surface
15748>0x10	belong	!0x44445320		Sega PVR image:
15749>>0	use	sega-pvr-image-header
15750
15751# Sega PVR image with GBIX.
157520	string	GBIX
15753>0x10	string	PVRT
15754>>0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
15755>>0x20	use	ms-directdraw-surface
15756>>0x10	belong	!0x44445320		Sega PVR image:
15757>>>0x10	use	sega-pvr-image-header
15758>>0x08	lelong	x	\b, global index = %u
15759
15760# Sega GVR header.
157610	name	sega-gvr-image-header
15762>0x0C	beshort	x	%u x
15763>0x0E	beshort	x	%u
15764# Image data format.
15765>0x0B	byte	0	\b, I4
15766>0x0B	byte	1	\b, I8
15767>0x0B	byte	2	\b, IA4
15768>0x0B	byte	3	\b, IA8
15769>0x0B	byte	4	\b, RGB565
15770>0x0B	byte	5	\b, RGB5A3
15771>0x0B	byte	6	\b, ARGB8888
15772>0x0B	byte	8	\b, CI4
15773>0x0B	byte	9	\b, CI8
15774>0x0B	byte	14	\b, DXT1
15775
15776# Sega GVR image.
157770	string	GVRT	Sega GVR image:
15778>0x10	use	sega-gvr-image-header
15779
15780# Sega GVR image with GBIX.
157810	string	GBIX
15782>0x10	string	GVRT	Sega GVR image:
15783>>0x10	use	sega-gvr-image-header
15784>>0x08	belong	x	\b, global index = %u
15785
15786# Sega GVR image with GCIX. (Wii)
157870	string	GCIX
15788>0x10	string	GVRT	Sega GVR image:
15789>>0x10	use	sega-gvr-image-header
15790>>0x08	belong	x	\b, global index = %u
15791
15792# Light Field Picture
15793# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
15794# Typical file extensions: .lfp .lfr .lfx
15795
157960	belong	0x894C4650
15797>4	belong	0x0D0A1A0A
15798>12	belong	0x00000000	Lytro Light Field Picture
15799>8	belong	x		\b, version %d
15800
15801# Type: Vision Research Phantom CINE Format
15802# URL: https://www.phantomhighspeed.com/
15803# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
15804# From: Harry Mallon <hjmallon at gmail.com>
15805#
15806# This has a short "CI" code but the 44 is the size of the struct which is
15807# stable
158080	string	CI
15809>2	leshort 44		Vision Research CINE Video,
15810>>4	leshort	0		Grayscale,
15811>>4	leshort 1		JPEG Compressed,
15812>>4	leshort 2		RAW,
15813>>6	leshort x		version %d,
15814>>20	lelong	x		%d frames,
15815>>48	lelong	x		%dx
15816>>52	lelong	x		\b%d
15817
15818# Type: ARRI Raw Image
15819# Info: SMPTE RDD30:2014
15820# From: Harry Mallon <hjmallon at gmail.com>
158210	string ARRI		ARRI ARI image data,
15822>4	lelong 0x78563412	little-endian,
15823>4 	lelong 0x12345678	big-endian,
15824>12	lelong x		version %d,
15825>20	lelong x 		%dx
15826>24	lelong x		\b%d
15827
15828# Type: Khronos KTX texture.
15829# From: David Korth <gerbilsoft@gerbilsoft.com>
15830# References:
15831# - https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/
15832
15833# glEnum decoding.
15834# NOTE: Only the most common formats are listed here.
158350	name	khronos-ktx-glEnum
15836>0	lelong	0x1907	\b, RGB
15837>0	lelong	0x1908	\b, RGBA
15838>0	lelong	0x1909	\b, LUMINANCE
15839>0	lelong	0x190A	\b, LUMINANCE_ALPHA
15840>0	lelong	0x80E1	\b, BGR
15841>0	lelong	0x80E2	\b, BGRA
15842>0	lelong	0x83A0	\b, RGB_S3TC
15843>0	lelong	0x83A1	\b, RGB4_S3TC
15844>0	lelong	0x83A2	\b, RGBA_S3TC
15845>0	lelong	0x83A3	\b, RGBA4_S3TC
15846>0	lelong	0x83A4	\b, RGBA_DXT5_S3TC
15847>0	lelong	0x83A5	\b, RGBA4_DXT5_S3TC
15848>0	lelong	0x8D64	\b, ETC1_RGB8_OES
15849>0	lelong	0x9270	\b, COMPRESSED_R11_EAC
15850>0	lelong	0x9271	\b, COMPRESSED_SIGNED_R11_EAC
15851>0	lelong	0x9272	\b, COMPRESSED_RG11_EAC
15852>0	lelong	0x9273	\b, COMPRESSED_SIGNED_RG11_EAC
15853>0	lelong	0x9274	\b, COMPRESSED_RGB8_ETC2
15854>0	lelong	0x9275	\b, COMPRESSED_SRGB8_ETC2
15855>0	lelong	0x9276	\b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2
15856>0	lelong	0x9277	\b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2
15857>0	lelong	0x9278	\b, COMPRESSED_RGBA2_ETC2_EAC
15858>0	lelong	0x9279	\b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC
15859>0	lelong	0x93B0	\b, COMPRESSED_RGBA_ASTC_4x4_KHR
15860>0	lelong	0x93B1	\b, COMPRESSED_RGBA_ASTC_5x4_KHR
15861>0	lelong	0x93B2	\b, COMPRESSED_RGBA_ASTC_5x5_KHR
15862>0	lelong	0x93B3	\b, COMPRESSED_RGBA_ASTC_6x5_KHR
15863>0	lelong	0x93B4	\b, COMPRESSED_RGBA_ASTC_6x6_KHR
15864>0	lelong	0x93B5	\b, COMPRESSED_RGBA_ASTC_8x5_KHR
15865>0	lelong	0x93B6	\b, COMPRESSED_RGBA_ASTC_8x6_KHR
15866>0	lelong	0x93B7	\b, COMPRESSED_RGBA_ASTC_8x8_KHR
15867>0	lelong	0x93B8	\b, COMPRESSED_RGBA_ASTC_10x5_KHR
15868>0	lelong	0x93B9	\b, COMPRESSED_RGBA_ASTC_10x6_KHR
15869>0	lelong	0x93BA	\b, COMPRESSED_RGBA_ASTC_10x8_KHR
15870>0	lelong	0x93BB	\b, COMPRESSED_RGBA_ASTC_10x10_KHR
15871>0	lelong	0x93BC	\b, COMPRESSED_RGBA_ASTC_12x10_KHR
15872>0	lelong	0x93BD	\b, COMPRESSED_RGBA_ASTC_12x12_KHR
15873>0	lelong	0x93D0	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR
15874>0	lelong	0x93D1	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR
15875>0	lelong	0x93D2	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR
15876>0	lelong	0x93D3	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR
15877>0	lelong	0x93D4	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR
15878>0	lelong	0x93D5	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR
15879>0	lelong	0x93D6	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR
15880>0	lelong	0x93D7	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR
15881>0	lelong	0x93D8	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR
15882>0	lelong	0x93D9	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR
15883>0	lelong	0x93DA	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR
15884>0	lelong	0x93DB	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR
15885>0	lelong	0x93DC	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR
15886>0	lelong	0x93DD	\b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR
15887
15888# Endian-specific KTX header.
15889# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE)
158900	name	khronos-ktx-endian-header
15891>20	lelong	x	\b, %u
15892>24	lelong	>1	x %u
15893>28	lelong	>1	x %u
15894>8	lelong	>0
15895>>8	use	khronos-ktx-glEnum
15896>8	lelong	0
15897>>12	use	khronos-ktx-glEnum
15898
15899# Main KTX header.
15900# Determine endianness, then check the rest of the header.
159010	string	\xABKTX\ 11\xBB\r\n\x1A\n	Khronos KTX texture
15902>12	lelong	0x04030201			(little-endian)
15903>>16	use	khronos-ktx-endian-header
15904>12	belong	0x04030201			(big-endian)
15905>>16	use	^khronos-ktx-endian-header
15906
15907# Type: Valve VTF texture.
15908# From: David Korth <gerbilsoft@gerbilsoft.com>
15909# References:
15910# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format
15911
15912# VTF image formats.
159130	name	vtf-image-format
15914>0	lelong	0	RGBA8888
15915>0	lelong	1	ABGR8888
15916>0	lelong	2	RGB888
15917>0	lelong	3	BGR888
15918>0	lelong	4	RGB565
15919>0	lelong	5	I8
15920>0	lelong	6	IA88
15921>0	lelong	7	P8
15922>0	lelong	8	A8
15923>0	lelong	9	RGB888 (bluescreen)
15924>0	lelong	10	BGR888 (bluescreen)
15925>0	lelong	11	ARGB8888
15926>0	lelong	12	BGRA8888
15927>0	lelong	13	DXT1
15928>0	lelong	14	DXT3
15929>0	lelong	15	DXT5
15930>0	lelong	16	BGRx8888
15931>0	lelong	17	BGR565
15932>0	lelong	18	BGRx5551
15933>0	lelong	19	BGRA4444
15934>0	lelong	20	DXT1+A1
15935>0	lelong	21	BGRA5551
15936>0	lelong	22	UV88
15937>0	lelong	23	UVWQ8888
15938>0	lelong	24	RGBA16161616F
15939>0	lelong	25	RGBA16161616
15940>0	lelong	26	UVLX8888
15941
15942# Main VTF header.
159430	string	VTF\0				Valve Texture Format
15944>4	lelong	x				v%u
15945>8	lelong	x				\b.%u
15946>0x10	leshort	x				\b, %u
15947>0x12	leshort	>1				x %u
15948>4	lequad	0x0000000700000002
15949>>0x3F	leshort	>1				x %u
15950>0x18	leshort	>1				\b, %u frames
15951>0x38	byte	x				\b, mipmaps: %u
15952>0x34	lelong	>-1				\b,
15953>>0x34	use	vtf-image-format
15954
15955# Type: Valve VTF3 (PS3) texture.
15956# From: David Korth <gerbilsoft@gerbilsoft.com>
159570	string		VTF3	Valve Texture Format (PS3)
15958>0x14	beshort		x	\b, %u
15959>0x16	beshort		x	\b x %u
15960>0x10	belong&0x2000	0	\b, DXT1
15961>0x10	belong&0x2000	0x2000	\b, DXT5
15962
15963# Type: ASTC texture.
15964# From: David Korth <gerbilsoft@gerbilsoft.com>
15965# References:
15966# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header
15967# - https://stackoverflow.com/a/22682244
159680	lelong	0x5ca1ab13			ASTC
15969>4	byte	x				%u
15970>5	byte	x				\bx%u
15971>6	byte	>1				\bx%u
15972# X, Y, and Z dimensions are stored as 24-bit LE.
15973# Pretend it's 32-bit and mask off the high byte.
15974>7	lelong&0x00FFFFFF	x		texture, %u
15975>10	lelong&0x00FFFFFF	x		x %u
15976>13	lelong&0x00FFFFFF	>1		x %u
15977
15978# Zebra Metafile graphic
15979# http://www.fileformat.info/format/zbr/egff.htm
159800	beshort	0x9a02	Zebra Metafile graphic
15981>2	leshort 1	(version 1.x)
15982>2	leshort	2	(version 1.1x or 1.2x)
15983>2	leshort	3	(version 1.49)
15984>2	leshort	4	(version 1.50)
15985>4	string	x	(comment = %s)
15986
15987# Microsoft Paint graphic
15988# http://www.fileformat.info/format/mspaint/egff.htm
159890	string	DanM 	icrosoft Paint image data (version 1.x)
15990>4	leshort	x	(%d
15991>>6	leshort	x	x %d)
159920	string	LinS 	Microsoft Paint image data (version 2.0)
15993>4	leshort	x	(%d
15994>>6	leshort	x	x %d)
15995
15996#------------------------------------------------------------------------------
15997# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
15998# inform:  file(1) magic for Inform interactive fiction language
15999
16000# URL:  http://www.inform-fiction.org/
16001# From: Reuben Thomas <rrt@sc3d.org>
16002
160030	search/100/cW	constant\ story		Inform source text
16004
16005#------------------------------------------------------------------------------
16006# $File: intel,v 1.16 2017/11/14 15:48:36 christos Exp $
16007# intel:  file(1) magic for x86 Unix
16008#
16009# Various flavors of x86 UNIX executable/object (other than Xenix, which
16010# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
16011# Windows as well.
16012#
16013# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
16014# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
16015# as well, if, as, and when IBM makes it portable.
16016#
16017# The `versions' should be un-commented if they work for you.
16018# (Was the problem just one of endianness?)
16019#
160200	leshort		0502		basic-16 executable
16021>12	lelong		>0		not stripped
16022#>22	leshort		>0		- version %d
160230	leshort		0503		basic-16 executable (TV)
16024>12	lelong		>0		not stripped
16025#>22	leshort		>0		- version %d
160260	leshort		0510		x86 executable
16027>12	lelong		>0		not stripped
160280	leshort		0511		x86 executable (TV)
16029>12	lelong		>0		not stripped
160300	leshort		=0512		iAPX 286 executable small model (COFF)
16031>12	lelong		>0		not stripped
16032#>22	leshort		>0		- version %d
160330	leshort		=0522		iAPX 286 executable large model (COFF)
16034>12	lelong		>0		not stripped
16035#>22	leshort		>0		- version %d
16036# updated by Joerg Jenderek at Oct 2015
16037# https://de.wikipedia.org/wiki/Common_Object_File_Format
16038# http://www.delorie.com/djgpp/doc/coff/filhdr.html
16039# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
16040# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
16041# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
160420	leshort		=0514
16043# use subroutine to display name+flags+variables for common object formated files
16044>0	use				display-coff
16045#>12	lelong		>0		not stripped
16046# no hint found, that at offset 22 is version
16047#>22	leshort		>0		- version %d
16048
16049# rom: file(1) magic for BIOS ROM Extensions found in intel machines
16050#      mapped into memory between 0xC0000 and 0xFFFFF
16051# From: Alex Myczko <alex@aiei.ch>
16052# updated by Joerg Jenderek
16053# https://en.wikipedia.org/wiki/Option_ROM
160540        beshort         0x55AA       BIOS (ia32) ROM Ext.
16055!:mime	application/octet-stream
16056!:ext	rom/bin
16057>5       string          USB          USB
16058>7       string          LDR          UNDI image
16059>30      string          IBM          IBM comp. Video
16060>26      string          Adaptec      Adaptec
16061>28      string          Adaptec      Adaptec
16062>42      string          PROMISE      Promise
16063>2       byte            x            (%d*512)
16064
16065# Flash descriptors for Intel SPI flash roms.
16066# From Dr. Jesus <j@hug.gs>
160670	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step
1606816	lelong		0x0ff0a55a	Intel serial flash for PCH ROM
16069
16070#------------------------------------------------------------------------------
16071# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
16072# interleaf:  file(1) magic for InterLeaf TPS:
16073#
160740	string		=\210OPS	Interleaf saved data
160750	string		=<!OPS		Interleaf document text
16076>5	string		,\ Version\ =	\b, version
16077>>17	string		>\0		%.3s
16078
16079#------------------------------------------------------------------------------
16080# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
16081# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
16082# "/etc/magic":
16083# From: guy@netapp.com (Guy Harris)
16084#
160854	string		pgscriptver	IslandWrite document
1608613	string		DrawFile	IslandDraw document
16087
16088
16089#------------------------------------------------------------------------------
16090# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
16091# ispell:  file(1) magic for ispell
16092#
16093# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
16094# will match 0x9600 through 0x9603 in *both* little endian and big endian.
16095# (No other current magic entries collide.)
16096#
16097# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
16098#
160990	leshort&0xFFFC	0x9600		little endian ispell
16100>0	byte		0		hash file (?),
16101>0	byte		1		3.0 hash file,
16102>0	byte		2		3.1 hash file,
16103>0	byte		3		hash file (?),
16104>2	leshort		0x00		8-bit, no capitalization, 26 flags
16105>2	leshort		0x01		7-bit, no capitalization, 26 flags
16106>2	leshort		0x02		8-bit, capitalization, 26 flags
16107>2	leshort		0x03		7-bit, capitalization, 26 flags
16108>2	leshort		0x04		8-bit, no capitalization, 52 flags
16109>2	leshort		0x05		7-bit, no capitalization, 52 flags
16110>2	leshort		0x06		8-bit, capitalization, 52 flags
16111>2	leshort		0x07		7-bit, capitalization, 52 flags
16112>2	leshort		0x08		8-bit, no capitalization, 128 flags
16113>2	leshort		0x09		7-bit, no capitalization, 128 flags
16114>2	leshort		0x0A		8-bit, capitalization, 128 flags
16115>2	leshort		0x0B		7-bit, capitalization, 128 flags
16116>2	leshort		0x0C		8-bit, no capitalization, 256 flags
16117>2	leshort		0x0D		7-bit, no capitalization, 256 flags
16118>2	leshort		0x0E		8-bit, capitalization, 256 flags
16119>2	leshort		0x0F		7-bit, capitalization, 256 flags
16120>4	leshort		>0		and %d string characters
161210	beshort&0xFFFC	0x9600		big endian ispell
16122>1	byte		0		hash file (?),
16123>1	byte		1		3.0 hash file,
16124>1	byte		2		3.1 hash file,
16125>1	byte		3		hash file (?),
16126>2	beshort		0x00		8-bit, no capitalization, 26 flags
16127>2	beshort		0x01		7-bit, no capitalization, 26 flags
16128>2	beshort		0x02		8-bit, capitalization, 26 flags
16129>2	beshort		0x03		7-bit, capitalization, 26 flags
16130>2	beshort		0x04		8-bit, no capitalization, 52 flags
16131>2	beshort		0x05		7-bit, no capitalization, 52 flags
16132>2	beshort		0x06		8-bit, capitalization, 52 flags
16133>2	beshort		0x07		7-bit, capitalization, 52 flags
16134>2	beshort		0x08		8-bit, no capitalization, 128 flags
16135>2	beshort		0x09		7-bit, no capitalization, 128 flags
16136>2	beshort		0x0A		8-bit, capitalization, 128 flags
16137>2	beshort		0x0B		7-bit, capitalization, 128 flags
16138>2	beshort		0x0C		8-bit, no capitalization, 256 flags
16139>2	beshort		0x0D		7-bit, no capitalization, 256 flags
16140>2	beshort		0x0E		8-bit, capitalization, 256 flags
16141>2	beshort		0x0F		7-bit, capitalization, 256 flags
16142>4	beshort		>0		and %d string characters
16143# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
16144# Ispell 4.0
161450       string          ISPL            ispell
16146>4      long            x               hash file version %d,
16147>8      long            x               lexletters %d,
16148>12     long            x               lexsize %d,
16149>16     long            x               hashsize %d,
16150>20     long            x               stblsize %d
16151
16152#------------------------------------------------------------------------------
16153# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $
16154# ISO Zipped file format
16155# http://www.ezbsystems.com/isz/iszspec.txt
161560	string	IsZ!	ISO Zipped file
16157>4	byte	x	\b, header size %u
16158>5	byte	x	\b, version %u
16159>8	lelong	x	\b, serial %u
16160#12	leshort	x	\b, sector size %u
16161#>16	lelong	x	\b, total sectors %u
16162>17	byte	>0	\b, password protected
16163#>24	lequad	x	\b, segment size %llu
16164#>32	lelong	x	\b, blocks %u
16165#>36	lelong	x	\b, block size %u
16166
16167#------------------------------------------------------------
16168# $File: java,v 1.18 2015/11/29 22:08:14 christos Exp $
16169# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
16170# same magic number, 0xcafebabe, so they are both handled
16171# in the entry called "cafebabe".
16172#------------------------------------------------------------
16173# Java serialization
16174# From Martin Pool (m.pool@pharos.com.au)
161750	beshort		0xaced		Java serialization data
16176>2	beshort		>0x0004		\b, version %d
16177
161780	belong		0xfeedfeed	Java KeyStore
16179!:mime	application/x-java-keystore
161800	belong		0xcececece	Java JCE KeyStore
16181!:mime	application/x-java-jce-keystore
16182
16183# Java source
161840	regex	\^import.*;$	Java source
16185!:mime	text/x-java
16186
16187# Java HPROF dumps
16188# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
161890	string		JAVA\x20PROFILE\x201.0.
16190>0x12	short		0
16191>>0x11	ushort-0x31	<2      Java HPROF dump,
16192>>0x17	beqdate/1000	x       created %s
16193
16194#------------------------------------------------------------------------------
16195# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $
16196# javascript:  magic for javascript and node.js scripts.
16197#
161980	search/1/w	#!/bin/node		Node.js script text executable
16199!:mime application/javascript
162000	search/1/w	#!/usr/bin/node		Node.js script text executable
16201!:mime application/javascript
162020	search/1/w	#!/bin/nodejs		Node.js script text executable
16203!:mime application/javascript
162040	search/1/w	#!/usr/bin/nodejs	Node.js script text executable
16205!:mime application/javascript
162060	search/1	#!/usr/bin/env\ node	Node.js script text executable
16207!:mime application/javascript
162080	search/1	#!/usr/bin/env\ nodejs	Node.js script text executable
16209!:mime application/javascript
16210
16211#------------------------------------------------------------------------------
16212# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $
16213# JPEG images
16214# SunOS 5.5.1 had
16215#
16216#	0	string		\377\330\377\340	JPEG file
16217#	0	string		\377\330\377\356	JPG file
16218#
16219# both of which turn into "JPEG image data" here.
16220#
162210	beshort		0xffd8		JPEG image data
16222!:mime	image/jpeg
16223!:apple	8BIMJPEG
16224!:strength *3
16225!:ext jpeg/jpg/jpe/jfif
16226>6	string		JFIF		\b, JFIF standard
16227# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
16228# in a vain attempt to add image size reporting for JFIF.  Note that these
16229# tests are not fool-proof since some perfectly valid JPEGs are currently
16230# impossible to specify in magic(4) format.
16231# First, a little JFIF version info:
16232>>11	byte		x		\b %d.
16233>>12	byte		x		\b%02d
16234# Next, the resolution or aspect ratio of the image:
16235>>13	byte		0		\b, aspect ratio
16236>>13	byte		1		\b, resolution (DPI)
16237>>13	byte		2		\b, resolution (DPCM)
16238>>14	beshort		x		\b, density %dx
16239>>16	beshort		x		\b%d
16240>>4	beshort		x		\b, segment length %d
16241# Next, show thumbnail info, if it exists:
16242>>18	byte		!0		\b, thumbnail %dx
16243>>>19	byte		x		\b%d
16244>6	string		Exif		\b, Exif standard: [
16245>>12	indirect/r	x
16246>>12	string		x		\b]
16247
16248# Jump to the first segment
16249>(4.S+4)	use		jpeg_segment
16250
16251# This uses recursion...
162520		name		jpeg_segment
16253>0	beshort		0xFFFE
16254# Recursion handled by FFE0
16255#>>(2.S+2)	use			jpeg_segment
16256>>2	pstring/HJ	x		\b, comment: "%s"
16257
16258>0	beshort		0xFFC0
16259>>(2.S+2)	use			jpeg_segment
16260>>4	byte		x		\b, baseline, precision %d
16261>>7	beshort		x		\b, %dx
16262>>5	beshort		x		\b%d
16263>>9	byte		x		\b, frames %d
16264
16265>0	beshort		0xFFC1
16266>>(2.S+2)	use			jpeg_segment
16267>>4	byte		x		\b, extended sequential, precision %d
16268>>7	beshort		x		\b, %dx
16269>>5	beshort		x		\b%d
16270>>9	byte		x		\b, frames %d
16271
16272>0	beshort		0xFFC2
16273>>(2.S+2)	use			jpeg_segment
16274>>4	byte		x		\b, progressive, precision %d
16275>>7	beshort		x		\b, %dx
16276>>5	beshort		x		\b%d
16277>>9	byte		x		\b, frames %d
16278
16279# Define Huffman Tables
16280>0	beshort		0xFFC4
16281>>(2.S+2)	use			jpeg_segment
16282
16283>0	beshort		0xFFE1
16284# Recursion handled by FFE0
16285#>>(2.S+2)	use			jpeg_segment
16286>>4	string		Exif		\b, Exif Standard: [
16287>>>10	indirect/r	x
16288>>>10	string		x		\b]
16289
16290# Application specific markers
16291>0	beshort&0xFFE0	=0xFFE0
16292>>(2.S+2)	use			jpeg_segment
16293
16294# DB: Define Quantization tables
16295# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
16296# D8: Start of image
16297# D9: End of image
16298# Dn: Restart
16299>0	beshort&0xFFD0	=0xFFD0
16300>>0	beshort&0xFFE0	!0xFFE0
16301>>>(2.S+2)	use			jpeg_segment
16302
16303#>0	beshort		x		unknown 0x%x
16304#>>(2.S+2)	use			jpeg_segment
16305
16306# HSI is Handmade Software's proprietary JPEG encoding scheme
163070	string		hsi1		JPEG image data, HSI proprietary
16308
16309# From: David Santinoli <david@santinoli.com>
163100	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
16311# From: Johan van der Knijff <johan.vanderknijff@kb.nl>
16312# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
16313# https://github.com/bitsgalore/jp2kMagic
16314#
16315# Now read value of 'Brand' field, which yields a few possibilities:
16316>20	string		\x6a\x70\x32\x20	Part 1 (JP2)
16317!:mime	image/jp2
16318>20	string		\x6a\x70\x78\x20	Part 2 (JPX)
16319!:mime	image/jpx
16320>20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
16321!:mime	image/jpm
16322>20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
16323!:mime	video/mj2
16324
16325# Type: JPEG 2000 codesream
16326# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>
163270	belong		0xff4fff51						JPEG 2000 codestream
1632845	beshort		0xff52
16329
16330# JPEG extended range
163310	string		\x49\x49\xbc
16332>3	byte		1
16333>>4	lelong%2	0	JPEG-XR
16334!:mime	image/jxr
16335!:ext	jxr
16336
16337#------------------------------------------------------------------------------
16338# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $
16339# karma:  file(1) magic for Karma data files
16340#
16341# From <rgooch@atnf.csiro.au>
16342
163430	string	KarmaRHD\040Version	Karma Data Structure Version
16344>16	belong		x		%u
16345
16346#------------------------------------------------------------------------------
16347# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
16348# kde:  file(1) magic for KDE
16349
163500		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
16351!:mime	application/x-kdelnk
163520		string/t	#\ KDE\ Config\ File	KDE config file
16353!:mime	application/x-kdelnk
163540		string/t	#\ xmcd	xmcd database file for kscd
16355!:mime	text/x-xmcd
16356
16357#------------------------------------------------------------------------------
16358# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $
16359# keepass: file(1) magic for KeePass file
16360#
16361# Keepass Password Safe:
16362#  * original one: http://keepass.info/
16363#  * *nix port:    http://www.keepassx.org/
16364#  * android port: http://code.google.com/p/keepassdroid/
16365
163660	lelong		0x9AA2D903	Keepass password database
16367>4	lelong		0xB54BFB65	1.x KDB
16368>>48	lelong		>0		\b, %d groups
16369>>52	lelong		>0		\b, %d entries
16370>>8	lelong&0x0f	1		\b, SHA-256
16371>>8	lelong&0x0f	2		\b, AES
16372>>8	lelong&0x0f	4		\b, RC4
16373>>8	lelong&0x0f	8		\b, Twofish
16374>>120	lelong		>0		\b, %d key transformation rounds
16375>4	lelong		0xB54BFB67	2.x KDBX
16376
16377#------------------------------------------------------------------------------
16378# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $
16379# kerberos: MIT kerberos file binary formats
16380#
16381
16382# This magic entry is for demonstration purposes and could be improved
16383# if the following features were implemented in file:
16384#
16385# Strings inside [[ .. ]] in the descriptions have special meanings and
16386# are not printed.
16387#
16388# 	- Provide some form of iteration in number of components
16389#		[[${counter}=%d]] in the description
16390#		then append
16391#		[${counter}--] in the offset of the entries
16392#	- Provide a way to round the next offset
16393#		Add [R:4] after the offset?
16394#	- Provide a way to have optional entries
16395#		XXX: Syntax:
16396#	- Provide a way to "save" entries to print them later.
16397#		if the description is [[${name}=%s]], then nothing is
16398#		printed and a subsequent entry in the same magic file
16399#		can refer to ${name}
16400#	- Provide a way to format strings as hex values
16401#
16402# http://www.gnu.org/software/shishi/manual/html_node/\
16403#	The-Keytab-Binary-File-Format.html
16404#
16405
164060		name		keytab_entry
16407#>0		beshort		x		\b, size=%d
16408#>2		beshort		x		\b, components=%d
16409>4		pstring/H	x		\b, realm=%s
16410>>&0		pstring/H	x		\b, principal=%s/
16411>>>&0		pstring/H	x		\b%s
16412>>>>&0		belong		x		\b, type=%d
16413>>>>>&0		bedate		x		\b, date=%s
16414>>>>>>&0	byte		x		\b, kvno=%u
16415#>>>>>>>&0	pstring/H	x
16416#>>>>>>>>&0	belong		x
16417#>>>>>>>>>>&0	use		keytab_entry
16418
164190		belong		0x05020000	Kerberos Keytab file
16420>4		use		keytab_entry
16421
16422#------------------------------------------------------------------------------
16423# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $
16424# Type: Google KML, formerly Keyhole Markup Language
16425# Future development of this format has been handed
16426# over to the Open Geospatial Consortium.
16427# http://www.opengeospatial.org/standards/kml/
16428# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
164290 string/t    \<?xml
16430>20  search/400 \ xmlns=
16431>>&0 regex ['"]http://earth.google.com/kml Google KML document
16432!:mime application/vnd.google-earth.kml+xml
16433>>>&1 string 2.0' \b, version 2.0
16434>>>&1 string 2.1' \b, version 2.1
16435>>>&1 string 2.2' \b, version 2.2
16436
16437#------------------------------------------------------------------------------
16438# Type: OpenGIS KML, formerly Keyhole Markup Language
16439# This standard is maintained by the
16440# Open Geospatial Consortium.
16441# http://www.opengeospatial.org/standards/kml/
16442# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
16443>>&0 regex ['"]http://www.opengis.net/kml OpenGIS KML document
16444!:mime application/vnd.google-earth.kml+xml
16445>>>&1 string/t 2.2 \b, version 2.2
16446
16447#------------------------------------------------------------------------------
16448# Type: Google KML Archive (ZIP based)
16449# http://code.google.com/apis/kml/documentation/kml_tut.html
16450# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
164510 string    PK\003\004
16452>4  byte    0x14
16453>>30  string doc.kml Compressed Google KML Document, including resources.
16454!:mime application/vnd.google-earth.kmz
16455
16456#------------------------------------------------------------------------------
16457# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
16458# DEC SRC Virtual Paper: Lectern files
16459# Karl M. Hegbloom <karlheg@inetarena.com>
164600	string	lect	DEC SRC Virtual Paper Lectern file
16461
16462#------------------------------------------------------------------------------
16463# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
16464# lex:  file(1) magic for lex
16465#
16466#	derived empirically, your offsets may vary!
164670	search/100	yyprevious	C program text (from lex)
16468>3	search/1	>\0		 for %s
16469# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
164700	search/100	generated\ by\ flex	C program text (from flex)
16471# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
164720	search/1	%{		lex description text
16473
16474#------------------------------------------------------------------------------
16475# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
16476# lif:  file(1) magic for lif
16477#
16478# (Daniel Quinlan <quinlan@yggdrasil.com>)
16479#
164800	beshort		0x8000		lif file
16481
16482#------------------------------------------------------------------------------
16483# $File: linux,v 1.65 2018/07/16 12:32:08 christos Exp $
16484# linux:  file(1) magic for Linux files
16485#
16486# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
16487# The following basic Linux magic is useful for reference, but using
16488# "long" magic is a better practice in order to avoid collisions.
16489#
16490# 2	leshort		100		Linux/i386
16491# >0	leshort		0407		impure executable (OMAGIC)
16492# >0	leshort		0410		pure executable (NMAGIC)
16493# >0	leshort		0413		demand-paged executable (ZMAGIC)
16494# >0	leshort		0314		demand-paged executable (QMAGIC)
16495#
164960	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
16497>16	lelong		0		\b, stripped
164980	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
16499>16	lelong		0		\b, stripped
165000	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
16501>16	lelong		0		\b, stripped
165020	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
16503>16	lelong		0		\b, stripped
16504#
165050	string		\007\001\000	Linux/i386 object file
16506>20	lelong		>0x1020		\b, DLL library
16507# Linux-8086 stuff:
165080	string		\01\03\020\04	Linux-8086 impure executable
16509>28	long		!0		not stripped
165100	string		\01\03\040\04	Linux-8086 executable
16511>28	long		!0		not stripped
16512#
165130	string		\243\206\001\0	Linux-8086 object file
16514#
165150	string		\01\03\020\20	Minix-386 impure executable
16516>28	long		!0		not stripped
165170	string		\01\03\040\20	Minix-386 executable
16518>28	long		!0		not stripped
165190	string		\01\03\04\20	Minix-386 NSYM/GNU executable
16520>28	long		!0		not stripped
16521# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
16522216	lelong		0421		Linux/i386 core file
16523!:strength / 2
16524>220	string		>\0		of '%s'
16525>200	lelong		>0		(signal %d)
16526#
16527# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
16528# this can be overridden by the DOS executable (COM) entry
165292	string		LILO		Linux/i386 LILO boot/chain loader
16530#
16531# Linux make config build file, from Ole Aamot <oka@oka.no>
16532# Updated by Ken Sharp
1653328	string		make\ config		Linux make config build file (old)
1653449	search/70	Kernel\ Configuration	Linux make config build file
16535
16536#
16537# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
16538# Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
16539# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
165400	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
16541>2	byte&0x01	0		256 characters,
16542>2	byte&0x01	!0		512 characters,
16543>2	byte&0x02	0		no directory,
16544>2	byte&0x02	!0		Unicode directory,
16545>3	byte		>0		8x%d
165460	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
16547>16	lelong		x		%d characters,
16548>12	lelong&0x01	0		no directory,
16549>12	lelong&0x01	!0		Unicode directory,
16550>24	lelong		x		%d
16551>28	lelong		x		\bx%d
16552
16553# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
165544086	string		SWAP-SPACE	Linux/i386 swap file
16555# From: Jeff Bailey <jbailey@ubuntu.com>
16556# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
165574076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
16558# From: James Hunt <james.hunt@ubuntu.com>
165594076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
16560# according to man page of mkswap (8) March 1999
16561# volume label and UUID Russell Coker
16562# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
165634086	string		SWAPSPACE2	Linux/i386 swap file (new style),
16564>0x400	long		x		version %d (4K pages),
16565>0x404	long		x		size %d pages,
16566>1052	string		\0		no label,
16567>1052	string		>\0		LABEL=%s,
16568>0x40c	belong		x		UUID=%08x
16569>0x410	beshort		x		\b-%04x
16570>0x412	beshort		x		\b-%04x
16571>0x414	beshort		x		\b-%04x
16572>0x416	belong		x		\b-%08x
16573>0x41a	beshort		x		\b%04x
16574# From Daniel Novotny <dnovotny@redhat.com>
16575# swap file for PowerPC
1657665526	string		SWAPSPACE2	Linux/ppc swap file
16577>0x400	long		x		version %d,
16578>0x404	long		x		size %d pages,
16579>1052	string		\0		no label,
16580>1052	string		>\0		LABEL=%s,
16581>0x40c	belong		x		UUID=%08x
16582>0x410	beshort		x		\b-%04x
16583>0x412	beshort		x		\b-%04x
16584>0x414	beshort		x		\b-%04x
16585>0x416	belong		x		\b-%08x
16586>0x41a	beshort		x		\b%04x
1658716374	string		SWAPSPACE2	Linux/ia64 swap file
16588#
16589# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
16590# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
16591# and Nicolas Lichtmaier <nick@debian.org>
16592# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
16593# Linux kernel boot images (i386 arch) (Wolfram Kleff)
16594514	string		HdrS		Linux kernel
16595!:strength + 55
16596>510	leshort		0xAA55		x86 boot executable
16597>>518	leshort		>0x1ff
16598>>>529	byte		0		zImage,
16599>>>529	byte		1		bzImage,
16600>>>526	lelong		>0
16601>>>>(526.s+0x200) string	>\0	version %s,
16602>>498	leshort		1		RO-rootFS,
16603>>498	leshort		0		RW-rootFS,
16604>>508	leshort		>0		root_dev 0x%X,
16605>>502	leshort		>0		swap_dev 0x%X,
16606>>504	leshort		>0		RAMdisksize %u KB,
16607>>506	leshort		0xFFFF		Normal VGA
16608>>506	leshort		0xFFFE		Extended VGA
16609>>506	leshort		0xFFFD		Prompt for Videomode
16610>>506	leshort		>0		Video mode %d
16611# This also matches new kernels, which were caught above by "HdrS".
166120		belong	0xb8c0078e	Linux kernel
16613>0x1e3		string	Loading		version 1.3.79 or older
16614>0x1e9		string	Loading		from prehistoric times
16615
16616# System.map files - Nicolas Lichtmaier <nick@debian.org>
166178	search/1	\ A\ _text	Linux kernel symbol map text
16618
16619# LSM entries - Nicolas Lichtmaier <nick@debian.org>
166200	search/1	Begin3	Linux Software Map entry text
166210	search/1	Begin4	Linux Software Map entry text (new format)
16622
16623# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
166240	belong	0x4f4f4f4d	User-mode Linux COW file
16625>4	belong	<3		\b, version %d
16626>>8	string	>\0		\b, backing file %s
16627>4	belong	>2		\b, version %d
16628>>32	string	>\0		\b, backing file %s
16629
16630############################################################################
16631# Linux kernel versions
16632
166330		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
16634>497		leshort		0		x86 boot sector
16635>>514		belong		0x8e	of a kernel from the dawn of time!
16636>>514		belong		0x908ed8b4	version 0.99-1.1.42
16637>>514		belong		0x908ed8b8	for memtest86
16638
16639>497		leshort		!0		x86 kernel
16640>>504		leshort		>0		RAMdisksize=%u KB
16641>>502		leshort		>0		swap=0x%X
16642>>508		leshort		>0		root=0x%X
16643>>>498		leshort		1		\b-ro
16644>>>498		leshort		0		\b-rw
16645>>506		leshort		0xFFFF		vga=normal
16646>>506		leshort		0xFFFE		vga=extended
16647>>506		leshort		0xFFFD		vga=ask
16648>>506		leshort		>0		vga=%d
16649>>514		belong		0x908ed881	version 1.1.43-1.1.45
16650>>514		belong		0x15b281cd
16651>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
16652>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
16653>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
16654>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
16655>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
16656>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
16657>>514		string		HdrS
16658>>>518		leshort		>0x1FF
16659>>>>529		byte		0		\b, zImage
16660>>>>529		byte		1		\b, bzImage
16661>>>>(526.s+0x200) string 	>\0		\b, version %s
16662
16663# Linux boot sector thefts.
166640		belong		0xb8c0078e	Linux
16665>0x1e6		belong		0x454c4b53	ELKS Kernel
16666>0x1e6		belong		!0x454c4b53	style boot sector
16667
16668############################################################################
16669# Linux S390 kernel image
16670# Created by: Jan Kaluza <jkaluza@redhat.com>
166718 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
16672>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
16673# 64bit
16674>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
16675>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
16676>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
16677>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
16678# 32bit
16679>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
16680>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
16681>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
16682>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
16683
16684# Linux ARM compressed kernel image
16685# From: Kevin Cernekee <cernekee@gmail.com>
1668636	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
1668736	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
16688
16689############################################################################
16690# Linux 8086 executable
166910	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
16692>5	string		.
16693>>4	string		>\0		\b, libc version %s
16694
166950	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
16696>2	byte&0x01	!0		\b, unmapped zero page
16697>2	byte&0x20	0		\b, impure
16698>2	byte&0x20	!0
16699>>2	byte&0x10	!0		\b, A_EXEC
16700>2	byte&0x02	!0		\b, A_PAL
16701>2	byte&0x04	!0		\b, A_NSYM
16702>2	byte&0x08	!0		\b, A_STAND
16703>2	byte&0x40	!0		\b, A_PURE
16704>2	byte&0x80	!0		\b, A_TOVLY
16705>28     long            !0              \b, not stripped
16706>37	string		.
16707>>36	string		>\0		\b, libc version %s
16708
16709# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
16710# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
16711# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
16712# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
16713
16714# SYSLINUX boot logo files (from 'ppmtolss16' sources)
16715# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
16716# file extension .lss .16
167170	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
16718# syslinux-4.05/mime/image/x-lss16.xml
16719!:mime image/x-lss16
16720>4	leshort	x			\b, width %d
16721>6	leshort	x			\b, height %d
16722
167230	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
16724>4	belong	x			version %d
16725
16726# SE Linux policy database
16727# From: Mike Frysinger <vapier@gentoo.org>
167280	lelong	0xf97cff8c		SE Linux policy
16729>16	lelong	x			v%d
16730>20	lelong	1			MLS
16731>24	lelong	x			%d symbols
16732>28	lelong	x			%d ocons
16733
16734# Linux Logical Volume Manager (LVM)
16735# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
16736#
16737# System ID, UUID and volume group name are 128 bytes long
16738# but they should never be full and initialized with zeros...
16739#
16740# LVM1
16741#
167420x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
16743>0x12c	string	>\0		, System ID: %s
16744
167450x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
16746>0x12c	string	>\0		, System ID: %s
16747
16748#  LVM2
16749#
16750# It seems that the label header can be in one the four first sector
16751# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
16752#
16753# 0x200 seems to be the common case
16754
167550x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
16756# read the offset to add to the start of the header, and the header
16757# start in 0x200
16758>&(&-12.l-0x21) byte    x
16759# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
16760>>&0x0          string  >\x2f          \b, UUID: %.6s
16761>>&0x6          string  >\x2f          \b-%.4s
16762>>&0xa          string  >\x2f          \b-%.4s
16763>>&0xe          string  >\x2f          \b-%.4s
16764>>&0x12         string  >\x2f          \b-%.4s
16765>>&0x16         string  >\x2f          \b-%.4s
16766>>&0x1a         string  >\x2f          \b-%.6s
16767>>&0x20         lequad  x              \b, size: %lld
16768
167690x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
16770>&(&-12.l-0x21) byte    x
16771# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
16772>>&0x0          string  >\x2f          \b, UUID: %.6s
16773>>&0x6          string  >\x2f          \b-%.4s
16774>>&0xa          string  >\x2f          \b-%.4s
16775>>&0xe          string  >\x2f          \b-%.4s
16776>>&0x12         string  >\x2f          \b-%.4s
16777>>&0x16         string  >\x2f          \b-%.4s
16778>>&0x1a         string  >\x2f          \b-%.6s
16779>>&0x20         lequad  x              \b, size: %lld
16780
167810x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
16782>&(&-12.l-0x21) byte    x
16783# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
16784>>&0x0          string  >\x2f          \b, UUID: %.6s
16785>>&0x6          string  >\x2f          \b-%.4s
16786>>&0xa          string  >\x2f          \b-%.4s
16787>>&0xe          string  >\x2f          \b-%.4s
16788>>&0x12         string  >\x2f          \b-%.4s
16789>>&0x16         string  >\x2f          \b-%.4s
16790>>&0x1a         string  >\x2f          \b-%.6s
16791>>&0x20         lequad  x              \b, size: %lld
16792
167930x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
16794>&(&-12.l-0x21) byte    x
16795# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
16796>>&0x0          string  >\x2f          \b, UUID: %.6s
16797>>&0x6          string  >\x2f          \b-%.4s
16798>>&0xa          string  >\x2f          \b-%.4s
16799>>&0xe          string  >\x2f          \b-%.4s
16800>>&0x12         string  >\x2f          \b-%.4s
16801>>&0x16         string  >\x2f          \b-%.4s
16802>>&0x1a         string  >\x2f          \b-%.6s
16803>>&0x20         lequad  x              \b, size: %lld
16804
16805# LVM snapshot
16806# from Jason Farrel
168070	string	SnAp	LVM Snapshot (CopyOnWrite store)
16808>4	lelong	!0	- valid,
16809>4	lelong	0	- invalid,
16810>8	lelong	x	version %d,
16811>12	lelong	x	chunk_size %d
16812
16813# SE Linux policy database
168140	lelong	0xf97cff8c		SE Linux policy
16815>16	lelong	x			v%d
16816>20	lelong	1			MLS
16817>24	lelong	x			%d symbols
16818>28	lelong	x			%d ocons
16819
16820# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
16821# Anthon van der Neut (anthon@mnt.org)
168220	string	LUKS\xba\xbe	LUKS encrypted file,
16823>6	beshort x		ver %d
16824>8	string	x		[%s,
16825>40	string	x		%s,
16826>72	string	x		%s]
16827>168	string	x		UUID: %s
16828
16829
16830# Summary: Xen saved domain file
16831# Created by: Radek Vokal <rvokal@redhat.com>
168320	string		LinuxGuestRecord	Xen saved domain
16833>20	search/256	(name
16834>>&1	string		x			(name %s)
16835
16836# Type: Xen, the virtual machine monitor
16837# From: Radek Vokal <rvokal@redhat.com>
168380	string		LinuxGuestRecord	Xen saved domain
16839#>2	regex		\(name\ [^)]*\)		%s
16840>20	search/256	(name			(name
16841>>&1	string		x			%s...)
16842
16843# Systemd journald files
16844# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/.
16845# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
16846
16847# check magic
168480	string	LPKSHHRH
16849# check that state is one of known values
16850>16		ubyte&252	0
16851# check that each half of three unique id128s is non-zero
16852>>24		ubequad		>0
16853>>>32		ubequad		>0
16854>>>>40		ubequad		>0
16855>>>>>48		ubequad		>0
16856>>>>>>56	ubequad		>0
16857>>>>>>>64	ubequad		>0	Journal file
16858!:mime application/octet-stream
16859# provide more info
16860>>>>>>>>184	leqdate		0	empty
16861>>>>>>>>16	ubyte		0	\b, offline
16862>>>>>>>>16	ubyte		1	\b, online
16863>>>>>>>>16	ubyte		2	\b, archived
16864>>>>>>>>8	ulelong&1	1	\b, sealed
16865>>>>>>>>12	ulelong&1	1	\b, compressed
16866
16867# BCache backing and cache devices
16868# From: Gabriel de Perthuis <g2p.code@gmail.com>
168690x1008		lequad		8
16870>0x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	BCache
16871>>0x1010	ulequad		0	cache device
16872>>0x1010	ulequad		1	backing device
16873>>0x1010	ulequad		3	cache device
16874>>0x1010	ulequad		4	backing device
16875>>0x1048	string		>0	\b, label "%.32s"
16876>>0x1028	ubelong		x	\b, uuid %08x
16877>>0x102c	ubeshort	x	\b-%04x
16878>>0x102e	ubeshort	x	\b-%04x
16879>>0x1030	ubeshort	x	\b-%04x
16880>>0x1032	ubelong		x	\b-%08x
16881>>0x1036	ubeshort	x	\b%04x
16882>>0x1038	ubelong		x	\b, set uuid %08x
16883>>0x103c	ubeshort	x	\b-%04x
16884>>0x103e	ubeshort	x	\b-%04x
16885>>0x1040	ubeshort	x	\b-%04x
16886>>0x1042	ubelong		x	\b-%08x
16887>>0x1046	ubeshort	x	\b%04x
16888
16889# Linux device tree:
16890# File format description can be found in the Linux kernel sources at
16891# Documentation/devicetree/booting-without-of.txt
16892# From Christoph Biedl
168930		belong		0xd00dfeed
16894# structure and strings must be within blob
16895>&(8.L)		byte		x
16896>>&(12.L)	byte		x
16897>>>20		belong		>1	Device Tree Blob version %d
16898>>>>4		belong		x	\b, size=%d
16899>>>>20		belong		>1
16900>>>>>28		belong		x	\b, boot CPU=%d
16901>>>>20		belong		>2
16902>>>>>32		belong		x	\b, string block size=%d
16903>>>>20		belong		>16
16904>>>>>36		belong		x	\b, DT structure block size=%d
16905
16906# glibc locale archive as defined in glibc locale/locarchive.h
169070		lelong		0xde020109	locale archive
16908>24		lelong		x		%d strings
16909
16910# Linux Software RAID (mdadm)
16911# Russell Coker <russell@coker.com.au>
169120	name	linuxraid
16913>16	belong	x		UUID=%8x:
16914>20	belong	x		\b%8x:
16915>24	belong	x		\b%8x:
16916>28	belong	x		\b%8x
16917>32	string	x		name=%s
16918>72	lelong	x		level=%d
16919>92	lelong	x		disks=%d
16920
169214096	lelong	0xa92b4efc	Linux Software RAID
16922>4100	lelong	x		version 1.2 (%d)
16923>4096	use	linuxraid
16924
169250	lelong	0xa92b4efc	Linux Software RAID
16926>4	lelong	x		version 1.1 (%d)
16927>0	use	linuxraid
16928
16929# Summary:     Database file for mlocate
16930# Description: A database file as used by mlocate, a fast implementation
16931#              of locate/updatedb. It uses merging to reuse the existing
16932#              database and avoid rereading most of the filesystem. It's
16933#              the default version of locate on Arch Linux (and others).
16934# File path:   /var/lib/mlocate/mlocate.db by default (but configurable)
16935# Site:        https://fedorahosted.org/mlocate/
16936# Format docs: http://linux.die.net/man/5/mlocate.db
16937# Type: mlocate database file
16938# URL:  https://fedorahosted.org/mlocate/
16939# From: Wander Nauta <info@wandernauta.nl>
169400		string		\0mlocate	mlocate database
16941>12		byte		x		\b, version %d
16942>13		byte		1		\b, require visibility
16943>16		string		x		\b, root %s
16944
16945# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
16946# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
16947# From: Pavel Emelyanov <xemul@parallels.com>
169480		lelong		0x45311224	iproute2 routes dump
169490		lelong		0x47361222	iproute2 addresses dump
16950
16951# Image and service files for CRIU tool.
16952# URL: http://criu.org
16953# From: Pavel Emelyanov <xemul@parallels.com>
169540		lelong		0x54564319	CRIU image file v1.1
169550		lelong		0x55105940	CRIU service file
169560		lelong		0x58313116	CRIU inventory
16957
16958# Kdump compressed dump files
16959# http://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
16960
169610		string		KDUMP          	Kdump compressed dump
16962>8		long		x		v%d
16963>12		string		>\0		\b, system %s
16964>77		string		>\0		\b, node %s
16965>142		string		>\0		\b, release %s
16966>207		string		>\0		\b, version %s
16967>272		string		>\0		\b, machine %s
16968>337		string		>\0		\b, domain %s
16969
16970#------------------------------------------------------------------------------
16971# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $
16972# lisp:  file(1) magic for lisp programs
16973#
16974# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
16975
16976# updated by Joerg Jenderek
16977# GRR: This lot is too weak
16978#0	string	;;
16979# windows INF files often begin with semicolon and use CRLF as line end
16980# lisp files are mainly created on unix system with LF as line end
16981#>2	search/4096	!\r		Lisp/Scheme program text
16982#>2	search/4096	\r		Windows INF file
16983
169840	search/4096	(setq\ 			Lisp/Scheme program text
16985!:mime	text/x-lisp
169860	search/4096	(defvar\ 		Lisp/Scheme program text
16987!:mime	text/x-lisp
169880	search/4096	(defparam\ 		Lisp/Scheme program text
16989!:mime	text/x-lisp
169900	search/4096	(defun\  		Lisp/Scheme program text
16991!:mime	text/x-lisp
169920	search/4096	(autoload\ 		Lisp/Scheme program text
16993!:mime	text/x-lisp
169940	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
16995!:mime	text/x-lisp
16996
16997# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
16998# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
16999# Update: Joerg Jenderek
17000# Emacs 18 - this is always correct, but not very magical.
170010	string	\012(
17002# look for emacs lisp keywords
17003# GRR: split regex because it is too long or get error like
17004# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
17005>&0	regex	\^(defun|defvar|defconst|defmacro|setq|fset)	Emacs v18 byte-compiled Lisp data
17006!:mime	application/x-elc
17007# https://searchcode.com/codesearch/view/2173420/
17008# not really pure text
17009!:apple	EMAxTEXT
17010!:ext elc
17011# remaining regex
17012>&0	regex	\^(put|provide|require|random)	Emacs v18 byte-compiled Lisp data
17013!:mime	application/x-elc
17014!:apple	EMAxTEXT
17015!:ext elc
17016# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;;
17017
17018# Emacs 19+ - ver. recognition added by Ian Springer
17019# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
17020# - Chris Chittleborough <cchittleborough@yahoo.com.au>
17021# Update: Joerg Jenderek
170220	string	;ELC
17023# version\0\0\0
17024>4	byte	>18			Emacs/XEmacs v%d byte-compiled Lisp data
17025# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
17026#>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
17027!:mime	application/x-elc
17028!:apple	EMAxTEXT
17029!:ext elc
17030
17031# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
170320	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program (pre 2004-03-27)
170330	string	(|SYSTEM|::|VERSION|\040'	CLISP byte-compiled Lisp program text
17034
170350	long	0x70768BD2		CLISP memory image data
170360	long	0xD28B7670		CLISP memory image data, other endian
17037
17038#.com and .bin for MIT scheme
170390	string	\372\372\372\372	MIT scheme (library?)
17040
17041# From: David Allouche <david@allouche.net>
170420	search/1	\<TeXmacs|	TeXmacs document text
17043!:mime	text/texmacs
17044
17045#------------------------------------------------------------------------------
17046# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
17047# llvm:  file(1) magic for LLVM byte-codes
17048# URL:  http://llvm.org/docs/BitCodeFormat.html
17049# From: Al Stone <ahs3@fc.hp.com>
17050
170510	string	llvm	LLVM byte-codes, uncompressed
170520	string	llvc0	LLVM byte-codes, null compression
170530	string	llvc1	LLVM byte-codes, gzip compression
170540	string	llvc2	LLVM byte-codes, bzip2 compression
17055
170560	lelong	0x0b17c0de	LLVM bitcode, wrapper
17057# Are these Mach-O ABI values?  They appear to be.
17058>16	lelong	0x01000007	x86_64
17059>16	lelong	0x00000007	i386
17060>16	lelong	0x00000012	ppc
17061>16	lelong	0x01000012	ppc64
17062>16	lelong 	0x0000000c	arm
17063
170640	string	BC\xc0\xde	LLVM IR bitcode
17065
17066#------------------------------------------------------------------------------
17067# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
17068# lua:  file(1) magic for Lua scripting language
17069# URL:  http://www.lua.org/
17070# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
17071
17072# Lua scripts
170730	search/1/w	#!\ /usr/bin/lua	Lua script text executable
17074!:mime	text/x-lua
170750	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
17076!:mime	text/x-lua
170770	search/1	#!/usr/bin/env\ lua	Lua script text executable
17078!:mime	text/x-lua
170790	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
17080!:mime	text/x-lua
17081
17082# Lua bytecode
170830	string		\033Lua			Lua bytecode,
17084>4	byte		0x50			version 5.0
17085>4	byte		0x51			version 5.1
17086>4	byte		0x52			version 5.2
17087
17088#------------------------------------------------------------------------------
17089# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
17090# luks:  file(1) magic for Linux Unified Key Setup
17091# URL:	http://luks.endorphin.org/spec
17092# From:	Anthon van der Neut <anthon@mnt.org>
17093
170940	string		LUKS\xba\xbe	LUKS encrypted file,
17095>6	beshort		x		ver %d
17096>8	string		x		[%s,
17097>40	string		x		%s,
17098>72	string		x		%s]
17099>168	string		x		UUID: %s
17100#------------------------------------------------------------------------------
17101# $File: m4,v 1.2 2017/08/14 07:40:38 christos Exp $
17102# make:  file(1) magic for M4 scripts
17103#
171040	regex	\^dnl\ 		M4 macro processor script text
17105!:mime	text/x-m4
171060	regex	\^AC_DEFUN\\(\\[	M4 macro processor script text
17107!:strength + 15
17108!:mime	text/x-m4
17109
17110#------------------------------------------------------------
17111# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $
17112# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
17113# Unfortunately the first, cafebabe, is shared with
17114# Java ByteCode, so they are both handled in the file "cafebabe".
17115# The "feedface" ones are handled herein.
17116#------------------------------------------------------------
17117# if set, it's for the 64-bit version of the architecture
17118# yes, this is separate from the low-order magic number bit
17119# it's also separate from the "64-bit libraries" bit in the
17120# upper 8 bits of the CPU subtype
17121
171220	name	mach-o-cpu
17123>0	belong&0x01000000	0
17124#
17125# 32-bit ABIs.
17126#
17127#				1	vax
17128>>0	belong&0x00ffffff	1
17129>>>4		belong&0x00ffffff	0	vax
17130>>>4		belong&0x00ffffff	1	vax11/780
17131>>>4		belong&0x00ffffff	2	vax11/785
17132>>>4		belong&0x00ffffff	3	vax11/750
17133>>>4		belong&0x00ffffff	4	vax11/730
17134>>>4		belong&0x00ffffff	5	uvaxI
17135>>>4		belong&0x00ffffff	6	uvaxII
17136>>>4		belong&0x00ffffff	7	vax8200
17137>>>4		belong&0x00ffffff	8	vax8500
17138>>>4		belong&0x00ffffff	9	vax8600
17139>>>4		belong&0x00ffffff	10	vax8650
17140>>>4		belong&0x00ffffff	11	vax8800
17141>>>4		belong&0x00ffffff	12	uvaxIII
17142>>>4		belong&0x00ffffff	>12	vax subarchitecture=%d
17143>>0	belong&0x00ffffff	2	romp
17144>>0	belong&0x00ffffff	3	architecture=3
17145>>0	belong&0x00ffffff	4	ns32032
17146>>0	belong&0x00ffffff	5	ns32332
17147>>0	belong&0x00ffffff	6	m68k
17148#				7	x86
17149>>0	belong&0x00ffffff	7
17150>>>4	belong&0x0000000f	3		i386
17151>>>4	belong&0x0000000f	4		i486
17152>>>>4	belong&0x00fffff0	0
17153>>>>4	belong&0x00fffff0	0x80		\bsx
17154>>>4	belong&0x0000000f	5		i586
17155>>>4	belong&0x0000000f	6
17156>>>>4	belong&0x00fffff0	0		p6
17157>>>>4	belong&0x00fffff0	0x10		pentium_pro
17158>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
17159>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
17160>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
17161>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
17162>>>>4	belong&0x00fffff0	>0x50		pentium_2_m0x%x
17163>>>4	belong&0x0000000f	7		celeron
17164>>>>4	belong&0x00fffff0	0x00		\b_m0x%x
17165>>>>4	belong&0x00fffff0	0x10		\b_m0x%x
17166>>>>4	belong&0x00fffff0	0x20		\b_m0x%x
17167>>>>4	belong&0x00fffff0	0x30		\b_m0x%x
17168>>>>4	belong&0x00fffff0	0x40		\b_m0x%x
17169>>>>4	belong&0x00fffff0	0x50		\b_m0x%x
17170>>>>4	belong&0x00fffff0	0x60
17171>>>>4	belong&0x00fffff0	0x70		\b_mobile
17172>>>>4	belong&0x00fffff0	>0x70		\b_m0x%x
17173>>>4	belong&0x0000000f	8		pentium_3
17174>>>>4	belong&0x00fffff0	0x00
17175>>>>4	belong&0x00fffff0	0x10		\b_m
17176>>>>4	belong&0x00fffff0	0x20		\b_xeon
17177>>>>4	belong&0x00fffff0	>0x20		\b_m0x%x
17178>>>4	belong&0x0000000f	9		pentiumM
17179>>>>4	belong&0x00fffff0	0x00
17180>>>>4	belong&0x00fffff0	>0x00		\b_m0x%x
17181>>>4	belong&0x0000000f	10		pentium_4
17182>>>>4	belong&0x00fffff0	0x00
17183>>>>4	belong&0x00fffff0	0x10		\b_m
17184>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
17185>>>4	belong&0x0000000f	11		itanium
17186>>>>4	belong&0x00fffff0	0x00
17187>>>>4	belong&0x00fffff0	0x10		\b_2
17188>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
17189>>>4	belong&0x0000000f	12		xeon
17190>>>>4	belong&0x00fffff0	0x00
17191>>>>4	belong&0x00fffff0	0x10		\b_mp
17192>>>>4	belong&0x00fffff0	>0x10		\b_m0x%x
17193>>>4	belong&0x0000000f	>12		ia32 family=%d
17194>>>>4	belong&0x00fffff0	0x00
17195>>>>4	belong&0x00fffff0	>0x00		model=%x
17196>>0	belong&0x00ffffff	8	mips
17197>>>4		belong&0x00ffffff	1	R2300
17198>>>4		belong&0x00ffffff	2	R2600
17199>>>4		belong&0x00ffffff	3	R2800
17200>>>4		belong&0x00ffffff	4	R2000a
17201>>>4		belong&0x00ffffff	5	R2000
17202>>>4		belong&0x00ffffff	6	R3000a
17203>>>4		belong&0x00ffffff	7	R3000
17204>>>4		belong&0x00ffffff	>7	subarchitecture=%d
17205>>0	belong&0x00ffffff	9	ns32532
17206>>0	belong&0x00ffffff	10	mc98000
17207>>0	belong&0x00ffffff	11	hppa
17208>>>4		belong&0x00ffffff	0	7100
17209>>>4		belong&0x00ffffff	1	7100LC
17210>>>4		belong&0x00ffffff	>1	subarchitecture=%d
17211>>0	belong&0x00ffffff	12	arm
17212>>>4		belong&0x00ffffff	0
17213>>>4		belong&0x00ffffff	1	subarchitecture=%d
17214>>>4		belong&0x00ffffff	2	subarchitecture=%d
17215>>>4		belong&0x00ffffff	3	subarchitecture=%d
17216>>>4		belong&0x00ffffff	4	subarchitecture=%d
17217>>>4		belong&0x00ffffff	5	\bv4t
17218>>>4		belong&0x00ffffff	6	\bv6
17219>>>4		belong&0x00ffffff	7	\bv5tej
17220>>>4		belong&0x00ffffff	8	\bxscale
17221>>>4		belong&0x00ffffff	9	\bv7
17222>>>4		belong&0x00ffffff	10	\bv7f
17223>>>4		belong&0x00ffffff	11	\bv7s
17224>>>4		belong&0x00ffffff	12	\bv7k
17225>>>4		belong&0x00ffffff	13	\bv8
17226>>>4		belong&0x00ffffff	14	\bv6m
17227>>>4		belong&0x00ffffff	15	\bv7m
17228>>>4		belong&0x00ffffff	16	\bv7em
17229>>>4		belong&0x00ffffff	>16	subarchitecture=%d
17230#				13	m88k
17231>>0	belong&0x00ffffff	13
17232>>>4		belong&0x00ffffff	0	mc88000
17233>>>4		belong&0x00ffffff	1	mc88100
17234>>>4		belong&0x00ffffff	2	mc88110
17235>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%d
17236>>0	belong&0x00ffffff	14	SPARC
17237>>0	belong&0x00ffffff	15	i860g
17238>>0	belong&0x00ffffff	16	alpha
17239>>0	belong&0x00ffffff	17	rs6000
17240>>0	belong&0x00ffffff	18	ppc
17241>>>4		belong&0x00ffffff	0
17242>>>4		belong&0x00ffffff	1	\b_601
17243>>>4		belong&0x00ffffff	2	\b_602
17244>>>4		belong&0x00ffffff	3	\b_603
17245>>>4		belong&0x00ffffff	4	\b_603e
17246>>>4		belong&0x00ffffff	5	\b_603ev
17247>>>4		belong&0x00ffffff	6	\b_604
17248>>>4		belong&0x00ffffff	7	\b_604e
17249>>>4		belong&0x00ffffff	8	\b_620
17250>>>4		belong&0x00ffffff	9	\b_650
17251>>>4		belong&0x00ffffff	10	\b_7400
17252>>>4		belong&0x00ffffff	11	\b_7450
17253>>>4		belong&0x00ffffff	100	\b_970
17254>>>4		belong&0x00ffffff	>100	subarchitecture=%d
17255>>0	belong&0x00ffffff	>18	architecture=%d
17256>0	belong&0x01000000	0x01000000
17257#
17258# 64-bit ABIs.
17259#
17260>>0	belong&0x00ffffff	0	64-bit architecture=%d
17261>>0	belong&0x00ffffff	1	64-bit architecture=%d
17262>>0	belong&0x00ffffff	2	64-bit architecture=%d
17263>>0	belong&0x00ffffff	3	64-bit architecture=%d
17264>>0	belong&0x00ffffff	4	64-bit architecture=%d
17265>>0	belong&0x00ffffff	5	64-bit architecture=%d
17266>>0	belong&0x00ffffff	6	64-bit architecture=%d
17267>>0	belong&0x00ffffff	7	x86_64
17268>>>4		belong&0x00ffffff	0	subarchitecture=%d
17269>>>4		belong&0x00ffffff	1	subarchitecture=%d
17270>>>4		belong&0x00ffffff	2	subarchitecture=%d
17271>>>4		belong&0x00ffffff	3
17272>>>4		belong&0x00ffffff	4	\b_arch1
17273>>>4		belong&0x00ffffff	8	\b_haswell
17274>>>4		belong&0x00ffffff	>4	subarchitecture=%d
17275>>0	belong&0x00ffffff	8	64-bit architecture=%d
17276>>0	belong&0x00ffffff	9	64-bit architecture=%d
17277>>0	belong&0x00ffffff	10	64-bit architecture=%d
17278>>0	belong&0x00ffffff	11	64-bit architecture=%d
17279>>0	belong&0x00ffffff	12	arm64
17280>>>4		belong&0x00ffffff	0
17281>>>4		belong&0x00ffffff	1	\bv8
17282>>0	belong&0x00ffffff	13	64-bit architecture=%d
17283>>0	belong&0x00ffffff	14	64-bit architecture=%d
17284>>0	belong&0x00ffffff	15	64-bit architecture=%d
17285>>0	belong&0x00ffffff	16	64-bit architecture=%d
17286>>0	belong&0x00ffffff	17	64-bit architecture=%d
17287>>0	belong&0x00ffffff	18	ppc64
17288>>>4		belong&0x00ffffff	0
17289>>>4		belong&0x00ffffff	1		\b_601
17290>>>4		belong&0x00ffffff	2		\b_602
17291>>>4		belong&0x00ffffff	3		\b_603
17292>>>4		belong&0x00ffffff	4		\b_603e
17293>>>4		belong&0x00ffffff	5		\b_603ev
17294>>>4		belong&0x00ffffff	6		\b_604
17295>>>4		belong&0x00ffffff	7		\b_604e
17296>>>4		belong&0x00ffffff	8		\b_620
17297>>>4		belong&0x00ffffff	9		\b_650
17298>>>4		belong&0x00ffffff	10		\b_7400
17299>>>4		belong&0x00ffffff	11		\b_7450
17300>>>4		belong&0x00ffffff	100		\b_970
17301>>>4		belong&0x00ffffff	>100		subarchitecture=%d
17302>>0	belong&0x00ffffff	>18	64-bit architecture=%d
17303
17304
173050	name		mach-o-be
17306>0	byte		0xcf		64-bit
17307>4	use		mach-o-cpu
17308>12	belong		1		object
17309>12	belong		2		executable
17310>12	belong		3		fixed virtual memory shared library
17311>12	belong		4		core
17312>12	belong		5		preload executable
17313>12	belong		6		dynamically linked shared library
17314>12	belong		7		dynamic linker
17315>12	belong		8		bundle
17316>12	belong		9		dynamically linked shared library stub
17317>12	belong		10		dSYM companion file
17318>12	belong		11		kext bundle
17319>12	belong		>11
17320>>12	belong		x		filetype=%d
17321>24	belong		>0		\b, flags:<
17322>>24	belong		&0x0000001	\bNOUNDEFS
17323>>24	belong		&0x0000002	\b|INCRLINK
17324>>24	belong		&0x0000004	\b|DYLDLINK
17325>>24	belong		&0x0000008	\b|BINDATLOAD
17326>>24	belong		&0x0000010	\b|PREBOUND
17327>>24	belong		&0x0000020	\b|SPLIT_SEGS
17328>>24	belong		&0x0000040	\b|LAZY_INIT
17329>>24	belong		&0x0000080	\b|TWOLEVEL
17330>>24	belong		&0x0000100	\b|FORCE_FLAT
17331>>24	belong		&0x0000200	\b|NOMULTIDEFS
17332>>24	belong		&0x0000400	\b|NOFIXPREBINDING
17333>>24	belong		&0x0000800	\b|PREBINDABLE
17334>>24	belong		&0x0001000	\b|ALLMODSBOUND
17335>>24	belong		&0x0002000	\b|SUBSECTIONS_VIA_SYMBOLS
17336>>24	belong		&0x0004000	\b|CANONICAL
17337>>24	belong		&0x0008000	\b|WEAK_DEFINES
17338>>24	belong		&0x0010000	\b|BINDS_TO_WEAK
17339>>24	belong		&0x0020000	\b|ALLOW_STACK_EXECUTION
17340>>24	belong		&0x0040000	\b|ROOT_SAFE
17341>>24	belong		&0x0080000	\b|SETUID_SAFE
17342>>24	belong		&0x0100000	\b|NO_REEXPORTED_DYLIBS
17343>>24	belong		&0x0200000	\b|PIE
17344>>24	belong		&0x0400000	\b|DEAD_STRIPPABLE_DYLIB
17345>>24	belong		&0x0800000	\b|HAS_TLV_DESCRIPTORS
17346>>24	belong		&0x1000000	\b|NO_HEAP_EXECUTION
17347>>24	belong		&0x2000000	\b|APP_EXTENSION_SAFE
17348>>24	belong		x		\b>
17349
17350#
173510	lelong&0xfffffffe	0xfeedface	Mach-O
17352!:strength +1
17353!:mime application/x-mach-binary
17354>0	use	\^mach-o-be
17355
173560	belong&0xfffffffe	0xfeedface	Mach-O
17357!:strength +1
17358!:mime application/x-mach-binary
17359>0	use	mach-o-be
17360
17361#------------------------------------------------------------------------------
17362# $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $
17363# macintosh description
17364#
17365# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
17366# Daniel Quinlan, quinlan@yggdrasil.com
1736711	string	must\ be\ converted\ with\ BinHex	BinHex binary text
17368!:mime	application/mac-binhex40
17369>41	string	x					\b, version %.3s
17370
17371# Stuffit archives are the de facto standard of compression for Macintosh
17372# files obtained from most archives. (franklsm@tuns.ca)
173730	string		SIT!			StuffIt Archive (data)
17374!:mime	application/x-stuffit
17375!:apple	SIT!SIT!
17376>2	string		x			: %s
173770	string		SITD			StuffIt Deluxe (data)
17378>2	string		x			: %s
173790	string		Seg			StuffIt Deluxe Segment (data)
17380>2	string		x			: %s
17381
17382# Newer StuffIt archives (grant@netbsd.org)
173830	string		StuffIt			StuffIt Archive
17384!:mime	application/x-stuffit
17385!:apple	SIT!SIT!
17386#>162	string		>0			: %s
17387
17388# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
17389# GRR: Too weak
17390#0	string		APPL			Macintosh Application (data)
17391#>2	string		x			\b: %s
17392
17393# Macintosh System files (franklsm@tuns.ca)
17394# GRR: Too weak
17395#0	string		zsys			Macintosh System File (data)
17396#0	string		FNDR			Macintosh Finder (data)
17397#0	string		libr			Macintosh Library (data)
17398#>2	string		x			: %s
17399#0	string		shlb			Macintosh Shared Library (data)
17400#>2	string		x			: %s
17401#0	string		cdev			Macintosh Control Panel (data)
17402#>2	string		x			: %s
17403#0	string		INIT			Macintosh Extension (data)
17404#>2	string		x			: %s
17405#0	string		FFIL			Macintosh Truetype Font (data)
17406#>2	string		x			: %s
17407#0	string		LWFN			Macintosh Postscript Font (data)
17408#>2	string		x			: %s
17409
17410# Additional Macintosh Files (franklsm@tuns.ca)
17411# GRR: Too weak
17412#0	string		PACT			Macintosh Compact Pro Archive (data)
17413#>2	string		x			: %s
17414#0	string		ttro			Macintosh TeachText File (data)
17415#>2	string		x			: %s
17416#0	string		TEXT			Macintosh TeachText File (data)
17417#>2	string		x			: %s
17418#0	string		PDF			Macintosh PDF File (data)
17419#>2	string		x			: %s
17420
17421# MacBinary format (Eric Fischer, enf@pobox.com)
17422# Update: Joerg Jenderek
17423# URL: https://en.wikipedia.org/wiki/MacBinary
17424# Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt
17425#
17426# Unfortunately MacBinary doesn't really have a magic number prior
17427# to the MacBinary III format.
17428#
17429
17430# old version number, must be kept at zero for compatibility
174310	byte	0
17432# length of filename (must be in the range 1-63)
17433>1	ubyte	>0
17434# skip T.PIC.LZ INSTRUMENT.7T INVENTORY
17435>>1	ubyte	<64
17436# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)"
17437# by looking for printable characters at beginning of file name
17438>>>2	ubelong	>0x1F000000
17439# zero fill, must be zero for compatibility
17440>>>>74	byte	0
17441# zero fill, must be zero for compatibility
17442>>>>>82	byte	0
17443# MacBinary I		test for valid version numbers
17444>>>>>>122	ubeshort	0
17445# additional check for creation date after 1 Jan 1970 ~ 7C25B080h
17446#>>>>>>>91	ubelong		>0x7c25b07F
17447# additional check for undefined header fields in MacBinary I
17448#>>>>>>>101	ulong		0
17449>>>>>>>0	use	mac-bin
17450# MacBinary II		the newer versions begins at 129
17451>>>>>>122	ubeshort	0x8181
17452>>>>>>>0	use	mac-bin
17453# MacBinary III with MacBinary II to read
17454>>>>>122	ubeshort	0x8281
17455>>>>>>0	use	mac-bin
17456
17457#	display information of MacBinary file
174580	name		mac-bin
17459>122	ubyte	x	MacBinary
17460# versions for MacBinary II/III
17461>122	ubyte	129		II
17462>122	ubyte	130		III
17463# only in MacBinary III
17464>>102	string	!mBIN		with surprising version
17465!:mime	application/x-macbinary
17466!:apple	PSPTBINA
17467!:ext	bin/macbin
17468# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
17469#>1	ubyte	>63		\b, name length %u too BIG!
17470#>122	ubeshort	x	\b, version 0x%x
17471# Finder flags if not 0
17472# >73	byte		!0		\b, flags 0x
17473# >73	byte		=0
17474# >>101	byte		!0		\b, flags 0x
17475# # original Finder flags (Bits 8-15)
17476# >73	byte		!0		\b%x
17477# # finder flags, bits 0-7
17478# >101	byte		!0		\b%x
17479>73	byte		&0x01		\b, inited
17480>73	byte		&0x02		\b, changed
17481>73	byte		&0x04		\b, busy
17482>73	byte		&0x08		\b, bozo
17483>73	byte		&0x10		\b, system
17484>73	byte		&0x20		\b, bundle
17485>73	byte		&0x40		\b, invisible
17486>73	byte		&0x80		\b, locked
17487
17488# 75	beshort				# vertical posn in window
17489#>75	beshort		!0		\b, v.pos %u
17490# 77	beshort				# horiz posn in window
17491#>77	beshort		!0		\b, h.pos %u
17492# 79	beshort				# window or folder ID
17493>79	ubeshort	!0		\b, ID 0x%x
17494# protected flag
17495>81	byte		!0		\b, protected 0x%x
17496# length of comment after resource
17497>99	ubeshort	!0		\b, comment length %u
17498# char. code of file name
17499>106	ubyte		!0		\b, char. code 0x%x
17500# still more Finder flags
17501>107	ubyte		!0		\b, more flags 0x%x
17502# length of total files when unpacked only used when pack and unpack on the fly
17503>116	ubelong		!0		\b, total length %u
17504# 120	beshort				# length of add'l header
17505>120	ubeshort	!0		\b, 2nd header length %u
17506# 124	beshort				# checksum
17507#>124	ubeshort	!0		\b, CRC 0x%x
17508# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
17509>91	beldate-0x7C25B080	x	\b, %s
17510# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
17511>91	ubelong		<0x7c25b080	INVALID date
17512#>91	belong-0x7C25B080	x	\b, DEBUG DATE %d
17513# last modified date
17514>95	beldate-0x7C25B080	x	\b, modified %s
17515# Apple creator+typ if not null
17516# file creator (normally expressed as four characters)
17517>69	ulong			!0	\b, creator
17518# instead 4 character code display full creator name
17519>>69	use			apple-creator
17520# file type (normally expressed as four characters)
17521>65	ulong			!0	\b, type
17522>>65	use			apple-type
17523# length of data segment
17524>83	ubelong			!0	\b, %u bytes
17525# filename (in the range 1-63)
17526>1	pstring			x	"%s"
17527# print 1 space and then at offset 128 inspect data fork content if it has one
17528>83	ubelong			!0	\b
17529>>128	indirect		x
17530# Afterwards resource fork if length of resource segment not zero
17531>87	ubelong			!0
17532# calculate resource fork offset
17533>>83	ubelong+128		x	\b, at 0x%x
17534# length of resource segment
17535>>87	ubelong			!0	%u bytes
17536>>(83.S+128)	ubequad		x	resource
17537# further resource fork content inspection
17538>>>&-8	indirect		x
17539
17540# Apple Type/Creator Database
17541# URL: https://en.wikipedia.org/wiki/Type_code
17542# Reference:	http://www.lacikam.co.il/tcdb/
17543#		http://www.macdisk.com/macsigen.php
17544# Note:	classic Mac OS files have two 4 character codes for type and creator.
17545#	Thereby the Finder attach documents types to applications.
17546
17547#>65	string		x		\b, type "%4.4s"
17548
17549#	display information about apple type
175500	name		apple-type
17551>0	string		8BIM		PhotoShop
17552>0	string		ALB3		PageMaker 3
17553>0	string		ALB4		PageMaker 4
17554>0	string		ALT3		PageMaker 3
17555>0	string		APPL		application
17556>0	string		AWWP		AppleWorks word processor
17557>0	string		CIRC		simulated circuit
17558>0	string		DRWG		MacDraw
17559>0	string		EPSF		Encapsulated PostScript
17560>0	string		FFIL		font suitcase
17561>0	string		FKEY		function key
17562>0	string		FNDR		Macintosh Finder
17563>0	string		GIFf		GIF image
17564>0	string		Gzip		GNU gzip
17565>0	string		INIT		system extension
17566>0	string		LIB\ 		library
17567>0	string		LWFN		PostScript font
17568>0	string		MSBC		Microsoft BASIC
17569>0	string		PACT		Compact Pro archive
17570>0	string		PDF\ 		Portable Document Format
17571>0	string		PICT		picture
17572>0	string		PNTG		MacPaint picture
17573>0	string		PREF		preferences
17574>0	string		PROJ		Think C project
17575>0	string		QPRJ		Think Pascal project
17576>0	string		SCFL		Defender scores
17577>0	string		SCRN		startup screen
17578>0	string		SITD		StuffIt Deluxe
17579>0	string		SPn3		SuperPaint
17580>0	string		STAK		HyperCard stack
17581>0	string		Seg\ 		StuffIt segment
17582>0	string		TARF		Unix tar archive
17583>0	string		TEXT		ASCII
17584>0	string		TIFF		TIFF image
17585>0	string		TOVF		Eudora table of contents
17586>0	string		WDBN		Microsoft Word word processor
17587>0	string		WORD		MacWrite word processor
17588>0	string		XLS\ 		Microsoft Excel
17589>0	string		ZIVM		compress (.Z)
17590>0	string		ZSYS		Pre-System 7 system file
17591>0	string		acf3		Aldus FreeHand
17592>0	string		cdev		control panel
17593>0	string		dfil		Desk Accessory suitcase
17594>0	string		libr		library
17595>0	string		nX^d		WriteNow word processor
17596>0	string		nX^w		WriteNow dictionary
17597>0	string		rsrc		resource
17598>0	string		scbk		Scrapbook
17599>0	string		shlb		shared library
17600>0	string		ttro		SimpleText read-only
17601>0	string		zsys		system file
17602
17603#	additional types added in Dec 2017
17604>0	string		BINA		binary file
17605>0	string		BMPp		BMP image
17606>0	string		JPEG		JPEG image
17607#>0	string		W4BN		Microsoft Word x.y word processor?
17608# if type name is not known display 4 character identifier
17609>0	default		x
17610>>0	string		x		'%4.4s'
17611
17612#>69	string		x		\b, creator "%4.4s"
17613
17614# Now Apple has no repository of registered Creator IDs any more. These are
17615# just the ones that I happened to have files from and was able to identify.
17616
17617#	display information about apple creator
176180	name		apple-creator
17619>0	string		8BIM		Adobe Photoshop
17620>0	string		ALD3		PageMaker 3
17621>0	string		ALD4		PageMaker 4
17622>0	string		ALFA		Alpha editor
17623>0	string		APLS		Apple Scanner
17624>0	string		APSC		Apple Scanner
17625>0	string		BRKL		Brickles
17626>0	string		BTFT		BitFont
17627>0	string		CCL2		Common Lisp 2
17628>0	string		CCL\ 		Common Lisp
17629>0	string		CDmo		The Talking Moose
17630>0	string		CPCT		Compact Pro
17631>0	string		CSOm		Eudora
17632>0	string		DMOV		Font/DA Mover
17633>0	string		DSIM		DigSim
17634>0	string		EDIT		Macintosh Edit
17635>0	string		ERIK		Macintosh Finder
17636>0	string		EXTR		self-extracting archive
17637>0	string		Gzip		GNU gzip
17638>0	string		KAHL		Think C
17639>0	string		LWFU		LaserWriter Utility
17640>0	string		LZIV		compress
17641>0	string		MACA		MacWrite
17642>0	string		MACS		Macintosh operating system
17643>0	string		MAcK		MacKnowledge terminal emulator
17644>0	string		MLND		Defender
17645>0	string		MPNT		MacPaint
17646>0	string		MSBB		Microsoft BASIC (binary)
17647>0	string		MSWD		Microsoft Word
17648>0	string		NCSA		NCSA Telnet
17649>0	string		PJMM		Think Pascal
17650>0	string		PSAL		Hunt the Wumpus
17651#>0	string		PSI2		Apple File Exchange
17652>0	string		R*ch		BBEdit
17653>0	string		RMKR		Resource Maker
17654>0	string		RSED		Resource Editor
17655>0	string		Rich		BBEdit
17656>0	string		SIT!		StuffIt
17657>0	string		SPNT		SuperPaint
17658>0	string		Unix		NeXT Mac filesystem
17659>0	string		VIM!		Vim editor
17660>0	string		WILD		HyperCard
17661>0	string		XCEL		Microsoft Excel
17662>0	string		aCa2		Fontographer
17663>0	string		aca3		Aldus FreeHand
17664>0	string		dosa		Macintosh MS-DOS file system
17665>0	string		movr		Font/DA Mover
17666>0	string		nX^n		WriteNow
17667>0	string		pdos		Apple ProDOS file system
17668>0	string		scbk		Scrapbook
17669>0	string		ttxt		SimpleText
17670>0	string		ufox		Foreign File Access
17671#	additional creators added in Dec 2017
17672# Claris/Apple Works
17673>0	string		BOBO		Apple Works
17674# CU-SeeMe_0.87b3_(68K).bin
17675#>0	string		CUce		bar
17676>0	string		PSPT		Apple File Exchange
17677# Disk_Copy_4.2.sea.bin
17678#>0	string		NCse		foo
17679# probably StuffIt/Aladdin by Smith Micro Software, Inc.
17680>0	string		STi0		stuffit
17681# MacGzip-1.1.3.sea.bin
17682#>0	string		aust		bar
17683# D-Disk_Copy_6.3.3.smi.bin
17684>0	string		oneb		Disk Copy Self Mounting
17685# if creator name is not known display 4 character identifier
17686>0	default		x
17687>>0	string		x		'%4.4s'
17688
17689# sas magic from Bruce Foster (bef@nwu.edu)
17690#
17691#0	string		SAS		SAS
17692#>8	string		x		%s
176930	string		SAS		SAS
17694>24	string		DATA		data file
17695>24	string		CATALOG		catalog
17696>24	string		INDEX		data file index
17697>24	string		VIEW		data view
17698# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
17699#
177000x54    string          SAS             SAS 7+
17701>0x9C   string          DATA            data file
17702>0x9C   string          CATALOG         catalog
17703>0x9C   string          INDEX           data file index
17704>0x9C   string          VIEW            data view
17705
17706# spss magic for SPSS system and portable files,
17707#	 from Bruce Foster (bef@nwu.edu).
17708
177090	long		0xc1e2c3c9	SPSS Portable File
17710>40	string 		x		%s
17711
177120	string		$FL2		SPSS System File
17713>24	string		x		%s
17714
177150	string		$FL3		SPSS System File
17716>24	string		x		%s
17717
17718# Macintosh filesystem data
17719# From "Tom N Harris" <telliamed@mac.com>
17720# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
17721# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
17722# entries depend on the data arithmetic added after v.35
17723# There's also some Pascal strings in here, ditto...
17724
17725# The boot block signature, according to IM:Files, is
17726# "for HFS volumes, this field always contains the value 0x4C4B."
17727# But if this is true for MFS or HFS+ volumes, I don't know.
17728# Alternatively, the boot block is supposed to be zeroed if it's
17729# unused, so a simply >0 should suffice.
17730
177310x400	beshort			0xD2D7		Macintosh MFS data
17732>0	beshort			0x4C4B		(bootable)
17733>0x40a	beshort			&0x8000		(locked)
17734>0x402	beldate-0x7C25B080	x		created: %s,
17735>0x406	beldate-0x7C25B080	>0		last backup: %s,
17736>0x414	belong			x		block size: %d,
17737>0x412	beshort			x		number of blocks: %d,
17738>0x424	pstring			x		volume name: %s
17739
17740# *.hfs updated by Joerg Jenderek
17741# http://en.wikipedia.org/wiki/Hierarchical_File_System
17742# "BD" gives many false positives
177430x400	beshort			0x4244
17744# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
17745# first block of volume bit map (always 3)
17746>0x40e	ubeshort		0x0003
17747# maximal length of volume name is 27
17748>>0x424		ubyte			<28	Macintosh HFS data
17749!:mime	application/x-apple-diskimage
17750#!:apple	hfsdINIT
17751#!:apple	MACSdisk
17752# http://www.macdisk.com/macsigen.php
17753#!:apple	ddskdevi
17754!:apple	????devi
17755# https://en.wikipedia.org/wiki/Apple_Disk_Image
17756!:ext hfs/dmg
17757>>>0		beshort			0x4C4B	(bootable)
17758#>>>0		beshort			0x0000	(not bootable)
17759>>>0x40a	beshort			&0x8000	(locked)
17760>>>0x40a	beshort			^0x0100	(mounted)
17761>>>0x40a	beshort			&0x0200	(spared blocks)
17762>>>0x40a	beshort			&0x0800	(unclean)
17763>>>0x47C	beshort			0x482B	(Embedded HFS+ Volume)
17764# http://www.epochconverter.com/
17765# 0x7C245F00 seconds	~ 2082758400	~ 01 Jan 2036 00:00:00	~ 66 years to 1970
17766# 0x7C25B080 seconds	~ 2082844800	~ 02 Jan 2036 00:00:00
17767# construct not working
17768#>>>0x402	beldate-0x7C25B080	x	created: %s,
17769#>>>0x406	beldate-0x7C25B080	x	last modified: %s,
17770#>>>0x440	beldate-0x7C25B080	>0	last backup: %s,
17771# found block sizes 200h,1200h,2800h
17772>>>0x414	belong			x	block size: %d,
17773>>>0x412	beshort			x	number of blocks: %d,
17774>>>0x424	pstring			x	volume name: %s
17775
177760x400	beshort			0x482B		Macintosh HFS Extended
17777>&0	beshort			x		version %d data
17778>0	beshort			0x4C4B		(bootable)
17779>0x404	belong			^0x00000100	(mounted)
17780>&2	belong			&0x00000200	(spared blocks)
17781>&2	belong			&0x00000800	(unclean)
17782>&2	belong			&0x00008000	(locked)
17783>&6	string			x		last mounted by: '%.4s',
17784# really, that should be treated as a belong and we print a string
17785# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
17786>&14	beldate-0x7C25B080	x		created: %s,
17787# only the creation date is local time, all other timestamps in HFS+ are UTC.
17788>&18	bedate-0x7C25B080	x		last modified: %s,
17789>&22	bedate-0x7C25B080	>0		last backup: %s,
17790>&26	bedate-0x7C25B080	>0		last checked: %s,
17791>&38	belong			x		block size: %d,
17792>&42	belong			x		number of blocks: %d,
17793>&46	belong			x		free blocks: %d
17794
17795## AFAIK, only the signature is different
17796# same as Apple Partition Map
17797# GRR: This magic is too weak, it is just "TS"
17798#0x200		beshort		0x5453		Apple Old Partition data
17799#>0x2		beshort		x		block size: %d,
17800#>0x230		string		x		first type: %s,
17801#>0x210		string		x		name: %s,
17802#>0x254		belong		x		number of blocks: %d,
17803#>0x400		beshort		0x504D
17804#>>0x430		string		x		second type: %s,
17805#>>0x410		string		x		name: %s,
17806#>>0x454		belong		x		number of blocks: %d,
17807#>>0x800		beshort		0x504D
17808#>>>0x830	string		x		third type: %s,
17809#>>>0x810	string		x		name: %s,
17810#>>>0x854	belong		x		number of blocks: %d,
17811#>>>0xa00	beshort		0x504D
17812#>>>>0xa30	string		x		fourth type: %s,
17813#>>>>0xa10	string		x		name: %s,
17814#>>>>0xa54	belong		x		number of blocks: %d
17815
17816# From: Remi Mommsen <mommsen@slac.stanford.edu>
178170		string		BOMStore	Mac OS X bill of materials (BOM) file
17818
17819# From: Adam Buchbinder <adam.buchbinder@gmail.com>
17820# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
17821# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
17822# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
17823# don't know what they mean.
178240	belong	0x100
17825>(0x4.L+24)	beshort	x
17826>>&4	belong	0x73666e74	Mac OSX datafork font, TrueType
17827>>&4	belong	0x464f4e54	Mac OSX datafork font, 'FONT'
17828>>&4	belong	0x4e464e54	Mac OSX datafork font, 'NFNT'
17829>>&4	belong	0x504f5354	Mac OSX datafork font, PostScript
17830
17831#------------------------------------------------------------------------------
17832# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
17833# MacOS files
17834#
17835
178360	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file
17837
17838#------------------------------------------------------------------------------
17839# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
17840# magic:  file(1) magic for magic files
17841#
178420	string/t		#\ Magic	magic text file for file(1) cmd
178430	lelong		0xF11E041C	magic binary file for file(1) cmd
17844>4	lelong		x		(version %d) (little endian)
178450	belong		0xF11E041C	magic binary file for file(1) cmd
17846>4	belong		x		(version %d) (big endian)
17847#------------------------------------------------------------------------------
17848# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $
17849# mail.news:  file(1) magic for mail and news
17850#
17851# Unfortunately, saved netnews also has From line added in some news software.
17852#0	string		From 		mail text
178530	string/t		Relay-Version: 	old news text
17854!:mime	message/rfc822
178550	string/t		#!\ rnews	batched news text
17856!:mime	message/rfc822
178570	string/t		N#!\ rnews	mailed, batched news text
17858!:mime	message/rfc822
178590	string/t		Forward\ to 	mail forwarding text
17860!:mime	message/rfc822
178610	string/t		Pipe\ to 	mail piping text
17862!:mime	message/rfc822
178630	string/tc		delivered-to:	SMTP mail text
17864!:mime	message/rfc822
178650	string/tc		return-path:	SMTP mail text
17866!:mime	message/rfc822
178670	string/t		Path:		news text
17868!:mime	message/news
178690	string/t		Xref:		news text
17870!:mime	message/news
178710	string/t		From:		news or mail text
17872!:mime	message/rfc822
178730	string/t		Article 	saved news text
17874!:mime	message/news
178750	string/t		BABYL		Emacs RMAIL text
178760	string/t		Received:	RFC 822 mail text
17877!:mime	message/rfc822
178780	string/t		MIME-Version:	MIME entity text
17879#0	string/t		Content-	MIME entity text
17880
17881# TNEF files...
178820	lelong		0x223E9F78	Transport Neutral Encapsulation Format
17883!:mime	application/vnd.ms-tnef
17884
17885# From: Kevin Sullivan <ksulliva@psc.edu>
178860	string		*mbx*		MBX mail folder
17887
17888# From: Simon Matter <simon.matter@invoca.ch>
178890	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
178900	string		\241\002\213\015twoskip\ file\0\0\0\0	Cyrus twoskip DB
17891
17892# JAM(mbp) Fidonet message area databases
17893# JHR file
178940	string	JAM\0			JAM message area header file
17895>12	leshort >0			(%d messages)
17896
17897# Squish Fidonet message area databases
17898# SQD file (requires at least one message in the area)
17899# XXX: Weak magic
17900#256	leshort	0xAFAE4453		Squish message area data file
17901#>4	leshort	>0			(%d messages)
17902
17903#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
17904
17905# Cyrus: file(1) magic for compiled Cyrus sieve scripts
17906# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
17907# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
17908# From: Philipp Hahn <hahn@univention.de>
17909
17910# Compiled Cyrus sieve script
179110       string CyrSBytecode     Cyrus sieve bytecode data,
17912>12     belong =1       version 1, big-endian
17913>12     lelong =1       version 1, little-endian
17914>12     belong x        version %d, network-endian
17915#------------------------------------------------------------------------------
17916# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $
17917# make:  file(1) magic for makefiles
17918#
17919# URL: https://en.wikipedia.org/wiki/Make_(software)
179200	regex/100l	\^CFLAGS	makefile script text
17921!:mime	text/x-makefile
179220	regex/100l	\^VPATH		makefile script text
17923!:mime	text/x-makefile
179240	regex/100l	\^LDFLAGS	makefile script text
17925!:mime	text/x-makefile
179260	regex/100l	\^all:		makefile script text
17927!:mime	text/x-makefile
179280	regex/100l	\^\\.PRECIOUS	makefile script text
17929!:mime	text/x-makefile
17930# Update: Joerg Jenderek
17931# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
17932# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
17933# by additional escaping point character
179340	regex/100l	\^\\.BEGIN	BSD makefile script text
17935!:mime	text/x-makefile
17936!:ext	/mk
17937!:strength +10
17938# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
17939# and NSIS script with "!include" by additional escaping point character
179400	regex/100l	\^\\.include	BSD makefile script text
17941!:mime	text/x-makefile
17942!:ext	/mk
17943!:strength +10
179440	regex/100l	\^\\.endif	BSD makefile script text
17945!:mime	text/x-makefile
17946!:ext	/mk
17947!:strength +10
179480	regex/100l	\^SUBDIRS	automake makefile script text
17949!:mime	text/x-makefile
17950!:strength +10
17951
17952
17953#------------------------------------------------------------------------------
17954# $File: map,v 1.4 2015/08/10 05:18:27 christos Exp $
17955# map:  file(1) magic for Map data
17956#
17957
17958# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
179598	string	.FIT		FIT Map data
17960>15	byte	0
17961>>35	belong	x		\b, unit id %d
17962>>39	lelong	x		\b, serial %u
17963# http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
17964# 20 years after unix epoch
17965# TZ=GMT date -d '1989-12-31 0:00' +%s
17966>>43	leldate+631065600	x	\b, %s
17967
17968>>47	leshort x		\b, manufacturer %d
17969>>47	leshort	1		\b (garmin)
17970>>49	leshort x		\b, product %d
17971>>53	byte	x		\b, type %d
17972>>53	byte	1		\b (Device)
17973>>53	byte	2		\b (Settings)
17974>>53	byte	3		\b (Sports/Cycling)
17975>>53	byte	4		\b (Activity)
17976>>53	byte	8		\b (Elevations)
17977>>53	byte	10		\b (Totals)
17978
17979# TOM TOM GPS watches ttbin files:
17980# http://github.com/ryanbinns/ttwatch/tree/master/ttbin
17981# From: Daniel Lenski
179820	byte	0x20
17983>1	leshort	0x0007
17984>>0x76	byte	0x20
17985>>>0x77	leshort	0x0075		TomTom activity file, v7
17986>>>>8	leldate	x		(%s,
17987>>>>3	byte    x		device firmware %d.
17988>>>>4	byte	x		\b%d.
17989>>>>5	byte	x		\b%d,
17990>>>>6	leshort	x		product ID %04d)
17991
17992
17993#------------------------------------------------------------------------------
17994# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
17995# maple:  file(1) magic for maple files
17996# "H. Nanosecond" <aldomel@ix.netcom.com>
17997# Maple V release 4, a multi-purpose math program
17998#
17999
18000# maple library .lib
180010	string	\000MVR4\nI	MapleVr4 library
18002
18003# .ind
18004# no magic for these :-(
18005# they are compiled indexes for maple files
18006
18007# .hdb
180080	string	\000\004\000\000	Maple help database
18009
18010# .mhp
18011# this has the form <PACKAGE=name>
180120	string	\<PACKAGE=	Maple help file
180130	string	\<HELP\ NAME=	Maple help file
180140	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
18015#0	string	#\ Newton	Maple help file, old style
180160	string	#\ daub	Maple help file, old style
18017#0	string	#===========	Maple help file, old style
18018
18019# .mws
180200	string	\000\000\001\044\000\221	Maple worksheet
18021#this is anomalous
180220	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
18023# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
18024# that is {VERSION major_version miunor_version computer_type version_string}
180250	string	{VERSION\ 	Maple worksheet
18026>9	string	>\0	version %.1s.
18027>>11	string	>\0	%.1s
18028
18029# .mps
180300	string	\0\0\001$	Maple something
18031# from byte 4 it is either 'nul E' or 'soh R'
18032# I think 'nul E' means a file that was saved as  a different name
18033# a sort of revision marking
18034# 'soh R' means new
18035>4	string	\000\105	An old revision
18036>4	string	\001\122	The latest save
18037
18038# .mpl
18039# some of these are the same as .mps above
18040#0000000 000 000 001 044 000 105 same as .mps
18041#0000000 000 000 001 044 001 122 same as .mps
18042
180430	string	#\n##\ <SHAREFILE=	Maple something
180440	string	\n#\n##\ <SHAREFILE=	Maple something
180450	string	##\ <SHAREFILE=	Maple something
180460	string	#\r##\ <SHAREFILE=	Maple something
180470	string	\r#\r##\ <SHAREFILE=	Maple something
180480	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
18049#--------------------------------------------
18050# marc21: file(1) magic for MARC 21 Format
18051#
18052# Kevin Ford (kefo@loc.gov)
18053#
18054# MARC21 formats are for the representation and communication
18055# of bibliographic and related information in machine-readable
18056# form.  For more info, see http://www.loc.gov/marc/
18057
18058
18059# leader position 20-21 must be 45
18060# and 22-23 also 00 so far, but we check that later.
1806120	string		45
18062>0	search/2048	\x1e
18063
18064# leader starts with 5 digits, followed by codes specific to MARC format
18065>>0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
18066!:mime	application/marc
18067>>0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
18068!:mime	application/marc
18069>>0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
18070!:mime	application/marc
18071>>0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
18072!:mime	application/marc
18073>>0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
18074!:mime	application/marc
18075
18076# leader position 22-23, should be "00" but is it?
18077>>0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
18078!:mime	application/marc
18079
18080#------------------------------------------------------------------------------
18081# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
18082# mathcad:  file(1) magic for Mathcad documents
18083# URL:	http://www.mathsoft.com/
18084# From:	Josh Triplett <josh@freedesktop.org>
18085
180860	string	.MCAD\t		Mathcad document
18087
18088#------------------------------------------------------------------------------
18089# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
18090# mathematica:  file(1) magic for mathematica files
18091# "H. Nanosecond" <aldomel@ix.netcom.com>
18092# Mathematica a multi-purpose math program
18093# versions 2.2 and 3.0
18094
18095#mathematica .mb
180960	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
18097!:ext mb
180980	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
18099!:ext mb
18100
18101# .ma
18102# multiple possibilites:
18103
181040	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
18105#>41	string	>\0	%s
18106!:ext mb
18107
18108#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
18109
18110#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
18111#>675	string	>\0	%s #doesn't work well
18112
18113# there may be 'cr' instread of 'nl' in some does this matter?
18114
18115# generic:
181160	string	(*^\r\r::[\011	Mathematica notebook version 2.x
18117!:ext mb
181180	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
18119!:ext mb
181200	string	(*^\015			Mathematica notebook version 2.x
18121!:ext mb
181220	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
18123!:ext mb
181240	string	(*^\r::[\011	Mathematica notebook version 2.x
18125!:ext mb
181260	string	(*^\r\n::[\011	Mathematica notebook version 2.x
18127!:ext mb
181280	string	(*^\n\n::[\011	Mathematica notebook version 2.x
18129!:ext mb
181300	string	(*^\n::[\011	Mathematica notebook version 2.x
18131!:ext mb
18132
18133
18134# Mathematica .mx files
18135
18136#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
181370	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
18138#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
18139# >71... is optional
18140>88	string	>\0	from %s
18141
18142
18143# Mathematica files PBF:
18144# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
181450	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
18146
18147# .ml files  These are menu resources I think
18148# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
18149# how to put that into a magic rule?
181504	string	\ A~	MAthematica .ml file
18151
18152# .nb files
18153#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
181540	string	(***********************	Mathematica 3.0 notebook
18155
18156# other (* matches it is a comment start in these langs
18157# GRR: Too weak; also matches other languages e.g. ML
18158#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text
18159
18160#########################
18161# MatLab v5
181620       string  MATLAB  Matlab v5 mat-file
18163>126    short   0x494d  (big endian)
18164>>124   beshort x       version 0x%04x
18165>126    short   0x4d49  (little endian)
18166>>124   leshort x       version 0x%04x
18167
18168
18169#------------------------------------------------------------------------------
18170# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
18171# matroska:  file(1) magic for Matroska files
18172#
18173# See http://www.matroska.org/
18174#
18175
18176# EBML id:
181770		belong		0x1a45dfa3
18178# DocType id:
18179>4		search/4096 	\x42\x82
18180# DocType contents:
18181>>&1		string		webm		WebM
18182!:mime  video/webm
18183>>&1		string		matroska	Matroska data
18184!:mime  video/x-matroska
18185
18186#------------------------------------------------------------------------------
18187# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
18188# Mavroyanopoulos Nikos <nmav@hellug.gr>
18189# mcrypt:   file(1) magic for mcrypt 2.2.x;
181900	string		\0m\3		mcrypt 2.5 encrypted data,
18191>4	string		>\0		algorithm: %s,
18192>>&1	leshort		>0		keysize: %d bytes,
18193>>>&0	string		>\0		mode: %s,
18194
181950	string		\0m\2		mcrypt 2.2 encrypted data,
18196>3	byte		0		algorithm: blowfish-448,
18197>3	byte		1		algorithm: DES,
18198>3	byte		2		algorithm: 3DES,
18199>3	byte		3		algorithm: 3-WAY,
18200>3	byte		4		algorithm: GOST,
18201>3	byte		6		algorithm: SAFER-SK64,
18202>3	byte		7		algorithm: SAFER-SK128,
18203>3	byte		8		algorithm: CAST-128,
18204>3	byte		9		algorithm: xTEA,
18205>3	byte		10		algorithm: TWOFISH-128,
18206>3	byte		11		algorithm: RC2,
18207>3	byte		12		algorithm: TWOFISH-192,
18208>3	byte		13		algorithm: TWOFISH-256,
18209>3	byte		14		algorithm: blowfish-128,
18210>3	byte		15		algorithm: blowfish-192,
18211>3	byte		16		algorithm: blowfish-256,
18212>3	byte		100		algorithm: RC6,
18213>3	byte		101		algorithm: IDEA,
18214>4	byte		0		mode: CBC,
18215>4	byte		1		mode: ECB,
18216>4	byte		2		mode: CFB,
18217>4	byte		3		mode: OFB,
18218>4	byte		4		mode: nOFB,
18219>5	byte		0		keymode: 8bit
18220>5	byte		1		keymode: 4bit
18221>5	byte		2		keymode: SHA-1 hash
18222>5	byte		3		keymode: MD5 hash
18223
18224#------------------------------------------------------------------------------
18225# $File: measure,v 1.2 2018/06/23 16:13:15 christos Exp $
18226# measure: file(1) magic for measurement data
18227
18228# DIY-Thermocam raw data
182290	name	diy-thermocam-parser
18230>0	beshort	x	scale %d-
18231>2	beshort x	\b%d,
18232>4	lefloat	x	spot sensor temperature %f,
18233>9	ubyte	0	unit celsius,
18234>9	ubyte	1	unit fahrenheit,
18235>8	ubyte	x	color scheme %d
18236>10	ubyte	1	\b, show spot sensor
18237>11	ubyte	1	\b, show scale bar
18238>12	ubyte	&1	\b, minimum point enabled
18239>12	ubyte	&2	\b, maximum point enabled
18240>13	lefloat	x	\b, calibration: offset %f,
18241>17	lefloat x	slope %f
18242
182430	name	diy-thermocam-checker
18244>9	ubyte	<2
18245>>10	ubyte	<2
18246>>>11	ubyte	<2
18247>>>>12	ubyte	<4
18248>>>>>17	lefloat	>0.0001	DIY-Thermocam raw data
18249
18250# V2 and Leption 3.x:
1825138408	ubyte	<19
18252>38400	use	diy-thermocam-checker
18253>>38400	default x	(Lepton 3.x),
18254>>>38400	use	diy-thermocam-parser
18255
18256# V1 or Lepton 2.x
182579608	ubyte	<19
18258>9600	use	diy-thermocam-checker
18259>>9600	default	x	(Lepton 2.x),
18260>>>9600	use	diy-thermocam-parser
18261
18262
18263#------------------------------------------------------------------------------
18264# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $
18265# mercurial:  file(1) magic for Mercurial changeset bundles
18266# http://www.selenic.com/mercurial/wiki/
18267#
18268# Jesse Glick (jesse.glick@sun.com)
18269#
18270
182710	string		HG10		Mercurial changeset bundle
18272>4	string		UN		(uncompressed)
18273>4	string		GZ		(gzip compressed)
18274>4	string		BZ		(bzip2 compressed)
18275
18276#------------------------------------------------------------------------------
18277# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $
18278# metastore:  file(1) magic for metastore files
18279# From: Thomas Wissen
18280# see http://david.hardeman.nu/software.php#metastore
182810	string		MeTaSt00r3	Metastore data file,
18282>10	bequad		x		version %0llx
18283
18284#------------------------------------------------------------------------------
18285# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
18286# rinex:  file(1) magic for RINEX files
18287# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
18288# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
18289# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
1829060	string		RINEX
18291>80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
18292>>&32	string		x		\b, date %15.15s
18293>>5	string		x		\b, version %6.6s
18294!:mime	rinex/broadcast
18295>80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
18296>>&32	string		x		\b, date %15.15s
18297>>5	string		x		\b, version %6.6s
18298!:mime	rinex/observation
18299>80	search/256	XXRINEXC	RINEX Data, Clock
18300>>&32	string		x		\b, date %15.15s
18301>>5	string		x		\b, version %6.6s
18302!:mime	rinex/clock
18303>80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
18304>>&32	string		x		\b, date %15.15s
18305>>5	string		x		\b, version %6.6s
18306!:mime	rinex/navigation
18307>80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
18308>>&32	string		x		\b, date %15.15s
18309>>5	string		x		\b, version %6.6s
18310!:mime	rinex/navigation
18311>80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
18312>>&32	string		x		\b, date %15.15s
18313>>5	string		x		\b, version %6.6s
18314!:mime	rinex/navigation
18315>80	search/256	XXRINEXM	RINEX Data, Meteorological
18316>>&32	string		x		\b, date %15.15s
18317>>5	string		x		\b, version %6.6s
18318!:mime	rinex/meteorological
18319>80	search/256	XXRINEXN	RINEX Data, Navigation
18320>>&32	string		x		\b, date %15.15s
18321>>5	string		x		\b, version %6.6s
18322!:mime	rinex/navigation
18323>80	search/256	XXRINEXO	RINEX Data, Observation
18324>>&32	string		x		\b, date %15.15s
18325>>5	string		x		\b, version %6.6s
18326!:mime	rinex/observation
18327
18328# https://en.wikipedia.org/wiki/GRIB
183290	string	GRIB
18330>7	byte	=1	Gridded binary (GRIB) version 1
18331>7	byte	=2	Gridded binary (GRIB) version 2
18332
18333#------------------------------------------------------------------------------
18334# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $
18335# Micro Focus COBOL data files.
18336
18337# http://documentation.microfocus.com/help/index.jsp?topic=\
18338# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
18339# http://www.cobolproducts.com/datafile/data-viewer.html
18340# https://github.com/miracle2k/mfcobol-export
18341
183420 string \x30\x00\x00\x7C
18343>36 string \x00\x3E Micro Focus File with Header (DAT)
18344!:mime application/octet-stream
18345
183460 string \x30\x7E\x00\x00
18347>36 string \x00\x3E Micro Focus File with Header (DAT)
18348!:mime application/octet-stream
18349
1835039 string \x02
18351>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX)
18352!:mime application/octet-stream
18353
18354#------------------------------------------------------------------------------
18355# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
18356# mime:  file(1) magic for MIME encoded files
18357#
183580	string/t		Content-Type:\040
18359>14	string		>\0		%s
183600	string/t		Content-Type:
18361>13	string		>\0		%s
18362
18363#------------------------------------------------------------------------------
18364# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
18365# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
18366# and DEC Ultrix
18367#
183680	beshort	0x0160		MIPSEB ECOFF executable
18369>20	beshort	0407		(impure)
18370>20	beshort	0410		(swapped)
18371>20	beshort	0413		(paged)
18372>8	belong	>0		not stripped
18373>8	belong	0		stripped
18374>22	byte	x		- version %d
18375>23	byte	x		\b.%d
18376#
183770	beshort	0x0162		MIPSEL-BE ECOFF executable
18378>20	beshort	0407		(impure)
18379>20	beshort	0410		(swapped)
18380>20	beshort	0413		(paged)
18381>8	belong	>0		not stripped
18382>8	belong	0		stripped
18383>23	byte	x		- version %d
18384>22	byte	x		\b.%d
18385#
183860	beshort	0x6001		MIPSEB-LE ECOFF executable
18387>20	beshort	03401		(impure)
18388>20	beshort	04001		(swapped)
18389>20	beshort	05401		(paged)
18390>8	belong	>0		not stripped
18391>8	belong	0		stripped
18392>23	byte	x		- version %d
18393>22	byte	x		\b.%d
18394#
183950	beshort	0x6201		MIPSEL ECOFF executable
18396>20	beshort	03401		(impure)
18397>20	beshort	04001		(swapped)
18398>20	beshort	05401		(paged)
18399>8	belong	>0		not stripped
18400>8	belong	0		stripped
18401>23	byte	x		- version %d
18402>22	byte	x		\b.%d
18403#
18404# MIPS 2 additions
18405#
184060	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
18407>20	beshort	0407		(impure)
18408>20	beshort	0410		(swapped)
18409>20	beshort	0413		(paged)
18410>8	belong	>0		not stripped
18411>8	belong	0		stripped
18412>22	byte	x		- version %d
18413>23	byte	x		\b.%d
18414#
184150	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
18416>20	beshort	0407		(impure)
18417>20	beshort	0410		(swapped)
18418>20	beshort	0413		(paged)
18419>8	belong	>0		not stripped
18420>8	belong	0		stripped
18421>22	byte	x		- version %d
18422>23	byte	x		\b.%d
18423#
184240	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
18425>20	beshort	03401		(impure)
18426>20	beshort	04001		(swapped)
18427>20	beshort	05401		(paged)
18428>8	belong	>0		not stripped
18429>8	belong	0		stripped
18430>23	byte	x		- version %d
18431>22	byte	x		\b.%d
18432#
184330	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
18434>20	beshort	03401		(impure)
18435>20	beshort	04001		(swapped)
18436>20	beshort	05401		(paged)
18437>8	belong	>0		not stripped
18438>8	belong	0		stripped
18439>23	byte	x		- version %d
18440>22	byte	x		\b.%d
18441#
18442# MIPS 3 additions
18443#
184440	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
18445>20	beshort	0407		(impure)
18446>20	beshort	0410		(swapped)
18447>20	beshort	0413		(paged)
18448>8	belong	>0		not stripped
18449>8	belong	0		stripped
18450>22	byte	x		- version %d
18451>23	byte	x		\b.%d
18452#
184530	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
18454>20	beshort	0407		(impure)
18455>20	beshort	0410		(swapped)
18456>20	beshort	0413		(paged)
18457>8	belong	>0		not stripped
18458>8	belong	0		stripped
18459>22	byte	x		- version %d
18460>23	byte	x		\b.%d
18461#
184620	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
18463>20	beshort	03401		(impure)
18464>20	beshort	04001		(swapped)
18465>20	beshort	05401		(paged)
18466>8	belong	>0		not stripped
18467>8	belong	0		stripped
18468>23	byte	x		- version %d
18469>22	byte	x		\b.%d
18470#
184710	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
18472>20	beshort	03401		(impure)
18473>20	beshort	04001		(swapped)
18474>20	beshort	05401		(paged)
18475>8	belong	>0		not stripped
18476>8	belong	0		stripped
18477>23	byte	x		- version %d
18478>22	byte	x		\b.%d
18479#
184800	beshort	0x180		MIPSEB Ucode
184810	beshort	0x182		MIPSEL-BE Ucode
18482
18483#------------------------------------------------------------------------------
18484# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
18485# mirage:  file(1) magic for Mirage executables
18486#
18487# XXX - byte order?
18488#
184890	long	31415		Mirage Assembler m.out executable
18490
18491#-----------------------------------------------------------------------------
18492# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $
18493# misctools:  file(1) magic for miscellaneous UNIX tools.
18494#
184950	search/1	%%!!			X-Post-It-Note text
184960	string/c	BEGIN:VCALENDAR		vCalendar calendar file
18497!:mime	text/calendar
18498# updated by Joerg Jenderek at Apr 2015
18499# Extension: .vcf
18500# http://en.wikipedia.org/wiki/VCard
185010	string/c	BEGIN:VCARD		vCard visiting card
18502# deprecated
18503#!:mime	text/x-vcard
18504!:mime	text/vcard
18505# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
18506>12	search/14000/c	VERSION:
18507# VERSION 2.1 , 3.0 or 4.0
18508>>&0	string		x			\b, version %-.3s
18509
18510# Summary: Libtool library file
18511# Extension: .la
18512# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
185130	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file
18514
18515# Summary: Libtool object file
18516# Extension: .lo
18517# Submitted by: Abel Cheung <abelcheung@gmail.com>
185180	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file
18519
18520# From: Daniel Novotny <dnovotny@redhat.com>
18521# Update: Joerg Jenderek
18522# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
18523# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
18524#
18525# "Windows Minidump" by TrID
18526# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
185270	string		MDMP					Mini DuMP crash report
18528# http://filext.com/file-extension/DMP
18529!:mime	application/x-dmp
18530!:ext	dmp/mdmp
18531# The high-order word is an internal value that is implementation specific.
18532# The low-order word is MINIDUMP_VERSION 0xA793
18533>4	ulelong&0x0000FFFF	!0xA793				\b, version 0x%4.4x
18534# NumberOfStreams 8,9,10,13
18535>8	ulelong			x				\b, %d streams
18536# StreamDirectoryRva 0x20
18537>12	ulelong			!0x20				\b, 0x%8.8x RVA
18538# CheckSum 0
18539>16	ulelong			!0				\b, CheckSum 0x%8.8x
18540# Reserved or TimeDateStamp
18541>20	ledate			x				\b, %s
18542# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
18543# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
18544>24	ulelong			x				\b, 0x%x type
18545# >24	ulelong			>0				\b; include
18546# >>24	ulelong			&0x00000001			\b data sections,
18547# >>24	ulelong			&0x00000020			\b list of unloaded modules,
18548# >>24	ulelong			&0x00000100			\b process and thread information,
18549# >>24	ulelong			&0x00000800			\b memory information,
18550
18551# Summary: abook addressbook file
18552# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
185530	string	#\x20abook\x20addressbook\x20file abook address book
18554!:mime application/x-abook-addressbook
18555
18556#------------------------------------------------------------------------------
18557# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
18558# mkid:  file(1) magic for mkid(1) databases
18559#
18560# ID is the binary tags database produced by mkid(1).
18561#
18562# XXX - byte order?
18563#
185640	string		\311\304	ID tags data
18565>2	short		>0		version %d
18566
18567#------------------------------------------------------------------------------
18568# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
18569# mlssa: file(1) magic for MLSSA datafiles
18570#
185710		lelong		0xffffabcd	MLSSA datafile,
18572>4		leshort		x		algorithm %d,
18573>10		lelong		x		%d samples
18574
18575#------------------------------------------------------------------------------
18576# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
18577# mmdf:  file(1) magic for MMDF mail files
18578#
185790	string	\001\001\001\001	MMDF mailbox
18580
18581#------------------------------------------------------------------------------
18582# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $
18583# modem:  file(1) magic for modem programs
18584#
18585# From: Florian La Roche <florian@knorke.saar.de>
185861	string		PC\ Research,\ Inc	Digifax-G3-File
18587>29	byte		1			\b, fine resolution
18588>29	byte		0			\b, normal resolution
18589
18590# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
18591# Modified by: Joerg Jenderek
18592# URL: https://de.wikipedia.org/wiki/Fax
18593# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
18594# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
185950	short		0x0100
18596# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
18597>2	search/9	\0\0
18598# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
18599>2	default		x
18600# skip IRCAM file (VAX big-endian)	./audio
18601>>0	belong		!0x0001a364
18602# skip GEM Image data			./images
18603>>>2	beshort		!0x0008
18604# look for first keyword of Panorama database *.pan
18605>>>>11	search/262	\x06DESIGN
18606# skip Panorama database
18607>>>>11	default		x
18608# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
18609>>>>>27118	search/1864	DreamWorld
18610>>>>>27118	default		x
18611# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
18612>>>>>>8		ubequad		!0x2e01010454010203
18613# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
18614>>>>>>>8	ubequad		!0x5dee74ad1aa56394	raw G3 (Group 3) FAX, byte-padded
18615# version 5.25 labeled the entry above "raw G3 data, byte-padded"
18616!:mime	image/g3fax
18617#!:apple	????TIFF
18618!:ext	g3
18619# unusual image starting with black pixel
18620#0	short		0x1300		raw G3 (Group 3) FAX
186210	short		0x1400
18622# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
18623>2	search/9	\0\0
18624# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
18625>2	default		x		raw G3 (Group 3) FAX
18626# version 5.25 labeled the above entry as "raw G3 data"
18627!:mime	image/g3fax
18628!:ext	g3
18629# unusual image with black pixel near beginning
18630#0	short		0x1900		raw G3 (Group 3) FAX
18631
18632#
18633# Magic data for vgetty voice formats
18634# (Martin Seine & Marc Eberhard)
18635
18636#
18637# raw modem data version 1
18638#
186390    string    RMD1      raw modem data
18640>4   string    >\0       (%s /
18641>20  short     >0        compression type 0x%04x)
18642
18643#
18644# portable voice format 1
18645#
186460    string    PVF1\n         portable voice format
18647>5   string    >\0       (binary %s)
18648
18649#
18650# portable voice format 2
18651#
186520    string    PVF2\n         portable voice format
18653>5   string >\0          (ascii %s)
18654
18655# From: Bernd Nuernberger <bernd.nuernberger@web.de>
18656# Brooktrout G3 fax data incl. 128 byte header
18657# Common suffixes: 3??, BRK, BRT, BTR
186580	leshort		0x01bb
18659>2	leshort		0x0100		Brooktrout 301 fax image,
18660>>9	leshort		x		%d x
18661>>0x2d	leshort		x		%d
18662>>6	leshort		200		\b, fine resolution
18663>>6	leshort		100		\b, normal resolution
18664>>11	byte		1		\b, G3 compression
18665>>11	byte		2		\b, G32D compression
18666
18667#------------------------------------------------------------------------------
18668# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
18669# motorola:  file(1) magic for Motorola 68K and 88K binaries
18670#
18671# 68K
18672#
186730	beshort		0520		mc68k COFF
18674>18	beshort		^00000020	object
18675>18	beshort		&00000020	executable
18676>12	belong		>0		not stripped
18677>168	string		.lowmem		Apple toolbox
18678>20	beshort		0407		(impure)
18679>20	beshort		0410		(pure)
18680>20	beshort		0413		(demand paged)
18681>20	beshort		0421		(standalone)
186820	beshort		0521		mc68k executable (shared)
18683>12	belong		>0		not stripped
186840	beshort		0522		mc68k executable (shared demand paged)
18685>12	belong		>0		not stripped
18686#
18687# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
18688#
186890	beshort		0554		68K BCS executable
18690#
18691# 88K
18692#
18693# Motorola/88Open BCS
18694#
186950	beshort		0555		88K BCS executable
18696#
18697# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
186980   string      S0          Motorola S-Record; binary data in text format
18699
18700# ATARI ST relocatable PRG
18701#
18702# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
18703# (according to Roland Waldi, Oct 21, 1987)
18704# besides the magic 0x601a, the text segment size is checked to be
18705# not larger than 1 MB (which is a lot on ST).
18706# The additional 0x601b distinction I took from Doug Lee's magic.
187070	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
18708>2	belong			x		(txt=%d,
18709>6	belong			x		dat=%d,
18710>10	belong			x		bss=%d,
18711>14	belong			x		sym=%d)
187120	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
18713>2	belong			x		(txt=%d,
18714>6	belong			x		dat=%d,
18715>10	belong			x		bss=%d,
18716>14	belong			x		sym=%d)
18717
18718# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
187190       beshort         0x601A          Atari 68xxx executable,
18720>2      belong          x               text len %u,
18721>6      belong          x               data len %u,
18722>10     belong          x               BSS len %u,
18723>14     belong          x               symboltab len %u,
18724>18     belong          0
18725>22     belong          &0x01           fastload flag,
18726>22     belong          &0x02           may be loaded to alternate RAM,
18727>22     belong          &0x04           malloc may be from alternate RAM,
18728>22     belong          x               flags: 0x%X,
18729>26     beshort         0               no relocation tab
18730>26     beshort         !0              + relocation tab
18731>30     string          SFX             [Self-Extracting LZH SFX archive]
18732>38     string          SFX             [Self-Extracting LZH SFX archive]
18733>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
18734
187350       beshort         0x0064          Atari 68xxx CPX file
18736>8      beshort         x               (version %04x)
18737
18738#------------------------------------------------------------------------------
18739# $File: mozilla,v 1.8 2018/01/17 12:08:36 christos Exp $
18740# mozilla:  file(1) magic for Mozilla XUL fastload files
18741# (XUL.mfasl and XPC.mfasl)
18742# URL:	http://www.mozilla.org/
18743# From:	Josh Triplett <josh@freedesktop.org>
18744
187450	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
187460	string	mozLz4a				Mozilla lz4 compressed bookmark data
18747
18748# From: Joerg Jenderek
18749# URL: https://en.wikipedia.org/wiki/Firefox_4
18750# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
18751# Note:	Most ZIP utilities are able to extract such archives
18752#	maybe only partly or after some warnings. Example:
18753#	zip -FF omni.ja --out omni.zip
187544	string	PK\001\002	Mozilla archive omni.ja
18755!:mime	application/x-zip
18756!:ext	ja
18757# TODO:
18758#>4	use	zip-dir-entry
18759
18760#------------------------------------------------------------------------------
18761# $File: msdos,v 1.124 2018/07/10 04:05:50 christos Exp $
18762# msdos:  file(1) magic for MS-DOS files
18763#
18764
18765# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
18766# updated by Joerg Jenderek at Oct 2008,Apr 2011
187670	string/t	@
18768>1	string/cW	\ echo\ off	DOS batch file text
18769!:mime	text/x-msdos-batch
18770>1	string/cW	echo\ off	DOS batch file text
18771!:mime	text/x-msdos-batch
18772>1	string/cW	rem		DOS batch file text
18773!:mime	text/x-msdos-batch
18774>1	string/cW	set\ 		DOS batch file text
18775!:mime	text/x-msdos-batch
18776
18777
18778# OS/2 batch files are REXX. the second regex is a bit generic, oh well
18779# the matched commands seem to be common in REXX and uncommon elsewhere
18780100	search/0xffff   rxfuncadd
18781>100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
18782100	search/0xffff   say
18783>100	regex/c =^[\ \t]{0,10}say\ ['"]			OS/2 REXX batch file text
18784
18785# updated by Joerg Jenderek at Oct 2015
18786# https://de.wikipedia.org/wiki/Common_Object_File_Format
18787# http://www.delorie.com/djgpp/doc/coff/filhdr.html
18788# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable"
18789#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
18790#>4	ledate		x	stamp %s
187910	leshort		0x166	MS Windows COFF MIPS R4000 object file
18792#>4	ledate		x	stamp %s
187930	leshort		0x184	MS Windows COFF Alpha object file
18794#>4	ledate		x	stamp %s
187950	leshort		0x268	MS Windows COFF Motorola 68000 object file
18796#>4	ledate		x	stamp %s
187970	leshort		0x1f0	MS Windows COFF PowerPC object file
18798#>4	ledate		x	stamp %s
187990	leshort		0x290	MS Windows COFF PA-RISC object file
18800#>4	ledate		x	stamp %s
18801
18802# Tests for various EXE types.
18803#
18804# Many of the compressed formats were extraced from IDARC 1.23 source code.
18805#
188060	string/b	MZ
18807# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
18808>0x18	leshort <0x40 MS-DOS executable
18809!:mime	application/x-dosexec
18810# These traditional tests usually work but not always.  When test quality support is
18811# implemented these can be turned on.
18812#>>0x18	leshort	0x1c	(Borland compiler)
18813#>>0x18	leshort	0x1e	(MS compiler)
18814
18815# If the relocation table is 0x40 or more bytes into the file, it's definitely
18816# not a DOS EXE.
18817>0x18  leshort >0x3f
18818
18819# Maybe it's a PE?
18820>>(0x3c.l) string PE\0\0 PE
18821!:mime	application/x-dosexec
18822>>>(0x3c.l+24)	leshort		0x010b	\b32 executable
18823>>>(0x3c.l+24)	leshort		0x020b	\b32+ executable
18824>>>(0x3c.l+24)	leshort		0x0107	ROM image
18825>>>(0x3c.l+24)	default		x	Unknown PE signature
18826>>>>&0 		leshort		x	0x%x
18827>>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
18828>>>(0x3c.l+92)	leshort		1	(native)
18829>>>(0x3c.l+92)	leshort		2	(GUI)
18830>>>(0x3c.l+92)	leshort		3	(console)
18831>>>(0x3c.l+92)	leshort		7	(POSIX)
18832>>>(0x3c.l+92)	leshort		9	(Windows CE)
18833>>>(0x3c.l+92)	leshort		10	(EFI application)
18834>>>(0x3c.l+92)	leshort		11	(EFI boot service driver)
18835>>>(0x3c.l+92)	leshort		12	(EFI runtime driver)
18836>>>(0x3c.l+92)	leshort		13	(EFI ROM)
18837>>>(0x3c.l+92)	leshort		14	(XBOX)
18838>>>(0x3c.l+92)	leshort		15	(Windows boot application)
18839>>>(0x3c.l+92)	default		x	(Unknown subsystem
18840>>>>&0		leshort		x	0x%x)
18841>>>(0x3c.l+4)	leshort		0x14c	Intel 80386
18842>>>(0x3c.l+4)	leshort		0x166	MIPS R4000
18843>>>(0x3c.l+4)	leshort		0x168	MIPS R10000
18844>>>(0x3c.l+4)	leshort		0x184	Alpha
18845>>>(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
18846>>>(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
18847>>>(0x3c.l+4)	leshort		0x1c0	ARM
18848>>>(0x3c.l+4)	leshort		0x1c2	ARM Thumb
18849>>>(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
18850>>>(0x3c.l+4)	leshort		0x1f0	PowerPC
18851>>>(0x3c.l+4)	leshort		0x200	Intel Itanium
18852>>>(0x3c.l+4)	leshort		0x266	MIPS16
18853>>>(0x3c.l+4)	leshort		0x268	Motorola 68000
18854>>>(0x3c.l+4)	leshort		0x290	PA-RISC
18855>>>(0x3c.l+4)	leshort		0x366	MIPSIV
18856>>>(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
18857>>>(0x3c.l+4)	leshort		0xebc	EFI byte code
18858>>>(0x3c.l+4)	leshort		0x8664	x86-64
18859>>>(0x3c.l+4)	leshort		0xc0ee	MSIL
18860>>>(0x3c.l+4)	default		x	Unknown processor type
18861>>>>&0		leshort		x	0x%x
18862>>>(0x3c.l+22)	leshort&0x0200	>0	(stripped to external PDB)
18863>>>(0x3c.l+22)	leshort&0x1000	>0	system file
18864>>>(0x3c.l+24)	leshort		0x010b
18865>>>>(0x3c.l+232) lelong	>0	Mono/.Net assembly
18866>>>(0x3c.l+24)	leshort		0x020b
18867>>>>(0x3c.l+248) lelong	>0	Mono/.Net assembly
18868
18869# hooray, there's a DOS extender using the PE format, with a valid PE
18870# executable inside (which just prints a message and exits if run in win)
18871>>>(8.s*16)		string		32STUB	\b, 32rtm DOS extender
18872>>>(8.s*16)		string		!32STUB	\b, for MS Windows
18873>>>(0x3c.l+0xf8)	string		UPX0 \b, UPX compressed
18874>>>(0x3c.l+0xf8)	search/0x140	PEC2 \b, PECompact2 compressed
18875>>>(0x3c.l+0xf8)	search/0x140	UPX2
18876>>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
18877>>>(0x3c.l+0xf8)	search/0x140	.idata
18878>>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
18879>>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
18880>>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
18881>>>(0x3c.l+0xf8)	search/0x140	.rsrc
18882>>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
18883>>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
18884>>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
18885>>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
18886>>>(0x3c.l+0xf8)	search/0x140	.data
18887>>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
18888>>>(0x3c.l+0xf8)	search/0x140	.petite\0 \b, Petite compressed
18889>>>>(0x3c.l+0xf7)	byte		x
18890>>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
18891>>>(0x3c.l+0xf8)	search/0x140	.WISE \b, WISE installer self-extracting archive
18892>>>(0x3c.l+0xf8)	search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
18893>>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
18894>>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
18895>>>0x30			string		Inno \b, InnoSetup self-extracting archive
18896
18897# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
18898# must be one of the unusual subformats.
18899>>(0x3c.l) string !PE\0\0 MS-DOS executable
18900!:mime	application/x-dosexec
18901
18902>>(0x3c.l)		string		NE \b, NE
18903!:mime	application/x-dosexec
18904>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
18905>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
18906>>>(0x3c.l+0x36)	byte		3 for MS-DOS
18907>>>(0x3c.l+0x36)	byte		4 for Windows 386
18908>>>(0x3c.l+0x36)	byte		5 for Borland Operating System Services
18909>>>(0x3c.l+0x36)	default		x
18910>>>>(0x3c.l+0x36)	byte		x (unknown OS %x)
18911>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
18912>>>(0x3c.l+0x0c)	leshort&0x8003	0x8002 (DLL)
18913>>>(0x3c.l+0x0c)	leshort&0x8003	0x8001 (driver)
18914>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
18915>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
18916
18917>>(0x3c.l)		string		LX\0\0 \b, LX
18918!:mime	application/x-dosexec
18919>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
18920>>>(0x3c.l+0x0a)	leshort		1 for OS/2
18921>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
18922>>>(0x3c.l+0x0a)	leshort		3 for DOS
18923>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
18924>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
18925>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
18926>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
18927>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
18928>>>(0x3c.l+0x08)	leshort		1 i80286
18929>>>(0x3c.l+0x08)	leshort		2 i80386
18930>>>(0x3c.l+0x08)	leshort		3 i80486
18931>>>(8.s*16)		string		emx \b, emx
18932>>>>&1			string		x %s
18933>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
18934
18935# MS Windows system file, supposedly a collection of LE executables
18936>>(0x3c.l)		string		W3 \b, W3 for MS Windows
18937!:mime	application/x-dosexec
18938
18939>>(0x3c.l)		string		LE\0\0 \b, LE executable
18940!:mime	application/x-dosexec
18941>>>(0x3c.l+0x0a)	leshort		1
18942# some DOS extenders use LE files with OS/2 header
18943>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
18944>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
18945>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
18946>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
18947>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
18948>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
18949>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
18950# this is a wild guess; hopefully it is a specific signature
18951>>>>&0x24		lelong		<0x50
18952>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
18953>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
18954# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
18955#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
18956# fails with DOS-Extenders.
18957>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
18958>>>(0x3c.l+0x0a)	leshort		3 for DOS
18959>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
18960>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
18961>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
18962
18963# looks like ASCII, probably some embedded copyright message.
18964# and definitely not NE/LE/LX/PE
18965>>0x3c		lelong	>0x20000000
18966>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
18967!:mime	application/x-dosexec
18968# header data too small for extended executable
18969>2		long	!0
18970>>0x18		leshort <0x40
18971>>>(4.s*512)	leshort !0x014c
18972
18973>>>>&(2.s-514)	string	!LE
18974>>>>>&-2	string	!BW \b, MZ for MS-DOS
18975!:mime	application/x-dosexec
18976>>>>&(2.s-514)	string	LE \b, LE
18977>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
18978# educated guess since indirection is still not capable enough for complex offset
18979# calculations (next embedded executable would be at &(&2*512+&0-2)
18980# I suspect there are only LE executables in these multi-exe files
18981>>>>&(2.s-514)	string	BW
18982>>>>>0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
18983>>>>>0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS
18984
18985# This sequence skips to the first COFF segment, usually .text
18986>(4.s*512)	leshort		0x014c \b, COFF
18987!:mime	application/x-dosexec
18988>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
18989>>(8.s*16)	string		emx
18990>>>&1		string		x for DOS, Win or OS/2, emx %s
18991>>&(&0x42.l-3)	byte		x
18992>>>&0x26	string		UPX \b, UPX compressed
18993# and yet another guess: small .text, and after large .data is unusal, could be 32lite
18994>>&0x2c		search/0xa0	.text
18995>>>&0x0b	lelong		<0x2000
18996>>>>&0		lelong		>0x6000 \b, 32lite compressed
18997
18998>(8.s*16) string $WdX \b, WDos/X DOS extender
18999
19000# By now an executable type should have been printed out.  The executable
19001# may be a self-uncompressing archive, so look for evidence of that and
19002# print it out.
19003#
19004# Some signatures below from Greg Roelofs, newt@uchicago.edu.
19005#
19006>0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
19007>0xe7	string	LH/2\ 	Self-Extract \b, %s
19008>0x1c	string	UC2X	\b, UCEXE compressed
19009>0x1c	string	WWP\ 	\b, WWPACK compressed
19010>0x1c	string	RJSX 	\b, ARJ self-extracting archive
19011>0x1c	string	diet 	\b, diet compressed
19012>0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
19013>0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
19014>0x1c	string	tz 	\b, TinyProg compressed
19015>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
19016!:mime	application/zip
19017# Yes, this really is "Copr", not "Corp."
19018>0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
19019!:mime	application/zip
19020# winarj stores a message in the stub instead of the sig in the MZ header
19021>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
19022>0x20	string AIN
19023>>0x23	string 2	\b, AIN 2.x compressed
19024>>0x23	string <2	\b, AIN 1.x compressed
19025>>0x23	string >2	\b, AIN 1.x compressed
19026>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
19027!:mime	application/x-lha
19028>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
19029!:mime	application/x-lha
19030>0x24	string	\ $ARX \b, ARX self-extracting archive
19031>0x24	string	\ $LHarc \b, LHarc self-extracting archive
19032>0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
19033>0x40	string aPKG \b, aPackage self-extracting archive
19034>0x64	string	W\ Collis\0\0 \b, Compack compressed
19035>0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
19036>>&0xf4 search/0x140 \x0\x40\x1\x0
19037>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
19038>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
19039>0x17888 string Rar! \b, RAR self-extracting archive
19040
19041# Skip to the end of the EXE.  This will usually work fine in the PE case
19042# because the MZ image is hardcoded into the toolchain and almost certainly
19043# won't match any of these signatures.
19044>(4.s*512)	long	x
19045>>&(2.s-517)	byte	x
19046>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
19047>>>&0	string		Rar! \b, RAR self-extracting archive
19048>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
19049>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
19050>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
19051>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
19052>>>&7	search/400	**ACE** \b, ACE self-extracting archive
19053>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
19054
19055# a few unknown ZIP sfxes, no idea if they are needed or if they are
19056# already captured by the generic patterns above
19057>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
19058# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
19059#
19060
19061# TELVOX Teleinformatica CODEC self-extractor for OS/2:
19062>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
19063>>49824 leshort		=1			\b, 1 file
19064>>49824 leshort		>1			\b, %u files
19065
19066# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
19067# and http://www.freedos.org/software/?prog=kpdos
19068# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
190690	string/b	KCF		FreeDOS KEYBoard Layout collection
19070# only version=0x100 found
19071>3	uleshort	x		\b, version 0x%x
19072# length of string containing author,info and special characters
19073>6	ubyte		>0
19074#>>6	pstring		x		\b, name=%s
19075>>7	string		>\0		\b, author=%-.14s
19076>>7	search/254	\xff		\b, info=
19077#>>>&0	string		x		\b%-s
19078>>>&0	string		x		\b%-.15s
19079# for FreeDOS *.KL files
190800	string/b	KLF		FreeDOS KEYBoard Layout file
19081# only version=0x100 or 0x101 found
19082>3	uleshort	x		\b, version 0x%x
19083# stringlength
19084>5	ubyte		>0
19085>>8	string		x		\b, name=%-.2s
190860	string	\xffKEYB\ \ \ \0\0\0\0
19087>12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file
19088
19089# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
19090# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
190910	ulequad&0x07a0ffffffff		0xffffffff
19092>0	use				msdos-driver
190930       name    			msdos-driver		DOS executable (
19094#!:mime	application/octet-stream
19095!:mime	application/x-dosdriver
19096# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
19097!:ext	sys/dev/bin
19098>40	search/7			UPX!			\bUPX compressed
19099# DOS device driver attributes
19100>4	uleshort&0x8000			0x0000			\bblock device driver
19101# character device
19102>4	uleshort&0x8000			0x8000			\b
19103>>4	uleshort&0x0008			0x0008			\bclock
19104# fast video output by int 29h
19105>>4	uleshort&0x0010			0x0010			\bfast
19106# standard input/output device
19107>>4	uleshort&0x0003			>0			\bstandard
19108>>>4	uleshort&0x0001			0x0001			\binput
19109>>>4	uleshort&0x0003			0x0003			\b/
19110>>>4	uleshort&0x0002			0x0002			\boutput
19111>>4	uleshort&0x8000			0x8000			\bcharacter device driver
19112>0	ubyte				x
19113# upx compressed device driver has garbage instead of real in name field of header
19114>>40	search/7			UPX!
19115>>40	default				x
19116# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
19117>>>12		ubyte			>0x2E			\b
19118>>>>10		ubyte			>0x20
19119>>>>>10		ubyte			!0x2E
19120>>>>>>10	ubyte			!0x2A			\b%c
19121>>>>11		ubyte			>0x20
19122>>>>>11		ubyte			!0x2E			\b%c
19123>>>>12		ubyte			>0x20
19124>>>>>12		ubyte			!0x39
19125>>>>>>12	ubyte			!0x2E			\b%c
19126>>>13		ubyte			>0x20
19127>>>>13		ubyte			!0x2E			\b%c
19128>>>>14		ubyte			>0x20
19129>>>>>14		ubyte			!0x2E			\b%c
19130>>>>15		ubyte			>0x20
19131>>>>>15		ubyte			!0x2E			\b%c
19132>>>>16		ubyte			>0x20
19133>>>>>16		ubyte			!0x2E
19134>>>>>>16	ubyte			<0xCB			\b%c
19135>>>>17		ubyte			>0x20
19136>>>>>17		ubyte			!0x2E
19137>>>>>>17	ubyte			<0x90			\b%c
19138# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
19139>>>12		ubyte			<0x2F
19140# they have their real name at offset 22
19141# also block device drivers like DUMBDRV.SYS
19142>>>>22		string			>\056			%-.6s
19143>4	uleshort&0x8000			0x0000
19144# 32 bit sector addressing ( > 32 MB) for block devices
19145>>4	uleshort&0x0002			0x0002			\b,32-bit sector-
19146# support by driver functions 13h, 17h, 18h
19147>4	uleshort&0x0040			0x0040			\b,IOCTL-
19148# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
19149>4	uleshort&0x0800			0x0800			\b,close media-
19150# output until busy support by int 10h for character device driver
19151>4	uleshort&0x8000			0x8000
19152>>4	uleshort&0x2000			0x2000			\b,until busy-
19153# direct read/write support by driver functions 03h,0Ch
19154>4	uleshort&0x4000			0x4000			\b,control strings-
19155>4	uleshort&0x8000			0x8000
19156>>4	uleshort&0x6840			>0			\bsupport
19157>4	uleshort&0x8000			0x0000
19158>>4	uleshort&0x4842			>0			\bsupport
19159>0	ubyte				x			\b)
19160# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
191610	ulequad				0x0513c00000000012
19162>0	use				msdos-driver
19163# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
191640	ulequad				0x32f28000ffff0016
19165>0	use				msdos-driver
191660	ulequad				0x007f00000000ffff
19167>0	use				msdos-driver
191680	ulequad				0x001600000000ffff
19169>0	use				msdos-driver
19170# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
191710	ulequad				0x0bf708c2ffffffff
19172>0	use				msdos-driver
191730	ulequad				0x07bd08c2ffffffff
19174>0	use				msdos-driver
19175
19176# updated by Joerg Jenderek
19177# GRR: line below too general as it catches also
19178# rt.lib DYADISKS.PIC and many more
19179# start with assembler instruction MOV
191800	ubyte		0x8c
19181# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
19182>4	string			!O====
19183# skip some unknown basic binaries like RocketRnger.SHR
19184>>5	string			!MAIN
19185# skip "GPG symmetrically encrypted data" ./gnu
19186# skip "PGP symmetric key encrypted data" ./pgp
19187# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
19188>>>4	ubyte			>13	DOS executable (COM, 0x8C-variant)
19189# the remaining files should be DOS *.COM executables
19190# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
19191# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
19192# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
19193# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
19194# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
19195# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
19196# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
19197# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
19198!:mime	application/x-dosexec
19199!:ext com
19200
19201# updated by Joerg Jenderek at Oct 2008
192020	ulelong		0xffff10eb	DR-DOS executable (COM)
19203# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
192040	ubeshort&0xeb8d	>0xeb00
19205# DR-DOS STACKER.COM SCREATE.SYS missed
19206
192070       name    msdos-com
19208>0  byte        x               DOS executable (COM)
19209>6	string		SFX\ of\ LHarc	\b, %s
19210>0x1FE leshort	0xAA55		    \b, boot code
19211>85	string		UPX		        \b, UPX compressed
19212>4	string		\ $ARX		    \b, ARX self-extracting archive
19213>4	string		\ $LHarc	    \b, LHarc self-extracting archive
19214>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
19215
19216# JMP 8bit
192170	        byte	0xeb
19218# allow forward jumps only
19219>1          byte    >-1
19220# that offset must be accessible
19221>>(1.b+2)   byte    x
19222>>>0        use msdos-com
19223
19224# JMP 16bit
192250           byte    0xe9
19226# forward jumps
19227>1          short   >-1
19228# that offset must be accessible
19229>>(1.s+3)   byte    x
19230>>>0        use msdos-com
19231# negative offset, must not lead into PSP
19232>1          short   <-259
19233# that offset must be accessible
19234>>(1,s+65539)   byte    x
19235>>>0        use msdos-com
19236
19237# updated by Joerg Jenderek at Oct 2008,2015
19238# following line is too general
192390	ubyte		0xb8
19240# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
19241>0	string		!\xb8\xc0\x07\x8e
19242# modified by Joerg Jenderek
19243# syslinux COM32 or COM32R executable
19244>>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
19245# http://www.syslinux.org/wiki/index.php/Comboot_API
19246# Since version 5.00 c32 modules switched from the COM32 object format to ELF
19247!:mime	application/x-c32-comboot-syslinux-exec
19248!:ext c32
19249# http://syslinux.zytor.com/comboot.php
19250# older syslinux version ( <4 )
19251# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
19252# start with assembler instructions mov eax,21cd4cffh
19253>>>1	lelong		0x21CD4CFf	\b)
19254# syslinux:doc/comboot.txt
19255# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
19256# eax,21cd4cfeh) as a magic number.
19257# syslinux version (4.x)
19258# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID
19259>>>1	lelong		0x21CD4CFe	\b, relocatable)
19260# remaining are DOS COM executables starting with assembler instruction MOV
19261# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
19262# MS-DOS SYS.COM RESTART.COM
19263# SYSLINUX.COM (version 1.40 - 2.13)
19264# GFXBOOT.COM (version 3.75)
19265# COPYBS.COM POWEROFF.COM INT18.COM
19266>>1	default	x			COM executable for DOS
19267!:mime	application/x-dosexec
19268#!:mime	application/x-ms-dos-executable
19269#!:mime	application/x-msdos-program
19270!:ext com
19271
192720	string/b	\x81\xfc
19273>4	string	\x77\x02\xcd\x20\xb9
19274>>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
19275252	string Must\ have\ DOS\ version DR-DOS executable (COM)
19276# added by Joerg Jenderek at Oct 2008
19277# GRR search is not working
19278#34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
1927934	string	UPX!			FREE-DOS executable (COM), UPX compressed
1928035	string	UPX!			FREE-DOS executable (COM), UPX compressed
19281# GRR search is not working
19282#2	search/28	\xcd\x21	COM executable for MS-DOS
19283#WHICHFAT.cOM
192842	string	\xcd\x21		COM executable for DOS
19285#DELTREE.cOM DELTREE2.cOM
192864	string	\xcd\x21		COM executable for DOS
19287#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
192885	string	\xcd\x21		COM executable for DOS
19289#DELTMP.COm HASFAT32.cOM
192907	string	\xcd\x21
19291>0	byte	!0xb8			COM executable for DOS
19292#COMP.cOM MORE.COm
1929310	string	\xcd\x21
19294>5	string	!\xcd\x21		COM executable for DOS
19295#comecho.com
1929613	string	\xcd\x21		COM executable for DOS
19297#HELP.COm EDIT.coM
1929818	string	\xcd\x21		COM executable for MS-DOS
19299#NWRPLTRM.COm
1930023	string	\xcd\x21		COM executable for MS-DOS
19301#LOADFIX.cOm LOADFIX.cOm
1930230	string	\xcd\x21		COM executable for MS-DOS
19303#syslinux.com 3.11
1930470	string	\xcd\x21		COM executable for DOS
19305# many compressed/converted COMs start with a copy loop instead of a jump
193060x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
193070x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
19308>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
193090x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
19310# FIXME: missing diet .com compression
19311
19312# miscellaneous formats
193130	string/b	LZ		MS-DOS executable (built-in)
19314#0	byte		0xf0		MS-DOS program library data
19315#
19316
19317# AAF files:
19318# <stuartc@rd.bbc.co.uk> Stuart Cunningham
193190	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
19320>30	byte	9		(512B sectors)
19321>30	byte	12		(4kB sectors)
193220	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
19323>30	byte	9		(512B sectors)
19324>30	byte	12		(4kB sectors)
19325
19326# Popular applications
193272080	string	Microsoft\ Word\ 6.0\ Document	%s
19328!:mime	application/msword
193292080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
19330!:mime	application/msword
19331# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
193322112	string	MSWordDoc			Microsoft Word document data
19333!:mime	application/msword
19334#
193350	belong	0x31be0000			Microsoft Word Document
19336!:mime	application/msword
19337#
193380	string/b	PO^Q`				Microsoft Word 6.0 Document
19339!:mime	application/msword
19340#
193414   long        0
19342>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
19343!:mime	application/msword
19344!:ext   mcw
19345>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
19346!:mime	application/msword
19347!:ext   mcw
19348>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
19349!:mime	application/msword
19350!:ext   mcw
19351>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
19352!:mime	application/msword
19353!:ext   mcw
19354
193550	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
19356!:mime	application/msword
19357!:ext   doc
19358# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs
19359#512	string/b	\354\245\301			Microsoft Word Document
19360#!:mime	application/msword
19361
19362#
193630	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
19364!:mime application/msword
19365#
193662080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
19367!:mime	application/vnd.ms-excel
19368#
193690	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
19370!:mime application/msword
19371
193722080	string	Foglio\ di\ lavoro\ Microsoft\ Exce	%s
19373!:mime	application/vnd.ms-excel
19374#
19375# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
193762114	string	Biff5		Microsoft Excel 5.0 Worksheet
19377!:mime	application/vnd.ms-excel
19378# Italian MS-Excel
193792121	string	Biff5		Microsoft Excel 5.0 Worksheet
19380!:mime	application/vnd.ms-excel
193810	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
19382!:mime	application/vnd.ms-excel
19383#
19384# Update: Joerg Jenderek
19385# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
19386# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
19387# Note: newer Lotus versions >2 use longer BOF record
19388# record type (BeginningOfFile=0000h) + length (001Ah)
193890	belong	0x00001a00
19390# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
19391#>18	uleshort&0x73E0	0
19392# Lotus Multi Byte Character Set (LMBCS=1-31)
19393>20	ubyte		>0
19394>>20	ubyte		<32	Lotus 1-2-3
19395#!:mime	application/x-123
19396!:mime	application/vnd.lotus-1-2-3
19397!:apple	????L123
19398# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data"
19399>>>4	uleshort	0x1000	WorKsheet, version 3
19400!:ext	wk3
19401# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data"
19402>>>4	uleshort	0x1002	WorKsheet, version 4
19403# also worksheet template 4 (.wt4)
19404!:ext	wk4/wt4
19405# no example or documentation for wk5
19406#>>4	uleshort	0x????	WorKsheet, version 4
19407#!:ext	wk5
19408# only MacrotoScript.123 example
19409>>>4	uleshort	0x1003	WorKsheet, version 97
19410# also worksheet template Smartmaster (.12M)?
19411!:ext	123
19412# only Set_Y2K.123 example
19413>>>4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
19414!:ext	123
19415# no example for this version
19416>>>4	uleshort	0x8001	FoRMatting data
19417!:ext	frm
19418# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data"
19419# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet"
19420>>>4	uleshort	0x8007	ForMatting data, version 3
19421!:ext	fm3
19422>>>4	default		x	unknown
19423# file revision sub code 0004h for worksheets
19424>>>>6	uleshort	=0x0004	worksheet
19425!:ext	wXX
19426>>>>6	uleshort	!0x0004	formatting data
19427!:ext	fXX
19428# main revision number
19429>>>>4	uleshort	x	\b, revision 0x%x
19430>>>6	uleshort	=0x0004	\b, cell range
19431# active cellcoord range (start row, page,column ; end row, page, column)
19432# start values normally 0~1st sheet A1
19433>>>>8	ulelong		!0
19434>>>>>10	ubyte		>0	\b%d*
19435>>>>>8	uleshort	x	\b%d,
19436>>>>>11	ubyte		x	\b%d-
19437# end page mostly 0
19438>>>>14	ubyte		>0	\b%d*
19439# end raw, column normally not 0
19440>>>>12	uleshort	x	\b%d,
19441>>>>15	ubyte		x	\b%d
19442# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
19443>>>>20	ubyte		>1	\b, character set 0x%x
19444# flags
19445>>>>21	ubyte		x	\b, flags 0x%x
19446>>>6	uleshort	!0x0004
19447# record type (FONTNAME=00AEh)
19448>>>>30	search/29	\0\xAE
19449# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
19450>>>>>&4	string		>\0	\b, 1st font "%s"
19451#
19452# Update: Joerg Jenderek
19453# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
19454# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
19455# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
19456# record type (BeginningOfFile=0000h) + length (0002h)
194570	belong	0x00000200
19458# GRR: line above is too general as it catches also MS Windows CURsor
19459# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
19460!:strength -1
19461# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
19462>7	ubyte		0
19463# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
19464>>6	ubyte		>0	Lotus
19465# !:mime	application/x-123
19466!:mime	application/vnd.lotus-1-2-3
19467!:apple	????L123
19468# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
19469# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3"
19470>>>4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
19471!:ext	cnf
19472>>>4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
19473!:ext	cnf
19474>>>4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
19475!:ext	cnf
19476>>>4	uleshort	0x0802	Symphony CoNFiguration
19477!:ext	cnf
19478>>>4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
19479!:ext	cnf
19480>>>4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
19481!:ext	cnf
19482>>>4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
19483!:ext	cnf
19484>>>4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
19485!:ext	cnf
19486# (version 5.26) labeled the entry as "Lotus 123"
19487# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
19488>>>4	uleshort	0x0404	1-2-3 WorKSheet, version 1
19489# extension "wks" also for Microsoft Works document
19490!:ext	wks
19491# (version 5.26) labeled the entry as "Lotus 123"
19492# TrID labeles the entry as "Lotus 123 Worksheet (generic)"
19493>>>4	uleshort	0x0405	Symphony WoRksheet, version 1.0
19494!:ext	wrk/wr1
19495# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data"
19496# TrID labeles the entry as "Lotus 123 Worksheet (V2)"
19497>>>4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
19498# Symphony (.wr1)
19499!:ext	wk1/wr1
19500# no example for this japan version
19501>>>4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
19502!:ext	wj1
19503# no example or documentation for wk2
19504#>>>4	uleshort	0x????	1-2-3 WorKsheet, version 2
19505#!:ext	wk2
19506# undocumented japan version
19507>>>4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
19508!:ext	wj3
19509# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data"
19510>>>4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
19511# japan version 2.4J (fj3)
19512!:ext	fmt/fj3
19513# no example for this version
19514>>>4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
19515!:ext	frm
19516# (version 5.26) labeled the entry as "Lotus 1-2-3"
19517>>>4	default		x	unknown worksheet or configuration
19518!:ext	cnf
19519>>>>4	uleshort	x	\b, revision 0x%x
19520# 2nd record for most worksheets describes cells range
19521>>>6		use	lotus-cells
19522# 3nd record for most japan worksheets describes cells range
19523>>>(8.s+10)	use	lotus-cells
19524#	check and then display Lotus worksheet cells range
195250	name		lotus-cells
19526# look for type (RANGE=0006h) + length (0008h) at record begin
19527>0	ubelong	0x06000800	\b, cell range
19528# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
19529>>4	ulong		!0
19530>>>4	uleshort	x	\b%d,
19531>>>6	uleshort	x	\b%d-
19532# end of cell range
19533>>8	uleshort	x	\b%d,
19534>>10	uleshort	x	\b%d
19535# EndOfLotus123
195360	string/b		WordPro\0	Lotus WordPro
19537!:mime	application/vnd.lotus-wordpro
195380	string/b		WordPro\r\373	Lotus WordPro
19539!:mime	application/vnd.lotus-wordpro
19540
19541
19542# Summary: Script used by InstallScield to uninstall applications
19543# Extension: .isu
19544# Submitted by: unknown
19545# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
195460		string		\x71\xa8\x00\x00\x01\x02
19547>12		string		Stirling\ Technologies,		InstallShield Uninstall Script
19548
19549# Winamp .avs
19550#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
195510	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in
19552
19553# Windows Metafile .WMF
195540	string/b	\327\315\306\232	Windows metafile
19555!:mime	image/wmf
19556!:ext	wmf
195570	string/b	\002\000\011\000	Windows metafile
19558!:mime	image/wmf
19559!:ext	wmf
195600	string/b	\001\000\011\000	Windows metafile
19561!:mime	image/wmf
19562!:ext	wmf
19563
19564#tz3 files whatever that is (MS Works files)
195650	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
195660	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
195670	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file
19568
19569# PGP sig files .sig
19570#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
195710 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
195720 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
195730 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
195740 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
195750 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
195760 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
19577
19578# windows zips files .dmf
195790	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
19580
19581
19582#ico files
195830	string/b	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for MS Windows
19584
19585# Windows icons
19586# Update: Joerg Jenderek
19587# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
19588# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
195890   belong  0x00000100
19590>9  byte    0
19591>>0 byte    x
19592>>0 use     cur-ico-dir
19593>9  ubyte   0xff
19594>>0 byte    x
19595>>0 use     cur-ico-dir
19596#	displays number of icons and information for icon or cursor
195970	name		cur-ico-dir
19598# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
19599# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
19600>18		ulelong		&0x00000006
19601# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
19602>>(18.l)	ulelong		x		MS Windows
19603>>>0		ubelong		0x00000100	icon resource
19604#!:mime		image/vnd.microsoft.icon
19605!:mime		image/x-icon
19606!:ext		ico
19607>>>>4 		uleshort	x		- %d icon
19608# plural s
19609>>>>4 		uleshort	>1		\bs
19610# 1st icon
19611>>>>0x06	use		ico-entry
19612# 2nd icon
19613>>>>4 		uleshort	>1
19614>>>>>0x16	use		ico-entry
19615>>>0		ubelong		0x00000200	cursor resource
19616#!:mime		image/x-cur
19617!:mime		image/x-win-bitmap
19618!:ext		cur
19619>>>>4 		uleshort	x		- %d icon
19620>>>>4 		uleshort	>1		\bs
19621# 1st cursor
19622>>>>0x06	use		cur-entry
19623#>>>>0x16	use		cur-entry
19624#	display information of one cursor entry
196250	name		cur-entry
19626>0	use		cur-ico-entry
19627>4	uleshort	x	\b, hotspot @%dx
19628>6	uleshort	x	\b%d
19629#	display information of one icon entry
196300	name		ico-entry
19631>0			use	cur-ico-entry
19632# normally 0 1 but also found 14
19633>4	uleshort	>1	\b, %d planes
19634# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
19635>6	uleshort	>1	\b, %d bits/pixel
19636#	display shared information of cursor or icon entry
196370		name		cur-ico-entry
19638>0		byte		=0		\b, 256x
19639>0		byte		!0		\b, %dx
19640>1		byte        	=0		\b256
19641>1		byte        	!0		\b%d
19642# number of colors in palette
19643>2		ubyte		!0		\b, %d colors
19644# reserved 0 FFh
19645#>3		ubyte        	x		\b, reserved %x
19646#>8		ulelong		x		\b, image size %d
19647# offset of PNG or DIB image
19648#>12		ulelong		x		\b, offset 0x%x
19649# PNG header (\x89PNG)
19650>(12.l)		ubelong		=0x89504e47
19651>>&-4		indirect	x	\b with
19652# DIB image
19653>(12.l)		ubelong		!0x89504e47
19654#>>&-4		use     	dib-image
19655
19656# Windows non-animated cursors
19657# Update: Joerg Jenderek
19658# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
19659# Note: similar to Windows ICOn. container for BMP ( only DIB part)
19660# GRR: line below is too general as it catches also Lotus 1-2-3 files
196610   belong  0x00000200
19662>9  byte    0
19663>>0 use     cur-ico-dir
19664>9  ubyte   0xff
19665>>0 use     cur-ico-dir
19666
19667# .chr files
196680	string/b	PK\010\010BGI	Borland font
19669>4	string	>\0	%s
19670# then there is a copyright notice
19671
19672
19673# .bgi files
196740	string/b	pk\010\010BGI	Borland device
19675>4	string	>\0	%s
19676# then there is a copyright notice
19677
19678
19679# Windows Recycle Bin record file (named INFO2)
19680# By Abel Cheung (abelcheung AT gmail dot com)
19681# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
19682# Since Vista uses another structure, INFO2 structure probably won't change
19683# anymore. Detailed analysis in:
19684# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
196850	lelong		0x00000004
19686>12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)
19687
196880	lelong		0x00000005
19689>12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)
19690
19691# From Doug Lee via a FreeBSD pr
196929	string		GERBILDOC	First Choice document
196939	string		GERBILDB	First Choice database
196949	string		GERBILCLIP	First Choice database
196950	string		GERBIL		First Choice device file
196969	string		RABBITGRAPH	RabbitGraph file
196970	string		DCU1		Borland Delphi .DCU file
196980	string		=!<spell>	MKS Spell hash list (old format)
196990	string		=!<spell2>	MKS Spell hash list
19700# Too simple - MPi
19701#0	string		AH		Halo(TM) bitmapped font file
197020	lelong		0x08086b70	TurboC BGI file
197030	lelong		0x08084b50	TurboC Font file
19704
19705# Debian#712046: The magic below identifies "Delphi compiled form data".
19706# An additional source of information is available at:
19707# http://www.woodmann.com/fravia/dafix_t1.htm
197080	string		TPF0
19709>4	pstring		>\0		Delphi compiled form '%s'
19710
19711# tests for DBase files moved, updated and merged to database
19712
197130	string		PMCC		Windows 3.x .GRP file
197141	string		RDC-meg		MegaDots
19715>8	byte		>0x2F		version %c
19716>9	byte		>0x2F		\b.%c file
197170	lelong		0x4C
19718>4	lelong		0x00021401	Windows shortcut file
19719
19720# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
19721# only for windows versions equal or greater 3.0
197220x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
19723!:mime	application/x-dosexec
19724#>2	string	 	>\0		\b, Title:%.30s
19725>0x24	string		>\0		\b for %.63s
19726>0x65	string		>\0		\b, directory=%.64s
19727>0xA5	string		>\0		\b, parameters=%.64s
19728#>0x181	leshort	x	\b, offset %x
19729#>0x183	leshort	x	\b, offsetdata %x
19730#>0x185	leshort	x	\b, section length %x
19731>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
19732>>&0x5e		ubyte	>0
19733>>>&-1		string	<PIFMGR.DLL		\b, icon=%s
19734#>>>&-1		string	PIFMGR.DLL		\b, icon=%s
19735>>>&-1		string	>PIFMGR.DLL		\b, icon=%s
19736>>&0xF0		ubyte	>0
19737>>>&-1		string	<Terminal		\b, font=%.32s
19738#>>>&-1		string	=Terminal		\b, font=%.32s
19739>>>&-1		string	>Terminal		\b, font=%.32s
19740>>&0x110	ubyte	>0
19741>>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
19742#>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
19743>>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
19744#>0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
19745#>0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
19746>0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
19747#>0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
19748>0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
19749#>>&06		string	x			\b:%s
19750>0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
19751#>>&06		string	x			\b:%s
19752
19753# DOS EPS Binary File Header
19754# From: Ed Sznyter <ews@Black.Market.NET>
197550	belong		0xC5D0D3C6	DOS EPS Binary File
19756!:mime	image/x-eps
19757>4	long		>0		Postscript starts at byte %d
19758>>8	long		>0		length %d
19759>>>12	long		>0		Metafile starts at byte %d
19760>>>>16	long		>0		length %d
19761>>>20	long		>0		TIFF starts at byte %d
19762>>>>24	long		>0		length %d
19763
19764# TNEF magic From "Joomy" <joomy@se-ed.net>
19765# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
197660	lelong		0x223e9f78	TNEF
19767!:mime	application/vnd.ms-tnef
19768
19769# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
19770# of http://www.davep.org/norton-guides/ng2h-105.tgz
19771# http://en.wikipedia.org/wiki/Norton_Guides
197720	string		NG\0\001
19773# only value 0x100 found at offset 2
19774>2	ulelong		0x00000100	Norton Guide
19775# Title[40]
19776>>8	string		>\0		"%-.40s"
19777#>>6	uleshort	x		\b, MenuCount=%u
19778# szCredits[5][66]
19779>>48	string		>\0		\b, %-.66s
19780>>114	string		>\0		%-.66s
19781
19782# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
19783# of http://www.4dos.info/
19784# pointer,HelpID[8]=4DHnnnmm
197850	ulelong	0x48443408		4DOS help file
19786>4	string	x			\b, version %-4.4s
19787
19788# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
197890	ulequad	0x3a000000024e4c	MS Advisor help file
19790
19791# HtmlHelp files (.chm)
197920	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data
19793
19794# GFA-BASIC (Wolfram Kleff)
197952	string/b	GFA-BASIC3	GFA-BASIC 3 data
19796
19797#------------------------------------------------------------------------------
19798# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
19799# Update: Joerg Jenderek
19800# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format)
19801# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx
19802# Note: verified by `7z l *.cab`
19803# Microsoft Cabinet files
198040	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
19805#
19806# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool
19807# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE
19808# because some archive does not have *.diag* as 1st or 2nd archive member like
19809# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab
19810# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section
19811>0x2c	search/980/c	.diag		\b, Diagnostic
19812!:mime	application/vnd.ms-cab-compressed
19813!:ext	diagcab
19814# http://fileformats.archiveteam.org/wiki/PUZ
19815# Microsoft Publisher version about 2003 has a "Pack and Go" feature that
19816# bundles a Publisher document *PNG.pub with all links into a CAB
19817>0x2c	search/300/c	png.pub\0		\b, Publisher Packed and Go
19818!:mime	application/vnd.ms-cab-compressed
19819!:ext	puz
19820# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation
19821>0x2c	search/17/c	ppview32.exe\0		\b, PowerPoint Viewer Packed and Go
19822!:mime	application/vnd.ms-powerpoint
19823#!:mime	application/mspowerpoint
19824!:ext	ppz
19825# http://www.incredimail.com/
19826# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims
19827>0x2c	search/3369/c	content.ini\0	\b, IncrediMail
19828!:mime	application/x-incredimail
19829# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf
19830>>0x2c	search/83/c	Flavor.htm\0	ecard
19831!:ext	imf
19832# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims
19833>>0x2c	search/211/c	.swf\0		skin
19834!:ext	ims
19835# member anim.im3 implies IncrediMail animation like in letter_fold.ima
19836>>0x2c	search/92/c	anim.im3\0	animation
19837!:ext	ima
19838# other IncrediMail cab archive
19839>>0x2c	default		x
19840>>>0x2c	search/116/c	thumb		ecard, image, notifier or skin
19841!:ext	imf/imi/imn/ims
19842# http://file-extension.net/seeker/file_extension_ime
19843>>>0x2c	default		x		emoticons or sound
19844!:ext	ime/imw
19845# no Diagnostic and IncrediMail
19846>0x2c	default		x
19847# look for 1st member name
19848>>(16.l+16)	ubyte	x
19849# https://en.wikipedia.org/wiki/SNP_file_format
19850>>>&-1	string/c 	_accrpt_.snp	\b, Access report snapshot
19851!:mime	application/msaccess
19852!:ext	snp
19853# https://www.cabextract.org.uk/wince_cab_format/
19854# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer
19855>>>&7	string 		=.000		\b, WinCE install
19856!:mime	application/vnd.ms-cab-compressed
19857!:ext	cab
19858
19859# http://support.microsoft.com/kb/934307/en-US
19860# All inspected MSU contain a file with name WSUSSCAN.cab
19861# that is called "Windows Update meta data" by Microsoft
19862>>>&-1	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
19863!:mime	application/vnd.ms-cab-compressed
19864!:ext	msu
19865>>>&-1	default		x
19866# look at point charcter of 1st archive member name for file name extension
19867>>>>&-1	search/255 	.
19868# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm
19869# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002
19870# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB
19871>>>>>&0	string/c	ppt\0		\b, PowerPoint Packed and Go
19872!:mime	application/vnd.ms-powerpoint
19873#!:mime	application/mspowerpoint
19874!:ext	ppz
19875# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx
19876# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack
19877# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack
19878>>>>>&0	string/c	theme		\b, Windows
19879!:mime	application/x-windows-themepack
19880# http://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8
19881# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack
19882# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme
19883>>>>>>(16.l+16)	string	=Panoram	8
19884!:ext	deskthemepack
19885>>>>>>(16.l+16)	string	!Panoram	7 or 8
19886!:ext	themepack/deskthemepack
19887>>>>>>(16.l+16)	ubyte	x		Theme Pack
19888>>>>>&0	default		x
19889# look for null terminator of 1st member name
19890>>>>>>&0	search/255 	\0
19891# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu
19892>>>>>>>&16	string/c 	wsusscan.cab	\b, Microsoft Standalone Update
19893!:mime	application/vnd.ms-cab-compressed
19894!:ext	msu
19895>>>>>>>&16	default	x
19896# archive with more then one file need some output in version 5.32 to avoid error message like
19897# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type
19898# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type
19899# file: could not find any valid magic files!
19900>>>>>>>>28	uleshort	>1	\b, many
19901!:mime	application/vnd.ms-cab-compressed
19902!:ext	cab
19903# remaining archives with just one file
19904>>>>>>>>28	uleshort	=1
19905# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386
19906>>>>>>>>>30	uleshort	=0x0000	\b, Windows 2000/XP setup
19907# cut of last char of source extension and add underscore to generate extension
19908# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_
19909!:mime	application/vnd.ms-cab-compressed
19910!:ext	_/?_/??_
19911# archive need some output like "single" in version 5.32 to avoid error messages
19912>>>>>>>>>30	uleshort	!0x0000	\b, single
19913!:mime	application/vnd.ms-cab-compressed
19914!:ext	cab
19915# TODO: additional extensions like
19916# .xsn	InfoPath Dynamic Form
19917# .xtp	InfoPath Template Part
19918# .lvf	Logitech Video Effects Face Accessory
19919>8	ulelong		x		\b, %u bytes
19920>28	uleshort		1		\b, 1 file
19921>28	uleshort		>1		\b, %u files
19922# Reserved fields, set to zero
19923#>4	belong		!0		\b, reserved1 %x
19924#>12	belong		!0		\b, reserved2 %x
19925# offset of the first CFFILE entry coffFiles: minimal 2Ch
19926>16	ulelong		x		\b, at 0x%x
19927>(16.l)	use		cab-file
19928# at least also 2nd member
19929>28	uleshort		>1
19930>>(16.l+16)	ubyte	x
19931>>>&0	search/255 	\0
19932# second member info
19933>>>>&0	use		cab-file
19934#>20	belong		!0		\b, reserved %x
19935# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3
19936>24	ubeshort	!0x0301		\b version 0x%x
19937# number of CFFOLDER entries
19938>26	uleshort	>1		\b, %u cffolders
19939# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields
19940# only found for flags 0 1 2 3 4 not 7
19941>30	uleshort	>0		\b, flags 0x%x
19942# Cabinet files have a 16-bit cabinet setID field that is designed for application use.
19943# default is zero, however, the -i option of cabarc can be used to set this field
19944>32	uleshort	>0		\b, ID %u
19945# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet
19946#>34	uleshort	x		\b, iCabinet %u
19947# add one for display because humans start numbering by 1 and also fit to name of disk szDisk*
19948>34	uleshort+1	x		\b, number %u
19949>30	uleshort	&0x0004		\b, extra bytes
19950# cbCFHeader optional size of per-cabinet reserved area 14h 1800h
19951>>36	uleshort	>0		%u in head
19952# cbCFFolder is optional size of per-folder reserved area
19953>>38	ubyte		>0		%u in folder
19954# cbCFData is optional size of per-datablock reserved area
19955>>39	ubyte		>0		%u in data block
19956# optional per-cabinet reserved area abReserve[cbCFHeader]
19957>>36	uleshort	>0
19958# 1st CFFOLDER after reserved area in header
19959>>>(36.s+40)	use			cab-folder
19960# no reserved area in header
19961>30	uleshort	^0x0004
19962# no previous and next cab archive
19963>>30	uleshort		=0x0000
19964>>>36	use				cab-folder
19965# only previous cab archive
19966>>30	uleshort		=0x0001	\b, previous
19967>>>36	use				cab-anchor
19968# only next cab archive
19969>>30	uleshort		=0x0002	\b, next
19970>>>36	use				cab-anchor
19971# previous+next cab archive
19972# can not use sub routine cab-anchor to display previous and next cabinet together
19973#>>>36	use				cab-anchor
19974#>>>>&0	use				cab-anchor
19975>>30	uleshort		=0x0003	\b, previous
19976>>>36	string		x		%s
19977# optional name of previous disk szDisk*
19978>>>>&1	string		x		disk %s
19979>>>>>&1	string		x		\b, next %s
19980# optional name of previous disk szDisk*
19981>>>>>>&1	string		x	disk %s
19982>>>>>>>&1	use			cab-folder
19983#	display filename and disk name of previous or next cabinet
199840       name    			cab-anchor
19985# optional name of previous/next cabinet file szCabinet*[255]
19986>&0	string		x		%s
19987# optional name of previous/next disk szDisk*[255]
19988>>&1	string		x		disk %s
19989#	display folder structure CFFOLDER information like compression of cabinet
199900       name    			cab-folder
19991# offset of the CFDATA block in this folder
19992#>0	ulelong		x		\b, coffCabStart 0x%x
19993# number of CFDATA blocks in folder
19994>4	uleshort	x		\b, %u datablock
19995# plural s
19996>4	uleshort	>1		\bs
19997# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15
19998>6	uleshort	x		\b, 0x%x compression
19999# optional per-folder reserved area
20000#>8	ubequad		x		\b, abReserve 0x%llx
20001#	display member structure CFFILE information like member name of cabinet
200020       name    			cab-file
20003# cbFile is uncompressed size of file in bytes
20004#>0	ulelong		x		\b, cbFile %u
20005# uoffFolderStart is uncompressed offset of file in folder
20006#>4	ulelong		>0		\b, uoffFolderStart 0x%x
20007# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet
20008# define ifoldCONTINUED_FROM_PREV      (0xFFFD)
20009# define ifoldCONTINUED_TO_NEXT        (0xFFFE)
20010# define ifoldCONTINUED_PREV_AND_NEXT  (0xFFFF)
20011>8	uleshort	>0		\b, iFolder 0x%x
20012# date stamp for file
20013#>10	uleshort	x		\b, date 0x%x
20014# time stamp for file
20015#>12	uleshort	x		\b, time 0x%x
20016# attribs is attribute flags for file
20017# define  _A_RDONLY       (0x01)  file is read-only
20018# define  _A_HIDDEN       (0x02)  file is hidden
20019# define  _A_SYSTEM       (0x04)  file is a system file
20020# define  _A_ARCH         (0x20)  file modified since last backup
20021# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab
20022# define  _A_EXEC         (0x40)  run after extraction
20023# define  _A_NAME_IS_UTF  (0x80)  szName[] contains UTF
20024# define  UNKNOWN       (0x0100)  undocumented or accident
20025#>14	uleshort	x		\b, attribs 0x%x
20026>14	uleshort	>0		+
20027>>14	uleshort	&0x0001		\bR
20028>>14	uleshort	&0x0002		\bH
20029>>14	uleshort	&0x0004		\bS
20030>>14	uleshort	&0x0020		\bA
20031>>14	uleshort	&0x0040		\bX
20032>>14	uleshort	&0x0080		\bUtf
20033# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB
20034>>14	uleshort	&0x0100		\b?
20035# szName is name of archive member
20036>16	string		x		"%s"
20037# next archive member name if more files
20038#>>&17	string		>\0		\b, NEXT NAME %-.50s
20039
20040# InstallShield Cabinet files
200410	string/b	ISc(		InstallShield Cabinet archive data
20042>5	byte&0xf0	=0x60		version 6,
20043>5	byte&0xf0	!0x60		version 4/5,
20044>(12.l+40)	lelong	x		%u files
20045
20046# Windows CE package files
200470	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
20048>20	lelong		0		\b, architecture-independent
20049>20	lelong		103		\b, Hitachi SH3
20050>20	lelong		104		\b, Hitachi SH4
20051>20	lelong		0xA11		\b, StrongARM
20052>20	lelong		4000		\b, MIPS R4000
20053>20	lelong		10003		\b, Hitachi SH3
20054>20	lelong		10004		\b, Hitachi SH3E
20055>20	lelong		10005		\b, Hitachi SH4
20056>20	lelong		70001		\b, ARM 7TDMI
20057>52	leshort		1		\b, 1 file
20058>52	leshort		>1		\b, %u files
20059>56	leshort		1		\b, 1 registry entry
20060>56	leshort		>1		\b, %u registry entries
20061
20062
20063# Windows Enhanced Metafile (EMF)
20064# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
20065# for further information.
200660	ulelong 1
20067>40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
20068>>44	ulelong x		version 0x%x
20069
20070
200710	string/b	\224\246\056		Microsoft Word Document
20072!:mime	application/msword
20073
20074512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	Microsoft Word Document
20075!:mime	application/msword
20076
20077# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
20078# Magic type for Dell's BIOS .hdr files
20079# Dell's .hdr
200800	string/b $RBU
20081>23	string Dell			%s system BIOS
20082>5	byte   2
20083>>48	byte   x			version %d.
20084>>49	byte   x			\b%d.
20085>>50	byte   x			\b%d
20086>5	byte   <2
20087>>48	string x			version %.3s
20088
20089# Type: Microsoft Document Imaging Format (.mdi)
20090# URL:	http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
20091# From: Daniele Sempione <scrows@oziosi.org>
20092# Too weak (EP)
20093#0	short	0x5045			Microsoft Document Imaging Format
20094
20095# MS eBook format (.lit)
200960	string/b	ITOLITLS		Microsoft Reader eBook Data
20097>8	lelong	x			\b, version %u
20098!:mime					application/x-ms-reader
20099
20100# Windows CE Binary Image Data Format
20101# From: Dr. Jesus <j@hug.gs>
201020	string/b	B000FF\n	Windows Embedded CE binary image
20103
20104# Windows Imaging (WIM) Image
201050	string/b	MSWIM\000\000\000	Windows imaging (WIM) image
201060	string/b	WLPWM\000\000\000	Windows imaging (WIM) image, wimlib pipable format
20107
20108# The second byte of these signatures is a file version; I don't know what,
20109# if anything, produced files with version numbers 0-2.
20110# From: John Elliott <johne@seasip.demon.co.uk>
201110	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
201120	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
201130	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
201140	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)
20115
201160	string	MIOPEN		Mallard BASIC Jetsam data
201170	string	Jetsam0		Mallard BASIC Jetsam index data
20118
20119# DOS backup 2.0 to 3.2
20120
20121# backupid.@@@
20122
20123# plausibility check for date
201240x3	ushort	>1979
20125>0x5	ubyte-1 <31
20126>>0x6	ubyte-1 <12
20127# actually 121 nul bytes
20128>>>0x7	string	\0\0\0\0\0\0\0\0
20129>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
20130!:ext @@@
20131>>>>0x0 ubyte	0xff	\b, last disk
20132
20133# backed up file
20134
20135# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
20136# by looking for trailing nul of maximal file name string
201370x52	ubyte	0
20138# test for flag byte: FFh~complete file, 00h~split file
20139# FFh -127 =	-1 -127 =	-128
20140# 00h -127 =	 0 -127 =	-127
20141>0	byte-127	<-126
20142# plausibility check for file name length
20143>>0x53	ubyte-1	<78
20144# looking for terminating nul of file name string
20145>>>(0x53.b+4)	ubyte	0
20146# looking if last char of string is valid DOS file name
20147>>>>(0x53.b+3)	ubyte	>0x1F
20148# actually 44 nul bytes
20149# but sometimes garbage according to Ralf Quint. So can not be used as test
20150#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
20151# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
20152# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
20153>>>>>5	ubyte&0x8C	0x0C
20154# ./msdos (version 5.30) labeled the entry as
20155# "DOS 2.0 backed up file %s, split file, sequence %d" or
20156# "DOS 2.0 backed up file %s, complete file"
20157>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
20158#>>>>>>0	ubyte	0xff	complete
20159>>>>>>0	ubyte	0
20160>>>>>>>1 uleshort	x	sequence %d of
20161# full file name with path but without drive letter and colon stored from 0x05 til 0x52
20162>>>>>>0x5	string	x	file %s
20163# backup name is original filename
20164#!:ext	*
20165# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
20166# file: line 1169: Bad magic entry '  *'
20167# after header original file content
20168>>>>>>128	indirect x	\b;
20169
20170
20171# DOS backup 3.3 to 5.x
20172
20173# CONTROL.nnn files
201740	string	\x8bBACKUP\x20
20175# actually 128 nul bytes
20176>0xa	string	\0\0\0\0\0\0\0\0
20177>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
20178>>0x8a	ubyte	0xff	\b, last disk
20179
20180# NB: The BACKUP.nnn files consist of the files backed up,
20181# concatenated.
20182
20183#------------------------------------------------------------------------------
20184# $File: msooxml,v 1.8 2018/05/24 18:11:17 christos Exp $
20185# msooxml:  file(1) magic for Microsoft Office XML
20186# From: Ralf Brown <ralf.brown@gmail.com>
20187
20188# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
20189#   archive.  The first member file is normally "[Content_Types].xml".
20190#   but some libreoffice generated files put this later. Perhaps skip
20191#   the "[Content_Types].xml" test?
20192# Since MSOOXML doesn't have anything like the uncompressed "mimetype"
20193#   file of ePub or OpenDocument, we'll have to scan for a filename
20194#   which can distinguish between the three types
20195
201960		name		msooxml
20197>0		string		word/		Microsoft Word 2007+
20198!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
20199>0		string		ppt/		Microsoft PowerPoint 2007+
20200!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
20201>0		string		xl/		Microsoft Excel 2007+
20202!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
20203
20204# start by checking for ZIP local file header signature
202050		string		PK\003\004
20206!:strength +10
20207# make sure the first file is correct
20208>0x1E		use		msooxml
20209>0x1E		regex		\\[Content_Types\\]\\.xml|_rels/\\.rels
20210# skip to the second local file header
20211# since some documents include a 520-byte extra field following the file
20212# header, we need to scan for the next header
20213>>(18.l+49)	search/2000	PK\003\004
20214# now skip to the *third* local file header; again, we need to scan due to a
20215# 520-byte extra field following the file header
20216>>>&26		search/1000	PK\003\004
20217# and check the subdirectory name to determine which type of OOXML
20218# file we have.  Correct the mimetype with the registered ones:
20219# http://technet.microsoft.com/en-us/library/cc179224.aspx
20220>>>>&26		use		msooxml
20221>>>>&26		default		x
20222# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
20223>>>>>&26	search/1000	PK\003\004
20224>>>>>>&26	use		msooxml
20225>>>>>>&26	default		x		Microsoft OOXML
20226
20227#------------------------------------------------------------------------------
20228# $File: msvc,v 1.9 2017/08/02 08:15:20 christos Exp $
20229# msvc:  file(1) magic for msvc
20230# "H. Nanosecond" <aldomel@ix.netcom.com>
20231# Microsoft visual C
20232#
20233# I have version 1.0
20234
20235# .aps
202360	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
20237
20238# .ide
20239#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
202400	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
20241
20242# .res
202430	string	\000\000\000\000\040\000\000\000\377	MSVC .res
202440	string	\377\003\000\377\001\000\020\020\350	MSVC .res
202450	string	\377\003\000\377\001\000\060\020\350	MSVC .res
20246
20247#.lib
202480	string	\360\015\000\000	Microsoft Visual C library
202490	string	\360\075\000\000	Microsoft Visual C library
202500	string	\360\175\000\000	Microsoft Visual C library
20251
20252#.pch
202530	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
20254
20255# Summary: Symbol Table / Debug info used by Microsoft compilers
20256# URL: https://en.wikipedia.org/wiki/Program_database
20257# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
20258# Update: Joerg Jenderek
20259# Note:	test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
20260#	info does only applies partly for older files like msvbvm50.pdb about year 2001
202610	string	Microsoft\ C/C++\040
20262# "Microsoft Program DataBase" by TrID
20263>24	search/14	\r\n\x1A	MSVC program database
20264!:mime	application/x-ms-pdb
20265!:ext	pdb
20266# "MSF 7.00" "program database 2.00" for msvbvm50.pdb
20267>>16	regex	\([0-9.]+\)	ver %s
20268#>>>0x38	search/128123456	/LinkInfo	\b with linkinfo
20269# "MSF 7.00" variant
20270>>0x1e	leshort	0
20271# PageSize 400h 1000h
20272>>>0x20	lelong	x	\b, %d
20273# Page Count
20274>>>0x28	lelong	x	\b*%d bytes
20275# "program database 2.00"  variant
20276>>0x1e	leshort	!0
20277# PageSize 400h
20278>>>0x2c	lelong	x	\b, %d
20279# Page Count for msoo-dll.pdb 4379h
20280>>>0x32	leshort	x	\b*%d bytes
20281
20282# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
202830       string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0     Microsoft Rosyln C# debugging symbols version 1.0
20284
20285#.sbr
202860	string	\000\002\000\007\000	MSVC .sbr
20287>5	string 	>\0	%s
20288
20289#.bsc
202900	string	\002\000\002\001	MSVC .bsc
20291
20292#.wsp
202930	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
20294# these seem to start with the version and contain menus
20295
20296#------------------------------------------------------------------------------
20297# msx:  file(1) magic for the MSX Home Computer
20298# v1.3
20299# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
20300
20301############## MSX Music file formats ##############
20302
20303# Gigamix MGSDRV music file
203040	string/b		MGS	MSX Gigamix MGSDRV3 music file,
20305>6	ubeshort	0x0D0A
20306>>3	byte		x	\bv%c
20307>>4	byte		x	\b.%c
20308>>5	byte		x	\b%c
20309>>8	string		>\0	\b, title: %s
20310
203111	string/b		mgs2\ 	MSX Gigamix MGSDRV2 music file
20312>6	uleshort	0x80
20313>>0x2E	uleshort	0
20314>>>0x30	string		>\0	\b, title: %s
20315
20316# KSS music file
203170	string/b		KSCC	KSS music file v1.03
20318>0xE	byte		0
20319>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
20320>>0xF	byte&0x02	2	\b, soundchip(s): SN76489
20321>>>0xF	byte&0x04	4	stereo
20322>>0xF	byte&0x01	1	\b, YM2413
20323>>0xF	byte&0x08	8	\b, Y8950
20324
203250	string/b		KSSX	KSS music file v1.20
20326>0xE	byte&0xEF	0
20327>>0xF	byte&0x40	0x00	\b, 60Hz
20328>>0xF	byte&0x40	0x40	\b, 50Hz
20329>>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
20330>>0xF	byte&0x02	0x02	\b, soundchips: SN76489
20331>>>0xF	byte&0x04	0x04	stereo
20332>>0xF	byte&0x01	0x01	\b,
20333>>>0xF	byte&0x18	0x00	\bYM2413
20334>>>0xF	byte&0x18	0x08	\bYM2413, Y8950
20335>>>0xF	byte&0x18	0x18	\bYM2413+Y8950 pseudostereo
20336>>0xF	byte&0x18	0x10	\b, Majyutsushi DAC
20337
20338# Moonblaster for Moonsound
203390	string/b		MBMS
20340>4	byte		0x10	MSX Moonblaster for MoonSound music
20341
20342# Music Player K-kaz
203430	string/b		MPK	MSX Music Player K-kaz song
20344>6	ubeshort	0x0D0A
20345>>3	byte		x	v%c
20346>>4	byte		x	\b.%c
20347>>5	byte		x	\b%c
20348
20349# I don't know why these don't work
20350#0	search/0xFFFF	\r\n.FM9
20351#>0	search/0xFFFF	\r\n#FORMAT	MSX Music Player K-kaz source MML file
20352#0	search/0xFFFF	\r\nFM1\ \=
20353#>0	search/0xFFFF	\r\nPSG1\=
20354#>>0	search/0xFFFF	\r\nSCC1\=		MSX MuSiCa MML source file
20355
20356# OPX Music file
203570x35	beshort		0x0d0a
20358>0x7B	beshort		0x0d0a
20359>>0x7D	byte		0x1a
20360>>>0x87	uleshort	0		MSX OPX Music file
20361>>>>0x86	byte		0		v1.5
20362>>>>>0	string		>\32		\b, title: %s
20363>>>>0x86	byte		1		v2.4
20364>>>>>0	string		>\32		\b, title: %s
20365
20366# SCMD music file
203670x8B	string/b		SCMD
20368>0xCE	uleshort	0	MSX SCMD Music file
20369#>>-2	uleshort	0x6a71	; The file must end with this value. How to code this here?
20370>>0x8F	string		>\0		\b, title: %s
20371
203720	search/0xFFFF	\r\n@title
20373>&0	search/0xFFFF	\r\n@m=[	MSX SCMD source MML file
20374
20375
20376############## MSX image file formats ##############
20377
20378# MSX raw VRAM dump
203790	ubyte		0xFE
20380>1	uleshort	0
20381>>5	uleshort	0
20382>>>3	uleshort	0x37FF		MSX SC2/GRP raw image
20383>>>3	uleshort	0x6A00		MSX Graph Saurus SR5 raw image
20384>>>3	uleshort	>0x769E
20385>>>>3	uleshort	<0x8000		MSX GE5/GE6 raw image
20386>>>>>3	uleshort	0x7FFF		\b, with sprite patterns
20387>>>3	uleshort	0xD3FF		MSX screen 7-12 raw image
20388>>>3	uleshort	0xD400		MSX Graph Saurus SR7/SR8/SRS raw image
20389
20390# Graph Saurus compressed images
203910	ubyte		0xFD
20392>1	uleshort	0
20393>>5	uleshort	0
20394>>>3	uleshort	>0x013D		MSX Graph Saurus compressed image
20395
20396# MSX G9B image file
203970	string/b		G9B
20398>1	uleshort	11
20399>>3	uleshort	>10
20400>>>5	ubyte		>0		MSX G9B image, depth=%d
20401>>>>8	uleshort	x		\b, %dx
20402>>>>10	uleshort	x		\b%d
20403>>>>5	ubyte		<9
20404>>>>>6	ubyte		0
20405>>>>>>7	ubyte		x		\b, codec=%d RGB color palettes
20406>>>>>6	ubyte		64		\b, codec=RGB fixed color
20407>>>>>6	ubyte		128		\b, codec=YJK
20408>>>>>6	ubyte		192		\b, codec=YUV
20409>>>>5	ubyte		>8		codec=RGB fixed color
20410>>>>12	ubyte		0		\b, raw
20411>>>>12	ubyte		1		\b, bitbuster compression
20412
20413############## Other MSX file formats ##############
20414
20415# MSX internal ROMs
204160		ubeshort	0xF3C3
20417>2		uleshort	<0x4000
20418>>8		ubyte		0xC3
20419>>>9		uleshort	<0x4000
20420>>>>0x0B	ubeshort	0x00C3
20421>>>>>0x0D	uleshort	<0x4000
20422>>>>>>0x0F	ubeshort	0x00C3
20423>>>>>>>0x11	uleshort	<0x4000
20424>>>>>>>>0x13	ubeshort	0x00C3
20425>>>>>>>>>0x15	uleshort	<0x4000
20426>>>>>>>>>>0x50	ubyte		0xC3
20427>>>>>>>>>>>0x51	uleshort	<0x4000
20428>>>>>>>>>>>>(9.s)	ubyte	0xC3
20429>>>>>>>>>>>>>&0	uleshort	>0x4000
20430>>>>>>>>>>>>>>&0	ubyte	0xC3		MSX BIOS+BASIC
20431>>>>>>>>>>>>>>>0x002D	ubyte+1	<3		\b. version=MSX%d
20432>>>>>>>>>>>>>>>0x002D	ubyte	2		\b, version=MSX2+
20433>>>>>>>>>>>>>>>0x002D	ubyte	3		\b, version=MSX Turbo-R
20434>>>>>>>>>>>>>>>0x002D	ubyte	>3		\b, version=Unknown MSX %d version
20435>>>>>>>>>>>>>>>0x0006	ubyte	x		\b, VDP.DR=0x%2x
20436>>>>>>>>>>>>>>>0x0007	ubyte	x		\b, VDP.DW=0x%2x
20437>>>>>>>>>>>>>>>0x002B	ubyte&0xF	0		\b, charset=Japanese
20438>>>>>>>>>>>>>>>0x002B	ubyte&0xF	1		\b, charset=International
20439>>>>>>>>>>>>>>>0x002B	ubyte&0xF	2		\b, charset=Korean
20440>>>>>>>>>>>>>>>0x002B	ubyte&0xF	>2		\b, charset=Unknown id:%d
20441>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x00		\b, date format=Y-M-D
20442>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x10		\b, date format=M-D-Y
20443>>>>>>>>>>>>>>>0x002B	ubyte&0x70	0x20		\b, date format=D-M-Y
20444>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x00		\b, vfreq=60Hz
20445>>>>>>>>>>>>>>>0x002B	ubyte&0x80	0x80		\b, vfreq=50Hz
20446>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	0		\b, keyboard=Japanese
20447>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	1		\b, keyboard=International
20448>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	2		\b, keyboard=French
20449>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	3		\b, keyboard=UK
20450>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	4		\b, keyboard=German
20451>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	5		\b, keyboard=Unknown id:%d
20452>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	6		\b, keyboard=Spanish
20453>>>>>>>>>>>>>>>0x002C	ubyte&0x0F	>6		\b, keyboard=Unknown id:%d
20454>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x00		\b, basic=Japanese
20455>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	0x10		\b, basic=International
20456>>>>>>>>>>>>>>>0x002C	ubyte&0xF0	>0x10		\b, basic=Unknown id:%d
20457>>>>>>>>>>>>>>>0x002E	ubyte&1		1		\b, built-in MIDI
20458
20459
204600		string/b		CD
20461>2		uleshort	>0x10
20462>>2		uleshort	<0x4000
20463>>>4		uleshort	<0x4000
20464>>>>6		uleshort	<0x4000
20465>>>>>8		ubyte		0xC3
20466>>>>>>9		uleshort	<0x4000
20467>>>>>>>0x10	ubyte		0xC3
20468>>>>>>>>0x11	uleshort	<0x4000
20469>>>>>>>>>0x14	ubyte		0xC3
20470>>>>>>>>>>0x15	uleshort	<0x4000		MSX2/2+/TR SubROM
20471
204720		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
20473>0x5F0		ubequad		0x8282828244380000
20474>>0x150		ubyte		0x38
20475>>>0x170	string		\20\20\20
20476>>>>0x1E32	string		())
20477>>>>>0x2130	ubequad		0xA5A5594924231807
20478>>>>>0x2138	ubequad		0x4A4A3424488830C0	MSX Kanji Font
20479
20480
20481
20482# MSX extension ROMs
204830	string/b		AB
20484>2	uleshort	0x0010			MSX ROM
20485>>2	uleshort	x			\b, init=0x%4x
20486>>4	uleshort	>0			\b, stahdl=0x%4x
20487>>6	uleshort	>0			\b, devhdl=0x%4x
20488>>8	uleshort	>0			\b, bas=0x%4x
20489>2	uleshort	0x4010			MSX ROM
20490>>2	uleshort	x			\b, init=0x%04x
20491>>4	uleshort	>0			\b, stahdl=0x%04x
20492>>6	uleshort	>0			\b, devhdl=0x%04x
20493>>8	uleshort	>0			\b, bas=0x%04x
20494>2	uleshort	0x8010			MSX ROM
20495>>2	uleshort	x			\b, init=0x%04x
20496>>4	uleshort	>0			\b, stahdl=0x%04x
20497>>6	uleshort	>0			\b, devhdl=0x%04x
20498>>8	uleshort	>0			\b, bas=0x%04x
204990	string/b		AB\0\0
20500>6	uleshort	0
20501>>4	uleshort	>0x400F			MSX-BASIC extension ROM
20502>>>4	uleshort	>0			\b, stahdl=0x%04x
20503>>>6	uleshort	>0			\b, devhdl=0x%04x
20504>>>0x1C		string		OPLL			\b, MSX-Music
20505>>>>0x18	string		PAC2			\b (external)
20506>>>>0x18	string		APRL			\b (internal)
20507
205080	string/b		AB\0\0\0\0
20509>6	uleshort	>0x400F			MSX device BIOS
20510>>6	uleshort	>0			\b, devhdl=0x%04x
20511
20512
205130	string/b		AB
20514#>2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
20515#>3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
20516#>3	string		@3\x80IA862		Golvellius MSX1 ROM
20517>2	uleshort	>15
20518>>2	uleshort	<0xC000
20519>>>8	string		\0\0\0\0\0\0\0\0
20520>>>>(2.s&0x3FFF)	uleshort	>0		MSX ROM
20521>>>>>0x10	string		YZ\0\0\0\0		Konami Game Master 2 MSX ROM
20522>>>>>0x10	string		CD			\b, Konami RC-
20523>>>>>>0x12	ubyte		x			\b%d
20524>>>>>>0x13	ubyte/16	x			\b%d
20525>>>>>>0x13	ubyte&0xF	x			\b%d
20526>>>>>0x10	string		EF			\b, Konami RC-
20527>>>>>>0x12	ubyte		x			\b%d
20528>>>>>>0x13	ubyte/16	x			\b%d
20529>>>>>>0x13	ubyte&0xF	x			\b%d
20530>>>>>2	uleshort	x			\b, init=0x%04x
20531>>>>>4	uleshort	>0			\b, stahdl=0x%04x
20532>>>>>6	uleshort	>0			\b, devhdl=0x%04x
20533>>>>>8	uleshort	>0			\b, bas=0x%04x
20534>>>2	uleshort	0
20535>>>>4	uleshort	0
20536>>>>>6	uleshort	0
20537>>>>>>8	uleshort	>0			MSX BASIC program in ROM, bas=0x%04x
20538
205390x4000	string/b		AB
20540>0x4002	uleshort	>0x400F
20541>>0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
20542>>>0x4002	uleshort	x			\b, init=0x%04x
20543>>>0x4004	uleshort	>0			\b, stahdl=0x%04x
20544>>>0x4006	uleshort	>0			\b, devhdl=0x%04x
20545>>>0x4008	uleshort	>0			\b, bas=0x%04x
20546
205470x8000	string/b		AB
20548>0x8002	uleshort	>0x400F
20549>>0x800A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
20550>>>0x8002	uleshort	x			\b, init=0x%04x
20551>>>0x8004	uleshort	>0			\b, stahdl=0x%04x
20552>>>0x8006	uleshort	>0			\b, devhdl=0x%04x
20553>>>0x8008	uleshort	>0			\b, bas=0x%04x
20554
20555
205560x3C000	string/b		AB
20557>0x3C008	string		\0\0\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
20558>>0x3C002	uleshort	x			\b, init=0x%04x
20559>>0x3C004	uleshort	>0			\b, stahdl=0x%04x
20560>>0x3C006	uleshort	>0			\b, devhdl=0x%04x
20561>>0x3C008	uleshort	>0			\b, bas=0x%04x
20562
20563# MSX BIN file
20564#0	byte		0xFE
20565#>1	uleshort	>0x8000
20566#>>3	uleshort	>0x8004
20567#>>>5	uleshort	>0x8000			MSX BIN file
20568
20569# MSX-BASIC file
205700	byte		0xFF
20571>3	uleshort	0x000A
20572>>1	uleshort	>0x8000			MSX-BASIC program
20573
20574# MSX .CAS file
205750	string/b	\x1F\xA6\xDE\xBA\xCC\x13\x7D\x74	MSX cassette archive
20576
20577# Mega-Assembler file
205780	byte		0xFE
20579>1	uleshort	0x0001
20580>>5	uleshort	0xffff
20581>>>6	byte		0x0A		MSX Mega-Assembler source
20582
20583# Execrom Patchfile
205840	string		ExecROM\ patchfile\x1A	MSX ExecROM patchfile
20585>0x12	ubyte/16	x		v%d
20586>0x12	ubyte&0xF	x		\b.%d
20587>0x13	ubyte		x		\b, contains %d patches
20588
20589# Konami's King's Valley-2 custom stage (ELG file)
205904	uleshort	0x0900
20591>0xF	byte		1
20592>>0x14	byte		0
20593>>>0x1E	string		\040\040\040
20594>>>>0x23	byte	1
20595>>>>>0x25	byte	0
20596>>>>>>0x15	string	>\x30
20597>>>>>>>0x15	string	<\x5A		Konami King's Valley-2 custom stage, title: "%-8.8s"
20598>>>>>>>>0x1D	byte	<32	\b, theme: %d
20599
20600# Metal Gear 1 savegame
20601#0x4F	string	\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
20602#>>0x60	string	\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
20603#>>>0x7B	string	\0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00	Metal Gear 1 savegame
20604
20605# ------------------------------------------------------------------------
20606# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
20607# mup: file(1) magic for Mup (Music Publisher) input file.
20608#
20609# From: Abel Cheung <abel (@) oaka.org>
20610#
20611# NOTE: This header is mainly proposed in the Arkkra mailing list,
20612# and is not a mandatory header because of old mup input file
20613# compatibility. Noteedit also use mup format, but is not forcing
20614# user to use any header as well.
20615#
206160		search/1	//!Mup		Mup music publication program input text
20617>6		string		-Arkkra		(Arkkra)
20618>>13		string		-
20619>>>16		string		.
20620>>>>14		string		x		\b, need V%.4s
20621>>>15		string		.
20622>>>>14		string		x		\b, need V%.3s
20623>6		string		-
20624>>9		string		.
20625>>>7		string		x		\b, need V%.4s
20626>>8		string		.
20627>>>7		string		x		\b, need V%.3s
20628#------------------------------------------------------------------------------
20629# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
20630# music:  file (1) magic for music formats
20631
20632# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
20633# and Bagpipe Writer by Doug Wickstrom
20634#
206350	string		Bagpipe		Bagpipe
20636>8	string		Reader		Reader
20637>>15	string		>\0		(version %.3s)
20638>8	string		Music\ Writer	Music Writer
20639>>20	string		:
20640>>>21	string		>\0		(version %.3s)
20641>>21	string		Gold		Gold
20642>>>25	string		:
20643>>>>26	string		>\0		(version %.3s)
20644
20645
20646#------------------------------------------------------------------------------
20647# nasa:	file(1) magic
20648
20649# From: Barry Carter <carter.barry@gmail.com>
206500	string	DAF/SPK				NASA SPICE file (binary format)
206510	string	DAFETF\ NAIF\ DAF\ ENCODED	NASA SPICE file (transfer format)
20652
20653#-----------------------------------------------------------------------------
20654# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
20655# natinst:  file(1) magic for National Instruments Code Files
20656
20657#
20658# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores
20659# version 1
20660# Many formats still missing, we use, for the moment LabVIEW
20661# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
20662#
206630       string          RSRC            National Instruments,
20664# Check if it's a LabVIEW File
20665>8      string          LV              LabVIEW File,
20666# Check which kind of file it is
20667>>10    string          SB              Code Resource File, data
20668>>10    string          IN              Virtual Instrument Program, data
20669>>10    string          AR              VI Library, data
20670# This is for Menu Libraries
20671>8      string          LMNULBVW        Portable File Names, data
20672# This is for General Resources
20673>8      string          rsc             Resources File, data
20674# This is for VXI Package
206750       string          VMAP            National Instruments, VXI File, data
20676
20677#------------------------------------------------------------------------------
20678# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
20679# ncr:  file(1) magic for NCR Tower objects
20680#
20681# contributed by
20682# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
20683# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
20684#
206850	beshort		000610	Tower/XP rel 2 object
20686>12	   belong		>0	not stripped
20687>20	   beshort		0407	executable
20688>20	   beshort		0410	pure executable
20689>22	   beshort		>0	- version %d
206900	beshort		000615	Tower/XP rel 2 object
20691>12	   belong		>0	not stripped
20692>20	   beshort		0407	executable
20693>20	   beshort		0410	pure executable
20694>22	   beshort		>0	- version %d
206950	beshort		000620	Tower/XP rel 3 object
20696>12	   belong		>0	not stripped
20697>20	   beshort		0407	executable
20698>20	   beshort		0410	pure executable
20699>22	   beshort		>0	- version %d
207000	beshort		000625	Tower/XP rel 3 object
20701>12	   belong		>0	not stripped
20702>20	   beshort		0407	executable
20703>20	   beshort		0410	pure executable
20704>22	   beshort		>0	- version %d
207050	beshort		000630	Tower32/600/400 68020 object
20706>12	   belong		>0	not stripped
20707>20	   beshort		0407	executable
20708>20	   beshort		0410	pure executable
20709>22	   beshort		>0	- version %d
207100	beshort		000640	Tower32/800 68020
20711>18	   beshort		&020000	w/68881 object
20712>18	   beshort		&040000	compatible object
20713>18	   beshort		&060000	object
20714>20	   beshort		0407	executable
20715>20	   beshort		0413	pure executable
20716>12	   belong		>0	not stripped
20717>22	   beshort		>0	- version %d
207180	beshort		000645	Tower32/800 68010
20719>18	   beshort		&040000	compatible object
20720>18	   beshort		&060000 object
20721>20	   beshort		0407	executable
20722>20	   beshort		0413	pure executable
20723>12	   belong		>0	not stripped
20724>22	   beshort		>0	- version %d
20725
20726#------------------------------------------------------------
20727# $File: neko,v 1.1 2009/11/10 20:36:10 christos Exp $
20728
20729# From: Mikhail Gusarov <dottedmag@dottedmag.net>
20730# NekoVM (http://nekovm.org/) bytecode
207310	string		NEKO	NekoVM bytecode
20732>4	lelong		x	(%d global symbols,
20733>8	lelong		x	%d global fields,
20734>12	lelong		x	%d bytecode ops)
20735!:mime	application/x-nekovm-bytecode
20736
20737
20738#------------------------------------------------------------------------------
20739# $File: netbsd,v 1.25 2017/09/28 02:37:47 christos Exp $
20740# netbsd:  file(1) magic for NetBSD objects
20741#
20742# All new-style magic numbers are in network byte order.
20743# The old-style magic numbers are indistinguishable from the same magic
20744# numbers used in other systems, and are handled, for all those systems,
20745# in aout.
20746#
20747
207480	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
20749>0	byte			&0x80
20750>>20	lelong			<4096		shared library
20751>>20	lelong			=4096		dynamically linked executable
20752>>20	lelong			>4096		dynamically linked executable
20753>0	byte			^0x80		executable
20754>16	lelong			>0		not stripped
207550	belong&0377777777	041400410	a.out NetBSD/i386 pure
20756>0	byte			&0x80		dynamically linked executable
20757>0	byte			^0x80		executable
20758>16	lelong			>0		not stripped
207590	belong&0377777777	041400407	a.out NetBSD/i386
20760>0	byte			&0x80		dynamically linked executable
20761>0	byte			^0x80
20762>>0	byte			&0x40		position independent
20763>>20	lelong			!0		executable
20764>>20	lelong			=0		object file
20765>16	lelong			>0		not stripped
207660	belong&0377777777	041400507	a.out NetBSD/i386 core
20767>12	string			>\0		from '%s'
20768>32	lelong			!0		(signal %d)
20769
207700	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
20771>0	byte			&0x80
20772>>20	belong			<8192		shared library
20773>>20	belong			=8192		dynamically linked executable
20774>>20	belong			>8192		dynamically linked executable
20775>0	byte			^0x80		executable
20776>16	belong			>0		not stripped
207770	belong&0377777777	041600410	a.out NetBSD/m68k pure
20778>0	byte			&0x80		dynamically linked executable
20779>0	byte			^0x80		executable
20780>16	belong			>0		not stripped
207810	belong&0377777777	041600407	a.out NetBSD/m68k
20782>0	byte			&0x80		dynamically linked executable
20783>0	byte			^0x80
20784>>0	byte			&0x40		position independent
20785>>20	belong			!0		executable
20786>>20	belong			=0		object file
20787>16	belong			>0		not stripped
207880	belong&0377777777	041600507	a.out NetBSD/m68k core
20789>12	string			>\0		from '%s'
20790>32	belong			!0		(signal %d)
20791
207920	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
20793>0	byte			&0x80
20794>>20	belong			<4096		shared library
20795>>20	belong			=4096		dynamically linked executable
20796>>20	belong			>4096		dynamically linked executable
20797>0	byte			^0x80		executable
20798>16	belong			>0		not stripped
207990	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
20800>0	byte			&0x80		dynamically linked executable
20801>0	byte			^0x80		executable
20802>16	belong			>0		not stripped
208030	belong&0377777777	042000407	a.out NetBSD/m68k4k
20804>0	byte			&0x80		dynamically linked executable
20805>0	byte			^0x80
20806>>0	byte			&0x40		position independent
20807>>20	belong			!0		executable
20808>>20	belong			=0		object file
20809>16	belong			>0		not stripped
208100	belong&0377777777	042000507	a.out NetBSD/m68k4k core
20811>12	string			>\0		from '%s'
20812>32	belong			!0		(signal %d)
20813
208140	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
20815>0	byte			&0x80
20816>>20	lelong			<4096		shared library
20817>>20	lelong			=4096		dynamically linked executable
20818>>20	lelong			>4096		dynamically linked executable
20819>0	byte			^0x80		executable
20820>16	lelong			>0		not stripped
208210	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
20822>0	byte			&0x80		dynamically linked executable
20823>0	byte			^0x80		executable
20824>16	lelong			>0		not stripped
208250	belong&0377777777	042200407	a.out NetBSD/ns32532
20826>0	byte			&0x80		dynamically linked executable
20827>0	byte			^0x80
20828>>0	byte			&0x40		position independent
20829>>20	lelong			!0		executable
20830>>20	lelong			=0		object file
20831>16	lelong			>0		not stripped
208320	belong&0377777777	042200507	a.out NetBSD/ns32532 core
20833>12	string			>\0		from '%s'
20834>32	lelong			!0		(signal %d)
20835
208360	belong&0377777777	045200507	a.out NetBSD/powerpc core
20837>12	string			>\0		from '%s'
20838
208390	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
20840>0	byte			&0x80
20841>>20	belong			<8192		shared library
20842>>20	belong			=8192		dynamically linked executable
20843>>20	belong			>8192		dynamically linked executable
20844>0	byte			^0x80		executable
20845>16	belong			>0		not stripped
208460	belong&0377777777	042400410	a.out NetBSD/SPARC pure
20847>0	byte			&0x80		dynamically linked executable
20848>0	byte			^0x80		executable
20849>16	belong			>0		not stripped
208500	belong&0377777777	042400407	a.out NetBSD/SPARC
20851>0	byte			&0x80		dynamically linked executable
20852>0	byte			^0x80
20853>>0	byte			&0x40		position independent
20854>>20	belong			!0		executable
20855>>20	belong			=0		object file
20856>16	belong			>0		not stripped
208570	belong&0377777777	042400507	a.out NetBSD/SPARC core
20858>12	string			>\0		from '%s'
20859>32	belong			!0		(signal %d)
20860
208610	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
20862>0	byte			&0x80
20863>>20	lelong			<4096		shared library
20864>>20	lelong			=4096		dynamically linked executable
20865>>20	lelong			>4096		dynamically linked executable
20866>0	byte			^0x80		executable
20867>16	lelong			>0		not stripped
208680	belong&0377777777	042600410	a.out NetBSD/pmax pure
20869>0	byte			&0x80		dynamically linked executable
20870>0	byte			^0x80		executable
20871>16	lelong			>0		not stripped
208720	belong&0377777777	042600407	a.out NetBSD/pmax
20873>0	byte			&0x80		dynamically linked executable
20874>0	byte			^0x80
20875>>0	byte			&0x40		position independent
20876>>20	lelong			!0		executable
20877>>20	lelong			=0		object file
20878>16	lelong			>0		not stripped
208790	belong&0377777777	042600507	a.out NetBSD/pmax core
20880>12	string			>\0		from '%s'
20881>32	lelong			!0		(signal %d)
20882
208830	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
20884>0	byte			&0x80
20885>>20	lelong			<4096		shared library
20886>>20	lelong			=4096		dynamically linked executable
20887>>20	lelong			>4096		dynamically linked executable
20888>0	byte			^0x80		executable
20889>16	lelong			>0		not stripped
208900	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
20891>0	byte			&0x80		dynamically linked executable
20892>0	byte			^0x80		executable
20893>16	lelong			>0		not stripped
208940	belong&0377777777	043000407	a.out NetBSD/vax 1k
20895>0	byte			&0x80		dynamically linked executable
20896>0	byte			^0x80
20897>>0	byte			&0x40		position independent
20898>>20	lelong			!0		executable
20899>>20	lelong			=0		object file
20900>16	lelong			>0		not stripped
209010	belong&0377777777	043000507	a.out NetBSD/vax 1k core
20902>12	string			>\0		from '%s'
20903>32	lelong			!0		(signal %d)
20904
209050	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
20906>0	byte			&0x80
20907>>20	lelong			<4096		shared library
20908>>20	lelong			=4096		dynamically linked executable
20909>>20	lelong			>4096		dynamically linked executable
20910>0	byte			^0x80		executable
20911>16	lelong			>0		not stripped
209120	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
20913>0	byte			&0x80		dynamically linked executable
20914>0	byte			^0x80		executable
20915>16	lelong			>0		not stripped
209160	belong&0377777777	045400407	a.out NetBSD/vax 4k
20917>0	byte			&0x80		dynamically linked executable
20918>0	byte			^0x80
20919>>0	byte			&0x40		position independent
20920>>20	lelong			!0		executable
20921>>20	lelong			=0		object file
20922>16	lelong			>0		not stripped
209230	belong&0377777777	045400507	a.out NetBSD/vax 4k core
20924>12	string			>\0		from '%s'
20925>32	lelong			!0		(signal %d)
20926
20927# NetBSD/alpha does not support (and has never supported) a.out objects,
20928# so no rules are provided for them.  NetBSD/alpha ELF objects are
20929# dealt with in "elf".
209300	lelong		0x00070185		ECOFF NetBSD/alpha binary
20931>10	leshort		0x0001			not stripped
20932>10	leshort		0x0000			stripped
209330	belong&0377777777	043200507	a.out NetBSD/alpha core
20934>12	string			>\0		from '%s'
20935>32	lelong			!0		(signal %d)
20936
209370	belong&0377777777	043400413	a.out NetBSD/mips demand paged
20938>0	byte			&0x80
20939>>20	belong			<8192		shared library
20940>>20	belong			=8192		dynamically linked executable
20941>>20	belong			>8192		dynamically linked executable
20942>0	byte			^0x80		executable
20943>16	belong			>0		not stripped
209440	belong&0377777777	043400410	a.out NetBSD/mips pure
20945>0	byte			&0x80		dynamically linked executable
20946>0	byte			^0x80		executable
20947>16	belong			>0		not stripped
209480	belong&0377777777	043400407	a.out NetBSD/mips
20949>0	byte			&0x80		dynamically linked executable
20950>0	byte			^0x80
20951>>0	byte			&0x40		position independent
20952>>20	belong			!0		executable
20953>>20	belong			=0		object file
20954>16	belong			>0		not stripped
209550	belong&0377777777	043400507	a.out NetBSD/mips core
20956>12	string			>\0		from '%s'
20957>32	belong			!0		(signal %d)
20958
209590	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
20960>0	byte			&0x80
20961>>20	lelong			<4096		shared library
20962>>20	lelong			=4096		dynamically linked executable
20963>>20	lelong			>4096		dynamically linked executable
20964>0	byte			^0x80		executable
20965>16	lelong			>0		not stripped
209660	belong&0377777777	043600410	a.out NetBSD/arm32 pure
20967>0	byte			&0x80		dynamically linked executable
20968>0	byte			^0x80		executable
20969>16	lelong			>0		not stripped
209700	belong&0377777777	043600407	a.out NetBSD/arm32
20971>0	byte			&0x80		dynamically linked executable
20972>0	byte			^0x80
20973>>0	byte			&0x40		position independent
20974>>20	lelong			!0		executable
20975>>20	lelong			=0		object file
20976>16	lelong			>0		not stripped
20977# NetBSD/arm26 has always used ELF objects, but it shares a core file
20978# format with NetBSD/arm32.
209790	belong&0377777777	043600507	a.out NetBSD/arm core
20980>12	string			>\0		from '%s'
20981>32	lelong			!0		(signal %d)
20982
20983# Kernel core dump format
209840	belong&0x0000ffff 0x00008fca	NetBSD kernel core file
20985>0	belong&0x03ff0000 0x00000000	\b, Unknown
20986>0	belong&0x03ff0000 0x00010000	\b, sun 68010/68020
20987>0	belong&0x03ff0000 0x00020000	\b, sun 68020
20988>0	belong&0x03ff0000 0x00640000	\b, 386 PC
20989>0	belong&0x03ff0000 0x00860000	\b, i386 BSD
20990>0	belong&0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
20991>0	belong&0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
20992>0	belong&0x03ff0000 0x00890000	\b, ns32532 BSD
20993>0	belong&0x03ff0000 0x008a0000	\b, SPARC/32 BSD
20994>0	belong&0x03ff0000 0x008b0000	\b, pmax BSD
20995>0	belong&0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
20996>0	belong&0x03ff0000 0x008d0000	\b, alpha BSD
20997>0	belong&0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
20998>0	belong&0x03ff0000 0x008f0000	\b, arm6 BSD
20999>0	belong&0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
21000>0	belong&0x03ff0000 0x00910000	\b, sh3 BSD
21001>0	belong&0x03ff0000 0x00950000	\b, ppc BSD (Big Endian)
21002>0	belong&0x03ff0000 0x00960000	\b, vax BSD (4K pages)
21003>0	belong&0x03ff0000 0x00970000	\b, mips1 BSD
21004>0	belong&0x03ff0000 0x00980000	\b, mips2 BSD
21005>0	belong&0x03ff0000 0x00990000	\b, m88k BSD
21006>0	belong&0x03ff0000 0x00920000	\b, parisc BSD
21007>0	belong&0x03ff0000 0x009b0000	\b, sh5/64 BSD
21008>0	belong&0x03ff0000 0x009c0000	\b, SPARC/64 BSD
21009>0	belong&0x03ff0000 0x009d0000	\b, amd64 BSD
21010>0	belong&0x03ff0000 0x009e0000	\b, sh5/32 BSD
21011>0	belong&0x03ff0000 0x009f0000	\b, ia64 BSD
21012>0	belong&0x03ff0000 0x00b70000	\b, aarch64 BSD
21013>0	belong&0x03ff0000 0x00b80000	\b, or1k BSD
21014>0	belong&0x03ff0000 0x00b90000	\b, Risk-V BSD
21015>0	belong&0x03ff0000 0x00c80000	\b, hp200 BSD
21016>0	belong&0x03ff0000 0x012c0000	\b, hp300 BSD
21017>0	belong&0x03ff0000 0x020b0000	\b, hp800 HP-UX
21018>0	belong&0x03ff0000 0x020c0000	\b, hp200/hp300 HP-UX
21019>0	belong&0xfc000000 0x04000000	\b, CPU
21020>0	belong&0xfc000000 0x08000000	\b, DATA
21021>0	belong&0xfc000000 0x10000000	\b, STACK
21022>4	leshort	x			\b, (headersize = %d
21023>6	leshort	x			\b, segmentsize = %d
21024>8	lelong	x			\b, segments = %d)
21025
21026# little endian only for now.
210270	name		ktrace
21028>4	leshort		7
21029>>6	leshort		<3		NetBSD ktrace file version %d
21030>>>12	string		x		from %s
21031>>>56	string		x		\b, emulation %s
21032>>>8	lelong		<65536		\b, pid=%d
21033
2103456	string		netbsd
21035>0	use		ktrace
2103656	string		linux
21037>0	use		ktrace
2103856	string		sunos
21039>0	use		ktrace
2104056	string		hpux
21041>0	use		ktrace
21042
21043#------------------------------------------------------------------------------
21044# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
21045# netscape:  file(1) magic for Netscape files
21046# "H. Nanosecond" <aldomel@ix.netcom.com>
21047# version 3 and 4 I think
21048#
21049
21050# Netscape Address book  .nab
210510	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
21052
21053# Netscape Communicator address book
210540   string   \000\017\102\111 Netscape Communicator address book
21055
21056# .snm Caches
210570	string		#\ Netscape\ folder\ cache	Netscape folder cache
210580	string	\000\036\204\220\000	Netscape folder cache
21059# .n2p
21060# Net 2 Phone
21061#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
210620	string	SX961999	Net2phone
21063
21064#
21065#This is files ending in .art, FIXME add more rules
210660	string	JG\004\016\0\0\0\0	AOL ART image
210670	string	JG\003\016\0\0\0\0	AOL ART image
21068
21069#------------------------------------------------------------------------------
21070# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
21071# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
21072# From: Mads Martin Joergensen <mmj@suse.de>
21073
210740	string	NetWare\ Loadable\ Module	NetWare Loadable Module
21075
21076#------------------------------------------------------------------------------
21077# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
21078# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
21079#
210800	string		StartFontMetrics	ASCII font metrics
210810	string		StartFont	ASCII font bits
210820	belong		0x137A2944	NeWS bitmap font
210830	belong		0x137A2947	NeWS font family
210840	belong		0x137A2950	scalable OpenFont binary
210850	belong		0x137A2951	encrypted scalable OpenFont binary
210868	belong		0x137A2B45	X11/NeWS bitmap font
210878	belong		0x137A2B48	X11/NeWS font family
21088
21089#------------------------------------------------------------------------------
21090# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $
21091# nitpicker:  file(1) magic for Flowfiles.
21092# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
210930	string	NPFF	NItpicker Flow File
21094>4	byte	x	V%d.
21095>5	byte	x	%d
21096>6	bedate	x	started: %s
21097>10	bedate	x	stopped: %s
21098>14	belong	x	Bytes: %u
21099>18	belong	x	Bytes1: %u
21100>22	belong	x	Flows: %u
21101>26	belong	x	Pkts: %u
21102
21103#------------------------------------------------------------------------------
21104# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
21105# OASIS
21106# Summary: OASIS stream file
21107# Long description: Open Artwork System Interchange Standard
21108# File extension: .oas
21109# Full name:	Ben Cowley (bcowley@broadcom.com)
21110#		Philip Dixon (pdixon@broadcom.com)
21111# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
21112#		(see page 3)
211130	string	%SEMI-OASIS\r\n		OASIS Stream file
21114
21115#------------------------------------------------------------------------------
21116# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
21117# ocaml: file(1) magic for Objective Caml files.
211180	string	Caml1999	OCaml
21119>8	string	X		exec file
21120>8	string	I		interface file (.cmi)
21121>8	string	O		object file (.cmo)
21122>8	string	A		library file (.cma)
21123>8	string	Y		native object file (.cmx)
21124>8	string	Z		native library file (.cmxa)
21125>8	string	M		abstract syntax tree implementation file
21126>8	string	N		abstract syntax tree interface file
21127>9	string	>\0		(Version %3.3s)
21128
21129#------------------------------------------------------------------------------
21130# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
21131# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
211320	string		Octave-1-L	Octave binary data (little endian)
211330	string		Octave-1-B	Octave binary data (big endian)
21134
21135#------------------------------------------------------------------------------
21136# $File: ole2compounddocs,v 1.5 2017/10/27 21:43:23 christos Exp $
21137# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
21138# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
21139# Additional tests for OLE 2 Compound Documents should be under this recipe.
21140
211410   string  \320\317\021\340\241\261\032\341      OLE 2 Compound Document
21142# - Microstation V8 DGN files (www.bentley.com)
21143#   Last update on 10/23/2006 by Lester Hightower
21144> 0x480  string  D\000g\000n\000~\000H                : Microstation V8 DGN
21145# - Visio documents
21146#   Last update on 10/23/2006 by Lester Hightower
21147> 0x480  string  V\000i\000s\000i\000o\000D\000o\000c : Visio Document
21148
21149# Note: moved & merged Microsoft Office parts from ./msdos Oct 2017
21150# Update: Joerg Jenderek
21151# from http://filext.com by Derek M Jones <derek@knosof.co.uk>
21152# False positive with PPT (also currently this string is too long)
21153#0	string/b	\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06	Microsoft Installer
21154#0	string/b	\320\317\021\340\241\261\032\341	Microsoft Office Document
21155#>48	byte	0x1B					Excel Document
21156#!:mime application/vnd.ms-excel
21157>546	string	bjbj			: Microsoft Word Document
21158!:mime	application/msword
21159# https://www.macdisk.com/macsigen.php
21160!:apple	MSWDWDBN
21161!:ext	doc/dot
21162>546	string	jbjb			: Microsoft Word Document
21163!:mime	application/msword
21164!:apple	MSWDWDBN
21165!:ext	doc
21166
21167
21168#------------------------------------------------------------------------------
21169# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
21170# olf:  file(1) magic for OLF executables
21171#
21172# We have to check the byte order flag to see what byte order all the
21173# other stuff in the header is in.
21174#
21175# MIPS R3000 may also be for MIPS R2000.
21176# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
21177#
21178# Created by Erik Theisen <etheisen@openbsd.org>
21179# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
211800	string		\177OLF		OLF
21181>4	byte		0		invalid class
21182>4	byte		1		32-bit
21183>4	byte		2		64-bit
21184>7	byte		0		invalid os
21185>7	byte		1		OpenBSD
21186>7	byte		2		NetBSD
21187>7	byte		3		FreeBSD
21188>7	byte		4		4.4BSD
21189>7	byte		5		Linux
21190>7	byte		6		SVR4
21191>7	byte		7		esix
21192>7	byte		8		Solaris
21193>7	byte		9		Irix
21194>7	byte		10		SCO
21195>7	byte		11		Dell
21196>7	byte		12		NCR
21197>5	byte		0		invalid byte order
21198>5	byte		1		LSB
21199>>16	leshort		0		no file type,
21200>>16	leshort		1		relocatable,
21201>>16	leshort		2		executable,
21202>>16	leshort		3		shared object,
21203# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
21204# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
21205>>16	leshort		4		core file
21206>>>(0x38+0xcc) string	>\0		of '%s'
21207>>>(0x38+0x10) lelong	>0		(signal %d),
21208>>16	leshort		&0xff00		processor-specific,
21209>>18	leshort		0		no machine,
21210>>18	leshort		1		AT&T WE32100 - invalid byte order,
21211>>18	leshort		2		SPARC - invalid byte order,
21212>>18	leshort		3		Intel 80386,
21213>>18	leshort		4		Motorola 68000 - invalid byte order,
21214>>18	leshort		5		Motorola 88000 - invalid byte order,
21215>>18	leshort		6		Intel 80486,
21216>>18	leshort		7		Intel 80860,
21217>>18	leshort		8		MIPS R3000_BE - invalid byte order,
21218>>18	leshort		9		Amdahl - invalid byte order,
21219>>18	leshort		10		MIPS R3000_LE,
21220>>18	leshort		11		RS6000 - invalid byte order,
21221>>18	leshort		15		PA-RISC - invalid byte order,
21222>>18	leshort		16		nCUBE,
21223>>18	leshort		17		VPP500,
21224>>18	leshort		18		SPARC32PLUS,
21225>>18	leshort		20		PowerPC,
21226>>18	leshort		0x9026		Alpha,
21227>>20	lelong		0		invalid version
21228>>20	lelong		1		version 1
21229>>36	lelong		1		MathCoPro/FPU/MAU Required
21230>8	string		>\0		(%s)
21231>5	byte		2		MSB
21232>>16	beshort		0		no file type,
21233>>16	beshort		1		relocatable,
21234>>16	beshort		2		executable,
21235>>16	beshort		3		shared object,
21236>>16	beshort		4		core file,
21237>>>(0x38+0xcc) string	>\0		of '%s'
21238>>>(0x38+0x10) belong	>0		(signal %d),
21239>>16	beshort		&0xff00		processor-specific,
21240>>18	beshort		0		no machine,
21241>>18	beshort		1		AT&T WE32100,
21242>>18	beshort		2		SPARC,
21243>>18	beshort		3		Intel 80386 - invalid byte order,
21244>>18	beshort		4		Motorola 68000,
21245>>18	beshort		5		Motorola 88000,
21246>>18	beshort		6		Intel 80486 - invalid byte order,
21247>>18	beshort		7		Intel 80860,
21248>>18	beshort		8		MIPS R3000_BE,
21249>>18	beshort		9		Amdahl,
21250>>18	beshort		10		MIPS R3000_LE - invalid byte order,
21251>>18	beshort		11		RS6000,
21252>>18	beshort		15		PA-RISC,
21253>>18	beshort		16		nCUBE,
21254>>18	beshort		17		VPP500,
21255>>18	beshort		18		SPARC32PLUS,
21256>>18	beshort		20		PowerPC or cisco 4500,
21257>>18	beshort		21		cisco 7500,
21258>>18	beshort		24		cisco SVIP,
21259>>18	beshort		25		cisco 7200,
21260>>18	beshort		36		cisco 12000,
21261>>18	beshort		0x9026		Alpha,
21262>>20	belong		0		invalid version
21263>>20	belong		1		version 1
21264>>36	belong		1		MathCoPro/FPU/MAU Required
21265
21266#------------------------------------------------------------------------------
21267# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
21268# os2:  file(1) magic for OS/2 files
21269#
21270
21271# Provided 1998/08/22 by
21272# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
212731	search/100	InternetShortcut	MS Windows 95 Internet shortcut text
21274>17	search/100	URL= 			(URL=<
21275>>&0	string		x			\b%s>)
21276
21277# OS/2 URL objects
21278# Provided 1998/08/22 by
21279# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
21280#0	string	http:			OS/2 URL object text
21281#>5	string	>\			(WWW) <http:%s>
21282#0	string	mailto:			OS/2 URL object text
21283#>7	string	>\			(email) <%s>
21284#0	string	news:			OS/2 URL object text
21285#>5	string	>\			(Usenet) <%s>
21286#0	string	ftp:			OS/2 URL object text
21287#>4	string	>\			(FTP) <ftp:%s>
21288#0	string	file:			OS/2 URL object text
21289#>5	string	>\			(Local file) <%s>
21290
21291# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
21292# Carl Hauser (chauser.parc@xerox.com) and
21293# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
21294# list the following header format in inf02a.doc:
21295#
21296#  int16 ID;           // ID magic word (5348h = "HS")
21297#  int8  unknown1;     // unknown purpose, could be third letter of ID
21298#  int8  flags;        // probably a flag word...
21299#                      //  bit 0: set if INF style file
21300#                      //  bit 4: set if HLP style file
21301#                      // patching this byte allows reading HLP files
21302#                      // using the VIEW command, while help files
21303#                      // seem to work with INF settings here as well.
21304#  int16 hdrsize;      // total size of header
21305#  int16 unknown2;     // unknown purpose
21306#
213070   string  HSP\x01\x9b\x00 OS/2 INF
21308>107 string >0                      (%s)
213090   string  HSP\x10\x9b\x00     OS/2 HLP
21310>107 string >0                      (%s)
21311
21312# OS/2 INI (this is a guess)
213130  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
21314
21315#------------------------------------------------------------------------------
21316# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
21317# os400:  file(1) magic for IBM OS/400 files
21318#
21319# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
21320# In spite of its quite variable format (due to internal memory page
21321# length differences between CISC and RISC versions of the OS) the
21322# SAVF structure hasn't suitable offsets to identify the catalog
21323# header in the first descriptor where there are some useful infos,
21324# so we must search in a somewhat large area for a particular string
21325# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
21326# descriptor space) preceded by a two byte constant.
21327#
213281090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
21329>&212	 byte		0x01			 \b, created with SAVOBJ
21330>&212	 byte		0x02			 \b, created with SAVLIB
21331>&212	 byte		0x07			 \b, created with SAVCFG
21332>&212	 byte		0x08			 \b, created with SAVSECDTA
21333>&212	 byte		0x0A			 \b, created with SAVSECDTA
21334>&212	 byte		0x0B			 \b, created with SAVDLO
21335>&212	 byte		0x0D			 \b, created with SAVLICPGM
21336>&212	 byte		0x11			 \b, created with SAVCHGOBJ
21337>&213	 byte		0x44			 \b, at least V5R4 to open
21338>&213	 byte		0x43			 \b, at least V5R3 to open
21339>&213	 byte		0x42			 \b, at least V5R2 to open
21340>&213	 byte		0x41			 \b, at least V5R1 to open
21341>&213	 byte		0x40			 \b, at least V4R5 to open
21342>&213	 byte		0x3F			 \b, at least V4R4 to open
21343>&213	 byte		0x3E			 \b, at least V4R3 to open
21344>&213	 byte		0x3C			 \b, at least V4R2 to open
21345>&213	 byte		0x3D			 \b, at least V4R1M4 to open
21346>&213	 byte		0x3B			 \b, at least V4R1 to open
21347>&213	 byte		0x3A			 \b, at least V3R7 to open
21348>&213	 byte		0x35			 \b, at least V3R6 to open
21349>&213	 byte		0x36			 \b, at least V3R2 to open
21350>&213	 byte		0x34			 \b, at least V3R1 to open
21351>&213	 byte		0x31			 \b, at least V3R0M5 to open
21352>&213	 byte		0x30			 \b, at least V2R3 to open
21353
21354#------------------------------------------------------------------------------
21355# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
21356#
21357# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
21358#
21359# Redistribution and use in source and binary forms, with or without
21360# modification, are permitted provided that the following conditions
21361# are met:
21362# 1. Redistributions of source code must retain the above copyright
21363#    notice, this list of conditions and the following disclaimer.
21364# 2. Redistributions in binary form must reproduce the above copyright
21365#    notice, this list of conditions and the following disclaimer in the
21366#    documentation and/or other materials provided with the distribution.
21367#
21368# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21369# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21370# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21371# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
21372# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
21373# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
21374# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
21375# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
21376# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
21377# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
21378#
21379#
21380#
21381# OS9/6809 module descriptions:
21382#
213830	beshort		0x87CD	OS9/6809 module:
21384#
21385>6	byte&0x0f	0x00	non-executable
21386>6	byte&0x0f	0x01	machine language
21387>6	byte&0x0f	0x02	BASIC I-code
21388>6	byte&0x0f	0x03	Pascal P-code
21389>6	byte&0x0f	0x04	C I-code
21390>6	byte&0x0f	0x05	COBOL I-code
21391>6	byte&0x0f	0x06	Fortran I-code
21392#
21393>6	byte&0xf0	0x10	program executable
21394>6	byte&0xf0	0x20	subroutine
21395>6	byte&0xf0	0x30	multi-module
21396>6	byte&0xf0	0x40	data module
21397#
21398>6	byte&0xf0	0xC0	system module
21399>6	byte&0xf0	0xD0	file manager
21400>6	byte&0xf0	0xE0	device driver
21401>6	byte&0xf0	0xF0	device descriptor
21402#
21403# OS9/m68k stuff (to be continued)
21404#
214050	beshort		0x4AFC	OS9/68K module:
21406#
21407# attr
21408>0x14	byte&0x80	0x80	re-entrant
21409>0x14	byte&0x40	0x40	ghost
21410>0x14	byte&0x20	0x20	system-state
21411#
21412# lang:
21413#
21414>0x13	byte		1	machine language
21415>0x13	byte		2	BASIC I-code
21416>0x13	byte		3	Pascal P-code
21417>0x13	byte		4	C I-code
21418>0x13	byte		5	COBOL I-code
21419>0x13	byte		6	Fortran I-code
21420#
21421#
21422# type:
21423#
21424>0x12	byte		1	program executable
21425>0x12	byte		2	subroutine
21426>0x12	byte		3	multi-module
21427>0x12	byte		4	data module
21428>0x12	byte		11	trap library
21429>0x12	byte		12	system module
21430>0x12	byte		13	file manager
21431>0x12	byte		14	device driver
21432>0x12	byte		15	device descriptor
21433
21434#------------------------------------------------------------------------------
21435# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
21436#
21437# Mach magic number info
21438#
214390	long		0xefbe	OSF/Rose object
21440# I386 magic number info
21441#
214420	short		0565	i386 COFF object
21443
21444#------------------------------------------------------------------------------
21445# $File: palm,v 1.13 2014/03/30 21:40:08 christos Exp $
21446# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
21447#
21448# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
21449
21450# These are weak, byte 59 is not guaranteed to be 0 and there are
21451# 8 character identifiers at byte 60, one I found for appl is BIGb.
21452# What are the possibilities and where is this documented?
21453
21454# The common header format for PalmOS .pdb/.prc files is
21455# {
21456#         char            name[ 32 ];
21457#         Word            attributes;
21458#         Word            version;
21459#         DWord           creationDate;
21460#         DWord           modificationDate;
21461#         DWord           lastBackupDate;
21462#         DWord           modificationNumber;
21463#         DWord           appInfoID;
21464#         DWord           sortInfoID;
21465#         char            type[4];
21466#         char            creator[4];
21467#         DWord           uniqueIDSeed;
21468#         RecordListType  recordList;
21469# };
21470#
21471# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
21472# or Unix/POSIX time + 2082844800.
21473
214740		name		aportisdoc
21475# date is supposed to be big-endian seconds since 1 Jan 1904, but many
21476# files contain the timestamp in little-endian or a completely
21477# nonsensical value...
21478#>36		bedate-2082844800	>0	\b, created %s
21479# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
21480>(78.L)		beshort		=1		\b, uncompressed
21481# compressed
21482>(78.L)		beshort		>1
21483>>(78.L+4)	belong		x		\b, %d bytes uncompressed
21484
21485# appl
21486#60		string		appl		PalmOS application
21487#>0		string		>\0		"%s"
21488
21489# HACK
21490#60		string		HACK		HackMaster hack
21491#>0		string		>\0		"%s"
21492
21493# iSiloX e-book
2149460		string		SDocSilX	iSiloX E-book
21495>0		string		>\0		"%s"
21496
21497# Mobipocket (www.mobipocket.com), donated by Carl Witty
21498# expanded by Ralf Brown
2149960		string	 	BOOKMOBI	Mobipocket E-book
21500# MobiPocket stores a full title, pointed at by the belong at offset
21501# 0x54 in its header at (78.L), with length given by the belong at
21502# offset 0x58.
21503# there's no guarantee that the title string is null-terminated, but
21504# we currently can't specify a variable-length string where the length
21505# field is not at the start of the string; in practice, the data
21506# following the string always seems to start with a zero byte
21507>(78.L)		belong		x
21508>>&(&0x50.L-4)	string		>\0		"%s"
21509>0		use		aportisdoc
21510>>(78.L+0x68)	belong		>0		\b, version %d
21511>>(78.L+0x1C)	belong		!0		\b, codepage %d
21512>>(78.L+0x0C)	beshort	 	>0		\b, encrypted (type %d)
21513
21514# AportisDoc/PalmDOC
2151560		string		TEXtREAd	AportisDoc/PalmDOC E-book
21516>0		string		>\0		"%s"
21517>0		use		aportisdoc
21518
21519# Variety of PalmOS document types
21520# Michael-John Turner <mj@debian.org>
21521# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
2152260	string			BVokBDIC	BDicty PalmOS document
21523>0	string			>\0		"%s"
2152460	string			DB99DBOS	DB PalmOS document
21525>0	string			>\0		"%s"
2152660	string			vIMGView	FireViewer/ImageViewer PalmOS document
21527>0	string			>\0		"%s"
2152860	string			PmDBPmDB	HanDBase PalmOS document
21529>0	string			>\0		"%s"
2153060	string			InfoINDB	InfoView PalmOS document
21531>0	string			>\0		"%s"
2153260	string			ToGoToGo	iSilo PalmOS document
21533>0	string			>\0		"%s"
2153460	string			JfDbJBas	JFile PalmOS document
21535>0	string			>\0		"%s"
2153660	string			JfDbJFil	JFile Pro PalmOS document
21537>0	string			>\0		"%s"
2153860	string			DATALSdb	List PalmOS document
21539>0	string			>\0		"%s"
2154060	string			Mdb1Mdb1	MobileDB PalmOS document
21541>0	string			>\0		"%s"
2154260	string			PNRdPPrs	PeanutPress PalmOS document
21543>0	string			>\0		"%s"
2154460	string			DataPlkr	Plucker PalmOS document
21545>0	string			>\0		"%s"
2154660	string			DataSprd	QuickSheet PalmOS document
21547>0	string			>\0		"%s"
2154860	string			SM01SMem	SuperMemo PalmOS document
21549>0	string			>\0		"%s"
2155060	string			TEXtTlDc	TealDoc PalmOS document
21551>0	string			>\0		"%s"
2155260	string			InfoTlIf	TealInfo PalmOS document
21553>0	string			>\0		"%s"
2155460	string			DataTlMl	TealMeal PalmOS document
21555>0	string			>\0		"%s"
2155660	string			DataTlPt	TealPaint PalmOS document
21557>0	string			>\0		"%s"
2155860	string			dataTDBP	ThinkDB PalmOS document
21559>0	string			>\0		"%s"
2156060	string			TdatTide	Tides PalmOS document
21561>0	string			>\0		"%s"
2156260	string			ToRaTRPW	TomeRaider PalmOS document
21563>0	string			>\0		"%s"
21564
21565# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
21566# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
21567#   annotations.
21568# For other versions, just outputs version.
21569#
2157060		string		zTXT		A GutenPalm zTXT e-book
21571>0		string		>\0		"%s"
21572>(0x4E.L)	byte		0
21573>>(0x4E.L+1)	byte		x		(v0.%02d)
21574>(0x4E.L)	byte		1
21575>>(0x4E.L+1)	byte		x		(v1.%02d)
21576>>>(0x4E.L+10)	beshort		>0
21577>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
21578>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
21579>>>(0x4E.L+14)	beshort		>0
21580>>>>(0x4E.L+14) beshort		<2		- 1 annotation
21581>>>>(0x4E.L+14) beshort		>1		- %d annotations
21582>(0x4E.L)	byte		>1		(v%d.
21583>>(0x4E.L+1)	byte		x		%02d)
21584
21585# Palm OS .prc file types
2158660		string		libr
21587# flags, only bit 0 or bit 6
21588# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
21589# http://web.mit.edu/tytso/www/pilot/prc-format.html
21590>0x20		beshort&0xffbe	0
21591>>0		string		>\0		Palm OS dynamic library data "%s"
2159260		string		ptch		Palm OS operating system patch data
21593>0		string		>\0		"%s"
21594
21595# Mobipocket (www.mobipocket.com), donated by Carl Witty
2159660	string			BOOKMOBI	Mobipocket E-book
21597>0	string			>\0		"%s"
21598
21599#------------------------------------------------------------------------------
21600# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
21601#
21602# Parix COFF executables
21603# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
21604#
216050	beshort&0xfff	0xACE	PARIX
21606>0	byte&0xf0	0x80	T800
21607>0	byte&0xf0	0x90	T9000
21608>19	byte&0x02	0x02	executable
21609>19	byte&0x02	0x00	object
21610>19	byte&0x0c	0x00	not stripped
21611#------------------------------------------------------------------------------
21612# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $
21613# parrot: file(1) magic for Parrot Virtual Machine
21614# URL:	http://www.lua.org/
21615# From: Lubomir Rintel <lkundrak@v3.sk>
21616
21617# Compiled Parrot byte code
216180	string	\376PBC\r\n\032\n	Parrot bytecode
21619>64	byte	x			%d.
21620>72	byte	x			\b%d,
21621>8	byte	>0			%d byte words,
21622>16	byte	0			little-endian,
21623>16	byte	1			big-endian,
21624>32	byte	0			IEEE-754 8 byte double floats,
21625>32	byte	1			x86 12 byte long double floats,
21626>32	byte	2			IEEE-754 16 byte long double floats,
21627>32	byte	3			MIPS 16 byte long double floats,
21628>32	byte	4			AIX 16 byte long double floats,
21629>32	byte	5			4-byte floats,
21630>40	byte	x			Parrot %d.
21631>48	byte	x			\b%d.
21632>56	byte	x			\b%d
21633#------------------------------------------------------------------------------
21634# $File: pascal,v 1.2 2014/07/14 14:21:33 rrt Exp $
21635# pascal:  file(1) magic for Pascal source
21636#
216370	search/8192	(input,		Pascal source text
21638!:mime	text/x-pascal
21639#0	regex		\^program	Pascal source text
21640#!:mime	text/x-pascal
21641#0	regex           	\^record		Pascal source text
21642#!:mime	text/x-pascal
21643
21644#------------------------------------------------------------------------------
21645# $File: pbf,v 1.2 2017/01/18 16:16:21 christos Exp $
21646# file(1) magic(5) data for OpenStreetMap
21647
21648# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
21649# http://wiki.openstreetmap.org/wiki/PBF_Format
21650# From: Markus Heidelberg <markus.heidelberg@web.de>
216510	belong&0xfffffff0	0
21652>4	beshort			0x0A09
21653>>6	string			OSMHeader	OpenStreetMap Protocolbuffer Binary Format
21654
21655#------------------------------------------------------------------------------
21656# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
21657# pbm:  file(1) magic for Portable Bitmap files
21658#
21659# XXX - byte order?
21660#
216610	short	0x2a17	"compact bitmap" format (Poskanzer)
21662#------------------------------------------------------------------------------
21663# pc88:  file(1) magic for the NEC Home Computer
21664# v1.0
21665# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
21666
21667# PC88 2D disk image
216680x20		ulelong&0xFFFFFEFF	0x2A0
21669>0x10		string		\0\0\0\0\0\0\0\0\0\0
21670>>0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
21671>>>0x1A		ubyte&0xEF	0
21672>>>>0x1B	ubyte&0x8F	0
21673>>>>>0x1B	ubyte&70	<0x40
21674>>>>>>0x1C	ulelong	>0x21
21675>>>>>>>0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
21676>>>>>>>>0x1B	ubyte	0	\b, media=2D
21677>>>>>>>>0x1B	ubyte	0x10	\b, media=2DD
21678>>>>>>>>0x1B	ubyte	0x20	\b, media=2HD
21679>>>>>>>>0x1B	ubyte	0x30	\b, media=1D
21680>>>>>>>>0x1B	ubyte	0x40	\b, media=1DD
21681>>>>>>>>0x1A	ubyte	0x10	\b, write-protected
21682
21683
21684
21685
21686#------------------------------------------------------------------------------
21687# pc98:  file(1) magic for the MSX Home Computer
21688# v1.0
21689# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
21690
21691# Maki-chan v1 Graphic format
21692# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so
21693# http://www.jisyo.com/viewer/faq/maki_tech.htm
216940	string/b		MAKI01 	Maki-chan v1.
21695>6	ubyte|0x20	x		\b%c image
21696>8	ubelong		>0x40404040	\b, system ID:
21697>>8	byte		x		%c
21698>>9	byte		x		\b%c
21699>>10	byte		x		\b%c
21700>>11	byte		x		\b%c
21701>44	ubeshort	x		\b, %dx
21702>46	ubeshort	x		\b%d
21703>38	ubeshort&2	0		\b, 16 paletted RGB colors
21704>38	ubeshort&2	2		\b, 8 fixed RGB colors
21705>38	ubeshort&1	1		\b, 2:1 dot aspect ratio
21706
21707# Maki-chan v2 Graphic format
21708# http://www.jisyo.com/viewer/faq/mag_tech.htm
21709# http://mooncore.eu/bunny/txt/makichan.htm
21710# http://metanest.jp/mag/mag.xhtml
217110	string/b		MAKI02\ \ 	Maki-chan v2 image,
21712>8	byte		x		system ID: %c
21713>9	byte		x		\b%c
21714>10	byte		x		\b%c
21715>11	byte		x		\b%c,
21716>13	search/0x200	\x1A
21717#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing:
21718#1) When offset1(ubeshort) !=0x0344:
21719# 1.1) And  offset3(ubyte).b7=0:
21720# - b0=pixel aspect ratio: 1=2:1   (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1)
21721# - b1=number of colors: 0=16 colors, 1=8 colors
21722# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data
21723# 1.2) And  offset3(ubyte).B7=1:
21724# - b0=256 paletted colors
21725# - b1=256 fixed colors using the MSX SCR8 palette
21726#2) When offset1(ubeshort) =0x0344:
21727# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored
21728>>&1	ubeshort	0x0344		256x212, 19268 fixed YJK colors
21729>>&1	ubeshort	!0x0344
21730>>>&5	uleshort+1	x		%dx
21731>>>&7	uleshort+1	x		\b%d,
21732>>>&0	ubyte&0x86	0x00		16 paletted RGB colors
21733>>>&0	ubyte&0x86	0x02		8 paletted RGB colors
21734>>>&0	ubyte&0x86	0x04		16 fixed RGB colors
21735>>>&0	ubyte&0x86	0x06		8 fixed RGB colors
21736>>>&0	ubyte&0x81	0x80		256 paletted RGB colors
21737>>>&0	ubyte&0x81	0x81		256 fixed MSX-SCR8 colors
21738>>>&0	ubyte&0x01	1		\b, 2:1 dot aspect ratio
21739
21740# XLD4 (Q4) picture
2174111	string/b	MAJYO		XLD4(Q4) picture
21742
21743# Yanagisawa Pi picture
21744#0	string		Pi\x1A\0	Yanagisawa Pi picture
21745#>3	search/0x200	\x04
217460	string		Pi
21747>2	search/0x200	\x1A
21748>>&0	ubyte		0
21749>>>&3	ubyte		4		Yanagisawa Pi 16 color picture,
21750>>>&4	byte		x		system ID: %c
21751>>>&5	byte		x		\b%c
21752>>>&6	byte		x		\b%c
21753>>>&7	byte		x		\b%c,
21754>>>&10	ubeshort	x		%dx
21755>>>&12	ubeshort	x		\b%d
21756>>>&3	ubyte		8		Yanagisawa Pi 256 color picture
21757>>>&4	byte		x		system ID: %c
21758>>>&5	byte		x		\b%c
21759>>>&6	byte		x		\b%c
21760>>>&7	byte		x		\b%c,
21761>>>&10	ubeshort	x		%dx
21762>>>&12	ubeshort	x		\b%d
21763
21764#------------------------------------------------------------------------------
21765# $File: pdf,v 1.10 2018/05/23 22:21:01 christos Exp $
21766# pdf:  file(1) magic for Portable Document Format
21767#
21768
217690	string		%PDF-		PDF document
21770!:mime	application/pdf
21771!:strength +60
21772>5	byte		x		\b, version %c
21773>7	byte		x		\b.%c
21774
217750	string		\012%PDF-	PDF document
21776!:mime	application/pdf
21777!:strength +60
21778>6	byte		x		\b, version %c
21779>8	byte		x		\b.%c
21780
21781# From: Nick Schmalenberger <nick@schmalenberger.us>
21782# Forms Data Format
217830       string          %FDF-           FDF document
21784!:mime application/vnd.fdf
21785!:strength +60
21786>5      byte            x               \b, version %c
21787>7      byte            x               \b.%c
21788
217890	search/256	%PDF-		PDF document
21790!:mime	application/pdf
21791!:strength +60
21792>&0	byte		x		\b, version %c
21793>&2	byte		x		\b.%c
21794
21795#------------------------------------------------------------------------------
21796# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
21797# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
21798#
217990	lelong		0101555		PDP-11 single precision APL workspace
218000	lelong		0101554		PDP-11 double precision APL workspace
21801#
21802# PDP-11 a.out
21803#
218040	leshort		0407		PDP-11 executable
21805>8	leshort		>0		not stripped
21806>15	byte		>0		- version %d
21807
21808# updated by Joerg Jenderek at Mar 2013
21809# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
218100	leshort		0401
21811# skip *.PNF with WinDirPathOffset 58h
21812>68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
21813# skip *.PNF with high byte of InfVersionDatumCount zero
21814#>>15	byte		!0		PDP-11 UNIX/RT ldp
218150	leshort		0405		PDP-11 old overlay
21816
218170	leshort		0410		PDP-11 pure executable
21818>8	leshort		>0		not stripped
21819>15	byte		>0		- version %d
21820
218210	leshort		0411		PDP-11 separate I&D executable
21822>8	leshort		>0		not stripped
21823>15	byte		>0		- version %d
21824
218250	leshort		0437		PDP-11 kernel overlay
21826
21827# These last three are derived from 2.11BSD file(1)
218280	leshort		0413		PDP-11 demand-paged pure executable
21829>8	leshort		>0		not stripped
21830
218310	leshort		0430		PDP-11 overlaid pure executable
21832>8	leshort		>0		not stripped
21833
218340	leshort		0431		PDP-11 overlaid separate executable
21835>8	leshort		>0		not stripped
21836#------------------------------------------------------------------------------
21837# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
21838# perl:  file(1) magic for Larry Wall's perl language.
21839#
21840# The `eval' lines recognizes an outrageously clever hack.
21841# Keith Waclena <keith@cerberus.uchicago.edu>
21842# Send additions to <perl5-porters@perl.org>
218430	search/1024	eval\ "exec\ perl		Perl script text
21844!:mime	text/x-perl
218450	search/1024	eval\ "exec\ /bin/perl		Perl script text
21846!:mime	text/x-perl
218470	search/1024	eval\ "exec\ /usr/bin/perl	Perl script text
21848!:mime	text/x-perl
218490	search/1024	eval\ "exec\ /usr/local/bin/perl	Perl script text
21850!:mime	text/x-perl
218510	search/1024	eval\ 'exec\ perl		Perl script text
21852!:mime	text/x-perl
218530	search/1024	eval\ 'exec\ /bin/perl		Perl script text
21854!:mime	text/x-perl
218550	search/1024	eval\ 'exec\ /usr/bin/perl	Perl script text
21856!:mime	text/x-perl
218570	search/1024	eval\ 'exec\ /usr/local/bin/perl	Perl script text
21858!:mime	text/x-perl
218590	search/1024	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
21860!:mime	text/x-perl
218610	string	#!/usr/bin/env\ perl	Perl script text executable
21862!:mime	text/x-perl
218630	string	#!\ /usr/bin/env\ perl	Perl script text executable
21864!:mime	text/x-perl
218650	string	#!
21866>0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
21867!:mime	text/x-perl
21868
21869# by Dmitry V. Levin and Alexey Tourbin
21870# check the first line
218710	search/8192	package
21872>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
21873!:strength + 40
21874# not 'p', check other lines
218750	search/8192	!p
21876>0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
21877>>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
21878!:strength + 75
21879
21880# Perl POD documents
21881# From: Tom Hukins <tom@eborcom.com>
218820	search/1024/W	\=pod\n		Perl POD document text
218830	search/1024/W	\n\=pod\n	Perl POD document text
218840	search/1024/W	\=head1\ 	Perl POD document text
218850	search/1024/W	\n\=head1\ 	Perl POD document text
218860	search/1024/W	\=head2\ 	Perl POD document text
218870	search/1024/W	\n\=head2\ 	Perl POD document text
218880	search/1024/W	\=encoding\ 	Perl POD document text
218890	search/1024/W	\n\=encoding\ 	Perl POD document text
21890
21891
21892# Perl Storable data files.
218930	string	perl-store	perl Storable (v0.6) data
21894>4	byte	>0	(net-order %d)
21895>>4	byte	&01	(network-ordered)
21896>>4	byte	=3	(major 1)
21897>>4	byte	=2	(major 1)
21898
218990	string	pst0	perl Storable (v0.7) data
21900>4	byte	>0
21901>>4	byte	&01	(network-ordered)
21902>>4	byte	=5	(major 2)
21903>>4	byte	=4	(major 2)
21904>>5	byte	>0	(minor %d)
21905
21906# This is Debian #742949 by Zefram <zefram@fysh.org>:
21907# -----------------------------------------------------------
21908# The Perl module Hash::SharedMem
21909# <https://metacpan.org/release/Hash-SharedMem> defines a file format
21910# for a key/value store.  Details of the file format are in the "DESIGN"
21911# file in the module distribution.  Magic:
219120	bequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, big-endian
21913>8	bequad	<0x1000000
21914>>15	byte	>2	\b, line size 2^%d byte
21915>>14	byte	>2	\b, page size 2^%d byte
21916>>13	byte	&1
21917>>>13	byte	>1	\b, max fanout %d
219180	lequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, little-endian
21919>8	lequad	<0x1000000
21920>>8	byte	>2	\b, line size 2^%d byte
21921>>9	byte	>2	\b, page size 2^%d byte
21922>>10	byte	&1
21923>>>10	byte	>1	\b, max fanout %d
219240	bequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, big-endian
21925>8	bequad	<0x1000000
21926>>15	byte	>2	\b, line size 2^%d byte
21927>>14	byte	>2	\b, page size 2^%d byte
21928>>13	byte	&1
21929>>>13	byte	>1	\b, max fanout %d
219300	lequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, little-endian
21931>8	lequad	<0x1000000
21932>>8	byte	>2	\b, line size 2^%d byte
21933>>9	byte	>2	\b, page size 2^%d byte
21934>>10	byte	&1
21935>>>10	byte	>1	\b, max fanout %d
21936
21937#------------------------------------------------------------------------------
21938# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
21939# pgf: file(1) magic for Progressive Graphics File (PGF)
21940#
21941# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
21942# 2013 by Philipp Hahn <pmhahn debian org>
219430 string PGF Progressive Graphics image data,
21944!:mime image/x-pgf
21945>3	string	2	version %s,
21946>3	string	4	version %s,
21947>3	string	5	version %s,
21948>3	string	6	version %s,
21949#	PGFPreHeader
21950#>>4	lelong	x	header size %d,
21951#	PGFHeader
21952>>8	lelong	x	%d x
21953>>12	lelong	x	%d,
21954>>16	byte	x	%d levels,
21955>>17	byte	x	compression level %d,
21956>>18	byte	x	%d bpp,
21957>>19	byte	x	%d channels,
21958>>20	clear	x
21959>>20	byte	0	bitmap,
21960>>20	byte	1	gray scale,
21961>>20	byte	2	indexed color,
21962>>20	byte	3	RGB color,
21963>>20	byte	4	CYMK color,
21964>>20	byte	5	HSL color,
21965>>20	byte	6	HSB color,
21966>>20	byte	7	multi-channel,
21967>>20	byte	8	duo tone,
21968>>20	byte	9	LAB color,
21969>>20	byte	10	gray scale 16,
21970>>20	byte	11	RGB color 48,
21971>>20	byte	12	LAB color 48,
21972>>20	byte	13	CYMK color 64,
21973>>20	byte	14	deep multi-channel,
21974>>20	byte	15	duo tone 16,
21975>>20	byte	17	RGBA color,
21976>>20	byte	18	gray scale 32,
21977>>20	byte	19	RGB color 12,
21978>>20	byte	20	RGB color 16,
21979>>20	byte	255	unknown format,
21980>>20	default	x	format
21981>>>20	byte	x	\b %d,
21982>>21	byte	x	%d bpc
21983#	PGFPostHeader
21984#	Level-Sizes
21985#>>(4.l+4)	lelong x level 0 size: %d
21986#>>(4.l+8)	lelong x level 1 size: %d
21987#>>(4.l+12)	lelong x level 2 size: %d
21988
21989#------------------------------------------------------------------------------
21990# $File: pgp,v 1.15 2018/02/24 16:11:23 christos Exp $
21991# pgp:  file(1) magic for Pretty Good Privacy
21992# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
21993#
21994# Update: Joerg Jenderek
21995# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP`
21996#0		byte	0x99		MAYBE PGP 0x99
219970		byte	0x99
21998# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length
21999# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh
22000#>1		ubeshort	x		\b, body length 0x%.4x
22001# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number
22002#>3		ubyte		x		\b, V=%u
22003#>3		ubyte		<5		VERSION OK
22004>3		ubyte		<5
22005# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet
22006#>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
22007# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1)
22008#>>(1.S+3)	ubyte	>0x7F		TYPE OK,
22009>>(1.S+3)	ubyte	>0x7F
22010# old versions 2,3 implies Pretty Good Privacy
22011>>>3		ubyte		<4		PGP key public ring (v%u)
22012!:mime		application/pgp-keys
22013!:ext		pgp/ASD
22014>>>>4		beldate		x		created %s
22015# days that this key is valid. If this number is zero, then it does not expire
22016>>>>8		ubeshort	>0		\b, %u days valid
22017>>>>8		ubeshort	=0		\b, not expire
22018# display key algorithm 1~RSA (Encrypt or Sign)
22019>>>>10		use		key_algo
22020# Multiprecision Integers (MPI) size
22021>>>>11		ubeshort	x		%u bits
22022# MPI
22023>>>>13		ubequad		x		MPI=0x%16.16llx...
22024# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG)
22025>>>3		ubyte		>3		PGP/GPG key public ring (v%u)
22026!:mime		application/pgp-keys
22027!:ext		pgp/gpg/pkr/asd
22028>>>>4		beldate		x		created %s
22029# display key algorithm 17~DSA
22030>>>>8		use		key_algo
22031# Multiprecision Integers (MPI) size
22032>>>>9		ubeshort	x		%u bits
22033>>>>11		ubequad		x		MPI=0x%16.16llx...
22034
220350       beshort         0x9501                  PGP key security ring
22036!:mime	application/x-pgp-keyring
220370       beshort         0x9500                  PGP key security ring
22038!:mime	application/x-pgp-keyring
220390	beshort		0xa600			PGP encrypted data
22040#!:mime	application/pgp-encrypted
22041#0	string		-----BEGIN\040PGP	text/PGP armored data
22042!:mime	text/PGP # encoding: armored data
22043#>15	string	PUBLIC\040KEY\040BLOCK-	public key block
22044#>15	string	MESSAGE-		message
22045#>15	string	SIGNED\040MESSAGE-	signed message
22046#>15	string	PGP\040SIGNATURE-	signature
22047
220482	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
22049!:mime	application/pgp-keys
22050>10	search/100	\n\n
22051>>&0	use		pgp
220520	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
22053!:mime	application/pgp
22054>10	search/100	\n\n
22055>>&0	use		pgp
220560	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
22057!:mime	application/pgp-signature
22058>10	search/100	\n\n
22059>>&0	use		pgp
22060
22061# Decode the type of the packet based on it's base64 encoding.
22062# Idea from Mark Martinec
22063# The specification is in RFC 4880, section 4.2 and 4.3:
22064# http://tools.ietf.org/html/rfc4880#section-4.2
22065
220660	name		pgp
22067>0	byte		0x67		Reserved (old)
22068>0	byte		0x68		Public-Key Encrypted Session Key (old)
22069>0	byte		0x69		Signature (old)
22070>0	byte		0x6a		Symmetric-Key Encrypted Session Key (old)
22071>0	byte		0x6b		One-Pass Signature (old)
22072>0	byte		0x6c		Secret-Key (old)
22073>0	byte		0x6d		Public-Key (old)
22074>0	byte		0x6e		Secret-Subkey (old)
22075>0	byte		0x6f		Compressed Data (old)
22076>0	byte		0x70		Symmetrically Encrypted Data (old)
22077>0	byte		0x71		Marker (old)
22078>0	byte		0x72		Literal Data (old)
22079>0	byte		0x73		Trust (old)
22080>0	byte		0x74		User ID (old)
22081>0	byte		0x75		Public-Subkey (old)
22082>0	byte		0x76		Unused (old)
22083>0	byte		0x77
22084>>1	byte&0xc0	0x00		Reserved
22085>>1	byte&0xc0	0x40		Public-Key Encrypted Session Key
22086>>1	byte&0xc0	0x80		Signature
22087>>1	byte&0xc0	0xc0		Symmetric-Key Encrypted Session Key
22088>0	byte		0x78
22089>>1	byte&0xc0	0x00		One-Pass Signature
22090>>1	byte&0xc0	0x40		Secret-Key
22091>>1	byte&0xc0	0x80		Public-Key
22092>>1	byte&0xc0	0xc0		Secret-Subkey
22093>0	byte		0x79
22094>>1	byte&0xc0	0x00		Compressed Data
22095>>1	byte&0xc0	0x40		Symmetrically Encrypted Data
22096>>1	byte&0xc0	0x80		Marker
22097>>1	byte&0xc0	0xc0		Literal Data
22098>0	byte		0x7a
22099>>1	byte&0xc0	0x00		Trust
22100>>1	byte&0xc0	0x40		User ID
22101>>1	byte&0xc0	0x80		Public-Subkey
22102>>1	byte&0xc0	0xc0		Unused [z%x]
22103>0	byte		0x30
22104>>1	byte&0xc0	0x00		Unused [0%x]
22105>>1	byte&0xc0	0x40		User Attribute
22106>>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data
22107>>1	byte&0xc0	0xc0		Modification Detection Code
22108
22109# magic signatures to detect PGP crypto material (from stef)
22110# detects and extracts metadata from:
22111#  - symmetric encrypted packet header
22112#  - RSA (e=65537) secret (sub-)keys
22113
22114# 1024b RSA encrypted data
22115
221160	string	\x84\x8c\x03		PGP RSA encrypted session key -
22117>3	lelong	x			keyid: %X
22118>7	lelong	x			%X
22119>11	byte	0x01			RSA (Encrypt or Sign) 1024b
22120>11	byte	0x02			RSA Encrypt-Only 1024b
22121>12	string	\x04\x00
22122>12	string	\x03\xff
22123>12	string	\x03\xfe
22124>12	string	\x03\xfd
22125>12	string	\x03\xfc
22126>12	string	\x03\xfb
22127>12	string	\x03\xfa
22128>12	string	\x03\xf9
22129>142	byte	0xd2			.
22130
22131# 2048b RSA encrypted data
22132
221330	string	\x85\x01\x0c\x03	PGP RSA encrypted session key -
22134>4	lelong	x			keyid: %X
22135>8	lelong	x			%X
22136>12	byte	0x01			RSA (Encrypt or Sign) 2048b
22137>12	byte	0x02			RSA Encrypt-Only 2048b
22138>13	string	\x08\x00
22139>13	string	\x07\xff
22140>13	string	\x07\xfe
22141>13	string	\x07\xfd
22142>13	string	\x07\xfc
22143>13	string	\x07\xfb
22144>13	string	\x07\xfa
22145>13	string	\x07\xf9
22146>271	byte	0xd2			.
22147
22148# 3072b RSA encrypted data
22149
221500	string	\x85\x01\x8c\x03	PGP RSA encrypted session key -
22151>4	lelong	x			keyid: %X
22152>8	lelong	x			%X
22153>12	byte	0x01			RSA (Encrypt or Sign) 3072b
22154>12	byte	0x02			RSA Encrypt-Only 3072b
22155>13	string	\x0c\x00
22156>13	string	\x0b\xff
22157>13	string	\x0b\xfe
22158>13	string	\x0b\xfd
22159>13	string	\x0b\xfc
22160>13	string	\x0b\xfb
22161>13	string	\x0b\xfa
22162>13	string	\x0b\xf9
22163>399	byte	0xd2			.
22164
22165# 3072b RSA encrypted data
22166
221670	string	\x85\x02\x0c\x03	PGP RSA encrypted session key -
22168>4	lelong	x			keyid: %X
22169>8	lelong	x			%X
22170>12	byte	0x01			RSA (Encrypt or Sign) 4096b
22171>12	byte	0x02			RSA Encrypt-Only 4096b
22172>13	string	\x10\x00
22173>13	string	\x0f\xff
22174>13	string	\x0f\xfe
22175>13	string	\x0f\xfd
22176>13	string	\x0f\xfc
22177>13	string	\x0f\xfb
22178>13	string	\x0f\xfa
22179>13	string	\x0f\xf9
22180>527	byte	0xd2			.
22181
22182# 4096b RSA encrypted data
22183
221840	string	\x85\x04\x0c\x03	PGP RSA encrypted session key -
22185>4	lelong	x			keyid: %X
22186>8	lelong	x			%X
22187>12	byte	0x01			RSA (Encrypt or Sign) 8129b
22188>12	byte	0x02			RSA Encrypt-Only 8129b
22189>13	string	\x20\x00
22190>13	string	\x1f\xff
22191>13	string	\x1f\xfe
22192>13	string	\x1f\xfd
22193>13	string	\x1f\xfc
22194>13	string	\x1f\xfb
22195>13	string	\x1f\xfa
22196>13	string	\x1f\xf9
22197>1039	byte	0xd2			.
22198
22199# crypto algo mapper
22200
222010	name	crypto
22202>0	byte	0x00			Plaintext or unencrypted data
22203>0	byte	0x01			IDEA
22204>0	byte	0x02			TripleDES
22205>0	byte	0x03			CAST5 (128 bit key)
22206>0	byte	0x04			Blowfish (128 bit key, 16 rounds)
22207>0	byte	0x07			AES with 128-bit key
22208>0	byte	0x08			AES with 192-bit key
22209>0	byte	0x09			AES with 256-bit key
22210>0	byte	0x0a			Twofish with 256-bit key
22211
22212# hash algo mapper
22213
222140	name	hash
22215>0	byte	0x01			MD5
22216>0	byte	0x02			SHA-1
22217>0	byte	0x03			RIPE-MD/160
22218>0	byte	0x08			SHA256
22219>0	byte	0x09			SHA384
22220>0	byte	0x0a			SHA512
22221>0	byte	0x0b			SHA224
22222
22223# display public key algorithms as human readable text
222240	name	key_algo
22225>0	byte	0x01			RSA (Encrypt or Sign)
22226# keep old look of version 5.28 without parentheses
22227>0	byte	0x02			RSA Encrypt-Only
22228>0	byte	0x03			RSA (Sign-Only)
22229>0	byte	16			ElGamal (Encrypt-Only)
22230>0	byte	17			DSA
22231>0	byte	18			Elliptic Curve
22232>0	byte	19			ECDSA
22233>0	byte	20			ElGamal (Encrypt or Sign)
22234>0	byte	21			Diffie-Hellman
22235>0	default	x
22236>>0	ubyte	<22			unknown (pub %d)
22237# this should never happen
22238>>0	ubyte	>21			invalid (%d)
22239
22240# pgp symmetric encrypted data
22241
222420	byte	0x8c			PGP symmetric key encrypted data -
22243>1	byte	0x0d
22244>1	byte	0x0c
22245>2	byte	0x04
22246>3	use	crypto
22247>4	byte	0x01			salted -
22248>>5	use	hash
22249>>14	byte	0xd2			.
22250>>14	byte	0xc9			.
22251>4	byte	0x03			salted & iterated -
22252>>5	use	hash
22253>>15	byte	0xd2			.
22254>>15	byte	0xc9			.
22255
22256# encrypted keymaterial needs s2k & can be checksummed/hashed
22257
222580	name	chkcrypto
22259>0	use	crypto
22260>1	byte	0x00			Simple S2K
22261>1	byte	0x01			Salted S2K
22262>1	byte	0x03			Salted&Iterated S2K
22263>2	use	hash
22264
22265# all PGP keys start with this prolog
22266# containing version, creation date, and purpose
22267
222680	name	keyprolog
22269>0	byte	0x04
22270>1	beldate	x			created on %s -
22271>5	byte	0x01			RSA (Encrypt or Sign)
22272>5	byte	0x02			RSA Encrypt-Only
22273
22274# end of secret keys known signature
22275# contains e=65537 and the prolog to
22276# the encrypted parameters
22277
222780	name	keyend
22279>0	string	\x00\x11\x01\x00\x01	e=65537
22280>5	use	crypto
22281>5	byte	0xff			checksummed
22282>>6	use	chkcrypto
22283>5	byte	0xfe			hashed
22284>>6	use	chkcrypto
22285
22286# PGP secret keys contain also the public parts
22287# these vary by bitsize of the key
22288
222890	name	x1024
22290>0	use	keyprolog
22291>6	string	\x03\xfe
22292>6	string	\x03\xff
22293>6	string	\x04\x00
22294>136	use	keyend
22295
222960	name	x2048
22297>0	use	keyprolog
22298>6	string	\x80\x00
22299>6	string	\x07\xfe
22300>6	string	\x07\xff
22301>264	use	keyend
22302
223030	name	x3072
22304>0	use	keyprolog
22305>6	string	\x0b\xfe
22306>6	string	\x0b\xff
22307>6	string	\x0c\x00
22308>392	use	keyend
22309
223100	name	x4096
22311>0	use	keyprolog
22312>6	string	\x10\x00
22313>6	string	\x0f\xfe
22314>6	string	\x0f\xff
22315>520	use	keyend
22316
22317# \x00|\x1f[\xfe\xff]).{1024})'
223180	name	x8192
22319>0	use	keyprolog
22320>6	string	\x20\x00
22321>6	string	\x1f\xfe
22322>6	string	\x1f\xff
22323>1032	use	keyend
22324
22325# depending on the size of the pkt
22326# we branch into the proper key size
22327# signatures defined as x{keysize}
22328
22329>0	name	pgpkey
22330>0	string	\x01\xd8	1024b
22331>>2	use	x1024
22332>0	string	\x01\xeb	1024b
22333>>2	use	x1024
22334>0	string	\x01\xfb	1024b
22335>>2	use	x1024
22336>0	string	\x01\xfd	1024b
22337>>2	use	x1024
22338>0	string	\x01\xf3	1024b
22339>>2	use	x1024
22340>0	string	\x01\xee	1024b
22341>>2	use	x1024
22342>0	string	\x01\xfe	1024b
22343>>2	use	x1024
22344>0	string	\x01\xf4	1024b
22345>>2	use	x1024
22346>0	string	\x02\x0d	1024b
22347>>2	use	x1024
22348>0	string	\x02\x03	1024b
22349>>2	use	x1024
22350>0	string	\x02\x05	1024b
22351>>2	use	x1024
22352>0	string	\x02\x15	1024b
22353>>2	use	x1024
22354>0	string	\x02\x00	1024b
22355>>2	use	x1024
22356>0	string	\x02\x10	1024b
22357>>2	use	x1024
22358>0	string	\x02\x04	1024b
22359>>2	use	x1024
22360>0	string	\x02\x06	1024b
22361>>2	use	x1024
22362>0	string	\x02\x16	1024b
22363>>2	use	x1024
22364>0	string	\x03\x98	2048b
22365>>2	use	x2048
22366>0	string	\x03\xab	2048b
22367>>2	use	x2048
22368>0	string	\x03\xbb	2048b
22369>>2	use	x2048
22370>0	string	\x03\xbd	2048b
22371>>2	use	x2048
22372>0	string	\x03\xcd	2048b
22373>>2	use	x2048
22374>0	string	\x03\xb3	2048b
22375>>2	use	x2048
22376>0	string	\x03\xc3	2048b
22377>>2	use	x2048
22378>0	string	\x03\xc5	2048b
22379>>2	use	x2048
22380>0	string	\x03\xd5	2048b
22381>>2	use	x2048
22382>0	string	\x03\xae	2048b
22383>>2	use	x2048
22384>0	string	\x03\xbe	2048b
22385>>2	use	x2048
22386>0	string	\x03\xc0	2048b
22387>>2	use	x2048
22388>0	string	\x03\xd0	2048b
22389>>2	use	x2048
22390>0	string	\x03\xb4	2048b
22391>>2	use	x2048
22392>0	string	\x03\xc4	2048b
22393>>2	use	x2048
22394>0	string	\x03\xc6	2048b
22395>>2	use	x2048
22396>0	string	\x03\xd6	2048b
22397>>2	use	x2048
22398>0	string	\x05X		3072b
22399>>2	use	x3072
22400>0	string	\x05k		3072b
22401>>2	use	x3072
22402>0	string	\x05{		3072b
22403>>2	use	x3072
22404>0	string	\x05}		3072b
22405>>2	use	x3072
22406>0	string	\x05\x8d	3072b
22407>>2	use	x3072
22408>0	string	\x05s		3072b
22409>>2	use	x3072
22410>0	string	\x05\x83	3072b
22411>>2	use	x3072
22412>0	string	\x05\x85	3072b
22413>>2	use	x3072
22414>0	string	\x05\x95	3072b
22415>>2	use	x3072
22416>0	string	\x05n		3072b
22417>>2	use	x3072
22418>0	string	\x05\x7e	3072b
22419>>2	use	x3072
22420>0	string	\x05\x80	3072b
22421>>2	use	x3072
22422>0	string	\x05\x90	3072b
22423>>2	use	x3072
22424>0	string	\x05t		3072b
22425>>2	use	x3072
22426>0	string	\x05\x84	3072b
22427>>2	use	x3072
22428>0	string	\x05\x86	3072b
22429>>2	use	x3072
22430>0	string	\x05\x96	3072b
22431>>2	use	x3072
22432>0	string	\x07[		4096b
22433>>2	use	x4096
22434>0	string	\x07\x18	4096b
22435>>2	use	x4096
22436>0	string	\x07+		4096b
22437>>2	use	x4096
22438>0	string	\x07;		4096b
22439>>2	use	x4096
22440>0	string	\x07=		4096b
22441>>2	use	x4096
22442>0	string	\x07M		4096b
22443>>2	use	x4096
22444>0	string	\x073		4096b
22445>>2	use	x4096
22446>0	string	\x07C		4096b
22447>>2	use	x4096
22448>0	string	\x07E		4096b
22449>>2	use	x4096
22450>0	string	\x07U		4096b
22451>>2	use	x4096
22452>0	string	\x07.		4096b
22453>>2	use	x4096
22454>0	string	\x07>		4096b
22455>>2	use	x4096
22456>0	string	\x07@		4096b
22457>>2	use	x4096
22458>0	string	\x07P		4096b
22459>>2	use	x4096
22460>0	string	\x074		4096b
22461>>2	use	x4096
22462>0	string	\x07D		4096b
22463>>2	use	x4096
22464>0	string	\x07F		4096b
22465>>2	use	x4096
22466>0	string	\x07V		4096b
22467>>2	use	x4096
22468>0	string	\x0e[		8192b
22469>>2	use	x8192
22470>0	string	\x0e\x18	8192b
22471>>2	use	x8192
22472>0	string	\x0e+		8192b
22473>>2	use	x8192
22474>0	string	\x0e;		8192b
22475>>2	use	x8192
22476>0	string	\x0e=		8192b
22477>>2	use	x8192
22478>0	string	\x0eM		8192b
22479>>2	use	x8192
22480>0	string	\x0e3		8192b
22481>>2	use	x8192
22482>0	string	\x0eC		8192b
22483>>2	use	x8192
22484>0	string	\x0eE		8192b
22485>>2	use	x8192
22486>0	string	\x0eU		8192b
22487>>2	use	x8192
22488>0	string	\x0e.		8192b
22489>>2	use	x8192
22490>0	string	\x0e>		8192b
22491>>2	use	x8192
22492>0	string	\x0e@		8192b
22493>>2	use	x8192
22494>0	string	\x0eP		8192b
22495>>2	use	x8192
22496>0	string	\x0e4		8192b
22497>>2	use	x8192
22498>0	string	\x0eD		8192b
22499>>2	use	x8192
22500>0	string	\x0eF		8192b
22501>>2	use	x8192
22502>0	string	\x0eV		8192b
22503>>2	use	x8192
22504
22505# PGP RSA (e=65537) secret (sub-)key header
22506
225070	byte	0x95			PGP	Secret Key -
22508>1	use	pgpkey
225090	byte	0x97			PGP	Secret Sub-key -
22510>1	use	pgpkey
225110	byte	0x9d
22512# Update: Joerg Jenderek
22513# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
22514# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
22515>1	ubeshort	>0
22516#>1	ubeshort	x		\b, body length 0x%x
22517# next packet type often 88h,89h~(tag 2)~Signature Packet
22518#>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
22519# skip Dragon.SHR DEMO.INIT by looking for positive version
22520>>3	ubyte		>0
22521# skip BUISSON.13 GUITAR1 by looking for low version number
22522>>>3	ubyte		<5		PGP Secret Sub-key
22523# sub-key are normally part of secret key. So it does not occur as standalone file
22524#!:ext	bin
22525# version 2,3~old 4~new . Comment following line for version 5.28 look
22526>>>>3	ubyte		x		(v%d)
22527>>>>3	ubyte		x		-
22528# old versions 2 or 3 but no real example found
22529>>>>3	ubyte		<4
22530# 2 byte for key bits in version 5.28 look
22531>>>>>11		ubeshort	x	%db
22532>>>>>4		beldate		x	created on %s -
22533# old versions use 2 additional bytes after time stamp
22534#>>>>>8		ubeshort	x	0x%x
22535# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
22536>>>>>10	  	use		key_algo
22537>>>>>(11.S/8)	ubequad		x
22538# look after first key
22539>>>>>>&5	use		keyend
22540# new version
22541>>>>3	ubyte		>3
22542>>>>>9		ubeshort	x	%db
22543>>>>>4		beldate		x	created on %s -
22544# display key algorithm
22545>>>>>8		use		key_algo
22546>>>>>(9.S/8)	ubequad		x
22547# look after first key for something like s2k
22548>>>>>>&3	use		keyend
22549
22550#------------------------------------------------------------------------------
22551# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
22552# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
22553#
225540       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
22555!:mime	application/x-svr4-package
22556
22557#------------------------------------------------------------------------------
22558# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
22559# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
22560# From: "Stefan A. Haubenthal" <polluks@web.de>
22561#
225620	belong		0x00000107	Plan 9 executable, Motorola 68k
225630	belong		0x000001EB	Plan 9 executable, Intel 386
225640	belong		0x00000247	Plan 9 executable, Intel 960
225650	belong		0x000002AB	Plan 9 executable, SPARC
225660	belong		0x00000407	Plan 9 executable, MIPS R3000
225670	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
225680	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
225690	belong		0x000005AB	Plan 9 executable, AMD 29000
225700	belong		0x00000647	Plan 9 executable, ARM 7-something
225710	belong		0x000006EB	Plan 9 executable, PowerPC
225720	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
225730	belong		0x0000084B	Plan 9 executable, DEC Alpha
22574
22575#------------------------------------------------------------------------------
22576# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
22577# plus5:  file(1) magic for Plus Five's UNIX MUMPS
22578#
22579# XXX - byte order?  Paging Hokey....
22580#
225810	short		0x259		mumps avl global
22582>2	byte		>0		(V%d)
22583>6	byte		>0		with %d byte name
22584>7	byte		>0		and %d byte data cells
225850	short		0x25a		mumps blt global
22586>2	byte		>0		(V%d)
22587>8	short		>0		- %d byte blocks
22588>15	byte		0x00		- P/D format
22589>15	byte		0x01		- P/K/D format
22590>15	byte		0x02		- K/D format
22591>15	byte		>0x02		- Bad Flags
22592
22593#------------------------------------------------------------------------------
22594# $File: polyml,v 1.1 2016/02/26 15:52:45 christos Exp $
22595# polyml:  file(1) magic for PolyML
22596#
22597# PolyML
22598# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
22599# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
22600
22601# [0]: http://www.polyml.org/
22602# [1]: https://github.com/polyml/polyml/blob/master/\
22603#	libpolyml/savestate.cpp#L146-L147
22604# [2]: https://github.com/polyml/polyml/blob/master/\
22605#	libpolyml/savestate.cpp#L1262-L1263
22606
22607# Type: Poly/ML saved data
22608# From: Matthew Fernandez <matthew.fernandez@gmail.com>
22609
226100	string	POLYSAVE	Poly/ML saved state
22611>8	long	x		version %u
22612
226130	string  POLYMODU	Poly/ML saved module
22614>8	long	x		version %u
22615
22616#------------------------------------------------------------------------------
22617# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $
22618# printer:  file(1) magic for printer-formatted files
22619#
22620
22621# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
226220	string		%!		PostScript document text
22623!:mime	application/postscript
22624!:apple	ASPSTEXT
22625>2	string		PS-Adobe-	conforming
22626>>11	string		>\0		DSC level %.3s
22627>>>15	string		EPS		\b, type %s
22628>>>15	string		Query		\b, type %s
22629>>>15	string		ExitServer	\b, type %s
22630>>>15   search/1000		%%LanguageLevel:\040
22631>>>>&0	string		>\0		\b, Level %s
22632# Some PCs have the annoying habit of adding a ^D as a document separator
226330	string		\004%!		PostScript document text
22634!:mime	application/postscript
22635!:apple	ASPSTEXT
22636>3	string		PS-Adobe-	conforming
22637>>12	string		>\0		DSC level %.3s
22638>>>16	string		EPS		\b, type %s
22639>>>16	string		Query		\b, type %s
22640>>>16	string		ExitServer	\b, type %s
22641>>>16   search/1000		%%LanguageLevel:\040
22642>>>>&0	string		>\0		\b, Level %s
226430	string		\033%-12345X%!PS	PostScript document
22644
22645# DOS EPS Binary File Header
22646# From: Ed Sznyter <ews@Black.Market.NET>
226470       belong          0xC5D0D3C6      DOS EPS Binary File
22648>4      long            >0              Postscript starts at byte %d
22649>>8     long            >0              length %d
22650>>>12   long            >0              Metafile starts at byte %d
22651>>>>16  long            >0              length %d
22652>>>20   long            >0              TIFF starts at byte %d
22653>>>>24  long            >0              length %d
22654
22655# Summary: Adobe's PostScript Printer Description File
22656# Extension: .ppd
22657# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
22658# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr>
22659#
226600	string		*PPD-Adobe:\x20	PPD file
22661>&0	string		x		\b, version %s
22662
22663# HP Printer Job Language
226640	string		\033%-12345X@PJL	HP Printer Job Language data
22665# HP Printer Job Language
22666# The header found on Win95 HP plot files is the "Silliest Thing possible"
22667# (TM)
22668# Every driver puts the language at some random position, with random case
22669# (LANGUAGE and Language)
22670# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
22671# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
22672#
226730	string		\033%-12345X@PJL	HP Printer Job Language data
22674>&0	string		>\0			%s
22675>>&0	string		>\0			%s
22676>>>&0	string		>\0			%s
22677>>>>&0	string		>\0			%s
22678#>15	string		\ ENTER\ LANGUAGE\ =
22679#>31	string		PostScript		PostScript
22680
22681# From: Stefan Thurner <thurners@nicsys.de>
226820	string		\033%-12345X@PJL
22683>&0	search/10000	%!			PJL encapsulated PostScript document text
22684
22685# Rick Richardson <rickrich@gmail.com>
22686
22687# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
22688# For Oki Data Printers - HIPERC
22689# For Konica Minolta Printers - LAVAFLOW
22690# For Samsung Printers - QPDL
22691# For HP Printers - ZJS stands for Zenographics ZJStream
226920	string		\033%-12345X@PJL	HP Printer Job Language data
22693>0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
22694>0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
22695>0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
22696>0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
22697>0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
22698>0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS
22699
22700
22701# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
227020	string		\033E\033	HP PCL printer data
22703>3	string		\&l0A		- default page size
22704>3	string		\&l1A		- US executive page size
22705>3	string		\&l2A		- US letter page size
22706>3	string		\&l3A		- US legal page size
22707>3	string		\&l26A		- A4 page size
22708>3	string		\&l80A		- Monarch envelope size
22709>3	string		\&l81A		- No. 10 envelope size
22710>3	string		\&l90A		- Intl. DL envelope size
22711>3	string		\&l91A		- Intl. C5 envelope size
22712>3	string		\&l100A		- Intl. B5 envelope size
22713>3	string		\&l-81A		- No. 10 envelope size (landscape)
22714>3	string		\&l-90A		- Intl. DL envelope size (landscape)
22715
22716# IMAGEN printer-ready files:
227170	string	@document(		Imagen printer
22718# this only works if "language xxx" is first item in Imagen header.
22719>10	string	language\ impress	(imPRESS data)
22720>10	string	language\ daisy		(daisywheel text)
22721>10	string	language\ diablo	(daisywheel text)
22722>10	string	language\ printer	(line printer emulation)
22723>10	string	language\ tektronix	(Tektronix 4014 emulation)
22724# Add any other languages that your Imagen uses - remember
22725# to keep the word `text' if the file is human-readable.
22726# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
22727#
22728# Now magic for IMAGEN font files...
227290	string		Rast		RST-format raster font data
22730>45	string		>0		face %s
22731# From Jukka Ukkonen
227320	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
22733
22734# From <mike@flyn.org>
22735# These are the /etc/magic entries to decode data sent to an Epson printer.
227360       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
22737
22738
22739#------------------------------------------------------------------------------
22740# zenographics:  file(1) magic for Zenographics ZjStream printer data
22741# Rick Richardson <rickrich@gmail.com>
227420	string		JZJZ
22743>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
227440	string		ZJZJ
22745>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
22746
22747
22748#------------------------------------------------------------------------------
22749# Oak Technologies printer stream
22750# Rick Richardson <rickrich@gmail.com>
227510       string          OAK
22752>0x07	byte		0
22753>0x0b	byte		0	Oak Technologies printer stream
22754
22755# This would otherwise be recognized as PostScript - nick@debian.org
227560	string		%!VMF 		SunClock's Vector Map Format data
22757
22758#------------------------------------------------------------------------------
22759# HP LaserJet 1000 series downloadable firmware file
227600	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware
22761
22762# From: Paolo <oopla@users.sf.net>
22763# Epson ESC/Page, ESC/PageColor
227640	string	\x1b\x01@EJL	Epson ESC/Page language printer data
22765
22766#------------------------------------------------------------------------------
22767# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
22768# project:  file(1) magic for Project management
22769#
22770# Magic strings for ftnchek project files. Alexander Mai
227710	string	FTNCHEK_\ P	project file for ftnchek
22772>10	string	1		version 2.7
22773>10	string	2		version 2.8 to 2.10
22774>10	string	3		version 2.11 or later
22775
22776#------------------------------------------------------------------------------
22777# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
22778# psdbms:  file(1) magic for psdatabase
22779#
22780# Update: Joerg Jenderek
22781# GRR: line below too general as it catches also some Panorama database *.pan ,
22782# AppleWorks word processor
227830	belong&0xff00ffff	0x56000000
22784# assume version starts with digit
22785>1	regex/s			=^[0-9]		ps database
22786>>1	string	>\0	version %s
22787# kernel name
22788>>4	string	>\0	from kernel %s
22789
22790#------------------------------------------------------------------------------
22791# $File: psl,v 1.2 2016/07/14 17:34:27 christos Exp $
22792# psl:  file(1) magic for Public Suffix List representations
22793# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
22794# URL: https://publicsuffix.org
22795# see also: http://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166
22796
227970	search/512	\n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data
22798
227990	string	.DAFSA@PSL_
22800>15	string	\n	Public Suffix List data (optimized)
22801>>11	byte	>0x2f
22802>>>11	byte	<0x3a   (Version %c)
22803
22804#------------------------------------------------------------------------------
22805# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
22806# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
22807#
22808# http://pulsar.sourceforge.net
22809# mailto:rok.papez@lugos.si
22810#
22811
228120	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
22813>4	ubelong	x		Version: %d.
22814>8	ubelong	x		\b%d
22815
22816
22817#------------------------------------------------------------------------------
22818# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $
22819# pwsafe: file(1) magic for passwordsafe file
22820#
22821# Password Safe
22822# http://passwordsafe.sourceforge.net/
22823# file format specs
22824# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
22825# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
22826# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
22827# V2 and V1 have no easy identifier that I can find
22828# .psafe3
228290	string	PWS3	Password Safe V3 database
22830
22831#------------------------------------------------------------------------------
22832# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
22833# pyramid:  file(1) magic for Pyramids
22834#
22835# XXX - byte order?
22836#
228370	long		0x50900107	Pyramid 90x family executable
228380	long		0x50900108	Pyramid 90x family pure executable
22839>16	long		>0		not stripped
228400	long		0x5090010b	Pyramid 90x family demand paged pure executable
22841>16	long		>0		not stripped
22842
22843#------------------------------------------------------------------------------
22844# $File: python,v 1.34 2017/08/14 07:40:38 christos Exp $
22845# python:  file(1) magic for python
22846#
22847# Outlook puts """ too for urgent messages
22848# From: David Necas <yeti@physics.muni.cz>
22849# often the module starts with a multiline string
228500	string/t	"""	Python script text executable
22851# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
22852# that Py_UnicodeFlag is off for Python 2)
22853# two bytes of magic followed by "\r\n" in little endian order
228540	belong		0x994e0d0a	python 1.5/1.6 byte-compiled
228550	belong		0x87c60d0a	python 2.0 byte-compiled
228560	belong		0x2aeb0d0a	python 2.1 byte-compiled
228570	belong		0x2ded0d0a	python 2.2 byte-compiled
228580	belong		0x3bf20d0a	python 2.3 byte-compiled
228590	belong		0x6df20d0a	python 2.4 byte-compiled
228600	belong		0xb3f20d0a	python 2.5 byte-compiled
228610	belong		0xd1f20d0a	python 2.6 byte-compiled
228620	belong		0x03f30d0a	python 2.7 byte-compiled
228630	belong		0x3b0c0d0a	python 3.0 byte-compiled
228640	belong		0x4f0c0d0a	python 3.1 byte-compiled
228650	belong		0x6c0c0d0a	python 3.2 byte-compiled
228660	belong		0x9e0c0d0a	python 3.3 byte-compiled
228670	belong		0xee0c0d0a	python 3.4 byte-compiled
228680	belong		0x160d0d0a	python 3.5.1- byte-compiled
228690	belong		0x170d0d0a	python 3.5.2+ byte-compiled
228700	belong		0x330d0d0a	python 3.6 byte-compiled
228710	belong		0x3e0d0d0a	python 3.7 byte-compiled
22872
22873
228740	search/1/w	#!\ /usr/bin/python	Python script text executable
22875!:strength + 15
22876!:mime text/x-python
228770	search/1/w	#!\ /usr/local/bin/python	Python script text executable
22878!:strength + 15
22879!:mime text/x-python
228800	search/1	#!/usr/bin/env\ python	Python script text executable
22881!:strength + 15
22882!:mime text/x-python
228830	search/10	#!\ /usr/bin/env\ python	Python script text executable
22884!:strength + 15
22885!:mime text/x-python
22886
22887
22888# from module.submodule import func1, func2
228890	regex		\^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$	Python script text executable
22890!:strength + 15
22891!:mime text/x-python
22892
22893# def __init__ (self, ...):
228940	search/4096	def\ __init__
22895>&0	search/64 self	Python script text executable
22896!:strength + 15
22897!:mime text/x-python
22898
22899# if __name__ == "__main__":
229000 search/4096 if\ __name__
22901>&0 search/64 '__main__'	Python script text executable
22902>&0 search/64 "__main__"	Python script text executable
22903!:strength + 15
22904!:mime text/x-python
22905
22906# import module [as abrev]
229070	regex/4096	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
22908!:mime text/x-python
22909
22910# comments
22911#0	search/4096	'''
22912#>&0	regex	.*'''$	Python script text executable
22913#!:mime text/x-python
22914
22915#0	search/4096	"""
22916#>&0	regex	.*"""$	Python script text executable
22917#!:mime text/x-python
22918
22919# try:
22920# except: or finally:
22921# block
229220	search/4096	try:
22923>&0	regex/4096	\^[[:space:]]*except.*:$	Python script text executable
22924!:strength + 15
22925!:mime text/x-python
22926>&0	search/4096	finally:	Python script text executable
22927!:mime text/x-python
22928
22929# class name[(base classes,)]: [pass]
229300	regex	\^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$		Python script text executable
22931!:strength + 15
22932!:mime text/x-python
22933
22934# def name(*args, **kwargs):
229350	regex/4096	 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
22936>&0	regex	 \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
22937!:strength + 15
22938!:mime text/x-python
22939
22940#------------------------------------------------------------------------------
22941# $File: qt,v 1.2 2014/12/16 19:49:29 christos Exp $
22942# qt:  file(1) magic for Qt
22943
22944# http://doc.qt.io/qt-5/resources.html
229450	string		\<!DOCTYPE\040RCC\>	Qt Resource Collection file
22946
22947# https://qt.gitorious.org/qt/qtbase/source/\
22948# 5367fa356233da4c0f28172a8f817791525f5457:\
22949# src/tools/rcc/rcc.cpp#L840
229500	string		qres\0\0		Qt Binary Resource file
229510	search/1024	The\040Resource\040Compiler\040for\040Qt	Qt C-code resource file
22952
22953# https://qt.gitorious.org/qt/qtbase/source/\
22954# 5367fa356233da4c0f28172a8f817791525f5457:\
22955# src/corelib/kernel/qtranslator.cpp#L62
229560	string		\x3c\xb8\x64\x18\xca\xef\x9c\x95
22957>8	string		\xcd\x21\x1c\xbf\x60\xa1\xbd\xdd	Qt Translation file
22958
22959#------------------------------------------------------------------------------
22960# $File: revision,v 1.10 2017/10/19 16:40:37 christos Exp $
22961# file(1) magic for revision control files
22962# From Hendrik Scholz <hendrik@scholz.net>
229630	string/t	/1\ :pserver:	cvs password text file
22964
22965# Conary changesets
22966# From: Jonathan Smith <smithj@rpath.com>
229670	belong	0xea3f81bb	Conary changeset data
22968
22969# Type: Git bundles (git-bundle)
22970# From: Josh Triplett <josh@freedesktop.org>
229710	string	#\ v2\ git\ bundle\n	Git bundle
22972
22973# Type: Git pack
22974# From: Adam Buchbinder <adam.buchbinder@gmail.com>
22975# Update: Joerg Jenderek
22976# URL: http://fileformats.archiveteam.org/wiki/Git
22977# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
22978# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
22979# those have a little-endian offset immediately following the magic 'PACK',
22980# the first byte of which is never 0, while the first byte of the Git pack
22981# version, since it's a tiny number stored in big-endian format, is always 0.
229820	string	PACK
22983# GRR: line above is too general as it matches also PackDir archive ./acorn
22984# test for major version. Git 2017 accepts version number 2 or 3
22985>4	ubelong	<9
22986# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
22987# or SystemDevice::foobar
22988>>9	search/13 ::
22989# but in git binary
22990>>9	default	x	Git pack
22991!:mime	application/x-git
22992!:ext	pack
22993# 4 GB limit implies unsigned integer
22994>>>4	ubelong	x		\b, version %u
22995>>>8	ubelong	x		\b, %u objects
22996
22997# Type: Git pack index
22998# From: Adam Buchbinder <adam.buchbinder@gmail.com>
229990	string	\377tOc		Git pack index
23000>4	belong	=2		\b, version 2
23001
23002# Type: Git index file
23003# From: Frederic Briare <fbriere@fbriere.net>
230040	string	DIRC		Git index
23005>4	belong	>0		\b, version %d
23006>>8	belong	>0		\b, %d entries
23007
23008# Type:	Mercurial bundles
23009# From:	Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr>
230100	string	HG10		Mercurial bundle,
23011>4	string	UN		uncompressed
23012>4	string	BZ		bzip2 compressed
23013
23014# Type:	Subversion (SVN) dumps
23015# From:	Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de>
230160	string	SVN-fs-dump-format-version:	Subversion dumpfile
23017>28	string	>\0				(version: %s)
23018
23019# Type:	Bazaar revision bundles and merge requests
23020# URL:	http://www.bazaar-vcs.org/
23021# From:	Jelmer Vernooij <jelmer@samba.org>
230220	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
230230	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive
23024
23025#------------------------------------------------------------------------------
23026# $File: riff,v 1.33 2017/10/06 01:11:24 christos Exp $
23027# riff:  file(1) magic for RIFF format
23028# See
23029#
23030#	http://www.seanet.com/users/matts/riffmci/riffmci.htm
23031#	http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf
23032#
23033
23034# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
230350   name    riff-wave
23036>0	leshort		1		\b, Microsoft PCM
23037>>14	leshort		>0
23038>>>14	leshort		<1024	\b, %d bit
23039>0	leshort		2		\b, Microsoft ADPCM
23040>0	leshort		6		\b, ITU G.711 A-law
23041>0	leshort		7		\b, ITU G.711 mu-law
23042>0	leshort		8		\b, Microsoft DTS
23043>0	leshort		17		\b, IMA ADPCM
23044>0	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
23045>0	leshort		49		\b, GSM 6.10
23046>0	leshort		64		\b, ITU G.721 ADPCM
23047>0	leshort		80		\b, MPEG
23048>0	leshort		85		\b, MPEG Layer 3
23049>0	leshort		0x2001		\b, DTS
23050>2	leshort		=1		\b, mono
23051>2	leshort		=2		\b, stereo
23052>2	leshort		>2
23053>>2	leshort		<128	\b, %d channels
23054>4	lelong		>0
23055>>4	lelong		<1000000	%d Hz
23056
23057# try to find "fmt "
230580   name    riff-walk
23059>0  string  fmt\x20
23060>>4 lelong  <0x80
23061>>>8 use    riff-wave
23062>0  string  LIST
23063>>&(4.l+4)  use riff-walk
23064>0  string  DISP
23065>>&(4.l+4)  use riff-walk
23066>0  string  bext
23067>>&(4.l+4)  use riff-walk
23068>0  string  Fake
23069>>&(4.l+4)  use riff-walk
23070>0  string  fact
23071>>&(4.l+4)  use riff-walk
23072>0  string  VP8
23073>>11		byte		0x9d
23074>>>12		byte		0x01
23075>>>>13		byte		0x2a	\b, VP8 encoding
23076>>>>>14		leshort&0x3fff	x	\b, %d
23077>>>>>16		leshort&0x3fff	x	\bx%d, Scaling:
23078>>>>>14		leshort&0xc000	0x0000	\b [none]
23079>>>>>14		leshort&0xc000	0x1000	\b [5/4]
23080>>>>>14		leshort&0xc000	0x2000	\b [5/3]
23081>>>>>14		leshort&0xc000	0x3000	\b [2]
23082>>>>>14		leshort&0xc000	0x0000	\bx[none]
23083>>>>>14		leshort&0xc000	0x1000	\bx[5/4]
23084>>>>>14		leshort&0xc000	0x2000	\bx[5/3]
23085>>>>>14		leshort&0xc000	0x3000	\bx[2]
23086>>>>>15		byte&0x80	=0x00	\b, YUV color
23087>>>>>15		byte&0x80	=0x80	\b, bad color specification
23088>>>>>15		byte&0x40	=0x40	\b, no clamping required
23089>>>>>15		byte&0x40	=0x00	\b, decoders should clamp
23090#>0  string  x		we got %s
23091#>>&(4.l+4)  use riff-walk
23092
23093# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi>
23094#
230950	string		RIFF		RIFF (little-endian) data
23096# RIFF Palette format
23097# Update: Joerg Jenderek
23098# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format
23099# Reference: http://worms2d.info/Palette_file
23100>8	string		PAL\ 		\b, palette
23101!:mime	application/x-riff
23102# color palette by Microsoft Corporation
23103!:ext	pal
23104# file size =  chunk size + 8 in most cases
23105>>4	ulelong+8	x		\b, %u bytes
23106# Extended PAL Format
23107>>12	string		plth		\b, extended
23108# Simple PAL Format
23109>>12	string		data
23110# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes
23111>>>16	ulelong		x		\b, data size %u
23112# palVersion is always 0x0300
23113#>>>20	leshort		x		\b, version 0x%4.4x
23114# palNumEntries specifies the number of palette color entries
23115>>>22	uleshort	x		\b, %u entries
23116# after palPalEntry sized (number of color entries * 4 ) vector
23117>>>(22.s*4)	ubequad	x
23118# jump relative 22 ( 8 + 16) bytes forward points after end of file or to
23119# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal
23120>>>>&16		ubelong	x		\b, extra bytes
23121>>>>>&-4	ubelong	>0		0x%8.8x
23122# RIFF Device Independent Bitmap format
23123>8	string		RDIB		\b, device-independent bitmap
23124>>16	string		BM
23125>>>30	leshort		12		\b, OS/2 1.x format
23126>>>>34	leshort		x		\b, %d x
23127>>>>36	leshort		x		%d
23128>>>30	leshort		64		\b, OS/2 2.x format
23129>>>>34	leshort		x		\b, %d x
23130>>>>36	leshort		x		%d
23131>>>30	leshort		40		\b, Windows 3.x format
23132>>>>34	lelong		x		\b, %d x
23133>>>>38	lelong		x		%d x
23134>>>>44	leshort		x		%d
23135# RIFF MIDI format
23136>8	string		RMID		\b, MIDI
23137# RIFF Multimedia Movie File format
23138>8	string		RMMP		\b, multimedia movie
23139# RIFF wrapper for MP3
23140>8	string		RMP3		\b, MPEG Layer 3 audio
23141# Microsoft WAVE format (*.wav)
23142>8	string		WAVE		\b, WAVE audio
23143!:mime	audio/x-wav
23144>>12    string  >\0
23145>>>12   use     riff-walk
23146# Corel Draw Picture
23147>8	string		CDRA		\b, Corel Draw Picture
23148!:mime	image/x-coreldraw
23149>8	string		CDR6		\b, Corel Draw Picture, version 6
23150!:mime	image/x-coreldraw
23151>8	string		NUNDROOT	\b, Steinberg CuBase
23152# AVI == Audio Video Interleave
23153>8	string		AVI\040		\b, AVI
23154!:mime	video/x-msvideo
23155>>12    string          LIST
23156>>>20   string          hdrlavih
23157>>>>&36 lelong          x               \b, %u x
23158>>>>&40 lelong          x               %u,
23159>>>>&4  lelong          >1000000        <1 fps,
23160>>>>&4  lelong          1000000         1.00 fps,
23161>>>>&4  lelong          500000          2.00 fps,
23162>>>>&4  lelong          333333          3.00 fps,
23163>>>>&4  lelong          250000          4.00 fps,
23164>>>>&4  lelong          200000          5.00 fps,
23165>>>>&4  lelong          166667          6.00 fps,
23166>>>>&4  lelong          142857          7.00 fps,
23167>>>>&4  lelong          125000          8.00 fps,
23168>>>>&4  lelong          111111          9.00 fps,
23169>>>>&4  lelong          100000          10.00 fps,
23170# ]9.9,10.1[
23171>>>>&4  lelong          <101010
23172>>>>>&-4        lelong  >99010
23173>>>>>>&-4       lelong  !100000         ~10 fps,
23174>>>>&4  lelong          83333           12.00 fps,
23175# ]11.9,12.1[
23176>>>>&4  lelong          <84034
23177>>>>>&-4        lelong  >82645
23178>>>>>>&-4       lelong  !83333          ~12 fps,
23179>>>>&4  lelong          66667           15.00 fps,
23180# ]14.9,15.1[
23181>>>>&4  lelong          <67114
23182>>>>>&-4        lelong  >66225
23183>>>>>>&-4       lelong  !66667          ~15 fps,
23184>>>>&4  lelong          50000           20.00 fps,
23185>>>>&4  lelong          41708           23.98 fps,
23186>>>>&4  lelong          41667           24.00 fps,
23187# ]23.9,24.1[
23188>>>>&4  lelong          <41841
23189>>>>>&-4        lelong  >41494
23190>>>>>>&-4       lelong  !41708
23191>>>>>>>&-4      lelong  !41667          ~24 fps,
23192>>>>&4  lelong          40000           25.00 fps,
23193# ]24.9,25.1[
23194>>>>&4  lelong          <40161
23195>>>>>&-4        lelong  >39841
23196>>>>>>&-4       lelong  !40000          ~25 fps,
23197>>>>&4  lelong          33367           29.97 fps,
23198>>>>&4  lelong          33333           30.00 fps,
23199# ]29.9,30.1[
23200>>>>&4  lelong          <33445
23201>>>>>&-4        lelong  >33223
23202>>>>>>&-4       lelong  !33367
23203>>>>>>>&-4      lelong  !33333          ~30 fps,
23204>>>>&4  lelong          <32224          >30 fps,
23205##>>>>&4  lelong          x               (%lu)
23206##>>>>&20 lelong          x               %lu frames,
23207# Note: The tests below assume that the AVI has 1 or 2 streams,
23208#       "vids" optionally followed by "auds".
23209#       (Should cover 99.9% of all AVIs.)
23210# assuming avih length = 56
23211>>>88   string  LIST
23212>>>>96  string  strlstrh
23213>>>>>108        string  vids    video:
23214>>>>>>&0        lelong  0               uncompressed
23215# skip past vids strh
23216>>>>>>(104.l+108)       string  strf
23217>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
23218>>>>>>>(104.l+132)      string/c        cvid    Cinepak
23219>>>>>>>(104.l+132)      string/c        i263    Intel I.263
23220>>>>>>>(104.l+132)      string/c        iv32    Indeo 3.2
23221>>>>>>>(104.l+132)      string/c        iv41    Indeo 4.1
23222>>>>>>>(104.l+132)      string/c        iv50    Indeo 5.0
23223>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
23224>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
23225>>>>>>>(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
23226>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
23227>>>>>>>(104.l+132)      string/c        div3    DivX 3
23228>>>>>>>>112             string/c        div3    Low-Motion
23229>>>>>>>>112             string/c        div4    Fast-Motion
23230>>>>>>>(104.l+132)      string/c        divx    DivX 4
23231>>>>>>>(104.l+132)      string/c        dx50    DivX 5
23232>>>>>>>(104.l+132)      string/c        xvid    XviD
23233>>>>>>>(104.l+132)	string/c	h264	H.264
23234>>>>>>>(104.l+132)      string/c        wmv3    Windows Media Video 9
23235>>>>>>>(104.l+132)      string/c        h264    X.264 or H.264
23236>>>>>>>(104.l+132)      lelong  0
23237##>>>>>>>(104.l+132)      string  x       (%.4s)
23238# skip past first (video) LIST
23239>>>>(92.l+96)   string  LIST
23240>>>>>(92.l+104) string  strlstrh
23241>>>>>>(92.l+116)        string          auds    \b, audio:
23242# auds strh length = 56:
23243>>>>>>>(92.l+172)       string          strf
23244>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
23245>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
23246>>>>>>>>(92.l+180)      leshort 0x0006  aLaw
23247>>>>>>>>(92.l+180)      leshort 0x0007  uLaw
23248>>>>>>>>(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
23249>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
23250>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
23251>>>>>>>>(92.l+180)      leshort 0x0161  DivX
23252##>>>>>>>>(92.l+180)      leshort x       (0x%.4x)
23253>>>>>>>>(92.l+182)      leshort 1       (mono,
23254>>>>>>>>(92.l+182)      leshort 2       (stereo,
23255>>>>>>>>(92.l+182)      leshort >2      (%d channels,
23256>>>>>>>>(92.l+184)      lelong  x       %d Hz)
23257# auds strh length = 64:
23258>>>>>>>(92.l+180)       string          strf
23259>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
23260>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
23261>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
23262>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
23263>>>>>>>>(92.l+188)      leshort 0x0161  DivX
23264##>>>>>>>>(92.l+188)      leshort x       (0x%.4x)
23265>>>>>>>>(92.l+190)      leshort 1       (mono,
23266>>>>>>>>(92.l+190)      leshort 2       (stereo,
23267>>>>>>>>(92.l+190)      leshort >2      (%d channels,
23268>>>>>>>>(92.l+192)      lelong  x       %d Hz)
23269# Animated Cursor format
23270>8	string		ACON		\b, animated cursor
23271# SoundFont 2 <mpruett@sgi.com>
23272>8	string		sfbk		SoundFont/Bank
23273# MPEG-1 wrapped in a RIFF, apparently
23274>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
23275>8	string		4XMV		\b, 4X Movie file
23276# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
23277>8	string		AMV\040		\b, AMV
23278>8      string          WEBP            \b, Web/P image
23279!:mime	image/webp
23280>>12	use		riff-walk
23281
23282#
23283# XXX - some of the below may only appear in little-endian form.
23284#
23285# Also "MV93" appears to be for one form of Macromedia Director
23286# files, and "GDMF" appears to be another multimedia format.
23287#
232880	string		RIFX		RIFF (big-endian) data
23289# RIFF Palette format
23290>8	string		PAL		\b, palette
23291>>16	beshort		x		\b, version %d
23292>>18	beshort		x		\b, %d entries
23293# RIFF Device Independent Bitmap format
23294>8	string		RDIB		\b, device-independent bitmap
23295>>16	string		BM
23296>>>30	beshort		12		\b, OS/2 1.x format
23297>>>>34	beshort		x		\b, %d x
23298>>>>36	beshort		x		%d
23299>>>30	beshort		64		\b, OS/2 2.x format
23300>>>>34	beshort		x		\b, %d x
23301>>>>36	beshort		x		%d
23302>>>30	beshort		40		\b, Windows 3.x format
23303>>>>34	belong		x		\b, %d x
23304>>>>38	belong		x		%d x
23305>>>>44	beshort		x		%d
23306# RIFF MIDI format
23307>8	string		RMID		\b, MIDI
23308# RIFF Multimedia Movie File format
23309>8	string		RMMP		\b, multimedia movie
23310# Microsoft WAVE format (*.wav)
23311>8	string		WAVE		\b, WAVE audio
23312>>20	leshort		1		\b, Microsoft PCM
23313>>>34	leshort		>0		\b, %d bit
23314>>22	beshort		=1		\b, mono
23315>>22	beshort		=2		\b, stereo
23316>>22	beshort		>2		\b, %d channels
23317>>24	belong		>0		%d Hz
23318# Corel Draw Picture
23319>8	string		CDRA		\b, Corel Draw Picture
23320>8	string		CDR6		\b, Corel Draw Picture, version 6
23321# AVI == Audio Video Interleave
23322>8	string		AVI\040		\b, AVI
23323# Animated Cursor format
23324>8	string		ACON		\b, animated cursor
23325# Notation Interchange File Format (big-endian only)
23326>8	string		NIFF		\b, Notation Interchange File Format
23327# SoundFont 2 <mpruett@sgi.com>
23328>8	string		sfbk		SoundFont/Bank
23329
23330#------------------------------------------------------------------------------
23331# Sony Wave64
23332# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
23333# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
233340	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
23335# 128 bit + total file size (64 bits) so 24 bytes
23336# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
23337>24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
23338!:mime	audio/x-w64
23339# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
23340>>40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
23341>>>&10	leshort		=1		\b, mono
23342>>>&10	leshort		=2		\b, stereo
23343>>>&10	leshort		>2		\b, %d channels
23344>>>&12	lelong		>0		%d Hz
23345
23346#------------------------------------------------------------------------------
23347# MBWF/RF64
23348# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
233490	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
23350!:mime	audio/x-wav
23351>40	search/256	fmt\x20		\b
23352>>&6	leshort		=1		\b, mono
23353>>&6	leshort		=2		\b, stereo
23354>>&6	leshort		>2		\b, %d channels
23355>>&8	lelong		>0		%d Hz
23356
23357#------------------------------------------------------------------------------
23358# $File: rpi,v 1.1 2018/01/01 05:25:17 christos Exp $
23359# rpi:  file(1) magic for Raspberry Pi images
23360-44		lelong	0
23361>4		lelong	0
23362>>8		lelong	1
23363>>12		lelong	4
23364>>>16		string	283x
23365>>>>20		lelong	1
23366>>>>>24		lelong	4
23367>>>>>>28	string	DTOK
23368>>>>>>>32	lelong	44
23369>>>>>>>>36	lelong	4
23370>>>>>>>>>40	string	RPTL		Raspberry PI kernel image
23371
23372#------------------------------------------------------------------------------
23373# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
23374#
23375# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
23376#
233770	belong		0xedabeedb	RPM
23378!:mime	application/x-rpm
23379>4	byte		x		v%d
23380>5	byte		x		\b.%d
23381>6	beshort		1		src
23382>6	beshort		0		bin
23383>>8	beshort		1		i386/x86_64
23384>>8	beshort		2		Alpha/Sparc64
23385>>8	beshort		3		Sparc
23386>>8	beshort		4		MIPS
23387>>8	beshort		5		PowerPC
23388>>8	beshort		6		68000
23389>>8	beshort		7		SGI
23390>>8	beshort		8		RS6000
23391>>8	beshort		9		IA64
23392>>8	beshort		10		Sparc64
23393>>8	beshort		11		MIPSel
23394>>8	beshort		12		ARM
23395>>8	beshort		13		MiNT
23396>>8	beshort		14		S/390
23397>>8	beshort		15		S/390x
23398>>8	beshort		16		PowerPC64
23399>>8	beshort		17		SuperH
23400>>8	beshort		18		Xtensa
23401>>8	beshort		255		noarch
23402>>10	string		x		%s
23403
23404#delta RPM    Daniel Novotny (dnovotny@redhat.com)
234050	string		drpm		Delta RPM
23406!:mime  application/x-rpm
23407>12	string 	x	%s
23408>>8	beshort		11		MIPSel
23409>>8	beshort		12		ARM
23410>>8	beshort		13		MiNT
23411>>8	beshort		14		S/390
23412>>8	beshort		15		S/390x
23413>>8	beshort		16		PowerPC64
23414>>8	beshort		17		SuperH
23415>>8	beshort		18		Xtensa
23416>>10	string		x		%s
23417
23418#------------------------------------------------------------------------------
23419# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
23420# rtf:	file(1) magic for Rich Text Format (RTF)
23421#
23422# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
23423#
234240	string		{\\rtf		Rich Text Format data,
23425!:mime	text/rtf
23426>5	string		1		version 1,
23427>>6	string		\\ansi		ANSI
23428>>6	string		\\mac		Apple Macintosh
23429>>6	string		\\pc		IBM PC, code page 437
23430>>6	string		\\pca		IBM PS/2, code page 850
23431>>6	default		x		unknown character set
23432>5	default		x		unknown version
23433
23434#------------------------------------------------------------------------------
23435# $File: ruby,v 1.7 2017/08/14 13:39:18 christos Exp $
23436# ruby:  file(1) magic for Ruby scripting language
23437# URL:  http://www.ruby-lang.org/
23438# From: Reuben Thomas <rrt@sc3d.org>
23439
23440# Ruby scripts
234410	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
23442!:strength + 15
23443!:mime text/x-ruby
234440	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
23445!:strength + 15
23446!:mime text/x-ruby
234470	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
23448!:strength + 15
23449!:mime text/x-ruby
234500	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
23451!:strength + 15
23452!:mime text/x-ruby
23453
23454# What looks like ruby, but does not have a shebang
23455# (modules and such)
23456# From: Lubomir Rintel <lkundrak@v3.sk>
234570	regex/4096		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
23458>0	regex		def\ [a-z]|\ do$
23459>>&0	regex/4096		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
23460!:strength + 30
23461!:mime	text/x-ruby
234620	regex/4096		\^[[:space:]]*(class|module)[[:space:]][A-Z]
23463>0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
23464>>&0	regex/4096		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
23465!:strength + 30
23466!:mime	text/x-ruby
23467# Classes with no modules or defs, beats simple ASCII
234680	regex/4096		\^[[:space:]]*(class|module)[[:space:]][A-Z]
23469>&0	regex/4096	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
23470!:strength + 10
23471!:mime	text/x-ruby
23472# Looks for function definition to balance python magic
23473# def name (args)
23474# end
234750	regex/4096		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
23476>&0	regex/4096		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
23477!:strength + 10
23478!:mime	text/x-ruby
23479
234800	regex/4096		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'	Ruby script text
23481!:mime	text/x-ruby
234820 regex/4096 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
23483!:mime	text/x-ruby
23484
23485#------------------------------------------------------------------------------
23486# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
23487# sc:  file(1) magic for "sc" spreadsheet
23488#
2348938	string		Spreadsheet	sc spreadsheet file
23490!:mime	application/x-sc
23491
23492#------------------------------------------------------------------------------
23493# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
23494# sccs:  file(1) magic for SCCS archives
23495#
23496# SCCS archive structure:
23497# \001h01207
23498# \001s 00276/00000/00000
23499# \001d D 1.1 87/09/23 08:09:20 ian 1 0
23500# \001c date and time created 87/09/23 08:09:20 by ian
23501# \001e
23502# \001u
23503# \001U
23504# ... etc.
23505# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
23506# *Sigh*. And these both came from various parts of the USG.
23507# Maybe we should just switch everybody from SCCS to RCS!
23508# Further, you can't just say '\001h0', because the five-digit number
23509# is a checksum that could (presumably) have any leading digit,
23510# and we don't have regular expression matching yet.
23511# Hence the following official kludge:
235128	string		\001s\ 			SCCS archive data
23513
23514#------------------------------------------------------------------------------
23515# $File: scientific,v 1.12 2017/03/17 22:20:22 christos Exp $
23516# scientific:  file(1) magic for scientific formats
23517#
23518# From: Joe Krahn <krahn@niehs.nih.gov>
23519
23520########################################################
23521# CCP4 data and plot files:
235220	string		MTZ\040		MTZ reflection file
23523
2352492	string		PLOT%%84	Plot84 plotting file
23525>52	byte		1		, Little-endian
23526>55	byte		1		, Big-endian
23527
23528########################################################
23529# Electron density MAP/MASK formats
23530
235310	string		EZD_MAP	NEWEZD Electron Density Map
23532109	string		MAP\040(  Old EZD Electron Density Map
23533
235340	string/c	:-)\040Origin	BRIX Electron Density Map
23535>170	string		>0	, Sigma:%.12s
23536#>4	string		>0	%.178s
23537#>4	addr		x	%.178s
23538
235397	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
235409	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map
23541
23542208	string		MAP\040	CCP4 Electron Density Map
23543# Assumes same stamp for float and double (normal case)
23544>212	byte		17	\b, Big-endian
23545>212	byte		34	\b, VAX format
23546>212	byte		68	\b, Little-endian
23547>212	byte		85	\b, Convex native
23548
23549############################################################
23550# X-Ray Area Detector images
235510	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
23552>796	lelong	<20		Little-endian, IP #%d,
23553>>768	lelong	>0		Size=%dx
23554>>772	lelong	>0		\b%d
23555>796	belong	<20		Big-endian, IP #%d,
23556>>768	belong	>0		Size=%dx
23557>>772	belong	>0		\b%d
23558
235590	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
23560>796	lelong	<20		Little-endian, IP #%d,
23561>>768	lelong	>0		Size=%dx
23562>>772	lelong	>0		\b%d
23563>796	belong	<20		Big-endian, IP #%d,
23564>>768	belong	>0		Size=%dx
23565>>772	belong	>0		\b%d
23566
23567
235681028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
23569>1072	ulong	>1		Compressed(%d),
23570>1100	ulong	>1		%d headers,
23571>1104	ulong	>0		%d x
23572>1108	ulong	>0		%d,
23573>1120	ulong	>0		%d bits/pixel
23574
23575# Type: GEDCOM genealogical (family history) data
23576# From: Giuseppe Bilotta
235770       search/1/c	0\ HEAD         GEDCOM genealogy text
23578>&0     search		1\ GEDC
23579>>&0    search		2\ VERS         version
23580>>>&1   string		>\0		%s
23581# From: Phil Endecott <phil05@chezphil.org>
235820	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
235830	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
235840	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
235850	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data
23586
23587# PDB: Protein Data Bank files
23588# Adam Buchbinder <adam.buchbinder@gmail.com>
23589#
23590# http://www.wwpdb.org/documentation/format32/sect2.html
23591# http://www.ch.ic.ac.uk/chemime/
23592#
23593# The PDB file format is fixed-field, 80 columns. From the spec:
23594#
23595# COLS        DATA
23596#  1 -  6      "HEADER"
23597#  11 - 50     String(40)
23598#  51 - 59     Date
23599#  63 - 66     IDcode
23600#
23601# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
23602# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
23603# uppercase letters. However, examples have been seen without the date string,
23604# e.g., the example on the chemime site.
236050	string	HEADER\ \ \ \040
23606>&0	regex/1l	\^.{40}
23607>>&0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
23608>>>&0	regex/1ls	[A-Z0-9]{4}.{14}$
23609>>>>&0	regex/1l	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
23610!:mime	chemical/x-pdb
23611>>>>0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s
23612
23613# Type:	GDSII Stream file
236140	belong	0x00060002	GDSII Stream file
23615>4	byte	0x00
23616>>5	byte	x		version %d.0
23617>4	byte	>0x00		version %d
23618>>5	byte	x		\b.%d
23619
23620# Type: LXT (interLaced eXtensible Trace)
23621# chrysn <chrysn@fsfe.org>
236220	beshort	0x0138	interLaced eXtensible Trace (LXT) file
23623>2	beshort	>0	(Version %u)
23624
23625#------------------------------------------------------------------------------
23626# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
236270	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
236280	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
236290	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
23630
236310	string \0volume_key	volume_key escrow packet
23632# Type:	SE Linux policy modules *.pp reference policy
23633#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
23634# URL:	http://doc.coker.com.au/computers/selinux-magic
23635# From:	Russell Coker <russell@coker.com.au>
23636
236370		lelong	0xf97cff8f	SE Linux modular policy
23638>4		lelong	x		version %d,
23639>8		lelong	x		%d sections,
23640>>(12.l)	lelong	0xf97cff8d
23641>>>(12.l+27)	lelong	x		mod version %d,
23642>>>(12.l+31)	lelong	0		Not MLS,
23643>>>(12.l+31)	lelong	1		MLS,
23644>>>(12.l+23)	lelong	2
23645>>>>(12.l+47)	string	>\0		module name %s
23646>>>(12.l+23)	lelong	1		base
23647
236481	string	policy_module(	SE Linux policy module source
236492	string	policy_module(	SE Linux policy module source
23650
236510	string	##\ <summary>	SE Linux policy interface source
23652
23653#0	search	gen_context(	SE Linux policy file contexts
23654
23655#0	search	gen_sens(	SE Linux policy MLS constraints source
23656
23657#------------------------------------------------------------------------------
23658# $File: sendmail,v 1.10 2017/08/13 00:21:47 christos Exp $
23659# sendmail:  file(1) magic for sendmail config files
23660#
23661# XXX - byte order?
23662#
23663# Update: Joerg Jenderek
23664# GRR: this test is too general as it catches also
23665# READ.ME.FIRST.AWP Sendmail frozen configuration
23666# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
23667# Email_23_f217153422.ts Sendmail frozen configuration
23668# - version \330jK\354
236690	byte	046
23670# http://www.sendmail.com/sm/open_source/docs/older_release_notes/
23671# freezed configuration file (dbm format?) created from sendmal.cf with -bz
23672# by older sendmail. til version 8.6 support for frozen configuration files is removed
23673# valid version numbers look like "7.14.4" and should be similar to output of commands
23674# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
23675>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
23676# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
23677!:ext fc
23678>>16	string	>\0			- version %s
236790	short	0x271c
23680# look for valid version number
23681>16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
23682!:ext fc
23683>>16	string	>\0			- version %s
23684
23685#------------------------------------------------------------------------------
23686# sendmail:  file(1) magic for sendmail m4(1) files
23687#
23688# From Hendrik Scholz <hendrik@scholz.net>
23689# i.e. files in /usr/share/sendmail/cf/
23690#
236910   string  divert(-1)\n    sendmail m4 text file
23692
23693
23694#------------------------------------------------------------------------------
23695# $File: sequent,v 1.13 2017/03/17 21:35:28 christos Exp $
23696# sequent:  file(1) magic for Sequent machines
23697#
23698# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
23699# For Sequent's multiprocessor systems (incomplete).
237000	lelong	0x00ea        	BALANCE NS32000 .o
23701>16	lelong	>0		not stripped
23702>124	lelong	>0		version %d
237030	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
23704>16	lelong  >0            	not stripped
23705>124	lelong	>0		version %d
237060	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
23707>16	lelong  >0            	not stripped
23708>124	lelong	>0		version %d
237090	lelong	0x30ea        	BALANCE NS32000 standalone executable
23710>16	lelong  >0          	not stripped
23711>124	lelong	>0		version %d
23712#
23713# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
23714# Symmetry magic nums will not be reached if DOS COM comes before them;
23715# byte 0xeb is matched before these get a chance.
237160	leshort	0x12eb		SYMMETRY i386 .o
23717>16	lelong	>0		not stripped
23718>124	lelong	>0		version %d
237190	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
23720>16	lelong	>0		not stripped
23721>124	lelong	>0		version %d
237220	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
23723>16	lelong	>0		not stripped
23724>124	lelong	>0		version %d
23725# http://en.wikipedia.org/wiki/Sequent_Computer_Systems
23726# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
23727#0	leshort	0x42eb		SYMMETRY i386 standalone executable
237280	leshort	0x42eb
23729# skip unlike negative version
23730>124	lelong	>-1
23731# assuming version 28867614 is very low probable
23732>>124	lelong	!28867614	SYMMETRY i386 standalone executable
23733>>>16	lelong	>0		not stripped
23734>>>124	lelong	>0		version %d
23735
23736#------------------------------------------------------------------------------
23737# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $
23738# sereal: file(1) magic the Sereal binary serialization format
23739#
23740# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
23741#
23742# See the specification of the format at
23743# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
23744#
23745# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by
23746# doing (byte&0xF0)>>4 here, but unfortunately that's not
23747# supported. So when we print out a message about an unknown format
23748# we'll print out e.g. 0x30 instead of the more human-readable
23749# 0x30>>4.
23750#
23751# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
23752# Sereal.git repository for test Sereal data.
237530	name		sereal
23754>4	byte&0x0F	x		(version %d,
23755>4	byte&0xF0	0x00		uncompressed)
23756>4	byte&0xF0	0x10		compressed with non-incremental Snappy)
23757>4	byte&0xF0	0x20		compressed with incremental Snappy)
23758>4	byte&0xF0	>0x20		unknown subformat, flag: %d>>4)
23759
237600	string/b	\=srl		Sereal data packet
23761!:mime application/sereal
23762>&0	use		sereal
237630	string/b	\=\xF3rl	Sereal data packet
23764!:mime application/sereal
23765>&0	use		sereal
237660	string/b	\=\xC3\xB3rl	Sereal data packet, UTF-8 encoded
23767!:mime application/sereal
23768>&0	use		sereal
23769
23770
23771#------------------------------------------------------------------------------
23772# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $
23773# sgi:  file(1) magic for Silicon Graphics operating systems and applications
23774#
23775# Executable images are handled either in aout (for old-style a.out
23776# files for 68K; they are indistinguishable from other big-endian 32-bit
23777# a.out files) or in mips (for MIPS ECOFF and Ucode files)
23778#
23779
23780# kbd file definitions
237810	string	kbd!map		kbd map file
23782>8	byte	>0		Ver %d:
23783>10	short	>0		with %d table(s)
23784
237850	beshort	0x8765		disk quotas file
23786
237870	beshort	0x0506		IRIS Showcase file
23788>2	byte	0x49		-
23789>3	byte	x		- version %d
237900	beshort	0x0226		IRIS Showcase template
23791>2	byte	0x63		-
23792>3	byte	x		- version %d
237930	belong	0x5343464d	IRIS Showcase file
23794>4	byte	x		- version %d
237950	belong	0x5443464d	IRIS Showcase template
23796>4	byte	x		- version %d
237970	belong	0xdeadbabe	IRIX Parallel Arena
23798>8	belong	>0		- version %d
23799
23800# core files
23801#
23802# 32bit core file
238030	belong	0xdeadadb0	IRIX core dump
23804>4	belong	1		of
23805>16	string	>\0		'%s'
23806# 64bit core file
238070	belong	0xdeadad40	IRIX 64-bit core dump
23808>4	belong	1		of
23809>16	string	>\0		'%s'
23810# N32bit core file
238110       belong	0xbabec0bb	IRIX N32 core dump
23812>4      belong	1               of
23813>16     string	>\0             '%s'
23814# New style crash dump file
238150	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
23816>36	string	>\0					'%s'
23817
23818# Trusted IRIX info
238190	string	SGIAUDIT	SGI Audit file
23820>8	byte	x		- version %d
23821>9	byte	x		\b.%d
23822#
238230	string	WNGZWZSC	Wingz compiled script
238240	string	WNGZWZSS	Wingz spreadsheet
238250	string	WNGZWZHP	Wingz help file
23826#
238270	string	#Inventor\040V	IRIS Inventor 1.0 file
238280	string	#Inventor\040V2	Open Inventor 2.0 file
23829# GLF is OpenGL stream encoding
238300	string	glfHeadMagic();		GLF_TEXT
238314	belong	0x7d000000		GLF_BINARY_LSB_FIRST
23832!:strength -30
238334	belong	0x0000007d		GLF_BINARY_MSB_FIRST
23834!:strength -30
23835# GLS is OpenGL stream encoding; GLS is the successor of GLF
238360	string	glsBeginGLS(		GLS_TEXT
238374	belong	0x10000000		GLS_BINARY_LSB_FIRST
23838!:strength -30
238394	belong	0x00000010		GLS_BINARY_MSB_FIRST
23840!:strength -30
23841
23842# Performance Co-Pilot file types
238430	string	PmNs				PCP compiled namespace (V.0)
238440	string	PmN				PCP compiled namespace
23845>3	string	>\0				(V.%1.1s)
23846#3	lelong	0x84500526			PCP archive
238473	belong	0x84500526			PCP archive
23848>7	byte	x				(V.%d)
23849#>20	lelong	-2				temporal index
23850#>20	lelong	-1				metadata
23851#>20	lelong	0				log volume #0
23852#>20	lelong	>0				log volume #%d
23853>20	belong	-2				temporal index
23854>20	belong	-1				metadata
23855>20	belong	0				log volume #0
23856>20	belong	>0				log volume #%d
23857>24	string	>\0				host: %s
238580	string	PCPFolio			PCP
23859>9	string	Version:			Archive Folio
23860>18	string	>\0				(V.%s)
238610	string	#pmchart			PCP pmchart view
23862>9	string	Version
23863>17	string	>\0				(V%-3.3s)
238640	string	#kmchart			PCP kmchart view
23865>9	string	Version
23866>17	string	>\0				(V.%s)
238670	string	pmview				PCP pmview config
23868>7	string	Version
23869>15	string	>\0				(V%-3.3s)
238700	string	#pmlogger			PCP pmlogger config
23871>10	string	Version
23872>18	string	>\0				(V%1.1s)
238730	string	#pmdahotproc			PCP pmdahotproc config
23874>13	string	Version
23875>21	string	>\0				(V%-3.3s)
238760	string	PcPh				PCP Help
23877>4	string	1				Index
23878>4	string	2				Text
23879>5	string	>\0				(V.%1.1s)
238800	string	#pmieconf-rules			PCP pmieconf rules
23881>16	string	>\0				(V.%1.1s)
238823	string	pmieconf-pmie			PCP pmie config
23883>17	string	>\0				(V.%1.1s)
238840	string	MMV				PCP memory mapped values
23885>4	long	x				(V.%d)
23886
23887# SpeedShop data files
238880	lelong	0x13130303			SpeedShop data file
23889
23890# mdbm files
238910	lelong	0x01023962			mdbm file, version 0 (obsolete)
238920	string	mdbm				mdbm file,
23893>5	byte	x				version %d,
23894>6	byte	x				2^%d pages,
23895>7	byte	x				pagesize 2^%d,
23896>17	byte	x				hash %d,
23897>11	byte	x				dataformat %d
23898
23899# Alias Maya files
239000	string/t	//Maya\040ASCII	Alias Maya Ascii File,
23901>13	string	>\0	version %s
239028	string	MAYAFOR4	Alias Maya Binary File,
23903>32	string	>\0	version %s scene
239048	string	MayaFOR4	Alias Maya Binary File,
23905>32	string	>\0	version %s scene
239068	string	CIMG		Alias Maya Image File
239078	string	DEEP		Alias Maya Image File
23908
23909#------------------------------------------------------------------------------
23910# $File: sgml,v 1.38 2017/10/11 11:40:43 christos Exp $
23911# Type:	SVG Vectorial Graphics
23912# From:	Noel Torres <tecnico@ejerciciosresueltos.com>
239130	string		\<?xml\ version=
23914>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
23915>>19	search/4096	\<svg			SVG Scalable Vector Graphics image
23916!:mime	image/svg+xml
23917>>19	search/4096	\<gnc-v2		GnuCash file
23918!:mime	application/x-gnucash
239190	string		\<svg			SVG Scalable Vector Graphics image
23920!:mime	image/svg
23921
23922# Sitemap file
239230	string/t		\<?xml\ version=
23924>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
23925>>19	search/4096	\<urlset		XML Sitemap document text
23926!:mime	application/xml-sitemap
23927
23928# OpenStreetMap XML (.osm)
23929# http://wiki.openstreetmap.org/wiki/OSM_XML
23930# From: Markus Heidelberg <markus.heidelberg@web.de>
239310	string		\<?xml\ version=
23932>14	regex		['"\ \t]*[0-9.]+['"\ \t]*
23933>>19	search/4096	\<osm			OpenStreetMap XML data
23934
23935# xhtml
239360	string/t		\<?xml\ version="
23937>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
23938>>15	string		>\0	(version %.3s)
23939!:mime	text/html
239400	string/t		\<?xml\ version='
23941>19	search/4096/cWbt	\<!doctype\ html	XHTML document text
23942>>15	string		>\0	(version %.3s)
23943!:mime	text/html
239440	string/t		\<?xml\ version="
23945>19	search/4096/cWbt	\<html	broken XHTML document text
23946>>15	string		>\0	(version %.3s)
23947!:mime	text/html
23948
23949#------------------------------------------------------------------------------
23950# sgml:  file(1) magic for Standard Generalized Markup Language
23951# HyperText Markup Language (HTML) is an SGML document type,
23952# from Daniel Quinlan (quinlan@yggdrasil.com)
23953# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
239540	search/4096/cWt	\<!doctype\ html	HTML document text
23955!:mime	text/html
23956!:strength + 5
23957
23958# SVG document
23959# https://www.w3.org/TR/SVG/single-page.html
239600	search/4096/cWbt	\<!doctype\ svg	SVG XML document
23961!:mime  image/svg+xml
23962!:strength + 5
23963
239640	search/4096/cwt	\<head\>		HTML document text
23965!:mime	text/html
23966!:strength + 5
239670	search/4096/cWt	\<head\ 		HTML document text
23968!:mime	text/html
23969!:strength + 5
239700	search/4096/cwt	\<title\>		HTML document text
23971!:mime	text/html
23972!:strength + 5
239730	search/4096/cWt	\<title\ 		HTML document text
23974!:mime	text/html
23975!:strength + 5
239760	search/4096/cwt	\<html\>		HTML document text
23977!:mime	text/html
23978!:strength + 5
239790	search/4096/cWt	\<html\ 		HTML document text
23980!:mime	text/html
23981!:strength + 5
239820	search/4096/cwt	\<script\> 		HTML document text
23983!:mime	text/html
23984!:strength + 5
239850	search/4096/cWt	\<script\ 		HTML document text
23986!:mime	text/html
23987!:strength + 5
239880	search/4096/cwt	\<style\> 		HTML document text
23989!:mime	text/html
23990!:strength + 5
239910	search/4096/cWt	\<style\  		HTML document text
23992!:mime	text/html
23993!:strength + 5
239940	search/4096/cwt	\<table\>		HTML document text
23995!:mime	text/html
23996!:strength + 5
239970	search/4096/cWt	\<table\ 		HTML document text
23998!:mime	text/html
23999!:strength + 5
24000
240010	search/4096/cwt	\<a\ href=		HTML document text
24002!:mime	text/html
24003!:strength + 5
24004
24005# Extensible markup language (XML), a subset of SGML
24006# from Marc Prud'hommeaux (marc@apocalypse.org)
240070	search/1/cwt	\<?xml			XML document text
24008!:mime	text/xml
24009!:strength + 5
240100	string/t		\<?xml\ version\ "	XML
24011!:mime	text/xml
24012!:strength + 5
240130	string/t		\<?xml\ version="	XML
24014!:mime	text/xml
24015!:strength + 5
24016>15	string/t	>\0			%.3s document text
24017>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
24018>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
240190	string		\<?xml\ version='	XML
24020!:mime	text/xml
24021!:strength + 5
24022>15	string/t	>\0			%.3s document text
24023>>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
24024>>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
240250	search/1/wt	\<?XML			broken XML document text
24026!:mime	text/xml
24027!:strength - 10
24028
24029
24030# SGML, mostly from rph@sq
240310	search/4096/cwt	\<!doctype		exported SGML document text
240320	search/4096/cwt	\<!subdoc		exported SGML subdocument text
240330	search/4096/cwt	\<!--			exported SGML document text
24034!:strength - 10
24035
24036# Web browser cookie files
24037# (Mozilla, Galeon, Netscape 4, Konqueror..)
24038# Ulf Harnhammar <ulfh@update.uu.se>
240390	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
240400	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
240410	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
24042
24043# XML-based format representing braille pages in a digital format.
24044#
24045# Specification:
24046# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
24047#
24048# Simon Aittamaa <simon.aittamaa@gmail.com>
240490   string      \<?xml\ version=
24050>14 regex       ['"\ \t]*[0-9.]+['"\ \t]*
24051>>19    search/4096 \<pef           Portable Embosser Format
24052!:mime  application/x-pef+xml
24053#------------------------------------------------------------------------
24054# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
24055# file(1) magic for sharc files
24056#
24057# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
24058# FutureGroove Music (dsp@futuregroove.de)
24059
24060#------------------------------------------------------------------------
24061#0	string			Draw		RiscOS Drawfile
24062#0	string			PACK		RiscOS PackdDir archive
24063
24064#------------------------------------------------------------------------
24065# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
24066
24067#0	string			=!		Assembler source
24068#0	string			Analog		ADi asm listing file
240690	string			.SYSTEM		SHARC architecture file
240700	string			.system		SHARC architecture file
24071
240720	leshort			0x521C		SHARC COFF binary
24073>2	leshort			>1		, %d sections
24074>>12	lelong			>0		, not stripped
24075
24076#------------------------------------------------------------------------------
24077# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $
24078# sinclair:  file(1) sinclair QL
24079
24080# additions to /etc/magic by Thomas M. Ott (ThMO)
24081
24082# Sinclair QL floppy disk formats (ThMO)
240830	string	=QL5		QL disk dump data,
24084>3	string	=A		720 KB,
24085>3	string	=B		1.44 MB,
24086>3	string	=C		3.2 MB,
24087>4	string	>\0		label:%.10s
24088
24089# Sinclair QL OS dump (ThMO)
240900		belong	=0x30000
24091>49124		belong	<47104
24092>>49128		belong	<47104
24093>>>49132	belong	<47104
24094>>>>49136	belong	<47104	QL OS dump data,
24095>>>>>49148	string	>\0	type %.3s,
24096>>>>>49142	string	>\0	version %.4s
24097
24098# Sinclair QL firmware executables (ThMO)
240990	string	NqNqNq`\004	QL firmware executable (BCPL)
24100
24101# Sinclair QL libraries (was ThMO)
241020	beshort	0xFB01		QDOS object
24103>2	pstring	x		'%s'
24104
24105# Sinclair QL executables (was ThMO)
241064	belong	0x4AFB		QDOS executable
24107>9	pstring	x		'%s'
24108
24109# Sinclair QL ROM (ThMO)
241100	belong	=0x4AFB0001	QL plugin-ROM data,
24111>9	pstring	=\0		un-named
24112>9	pstring	>\0		named: %s
24113# Type: SiSU Markup Language
24114# URL:  http://www.sisudoc.org/
24115# From: Ralph Amissah <ralph.amissah@gmail.com>
24116
241170	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
24118>5	regex	[0-9.]+				%s
24119
241200	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
24121>5	regex	[0-9.]+				%s
24122
241230	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
24124>5	regex	[0-9.]+				%s
24125
241260	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
24127>5	regex	[0-9.]+				%s
24128
241290	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
24130>5	regex	[0-9.]+				%s
24131
24132#------------------------------------------------------------------------------
24133# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
24134# Sketch Drawings: http://sketch.sourceforge.net/
24135# From: Edwin Mons <e@ik.nu>
241360	search/1	##Sketch	Sketch document text
24137
24138#-----------------------------------------------
24139# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
24140# GNU Smalltalk image, starting at version 1.6.2
24141# From: catull_us@yahoo.com
24142#
241430	string	GSTIm\0\0	GNU SmallTalk
24144# little-endian
24145>7	byte&1	=0		LE image version
24146>>10	byte	x		%d.
24147>>9	byte	x		\b%d.
24148>>8	byte	x		\b%d
24149#>>12	lelong	x		, data: %ld
24150#>>16	lelong	x		, table: %ld
24151#>>20	lelong	x		, memory: %ld
24152# big-endian
24153>7	byte&1	=1		BE image version
24154>>8	byte	x		%d.
24155>>9	byte	x		\b%d.
24156>>10	byte	x		\b%d
24157#>>12	belong	x		, data: %ld
24158#>>16	belong	x		, table: %ld
24159#>>20	belong	x		, memory: %ld
24160
24161
24162
24163#------------------------------------------------------------------------------
24164# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
24165# smile:  file(1) magic for Smile serialization
24166#
24167# The Smile serialization format uses a 4-byte header:
24168#
24169#   Constant byte #0: 0x3A (ASCII ':')
24170#   Constant byte #1: 0x29 (ASCII ')')
24171#   Constant byte #2: 0x0A (ASCII linefeed, '\n')
24172#   Variable byte #3, consisting of bits:
24173#     Bits 4-7 (4 MSB): 4-bit version number
24174#     Bits 3: Reserved
24175#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
24176#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
24177#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
24178#
24179# Reference: http://wiki.fasterxml.com/SmileFormatSpec
24180# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org>
24181
24182# Detection
241830	string		:)\n	Smile binary data
24184
24185# Versioning
24186>3	byte&0xF0	x		version %d:
24187
24188# Properties
24189>3	byte&0x04	0x04		binary raw,
24190>3	byte&0x04	0x00		binary encoded,
24191>3	byte&0x02	0x02		shared String values enabled,
24192>3	byte&0x02	0x00		shared String values disabled,
24193>3	byte&0x01	0x01		shared field names enabled
24194>3	byte&0x01	0x00		shared field names disabled
24195
24196
24197#------------------------------------------------------------------------------
24198# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $
24199# sniffer:  file(1) magic for packet capture files
24200#
24201# From: guy@alum.mit.edu (Guy Harris)
24202#
24203
24204#
24205# Microsoft Network Monitor 1.x capture files.
24206#
242070	string		RTSS		NetMon capture file
24208>5	byte		x		- version %d
24209>4	byte		x		\b.%d
24210>6	leshort		0		(Unknown)
24211>6	leshort		1		(Ethernet)
24212>6	leshort		2		(Token Ring)
24213>6	leshort		3		(FDDI)
24214>6	leshort		4		(ATM)
24215>6	leshort		>4		(type %d)
24216
24217#
24218# Microsoft Network Monitor 2.x capture files.
24219#
242200	string		GMBU		NetMon capture file
24221>5	byte		x		- version %d
24222>4	byte		x		\b.%d
24223>6	leshort		0		(Unknown)
24224>6	leshort		1		(Ethernet)
24225>6	leshort		2		(Token Ring)
24226>6	leshort		3		(FDDI)
24227>6	leshort		4		(ATM)
24228>6	leshort		5		(IP-over-IEEE 1394)
24229>6	leshort		6		(802.11)
24230>6	leshort		7		(Raw IP)
24231>6	leshort		8		(Raw IP)
24232>6	leshort		9		(Raw IP)
24233>6	leshort		>9		(type %d)
24234
24235#
24236# Network General Sniffer capture files.
24237# Sorry, make that "Network Associates Sniffer capture files."
24238# Sorry, make that "Network General old DOS Sniffer capture files."
24239#
242400	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
24241>33	byte		2		(compressed)
24242>23	leshort		x		- version %d
24243>25	leshort		x		\b.%d
24244>32	byte		0		(Token Ring)
24245>32	byte		1		(Ethernet)
24246>32	byte		2		(ARCNET)
24247>32	byte		3		(StarLAN)
24248>32	byte		4		(PC Network broadband)
24249>32	byte		5		(LocalTalk)
24250>32	byte		6		(Znet)
24251>32	byte		7		(Internetwork Analyzer)
24252>32	byte		9		(FDDI)
24253>32	byte		10		(ATM)
24254
24255#
24256# Cinco Networks NetXRay capture files.
24257# Sorry, make that "Network General Sniffer Basic capture files."
24258# Sorry, make that "Network Associates Sniffer Basic capture files."
24259# Sorry, make that "Network Associates Sniffer Basic, and Windows
24260# Sniffer Pro", capture files."
24261# Sorry, make that "Network General Sniffer capture files."
24262# Sorry, make that "NetScout Sniffer capture files."
24263#
242640	string		XCP\0		NetXRay capture file
24265>4	string		>\0		- version %s
24266>44	leshort		0		(Ethernet)
24267>44	leshort		1		(Token Ring)
24268>44	leshort		2		(FDDI)
24269>44	leshort		3		(WAN)
24270>44	leshort		8		(ATM)
24271>44	leshort		9		(802.11)
24272
24273#
24274# "libpcap" capture files.
24275# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
24276# the main program that uses that format, but there are other programs
24277# that use "libpcap", or that use the same capture file format.)
24278#
242790	name		pcap-be
24280>4	beshort		x		- version %d
24281>6	beshort		x		\b.%d
24282>20	belong		0		(No link-layer encapsulation
24283>20	belong		1		(Ethernet
24284>20	belong		2		(3Mb Ethernet
24285>20	belong		3		(AX.25
24286>20	belong		4		(ProNET
24287>20	belong		5		(CHAOS
24288>20	belong		6		(Token Ring
24289>20	belong		7		(BSD ARCNET
24290>20	belong		8		(SLIP
24291>20	belong		9		(PPP
24292>20	belong		10		(FDDI
24293>20	belong		11		(RFC 1483 ATM
24294>20	belong		12		(raw IP
24295>20	belong		13		(BSD/OS SLIP
24296>20	belong		14		(BSD/OS PPP
24297>20	belong		19		(Linux ATM Classical IP
24298>20	belong		50		(PPP or Cisco HDLC
24299>20	belong		51		(PPP-over-Ethernet
24300>20	belong		99		(Symantec Enterprise Firewall
24301>20	belong		100		(RFC 1483 ATM
24302>20	belong		101		(raw IP
24303>20	belong		102		(BSD/OS SLIP
24304>20	belong		103		(BSD/OS PPP
24305>20	belong		104		(BSD/OS Cisco HDLC
24306>20	belong		105		(802.11
24307>20	belong		106		(Linux Classical IP over ATM
24308>20	belong		107		(Frame Relay
24309>20	belong		108		(OpenBSD loopback
24310>20	belong		109		(OpenBSD IPsec encrypted
24311>20	belong		112		(Cisco HDLC
24312>20	belong		113		(Linux "cooked"
24313>20	belong		114		(LocalTalk
24314>20	belong		117		(OpenBSD PFLOG
24315>20	belong		119		(802.11 with Prism header
24316>20	belong		122		(RFC 2625 IP over Fibre Channel
24317>20	belong		123		(SunATM
24318>20	belong		127		(802.11 with radiotap header
24319>20	belong		129		(Linux ARCNET
24320>20	belong		138		(Apple IP over IEEE 1394
24321>20	belong		139		(MTP2 with pseudo-header
24322>20	belong		140		(MTP2
24323>20	belong		141		(MTP3
24324>20	belong		142		(SCCP
24325>20	belong		143		(DOCSIS
24326>20	belong		144		(IrDA
24327>20	belong		147		(Private use 0
24328>20	belong		148		(Private use 1
24329>20	belong		149		(Private use 2
24330>20	belong		150		(Private use 3
24331>20	belong		151		(Private use 4
24332>20	belong		152		(Private use 5
24333>20	belong		153		(Private use 6
24334>20	belong		154		(Private use 7
24335>20	belong		155		(Private use 8
24336>20	belong		156		(Private use 9
24337>20	belong		157		(Private use 10
24338>20	belong		158		(Private use 11
24339>20	belong		159		(Private use 12
24340>20	belong		160		(Private use 13
24341>20	belong		161		(Private use 14
24342>20	belong		162		(Private use 15
24343>20	belong		163		(802.11 with AVS header
24344>20	belong		165		(BACnet MS/TP
24345>20	belong		166		(PPPD
24346>20	belong		169		(GPRS LLC
24347>20	belong		177		(Linux LAPD
24348>20	belong		187		(Bluetooth HCI H4
24349>20	belong		189		(Linux USB
24350>20	belong		192		(PPI
24351>20	belong		195		(802.15.4
24352>20	belong		196		(SITA
24353>20	belong		197		(Endace ERF
24354>20	belong		201		(Bluetooth HCI H4 with pseudo-header
24355>20	belong		202		(AX.25 with KISS header
24356>20	belong		203		(LAPD
24357>20	belong		204		(PPP with direction pseudo-header
24358>20	belong		205		(Cisco HDLC with direction pseudo-header
24359>20	belong		206		(Frame Relay with direction pseudo-header
24360>20	belong		209		(Linux IPMB
24361>20	belong		215		(802.15.4 with non-ASK PHY header
24362>20	belong		220		(Memory-mapped Linux USB
24363>20	belong		224		(Fibre Channel FC-2
24364>20	belong		225		(Fibre Channel FC-2 with frame delimiters
24365>20	belong		226		(Solaris IPNET
24366>20	belong		227		(SocketCAN
24367>20	belong		228		(Raw IPv4
24368>20	belong		229		(Raw IPv6
24369>20	belong		230		(802.15.4 without FCS
24370>20	belong		231		(D-Bus messages
24371>20	belong		235		(DVB-CI
24372>20	belong		236		(MUX27010
24373>20	belong		237		(STANAG 5066 D_PDUs
24374>20	belong		239		(Linux netlink NFLOG messages
24375>20	belong		240		(Hilscher netAnalyzer
24376>20	belong		241		(Hilscher netAnalyzer with delimiters
24377>20	belong		242		(IP-over-Infiniband
24378>20	belong		243		(MPEG-2 Transport Stream packets
24379>20	belong		244		(ng4t ng40
24380>20	belong		245		(NFC LLCP
24381>20	belong		247		(Infiniband
24382>20	belong		248		(SCTP
24383>16	belong		x		\b, capture length %d)
24384
243850	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
24386!:mime	application/vnd.tcpdump.pcap
24387>0	use	pcap-be
243880	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
24389!:mime	application/vnd.tcpdump.pcap
24390>0	use	\^pcap-be
24391
24392#
24393# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
24394# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
24395# the main program that uses that format, but there are other programs
24396# that use "libpcap", or that use the same capture file format.)
24397#
243980	ubelong		0xa1b2cd34	extended tcpdump capture file (big-endian)
24399>0	use	pcap-be
244000	ulelong		0xa1b2cd34	extended tcpdump capture file (little-endian)
24401>0	use	\^pcap-be
24402
24403#
24404# "pcap-ng" capture files.
24405# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
24406# Pcap-ng files can contain multiple sections. Printing the endianness,
24407# snaplen, or other information from the first SHB may be misleading.
24408#
244090	ubelong		0x0a0d0d0a
24410>8	ubelong		0x1a2b3c4d	pcap-ng capture file
24411>>12	beshort		x		- version %d
24412>>14	beshort		x		\b.%d
244130	ulelong		0x0a0d0d0a
24414>8	ulelong		0x1a2b3c4d	pcap-ng capture file
24415>>12	leshort		x		- version %d
24416>>14	leshort		x		\b.%d
24417
24418#
24419# AIX "iptrace" capture files.
24420#
244210	string		iptrace\ 1.0	"iptrace" capture file
244220	string		iptrace\ 2.0	"iptrace" capture file
24423
24424#
24425# Novell LANalyzer capture files.
24426#
244270	leshort		0x1001		LANalyzer capture file
244280	leshort		0x1007		LANalyzer capture file
24429
24430#
24431# HP-UX "nettl" capture files.
24432#
244330	string		\x54\x52\x00\x64\x00	"nettl" capture file
24434
24435#
24436# RADCOM WAN/LAN Analyzer capture files.
24437#
244380	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
24439
24440#
24441# NetStumbler log files.  Not really packets, per se, but about as
24442# close as you can get.  These are log files from NetStumbler, a
24443# Windows program, that scans for 802.11b networks.
24444#
244450	string		NetS		NetStumbler log file
24446>8	lelong		x		\b, %d stations found
24447
24448#
24449# *Peek tagged capture files.
24450#
244510	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
24452
24453#
24454# Visual Networks traffic capture files.
24455#
244560	string		\x05VNF		Visual Networks traffic capture file
24457
24458#
24459# Network Instruments Observer capture files.
24460#
244610	string		ObserverPktBuffe	Network Instruments Observer capture file
24462
24463#
24464# Files from Accellent Group's 5View products.
24465#
244660	string		\xaa\xaa\xaa\xaa	5View capture file
24467
24468#------------------------------------------------------------------------------
24469# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
24470# softquad:  file(1) magic for SoftQuad Publishing Software
24471#
24472# Author/Editor and RulesBuilder
24473#
24474# XXX - byte order?
24475#
244760	string		\<!SQ\ DTD>	Compiled SGML rules file
24477>9	string		>\0		 Type %s
244780	string		\<!SQ\ A/E>	A/E SGML Document binary
24479>9	string		>\0		 Type %s
244800	string		\<!SQ\ STS>	A/E SGML binary styles file
24481>9	string		>\0		 Type %s
244820	short		0xc0de		Compiled PSI (v1) data
244830	short		0xc0da		Compiled PSI (v2) data
24484>3	string		>\0		(%s)
24485# Binary sqtroff font/desc files...
244860	short		0125252		SoftQuad DESC or font file binary
24487>2	short		>0		- version %d
24488# Bitmaps...
244890	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
24490#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
24491# sqtroff intermediate language (replacement for ditroff int. lang.)
244920	string		X\ 		SoftQuad troff Context intermediate
24493>2	string		495		for AT&T 495 laser printer
24494>2	string		hp		for Hewlett-Packard LaserJet
24495>2	string		impr		for IMAGEN imPRESS
24496>2	string		ps		for PostScript
24497
24498# From: Michael Piefel <piefel@debian.org>
24499# sqtroff intermediate language (replacement for ditroff int. lang.)
245000	string		X\ 495		SoftQuad troff Context intermediate for AT&T 495 laser printer
245010	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
245020	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
245030	string		X\ ps		SoftQuad troff Context intermediate for PostScript
24504
24505#------------------------------------------------------------------------------
24506# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
24507# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
24508#
24509# Cloyce D. Spradling <cloyce@headgear.org>
24510
245110	string	spec			SPEC
24512>4	string	.cpu			CPU
24513>>8	string	<:			\b%.4s
24514>>12	string	.			raw result text
24515
2451617	string	version=SPECjbb		SPECjbb
24517>32	string	<:			\b%.4s
24518>>37	string	<:			v%.4s raw result text
24519
245200	string	BEGIN\040SPECWEB	SPECweb
24521>13	string	<:			\b%.2s
24522>>15	string	_SSL			\b_SSL
24523>>>20	string	<:			v%.4s raw result text
24524>>16	string	<:			v%.4s raw result text
24525
24526#------------------------------------------------------------------------------
24527# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $
24528# spectrum:  file(1) magic for Spectrum emulator files.
24529#
24530# John Elliott <jce@seasip.demon.co.uk>
24531
24532#
24533# Spectrum +3DOS header
24534#
245350       string          PLUS3DOS\032    Spectrum +3 data
24536>15     byte            0               - BASIC program
24537>15     byte            1               - number array
24538>15     byte            2               - character array
24539>15     byte            3               - memory block
24540>>16    belong          0x001B0040      (screen)
24541>15     byte            4               - Tasword document
24542>15     string          TAPEFILE        - ZXT tapefile
24543#
24544# Tape file. This assumes the .TAP starts with a Spectrum-format header,
24545# which nearly all will.
24546#
24547# Update: Sanity-check string contents to be printable.
24548#  -Adam Buchbinder <adam.buchbinder@gmail.com>
24549#
245500       string          \023\000\000
24551>4      string          >\0
24552>>4     string          <\177           Spectrum .TAP data "%-10.10s"
24553>>>3    byte            0               - BASIC program
24554>>>3    byte            1               - number array
24555>>>3    byte            2               - character array
24556>>>3    byte            3               - memory block
24557>>>>14  belong          0x001B0040      (screen)
24558
24559# The following three blocks are from pak21-spectrum@srcf.ucam.org
24560# TZX tape images
245610      string          ZXTape!\x1a     Spectrum .TZX data
24562>8     byte            x               version %d
24563>9     byte            x               \b.%d
24564
24565# RZX input recording files
245660      string          RZX!            Spectrum .RZX data
24567>4     byte            x               version %d
24568>5     byte            x               \b.%d
24569
24570# Floppy disk images
245710      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
245720      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
245730      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
245740      string          SINCLAIR        Spectrum .SCL Betadisk image
24575
24576# Hard disk images
245770      string          RS-IDE\x1a      Spectrum .HDF hard disk image
24578>7     byte            x               \b, version 0x%02x
24579
24580# SZX snapshots (fuse and spectaculator)
24581# Martin M. S. Pedersen <martin@linux.com>
24582# http://www.spectaculator.com/docs/zx-state/header.shtml
24583#
245840      string		ZXST	       zx-state snapshot
24585>4     byte		x	       version %d
24586>5     byte		x	       \b.%d
24587>>6    byte		0	       16k ZX Spectrum
24588>>6    byte		1	       48k ZX Spectrum/ZX Spectrum+
24589>>6    byte		2	       ZX Spectrum 128
24590>>6    byte		3	       ZX Spectrum +2
24591>>6    byte		4	       ZX Spectrum +2A/+2B
24592>>6    byte		5	       ZX Spectrum +3
24593>>6    byte		6	       ZX Spectrum +3e
24594>>6    byte		7	       Pentagon 128
24595>>6    byte		8	       Timex Sinclair TC2048
24596>>6    byte		9	       Timex Sinclair TC2068
24597>>6    byte	       10	       Scorpion ZS-256
24598>>6    byte	       11	       ZX Spectrum SE
24599>>6    byte	       12	       Timex Sinclair TS2068
24600>>6    byte	       13	       Pentagon 512
24601>>6    byte	       14	       Pentagon 1024
24602>>6    byte	       15	       48k ZX Spectrum (NTSC)
24603>>6    byte	       16	       ZX Spectrum 12Ke
24604>>>7   byte		1	       (alternate timings)
24605
24606#------------------------------------------------------------------------------
24607# $File: sql,v 1.21 2017/03/17 21:35:28 christos Exp $
24608# sql:  file(1) magic for SQL files
24609#
24610# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
24611# Recognize some MySQL files.
24612# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
24613# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
24614#
246150	beshort			0xfe01		MySQL table definition file
24616>2	byte			x		Version %d
24617>3	byte			0		\b, type UNKNOWN
24618>3	byte			1		\b, type DIAM_ISAM
24619>3	byte			2		\b, type HASH
24620>3	byte			3		\b, type MISAM
24621>3	byte			4		\b, type PISAM
24622>3	byte			5		\b, type RMS_ISAM
24623>3	byte			6		\b, type HEAP
24624>3	byte			7		\b, type ISAM
24625>3	byte			8		\b, type MRG_ISAM
24626>3	byte			9		\b, type MYISAM
24627>3	byte			10		\b, type MRG_MYISAM
24628>3	byte			11		\b, type BERKELEY_DB
24629>3	byte			12		\b, type INNODB
24630>3	byte			13		\b, type GEMINI
24631>3	byte			14		\b, type NDBCLUSTER
24632>3	byte			15		\b, type EXAMPLE_DB
24633>3	byte			16		\b, type CSV_DB
24634>3	byte			17		\b, type FEDERATED_DB
24635>3	byte			18		\b, type BLACKHOLE_DB
24636>3	byte			19		\b, type PARTITION_DB
24637>3	byte			20		\b, type BINLOG
24638>3	byte			21		\b, type SOLID
24639>3	byte			22		\b, type PBXT
24640>3	byte			23		\b, type TABLE_FUNCTION
24641>3	byte			24		\b, type MEMCACHE
24642>3	byte			25		\b, type FALCON
24643>3	byte			26		\b, type MARIA
24644>3	byte			27		\b, type PERFORMANCE_SCHEMA
24645>3	byte			127		\b, type DEFAULT
24646>0x0033	ulong			x		\b, MySQL version %d
246470	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
24648>3	byte			x		Version %d
246490	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
24650>3	byte			x		Version %d
246510	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
24652>3	byte			x		Version %d
24653>14	beshort			x		\b, %d key parts
24654>16	beshort			x		\b, %d unique key parts
24655>18	byte			x		\b, %d keys
24656>28	bequad			x		\b, %lld records
24657>36	bequad			x		\b, %lld deleted records
246580	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
24659>3	byte			x		Version %d
246600	belong&0xffffff00	0xfefe0900	MySQL Maria index file
24661>3	byte			x		Version %d
246620	belong&0xffffff00	0xfefe0a00	MySQL Maria compressed data file
24663>3	byte			x		Version %d
246640	belong&0xffffff00	0xfefe0c00
24665>4	string			MACF		MySQL Maria control file
24666>>3	byte			x		Version %d
246670	string			\376bin	MySQL replication log,
24668>9	long			x		server id %d
24669>8	byte			1
24670>>13	long			69		\b, MySQL V3.2.3
24671>>>19	string			x		\b, server version %s
24672>>13	long			75		\b, MySQL V4.0.2-V4.1
24673>>>25	string			x		\b, server version %s
24674>8	byte			15		MySQL V5+,
24675>>25	string			x		server version %s
24676>4	string			MARIALOG	MySQL Maria transaction log file
24677>>3	byte			x		Version %d
24678
24679#------------------------------------------------------------------------------
24680# iRiver H Series database file
24681# From Ken Guest <ken@linux.ie>
24682# As observed from iRivNavi.iDB and unencoded firmware
24683#
246840   string		iRivDB	iRiver Database file
24685>11  string	>\0	Version %s
24686>39  string		iHP-100	[H Series]
24687
24688#------------------------------------------------------------------------------
24689# SQLite database files
24690# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
24691#
24692# Version 1 used GDBM internally; its files cannot be distinguished
24693# from other GDBM files.
24694#
24695# Version 2 used this format:
246960	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
24697
24698# Version 3 of SQLite allows applications to embed their own "user version"
24699# number in the database at offset 60.  Later, SQLite added an "application id"
24700# at offset 68 that is preferred over "user version" for indicating the
24701# associated application.
24702#
247030   string  SQLite\ format\ 3	SQLite 3.x database
24704!:mime	application/x-sqlite3
24705# seldom found extension sqlite3 like in SyncData.sqlite3
24706# db
24707# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
24708# Unfortunately extension sqlite also used for other databases starting with string
24709# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
24710# and with string "ZV-zlib" in like extra.sqlite
24711!:ext sqlite/sqlite3/db/dbe
24712>60 belong  =0x5f4d544e  (Monotone source repository)
24713>68 belong  =0x0f055112  (Fossil checkout)
24714>68 belong  =0x0f055113  (Fossil global configuration)
24715>68 belong  =0x0f055111  (Fossil repository)
24716>68 belong  =0x42654462  (Bentley Systems BeSQLite Database)
24717>68 belong  =0x42654c6e  (Bentley Systems Localization File)
24718>68 belong  =0x47504b47  (OGC GeoPackage file)
24719>68 default x
24720>>68 belong  !0          \b, application id %u
24721>>60 belong  !0          \b, user version %d
24722>96 belong  x            \b, last written using SQLite version %d
24723
24724
24725# SQLite Write-Ahead Log from SQLite version >= 3.7.0
24726# http://www.sqlite.org/fileformat.html#walformat
247270	belong&0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
24728!:ext sqlite-wal/db-wal
24729>4	belong	x	version %d
24730
24731# SQLite Rollback Journal
24732# http://www.sqlite.org/fileformat.html#rollbackjournal
247330	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal
24734
24735# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
24736# https://github.com/PredatH0r/ChanSort
247370	string		PSDB\0			Panasonic channel list DataBase
24738!:ext db/bin
24739#!:mime	application/x-db-svl-panasonic
24740>126	string		SQLite\ format\ 3
24741#!:mime	application/x-panasonic-sqlite3
24742>>&-15	indirect	x			\b; contains
24743
24744# H2 Database from http://www.h2database.com/
247450	string		--\ H2\ 0.5/B\ --\ \n	H2 Database file
24746# Type:	OpenSSH key files
24747# From:	Nicolas Collignon <tsointsoin@gmail.com>
24748
247490	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
24750>28	string	>\0			version %s
247510	string	-----BEGIN\ OPENSSH\ PRIVATE\ KEY-----	OpenSSH private key
24752
247530	string	ssh-dss\ 		OpenSSH DSA public key
247540	string	ssh-rsa\ 		OpenSSH RSA public key
247550	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
247560	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
247570	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
247580	string	ssh-ed25519		OpenSSH ED25519 public key
24759
24760#------------------------------------------------------------------------------
24761# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $
24762# ssl:  file(1) magic for SSL file formats
24763
24764# Type: OpenSSL certificates/key files
24765# From: Nicolas Collignon <tsointsoin@gmail.com>
24766
247670	string	-----BEGIN\040CERTIFICATE-----	PEM certificate
247680	string	-----BEGIN\040CERTIFICATE\040REQ	PEM certificate request
247690	string	-----BEGIN\040RSA\040PRIVATE	PEM RSA private key
247700	string	-----BEGIN\040DSA\040PRIVATE	PEM DSA private key
247710	string	-----BEGIN\040EC\040PRIVATE	PEM EC private key
247720	string	-----BEGIN\040ECDSA\040PRIVATE	PEM ECDSA private key
24773
24774# From Luc Gommans
24775# OpenSSL enc file (recognized by a magic string preceding the password's salt)
247760	string	Salted__	openssl enc'd data with salted password
24777# Using the -a or -base64 option, OpenSSL will base64-encode the data.
247780	string U2FsdGVkX1	openssl enc'd data with salted password, base64 encoded
24779
24780#------------------------------------------------------------------------------
24781# $File: sun,v 1.27 2014/04/30 21:41:02 christos Exp $
24782# sun:  file(1) magic for Sun machines
24783#
24784# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
24785# releases.  (5.x uses ELF.)  Entries for executables without an
24786# architecture type, used before the 68020-based Sun-3's came out,
24787# are in aout, as they're indistinguishable from other big-endian
24788# 32-bit a.out files.
24789#
247900	belong&077777777	0600413		a.out SunOS SPARC demand paged
24791>0	byte		&0x80
24792>>20	belong		<4096		shared library
24793>>20	belong		=4096		dynamically linked executable
24794>>20	belong		>4096		dynamically linked executable
24795>0	byte		^0x80		executable
24796>16	belong		>0		not stripped
24797
247980	belong&077777777	0600410		a.out SunOS SPARC pure
24799>0	byte		&0x80		dynamically linked executable
24800>0	byte		^0x80		executable
24801>16	belong		>0		not stripped
24802
248030	belong&077777777	0600407		a.out SunOS SPARC
24804>0	byte		&0x80		dynamically linked executable
24805>0	byte		^0x80		executable
24806>16	belong		>0		not stripped
24807
248080	belong&077777777	0400413		a.out SunOS mc68020 demand paged
24809>0	byte		&0x80
24810>>20	belong		<4096		shared library
24811>>20	belong		=4096		dynamically linked executable
24812>>20	belong		>4096		dynamically linked executable
24813>0	byte		^0x80		executable
24814>16	belong		>0		not stripped
24815
248160	belong&077777777	0400410		a.out SunOS mc68020 pure
24817>0	byte		&0x80		dynamically linked executable
24818>0	byte		^0x80		executable
24819>16	belong		>0		not stripped
24820
248210	belong&077777777	0400407		a.out SunOS mc68020
24822>0	byte		&0x80		dynamically linked executable
24823>0	byte		^0x80		executable
24824>16	belong		>0		not stripped
24825
248260	belong&077777777	0200413		a.out SunOS mc68010 demand paged
24827>0	byte		&0x80
24828>>20	belong		<4096		shared library
24829>>20	belong		=4096		dynamically linked executable
24830>>20	belong		>4096		dynamically linked executable
24831>0	byte		^0x80		executable
24832>16	belong		>0		not stripped
24833
248340	belong&077777777	0200410		a.out SunOS mc68010 pure
24835>0	byte		&0x80		dynamically linked executable
24836>0	byte		^0x80		executable
24837>16	belong		>0		not stripped
24838
248390	belong&077777777	0200407		a.out SunOS mc68010
24840>0	byte		&0x80		dynamically linked executable
24841>0	byte		^0x80		executable
24842>16	belong		>0		not stripped
24843
24844#
24845# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
24846# binary executed in compatibility mode under SunOS 5.x".
24847#
248480	belong		0x080456	SunOS core file
24849>4	belong		432		(SPARC)
24850>>132	string		>\0		from '%s'
24851>>116	belong		=3		(quit)
24852>>116	belong		=4		(illegal instruction)
24853>>116	belong		=5		(trace trap)
24854>>116	belong		=6		(abort)
24855>>116	belong		=7		(emulator trap)
24856>>116	belong		=8		(arithmetic exception)
24857>>116	belong		=9		(kill)
24858>>116	belong		=10		(bus error)
24859>>116	belong		=11		(segmentation violation)
24860>>116	belong		=12		(bad argument to system call)
24861>>116	belong		=29		(resource lost)
24862>>120	belong		x		(T=%dK,
24863>>124	belong		x		D=%dK,
24864>>128	belong		x		S=%dK)
24865>4	belong		826		(68K)
24866>>128	string		>\0		from '%s'
24867>4	belong		456		(SPARC 4.x BCP)
24868>>152	string		>\0		from '%s'
24869# Sun SunPC
248700	long		0xfa33c08e	SunPC 4.0 Hard Disk
248710	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
24872# Sun snoop (see RFC 1761, which describes the capture file format,
24873# RFC 3827, which describes some additional datalink types, and
24874# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
24875# which is the IANA registry of Snoop datalink types)
24876#
248770	string		snoop		Snoop capture file
24878>8	belong		>0		- version %d
24879>12	belong		0		(IEEE 802.3)
24880>12	belong		1		(IEEE 802.4)
24881>12	belong		2		(IEEE 802.5)
24882>12	belong		3		(IEEE 802.6)
24883>12	belong		4		(Ethernet)
24884>12	belong		5		(HDLC)
24885>12	belong		6		(Character synchronous)
24886>12	belong		7		(IBM channel-to-channel adapter)
24887>12	belong		8		(FDDI)
24888>12	belong		9		(Other)
24889>12	belong		10		(type %d)
24890>12	belong		11		(type %d)
24891>12	belong		12		(type %d)
24892>12	belong		13		(type %d)
24893>12	belong		14		(type %d)
24894>12	belong		15		(type %d)
24895>12	belong		16		(Fibre Channel)
24896>12	belong		17		(ATM)
24897>12	belong		18		(ATM Classical IP)
24898>12	belong		19		(type %d)
24899>12	belong		20		(type %d)
24900>12	belong		21		(type %d)
24901>12	belong		22		(type %d)
24902>12	belong		23		(type %d)
24903>12	belong		24		(type %d)
24904>12	belong		25		(type %d)
24905>12	belong		26		(IP over Infiniband)
24906>12	belong		>26		(type %d)
24907
24908#---------------------------------------------------------------------------
24909# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
24910# lead Sun/Cobalt developer) who agrees that they are good and worthy of
24911# inclusion.
24912
24913# Boot ROM images for Sun/Cobalt Linux server appliances
249140       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
24915>38     string x        V%.4s
24916
24917# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
24918# at the very end where file(1) can't get it.
249190       string CRfs     COBALT boot rom data (Flat boot rom or file system)
24920
24921#------------------------------------------------------------------------------
24922# msx:  file(1) magic for the SymbOS operating system
24923# http://www.symbos.de
24924# Fabio R. Schmidlin <frs@pop.com.br>
24925
24926# SymbOS EXE file
249270x30	string		SymExe		SymbOS executable
24928>0x36	ubyte		x		v%c
24929>0x37	ubyte		x		\b.%c
24930>0xF	string		x		\b, name: %s
24931
24932# SymbOS DOX document
249330	string		INFOq\0		SymbOS DOX document
24934
24935# Symbos driver
249360	string		SMD1		SymbOS driver
24937>19	byte		x		\b, name: %c
24938>20	byte		x		\b%c
24939>21	byte		x		\b%c
24940>22	byte		x		\b%c
24941>23	byte		x		\b%c
24942>24	byte		x		\b%c
24943>25	byte		x		\b%c
24944>26	byte		x		\b%c
24945>27	byte		x		\b%c
24946>28	byte		x		\b%c
24947>29	byte		x		\b%c
24948>30	byte		x		\b%c
24949>31	byte		x		\b%c
24950
24951# Symbos video
249520	string		SymVid		SymbOS video
24953>6	ubyte		x		v%c
24954>7	ubyte		x		\b.%c
24955
24956# Soundtrakker 128 ST2 music
249570	byte		0
24958>0xC	string		\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00	Soundtrakker 128 ST2 music,
24959>>1	string		x		name: %s
24960
24961
24962
24963#------------------------------------------------------------------------
24964# $File: sysex,v 1.9 2017/03/17 21:35:28 christos Exp $
24965# sysex: file(1) magic for MIDI sysex files
24966#
24967# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
24968# where real SYStem EXclusive messages at offset 1 are limited to seven bits
24969# http://en.wikipedia.org/wiki/MIDI
249700	ubeshort&0xFF80		0xF000		SysEx File -
24971
24972# North American Group
24973>1	byte			0x01		Sequential
24974>1	byte			0x02		IDP
24975>1	byte			0x03		OctavePlateau
24976>1	byte			0x04		Moog
24977>1	byte			0x05		Passport
24978>1	byte			0x06		Lexicon
24979>1	byte			0x07		Kurzweil/Future Retro
24980>>3	byte			0x77		777
24981>>4	byte			0x00		Bank
24982>>4	byte			0x01		Song
24983>>5	byte			0x0f		16
24984>>5	byte			0x0e		15
24985>>5	byte			0x0d		14
24986>>5	byte			0x0c		13
24987>>5	byte			0x0b		12
24988>>5	byte			0x0a		11
24989>>5	byte			0x09		10
24990>>5	byte			0x08		9
24991>>5	byte			0x07		8
24992>>5	byte			0x06		7
24993>>5	byte			0x05		6
24994>>5	byte			0x04		5
24995>>5	byte			0x03		4
24996>>5	byte			0x02		3
24997>>5	byte			0x01		2
24998>>5	byte			0x00		1
24999>>5	byte			0x10		(ALL)
25000>>2	byte			x			\b, Channel %d
25001>1	byte			0x08		Fender
25002>1	byte			0x09		Gulbransen
25003>1	byte			0x0a		AKG
25004>1	byte			0x0b		Voyce
25005>1	byte			0x0c		Waveframe
25006>1	byte			0x0d		ADA
25007>1	byte			0x0e		Garfield
25008>1	byte			0x0f		Ensoniq
25009>1	byte			0x10		Oberheim
25010>>2	byte			0x06		Matrix 6 series
25011>>3	byte			0x0A		Dump (All)
25012>>3	byte			0x01		Dump (Bank)
25013>>4 belong			0x0002040E		Matrix 1000
25014>>>11 byte			<2			User bank %d
25015>>>11 byte			>1			Preset bank %d
25016>1	byte			0x11		Apple
25017>1	byte			0x12		GreyMatter
25018>1	byte			0x14		PalmTree
25019>1	byte			0x15		JLCooper
25020>1	byte			0x16		Lowrey
25021>1	byte			0x17		AdamsSmith
25022>1	byte			0x18		E-mu
25023>1	byte			0x19		Harmony
25024>1	byte			0x1a		ART
25025>1	byte			0x1b		Baldwin
25026>1	byte			0x1c		Eventide
25027>1	byte			0x1d		Inventronics
25028>1	byte			0x1f		Clarity
25029
25030# European Group
25031>1	byte			0x21		SIEL
25032>1	byte			0x22		Synthaxe
25033>1	byte			0x24		Hohner
25034>1	byte			0x25		Twister
25035>1	byte			0x26		Solton
25036>1	byte			0x27		Jellinghaus
25037>1	byte			0x28		Southworth
25038>1	byte			0x29		PPG
25039>1	byte			0x2a		JEN
25040>1	byte			0x2b		SSL
25041>1	byte			0x2c		AudioVertrieb
25042
25043>1	byte			0x2f		ELKA
25044>>3	byte			0x09		EK-44
25045
25046>1	byte			0x30		Dynacord
25047>1	byte			0x31		Jomox
25048>1	byte			0x33		Clavia
25049>1	byte			0x39		Soundcraft
25050# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
25051>1	byte			0x3e		Waldorf
25052>>2	byte			0x00		microWave
25053>>2	byte			0x0E		microwave2 / XT
25054>>2	byte			0x0F		Q / Q+
25055>>3	byte			=0			(default id)
25056>>3 byte			>0			(
25057>>>3 byte			<0x7F		\bdevice %d)
25058>>>3 byte			=0x7F		\bbroadcast id)
25059>>3	byte			0x7f		Microwave I
25060>>>4	byte			0x00		SNDR (Sound Request)
25061>>>4	byte			0x10		SNDD (Sound Dump)
25062>>>4	byte			0x20		SNDP (Sound Parameter Change)
25063>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
25064>>>4	byte			0x70		BOOT (Sound Reserved)
25065>>>4	byte			0x01		MULR (Multi Request)
25066>>>4	byte			0x11		MULD (Multi Dump)
25067>>>4	byte			0x21		MULP (Multi Parameter Change)
25068>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
25069>>>4	byte			0x71		OS (Multi Reserved)
25070>>>4	byte			0x02		DRMR (Drum Map Request)
25071>>>4	byte			0x12		DRMD (Drum Map Dump)
25072>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
25073>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
25074>>>4	byte			0x72		BIN (Drum Map Reserved)
25075>>>4	byte			0x03		PATR (Sequencer Pattern Request)
25076>>>4	byte			0x13		PATD (Sequencer Pattern Dump)
25077>>>4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
25078>>>4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
25079>>>4	byte			0x73		AFM (Sequencer Pattern Reserved)
25080>>>4	byte			0x04		GLBR (Global Parameter Request)
25081>>>4	byte			0x14		GLBD (Global Parameter Dump)
25082>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
25083>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
25084>>>4	byte			0x07		MODR (Mode Parameter Request)
25085>>>4	byte			0x17		MODD (Mode Parameter Dump)
25086>>>4	byte			0x27		MODP (Mode Parameter Parameter Change)
25087>>>4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
25088>>2	byte			0x10		microQ
25089>>>4	byte			0x00		SNDR (Sound Request)
25090>>>4	byte			0x10		SNDD (Sound Dump)
25091>>>4	byte			0x20		SNDP (Sound Parameter Change)
25092>>>4	byte			0x30		SNDQ (Sound Parameter Inquiry)
25093>>>4	byte			0x70		(Sound Reserved)
25094>>>4	byte			0x01		MULR (Multi Request)
25095>>>4	byte			0x11		MULD (Multi Dump)
25096>>>4	byte			0x21		MULP (Multi Parameter Change)
25097>>>4	byte			0x31		MULQ (Multi Parameter Inquiry)
25098>>>4	byte			0x71		OS (Multi Reserved)
25099>>>4	byte			0x02		DRMR (Drum Map Request)
25100>>>4	byte			0x12		DRMD (Drum Map Dump)
25101>>>4	byte			0x22		DRMP (Drum Map Parameter Change)
25102>>>4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
25103>>>4	byte			0x72		BIN (Drum Map Reserved)
25104>>>4	byte			0x04		GLBR (Global Parameter Request)
25105>>>4	byte			0x14		GLBD (Global Parameter Dump)
25106>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
25107>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
25108>>2	byte			0x11		rackAttack
25109>>>4	byte			0x00		SNDR (Sound Parameter Request)
25110>>>4	byte			0x10		SNDD (Sound Parameter Dump)
25111>>>4	byte			0x20		SNDP (Sound Parameter Parameter Change)
25112>>>4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
25113>>>4	byte			0x01		PRGR (Program Parameter Request)
25114>>>4	byte			0x11		PRGD (Program Parameter Dump)
25115>>>4	byte			0x21		PRGP (Program Parameter Parameter Change)
25116>>>4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
25117>>>4	byte			0x71		OS (Program Parameter Reserved)
25118>>>4	byte			0x03		PATR (Pattern Parameter Request)
25119>>>4	byte			0x13		PATD (Pattern Parameter Dump)
25120>>>4	byte			0x23		PATP (Pattern Parameter Parameter Change)
25121>>>4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
25122>>>4	byte			0x04		GLBR (Global Parameter Request)
25123>>>4	byte			0x14		GLBD (Global Parameter Dump)
25124>>>4	byte			0x24		GLBP (Global Parameter Parameter Change)
25125>>>4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
25126>>>4	byte			0x05		EFXR (FX Parameter Request)
25127>>>4	byte			0x15		EFXD (FX Parameter Dump)
25128>>>4	byte			0x25		EFXP (FX Parameter Parameter Change)
25129>>>4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
25130>>>4	byte			0x07		MODR (Mode Command Request)
25131>>>4	byte			0x17		MODD (Mode Command Dump)
25132>>>4	byte			0x27		MODP (Mode Command Parameter Change)
25133>>>4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
25134>>2	byte			0x03		Wave
25135>>>4	byte			0x00		SBPR (Soundprogram)
25136>>>4	byte			0x01		SAPR (Performance)
25137>>>4	byte			0x02		SWAVE (Wave)
25138>>>4	byte			0x03		SWTBL (Wave control table)
25139>>>4	byte			0x04		SVT (Velocity Curve)
25140>>>4	byte			0x05		STT (Tuning Table)
25141>>>4	byte			0x06		SGLB (Global Parameters)
25142>>>4	byte			0x07		SARRMAP (Performance Program Change Map)
25143>>>4	byte			0x08		SBPRMAP (Sound Program Change Map)
25144>>>4	byte			0x09		SBPRPAR (Sound Parameter)
25145>>>4	byte			0x0A		SARRPAR (Performance Parameter)
25146>>>4	byte			0x0B		SINSPAR (Instrument/External Parameter)
25147>>>4	byte			0x0F		SBULK (Bulk Switch on/off)
25148
25149# Japanese Group
25150>1	byte			0x40		Kawai
25151>>3	byte			0x20		K1
25152>>3	byte			0x22		K4
25153
25154>1	byte			0x41		Roland
25155>>3	byte			0x14		D-50
25156>>3	byte			0x2b		U-220
25157>>3	byte			0x02		TR-707
25158
25159>1	byte			0x42		Korg
25160>>3	byte			0x19		M1
25161
25162>1	byte			0x43		Yamaha
25163>1	byte			0x44		Casio
25164>1	byte			0x46		Kamiya
25165>1	byte			0x47		Akai
25166>1	byte			0x48		Victor
25167>1	byte			0x49		Mesosha
25168>1	byte			0x4b		Fujitsu
25169>1	byte			0x4c		Sony
25170>1	byte			0x4e		Teac
25171>1	byte			0x50		Matsushita
25172>1	byte			0x51		Fostex
25173>1	byte			0x52		Zoom
25174>1	byte			0x54		Matsushita
25175>1	byte			0x57		Acoustic tech. lab.
25176# http://www.midi.org/techspecs/manid.php
25177>1	belong&0xffffff00	0x00007400	Ta Horng
25178>1	belong&0xffffff00	0x00007500	e-Tek
25179>1	belong&0xffffff00	0x00007600	E-Voice
25180>1	belong&0xffffff00	0x00007700	Midisoft
25181>1	belong&0xffffff00	0x00007800	Q-Sound
25182>1	belong&0xffffff00	0x00007900	Westrex
25183>1	belong&0xffffff00	0x00007a00	Nvidia*
25184>1	belong&0xffffff00	0x00007b00	ESS
25185>1	belong&0xffffff00	0x00007c00	Mediatrix
25186>1	belong&0xffffff00	0x00007d00	Brooktree
25187>1	belong&0xffffff00	0x00007e00	Otari
25188>1	belong&0xffffff00	0x00007f00	Key Electronics
25189>1	belong&0xffffff00	0x00010000	Shure
25190>1	belong&0xffffff00	0x00010100	AuraSound
25191>1	belong&0xffffff00	0x00010200	Crystal
25192>1	belong&0xffffff00	0x00010300	Rockwell
25193>1	belong&0xffffff00	0x00010400	Silicon Graphics
25194>1	belong&0xffffff00	0x00010500	Midiman
25195>1	belong&0xffffff00	0x00010600	PreSonus
25196>1	belong&0xffffff00	0x00010800	Topaz
25197>1	belong&0xffffff00	0x00010900	Cast Lightning
25198>1	belong&0xffffff00	0x00010a00	Microsoft
25199>1	belong&0xffffff00	0x00010b00	Sonic Foundry
25200>1	belong&0xffffff00	0x00010c00	Line 6
25201>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
25202>1	belong&0xffffff00	0x00010e00	Van Koerving
25203>1	belong&0xffffff00	0x00010f00	Altech Systems
25204>1	belong&0xffffff00	0x00011000	S & S Research
25205>1	belong&0xffffff00	0x00011100	VLSI Technology
25206>1	belong&0xffffff00	0x00011200	Chromatic
25207>1	belong&0xffffff00	0x00011300	Sapphire
25208>1	belong&0xffffff00	0x00011400	IDRC
25209>1	belong&0xffffff00	0x00011500	Justonic Tuning
25210>1	belong&0xffffff00	0x00011600	TorComp
25211>1	belong&0xffffff00	0x00011700	Newtek Inc.
25212>1	belong&0xffffff00	0x00011800	Sound Sculpture
25213>1	belong&0xffffff00	0x00011900	Walker Technical
25214>1	belong&0xffffff00	0x00011a00	Digital Harmony
25215>1	belong&0xffffff00	0x00011b00	InVision
25216>1	belong&0xffffff00	0x00011c00	T-Square
25217>1	belong&0xffffff00	0x00011d00	Nemesys
25218>1	belong&0xffffff00	0x00011e00	DBX
25219>1	belong&0xffffff00	0x00011f00	Syndyne
25220>1	belong&0xffffff00	0x00012000	Bitheadz
25221>1	belong&0xffffff00	0x00012100	Cakewalk
25222>1	belong&0xffffff00	0x00012200	Staccato
25223>1	belong&0xffffff00	0x00012300	National Semicon.
25224>1	belong&0xffffff00	0x00012400	Boom Theory
25225>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
25226>1	belong&0xffffff00	0x00012600	Antares
25227>1	belong&0xffffff00	0x00012700	Angel Software
25228>1	belong&0xffffff00	0x00012800	St Louis Music
25229>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
25230>1	belong&0xffffff00	0x00012a00	Ashley Audio
25231>1	belong&0xffffff00	0x00012b00	Vari-Lite
25232>1	belong&0xffffff00	0x00012c00	Summit Audio
25233>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
25234>1	belong&0xffffff00	0x00012e00	SeaSound
25235>1	belong&0xffffff00	0x00012f00	U.S. Robotics
25236>1	belong&0xffffff00	0x00013000	Aurisis
25237>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
25238>1	belong&0xffffff00	0x00013200	FM7 Inc.
25239>1	belong&0xffffff00	0x00013300	Swivel Systems
25240>1	belong&0xffffff00	0x00013400	Hyperactive
25241>1	belong&0xffffff00	0x00013500	MidiLite
25242>1	belong&0xffffff00	0x00013600	Radical
25243>1	belong&0xffffff00	0x00013700	Roger Linn
25244>1	belong&0xffffff00	0x00013800	Helicon
25245>1	belong&0xffffff00	0x00013900	Event
25246>1	belong&0xffffff00	0x00013a00	Sonic Network
25247>1	belong&0xffffff00	0x00013b00	Realtime Music
25248>1	belong&0xffffff00	0x00013c00	Apogee Digital
25249
25250>1	belong&0xffffff00	0x00202b00	Medeli Electronics
25251>1	belong&0xffffff00	0x00202c00	Charlie Lab
25252>1	belong&0xffffff00	0x00202d00	Blue Chip Music
25253>1	belong&0xffffff00	0x00202e00	BEE OH Corp
25254>1	belong&0xffffff00	0x00202f00	LG Semicon America
25255>1	belong&0xffffff00	0x00203000	TESI
25256>1	belong&0xffffff00	0x00203100	EMAGIC
25257>1	belong&0xffffff00	0x00203200	Behringer
25258>1	belong&0xffffff00	0x00203300	Access Music
25259>1	belong&0xffffff00	0x00203400	Synoptic
25260>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
25261>1	belong&0xffffff00	0x00203600	Terratec
25262>1	belong&0xffffff00	0x00203700	Proel SpA
25263>1	belong&0xffffff00	0x00203800	IBK MIDI
25264>1	belong&0xffffff00	0x00203900	IRCAM
25265>1	belong&0xffffff00	0x00203a00	Propellerhead Software
25266>1	belong&0xffffff00	0x00203b00	Red Sound Systems
25267>1	belong&0xffffff00	0x00203c00	Electron ESI AB
25268>1	belong&0xffffff00	0x00203d00	Sintefex Audio
25269>1	belong&0xffffff00	0x00203e00	Music and More
25270>1	belong&0xffffff00	0x00203f00	Amsaro
25271>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
25272>1	belong&0xffffff00	0x00204100	Touched by Sound
25273>1	belong&0xffffff00	0x00204200	DSP Arts
25274>1	belong&0xffffff00	0x00204300	Phil Rees Music
25275>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
25276>1	belong&0xffffff00	0x00204500	Soundart
25277>1	belong&0xffffff00	0x00204600	C-Mexx Software
25278>1	belong&0xffffff00	0x00204700	Klavis Tech.
25279>1	belong&0xffffff00	0x00204800	Noteheads AB
25280
252810	string			T707		Roland TR-707 Data
25282#------------------------------------------------------------------------------
25283# file:  file(1) magic for Tcl scripting language
25284# URL:  http://www.tcl.tk/
25285# From: gustaf neumann
25286
25287# Tcl scripts
252880	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
25289!:mime	text/x-tcl
252900	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
25291!:mime	text/x-tcl
252920	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
25293!:mime	text/x-tcl
252940	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
25295!:mime	text/x-tcl
252960	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
25297!:mime	text/x-tcl
252980	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
25299!:mime	text/x-tcl
253000	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
25301!:mime	text/x-tcl
253020	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
25303!:mime	text/x-tcl
25304
25305# check the first line
253060	search/1	package\ req
25307>0	regex		\^package[\ \t]+req	Tcl script
25308# not 'p', check other lines
253090	search/1	!p
25310>0	regex		\^package[\ \t]+req	Tcl script
25311
25312#------------------------------------------------------------------------------
25313# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
25314# teapot:  file(1) magic for "teapot" spreadsheet
25315#
253160       string          #!teapot\012xdr      teapot work sheet (XDR format)
25317
25318#------------------------------------------------------------------------------
25319# $File: terminfo,v 1.10 2018/01/21 03:26:33 christos Exp $
25320# terminfo:  file(1) magic for terminfo
25321#
25322# URL: http://invisible-island.net/ncurses/man/term.5.html
25323# URL: http://invisible-island.net/ncurses/man/scr_dump.5.html
25324#
25325# Workaround for Targa image type by Joerg Jenderek
25326# GRR: line below too general as it catches also
25327# Targa image type 1 with 26 long identification field
25328# and HELP.DSK
253290	string		\032\001
25330# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
25331>16	ubyte		>32
25332# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1"
25333>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled terminfo entry "%-s"
25334!:mime	application/x-terminfo
25335# no extension
25336#!:ext
25337#
25338#------------------------------------------------------------------------------
25339# The following was added for ncurses6 development:
25340#------------------------------------------------------------------------------
25341#
253420	string		\036\002
25343# imitate the legacy compiled-format, to get the entry-name printed
25344>16	ubyte		>32
25345# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1"
25346>>12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled 32-bit terminfo entry "%-s"
25347!:mime	application/x-terminfo2
25348#
25349# While the compiled terminfo uses little-endian format irregardless of
25350# platform, SystemV screen dumps do not.  They came later, and that detail was
25351# overlooked.
25352#
25353# AIX and HPUX use the SVr4 big-endian format
25354# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
253550	beshort		0433 		SVr2 curses screen image, big-endian
253560	beshort		0434		SVr3 curses screen image, big-endian
253570	beshort		0435		SVr4 curses screen image, big-endian
25358#
253590	leshort		0433		SVr2 curses screen image, little-endian
253600	leshort		0434		SVr3 curses screen image, little-endian
253610	leshort		0435		SVr4 curses screen image, little-endian
25362#
25363# Rather than SVr4, Solaris "xcurses" writes this header:
253640	regex		\^MAX=[0-9]+,[0-9]+$
25365>1	regex		\^BEG=[0-9]+,[0-9]+$
25366>2	regex		\^SCROLL=[0-9]+,[0-9]+$
25367>3	regex		\^VMIN=[0-9]+$
25368>4	regex		\^VTIME=[0-9]+$
25369>5	regex		\^FLAGS=0x[[:xdigit:]]+$
25370>6	regex		\^FG=[0-9],[0-9]+$
25371>7	regex		\^BG=[0-9]+,[0-9]+,	Solaris xcurses screen image
25372#
25373# ncurses5 (and before) did not use a magic number, making screen dumps "data".
25374# ncurses6 (2015) uses this format, ignoring byte-order
253750	string	\210\210\210\210ncurses	ncurses6 screen image
25376#
25377# PDCurses added this in 2005
253780	string		PDC\001		PDCurses screen image
25379
25380#------------------------------------------------------------------------------
25381# $File: tex,v 1.20 2014/03/16 02:53:03 christos Exp $
25382# tex:  file(1) magic for TeX files
25383#
25384# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
25385#
25386# From <conklin@talisman.kaleida.com>
25387
25388# Although we may know the offset of certain text fields in TeX DVI
25389# and font files, we can't use them reliably because they are not
25390# zero terminated. [but we do anyway, christos]
253910	string		\367\002	TeX DVI file
25392!:mime	application/x-dvi
25393>16	string		>\0		(%s)
253940	string		\367\203	TeX generic font data
253950	string		\367\131	TeX packed font data
25396>3	string		>\0		(%s)
253970	string		\367\312	TeX virtual font data
253980	search/1	This\ is\ TeX,	TeX transcript text
253990	search/1	This\ is\ METAFONT,	METAFONT transcript text
25400
25401# There is no way to detect TeX Font Metric (*.tfm) files without
25402# breaking them apart and reading the data.  The following patterns
25403# match most *.tfm files generated by METAFONT or afm2tfm.
254042	string		\000\021	TeX font metric data
25405!:mime	application/x-tex-tfm
25406>33	string		>\0		(%s)
254072	string		\000\022	TeX font metric data
25408!:mime	application/x-tex-tfm
25409>33	string		>\0		(%s)
25410
25411# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
254120	search/1	\\input\ texinfo	Texinfo source text
25413!:mime	text/x-texinfo
254140	search/1	This\ is\ Info\ file	GNU Info text
25415!:mime	text/x-info
25416
25417# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
254180	search/4096	\\input		TeX document text
25419!:mime	text/x-tex
25420!:strength + 15
254210	search/4096	\\begin		LaTeX document text
25422!:mime	text/x-tex
25423!:strength + 15
254240	search/4096	\\section	LaTeX document text
25425!:mime	text/x-tex
25426!:strength + 18
254270	search/4096	\\setlength	LaTeX document text
25428!:mime	text/x-tex
25429!:strength + 15
254300	search/4096	\\documentstyle	LaTeX document text
25431!:mime	text/x-tex
25432!:strength + 18
254330	search/4096	\\chapter	LaTeX document text
25434!:mime	text/x-tex
25435!:strength + 18
254360	search/4096	\\documentclass	LaTeX 2e document text
25437!:mime	text/x-tex
25438!:strength + 15
254390	search/4096	\\relax		LaTeX auxiliary file
25440!:mime	text/x-tex
25441!:strength + 15
254420	search/4096	\\contentsline	LaTeX table of contents
25443!:mime	text/x-tex
25444!:strength + 15
254450	search/4096	%\ -*-latex-*-	LaTeX document text
25446!:mime	text/x-tex
25447
25448# Tex document, from Hendrik Scholz <hendrik@scholz.net>
254490   	search/1	\\ifx		TeX document text
25450
25451# Index and glossary files
254520	search/4096	\\indexentry	LaTeX raw index file
254530	search/4096	\\begin{theindex}	LaTeX sorted index
254540	search/4096	\\glossaryentry	LaTeX raw glossary
254550	search/4096	\\begin{theglossary}	LaTeX sorted glossary
254560	search/4096	This\ is\ makeindex	Makeindex log file
25457
25458# End of TeX
25459
25460#------------------------------------------------------------------------------
25461# file(1) magic for BibTex text files
25462# From Hendrik Scholz <hendrik@scholz.net>
25463
254640	search/1/c	@article{	BibTeX text file
254650	search/1/c	@book{		BibTeX text file
254660	search/1/c	@inbook{	BibTeX text file
254670	search/1/c	@incollection{	BibTeX text file
254680	search/1/c	@inproceedings{	BibTeX text file
254690	search/1/c	@manual{	BibTeX text file
254700	search/1/c	@misc{		BibTeX text file
254710	search/1/c	@preamble{	BibTeX text file
254720	search/1/c	@phdthesis{	BibTeX text file
254730	search/1/c	@techreport{	BibTeX text file
254740	search/1/c	@unpublished{	BibTeX text file
25475
2547673	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)
25477
2547873	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
25479
254800	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file
25481
254820	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file
25483
254840	search/1	@c\ @mapfile{	TeX font aliases text file
25485
254860	string		#LyX		LyX document text
25487
25488# ConTeXt documents
25489#	http://wiki.contextgarden.net/
254900	search/4096	\\setupcolors[		ConTeXt document text
25491!:strength + 15
254920	search/4096	\\definecolor[		ConTeXt document text
25493!:strength + 15
254940	search/4096	\\setupinteraction[	ConTeXt document text
25495!:strength + 15
254960	search/4096	\\useURL[		ConTeXt document text
25497!:strength + 15
254980	search/4096	\\setuppapersize[	ConTeXt document text
25499!:strength + 15
255000	search/4096	\\setuplayout[		ConTeXt document text
25501!:strength + 15
255020	search/4096	\\setupfooter[		ConTeXt document text
25503!:strength + 15
255040	search/4096	\\setupfootertexts[	ConTeXt document text
25505!:strength + 15
255060	search/4096	\\setuppagenumbering[	ConTeXt document text
25507!:strength + 15
255080	search/4096	\\setupbodyfont[	ConTeXt document text
25509!:strength + 15
255100	search/4096	\\setuphead[		ConTeXt document text
25511!:strength + 15
255120	search/4096	\\setupitemize[		ConTeXt document text
25513!:strength + 15
255140	search/4096	\\setupwhitespace[	ConTeXt document text
25515!:strength + 15
255160	search/4096	\\setupindenting[	ConTeXt document text
25517!:strength + 15
25518
25519#------------------------------------------------------------------------------
25520# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
25521# file(1) magic for tgif(1) files
25522# From Hendrik Scholz <hendrik@scholz.net>
255230	string	%TGIF\ 			Tgif file version
25524>6	string	x			%s
25525
25526#------------------------------------------------------------------------------
25527# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $
25528# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
25529#
25530# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
25531#
25532# Update: Romain Lievin (roms@lpg.ticalc.org).
25533#
25534# NOTE: This list is not complete.
25535# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
25536# program/group magic numbers in here because I cannot find any.
255370		string		**TI80**	TI-80 Graphing Calculator File.
255380		string		**TI81**	TI-81 Graphing Calculator File.
25539#
25540# Magic Numbers for the TI-73
25541#
255420		string		**TI73**	TI-73 Graphing Calculator
25543>0x00003B	byte		0x00		(real number)
25544>0x00003B	byte		0x01		(list)
25545>0x00003B	byte		0x02		(matrix)
25546>0x00003B	byte		0x03		(equation)
25547>0x00003B	byte		0x04		(string)
25548>0x00003B	byte		0x05		(program)
25549>0x00003B	byte		0x06		(assembly program)
25550>0x00003B	byte		0x07		(picture)
25551>0x00003B	byte		0x08		(gdb)
25552>0x00003B	byte		0x0C		(complex number)
25553>0x00003B	byte		0x0F		(window settings)
25554>0x00003B	byte		0x10		(zoom)
25555>0x00003B	byte		0x11		(table setup)
25556>0x00003B	byte		0x13		(backup)
25557
25558# Magic Numbers for the TI-82
25559#
255600		string		**TI82**	TI-82 Graphing Calculator
25561>0x00003B	byte		0x00		(real)
25562>0x00003B	byte		0x01		(list)
25563>0x00003B	byte		0x02		(matrix)
25564>0x00003B	byte		0x03		(Y-variable)
25565>0x00003B	byte		0x05		(program)
25566>0x00003B	byte		0x06		(protected prgm)
25567>0x00003B	byte		0x07		(picture)
25568>0x00003B	byte		0x08		(gdb)
25569>0x00003B	byte		0x0B		(window settings)
25570>0x00003B	byte		0x0C		(window settings)
25571>0x00003B	byte		0x0D		(table setup)
25572>0x00003B	byte		0x0E		(screenshot)
25573>0x00003B	byte		0x0F		(backup)
25574#
25575# Magic Numbers for the TI-83
25576#
255770		string		**TI83**	TI-83 Graphing Calculator
25578>0x00003B	byte		0x00		(real)
25579>0x00003B	byte		0x01		(list)
25580>0x00003B	byte		0x02		(matrix)
25581>0x00003B	byte		0x03		(Y-variable)
25582>0x00003B	byte		0x04		(string)
25583>0x00003B	byte		0x05		(program)
25584>0x00003B	byte		0x06		(protected prgm)
25585>0x00003B	byte		0x07		(picture)
25586>0x00003B	byte		0x08		(gdb)
25587>0x00003B	byte		0x0B		(window settings)
25588>0x00003B	byte		0x0C		(window settings)
25589>0x00003B	byte		0x0D		(table setup)
25590>0x00003B	byte		0x0E		(screenshot)
25591>0x00003B	byte		0x13		(backup)
25592#
25593# Magic Numbers for the TI-83+
25594#
255950		string		**TI83F*	TI-83+ Graphing Calculator
25596>0x00003B	byte		0x00		(real number)
25597>0x00003B	byte		0x01		(list)
25598>0x00003B	byte		0x02		(matrix)
25599>0x00003B	byte		0x03		(equation)
25600>0x00003B	byte		0x04		(string)
25601>0x00003B	byte		0x05		(program)
25602>0x00003B	byte		0x06		(assembly program)
25603>0x00003B	byte		0x07		(picture)
25604>0x00003B	byte		0x08		(gdb)
25605>0x00003B	byte		0x0C		(complex number)
25606>0x00003B	byte		0x0F		(window settings)
25607>0x00003B	byte		0x10		(zoom)
25608>0x00003B	byte		0x11		(table setup)
25609>0x00003B	byte		0x13		(backup)
25610>0x00003B	byte		0x15		(application variable)
25611>0x00003B	byte		0x17		(group of variable)
25612
25613#
25614# Magic Numbers for the TI-85
25615#
256160		string		**TI85**	TI-85 Graphing Calculator
25617>0x00003B	byte		0x00		(real number)
25618>0x00003B	byte		0x01		(complex number)
25619>0x00003B	byte		0x02		(real vector)
25620>0x00003B	byte		0x03		(complex vector)
25621>0x00003B	byte		0x04		(real list)
25622>0x00003B	byte		0x05		(complex list)
25623>0x00003B	byte		0x06		(real matrix)
25624>0x00003B	byte		0x07		(complex matrix)
25625>0x00003B	byte		0x08		(real constant)
25626>0x00003B	byte		0x09		(complex constant)
25627>0x00003B	byte		0x0A		(equation)
25628>0x00003B	byte		0x0C		(string)
25629>0x00003B	byte		0x0D		(function GDB)
25630>0x00003B	byte		0x0E		(polar GDB)
25631>0x00003B	byte		0x0F		(parametric GDB)
25632>0x00003B	byte		0x10		(diffeq GDB)
25633>0x00003B	byte		0x11		(picture)
25634>0x00003B	byte		0x12		(program)
25635>0x00003B	byte		0x13		(range)
25636>0x00003B	byte		0x17		(window settings)
25637>0x00003B	byte		0x18		(window settings)
25638>0x00003B	byte		0x19		(window settings)
25639>0x00003B	byte		0x1A		(window settings)
25640>0x00003B	byte		0x1B		(zoom)
25641>0x00003B	byte		0x1D		(backup)
25642>0x00003B	byte		0x1E		(unknown)
25643>0x00003B	byte		0x2A		(equation)
25644>0x000032	string		ZS4		- ZShell Version 4 File.
25645>0x000032	string		ZS3		- ZShell Version 3 File.
25646#
25647# Magic Numbers for the TI-86
25648#
256490		string		**TI86**	TI-86 Graphing Calculator
25650>0x00003B	byte		0x00		(real number)
25651>0x00003B	byte		0x01		(complex number)
25652>0x00003B	byte		0x02		(real vector)
25653>0x00003B	byte		0x03		(complex vector)
25654>0x00003B	byte		0x04		(real list)
25655>0x00003B	byte		0x05		(complex list)
25656>0x00003B	byte		0x06		(real matrix)
25657>0x00003B	byte		0x07		(complex matrix)
25658>0x00003B	byte		0x08		(real constant)
25659>0x00003B	byte		0x09		(complex constant)
25660>0x00003B	byte		0x0A		(equation)
25661>0x00003B	byte		0x0C		(string)
25662>0x00003B	byte		0x0D		(function GDB)
25663>0x00003B	byte		0x0E		(polar GDB)
25664>0x00003B	byte		0x0F		(parametric GDB)
25665>0x00003B	byte		0x10		(diffeq GDB)
25666>0x00003B	byte		0x11		(picture)
25667>0x00003B	byte		0x12		(program)
25668>0x00003B	byte		0x13		(range)
25669>0x00003B	byte		0x17		(window settings)
25670>0x00003B	byte		0x18		(window settings)
25671>0x00003B	byte		0x19		(window settings)
25672>0x00003B	byte		0x1A		(window settings)
25673>0x00003B	byte		0x1B		(zoom)
25674>0x00003B	byte		0x1D		(backup)
25675>0x00003B	byte		0x1E		(unknown)
25676>0x00003B	byte		0x2A		(equation)
25677#
25678# Magic Numbers for the TI-89
25679#
256800		string		**TI89**	TI-89 Graphing Calculator
25681>0x000048	byte		0x00		(expression)
25682>0x000048	byte		0x04		(list)
25683>0x000048	byte		0x06		(matrix)
25684>0x000048	byte		0x0A		(data)
25685>0x000048	byte		0x0B		(text)
25686>0x000048	byte		0x0C		(string)
25687>0x000048	byte		0x0D		(graphic data base)
25688>0x000048	byte		0x0E		(figure)
25689>0x000048	byte		0x10		(picture)
25690>0x000048	byte		0x12		(program)
25691>0x000048	byte		0x13		(function)
25692>0x000048	byte		0x14		(macro)
25693>0x000048	byte		0x1C		(zipped)
25694>0x000048	byte		0x21		(assembler)
25695#
25696# Magic Numbers for the TI-92
25697#
256980		string		**TI92**	TI-92 Graphing Calculator
25699>0x000048	byte		0x00		(expression)
25700>0x000048	byte		0x04		(list)
25701>0x000048	byte		0x06		(matrix)
25702>0x000048	byte		0x0A		(data)
25703>0x000048	byte		0x0B		(text)
25704>0x000048	byte		0x0C		(string)
25705>0x000048	byte		0x0D		(graphic data base)
25706>0x000048	byte		0x0E		(figure)
25707>0x000048	byte		0x10		(picture)
25708>0x000048	byte		0x12		(program)
25709>0x000048	byte		0x13		(function)
25710>0x000048	byte		0x14		(macro)
25711>0x000048	byte		0x1D		(backup)
25712#
25713# Magic Numbers for the TI-92+/V200
25714#
257150		string		**TI92P*	TI-92+/V200 Graphing Calculator
25716>0x000048	byte		0x00		(expression)
25717>0x000048	byte		0x04		(list)
25718>0x000048	byte		0x06		(matrix)
25719>0x000048	byte		0x0A		(data)
25720>0x000048	byte		0x0B		(text)
25721>0x000048	byte		0x0C		(string)
25722>0x000048	byte		0x0D		(graphic data base)
25723>0x000048	byte		0x0E		(figure)
25724>0x000048	byte		0x10		(picture)
25725>0x000048	byte		0x12		(program)
25726>0x000048	byte		0x13		(function)
25727>0x000048	byte		0x14		(macro)
25728>0x000048	byte		0x1C		(zipped)
25729>0x000048	byte		0x21		(assembler)
25730#
25731# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
25732#
257330x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
257340		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
25735>8		byte		>0		- Revision %d
25736>>9 		byte		x		\b.%d,
25737>12		byte		>0		Revision date %02x
25738>>13		byte		x		\b/%02x
25739>>14		beshort		x		\b/%04x,
25740>17		string		>/0		name: '%s',
25741>48		byte		0x74		device: TI-73,
25742>48		byte		0x73		device: TI-83+,
25743>48		byte		0x98		device: TI-89,
25744>48		byte		0x88		device: TI-92+,
25745>49		byte		0x23		type: OS upgrade,
25746>49		byte		0x24		type: application,
25747>49		byte		0x25		type: certificate,
25748>49		byte		0x3e		type: license,
25749>74		lelong		>0		size: %d bytes
25750
25751# VTi & TiEmu skins (TI Graphing Calculators).
25752# From: Romain Lievin (roms@lpg.ticalc.org).
25753# Magic Numbers for the VTi skins
257540               string          VTI		Virtual TI skin
25755>3		string		v		- Version
25756>>4		byte		>0		\b %c
25757>>6		byte		x		\b.%c
25758# Magic Numbers for the TiEmu skins
257590		string		TiEmu		TiEmu skin
25760>6              string          v               - Version
25761>>7             byte            >0              \b %c
25762>>9             byte            x               \b.%c
25763>>10		byte		x		\b%c
25764
25765#------------------------------------------------------------------------------
25766# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
25767# timezone:  file(1) magic for timezone data
25768#
25769# from Daniel Quinlan (quinlan@yggdrasil.com)
25770# this should work on Linux, SunOS, and maybe others
25771# Added new official magic number for recent versions of the Olson code
257720	string	TZif	timezone data
25773>4	byte	0	\b, old version
25774>4	byte	>0	\b, version %c
25775>20	belong	0	\b, no gmt time flags
25776>20	belong	1	\b, 1 gmt time flag
25777>20	belong	>1	\b, %d gmt time flags
25778>24	belong	0	\b, no std time flags
25779>20	belong	1	\b, 1 std time flag
25780>24	belong	>1	\b, %d std time flags
25781>28	belong	0	\b, no leap seconds
25782>28	belong	1	\b, 1 leap second
25783>28	belong  >1	\b, %d leap seconds
25784>32	belong	0	\b, no transition times
25785>32	belong	1	\b, 1 transition time
25786>32	belong  >1	\b, %d transition times
25787>36	belong	0	\b, no abbreviation chars
25788>36	belong	1	\b, 1 abbreviation char
25789>36	belong	>1	\b, %d abbreviation chars
257900	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
257910	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
257920	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
257930	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
257940	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
257950	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
25796
25797#------------------------------------------------------------------------------
25798# $File: tplink,v 1.2 2017/12/14 05:52:56 christos Exp $
25799# tplink: File magic for openwrt firmware files
25800
25801# URL: https://wiki.openwrt.org/doc/techref/header
25802# Reference: http://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c
25803# From: Joerg Jenderek
25804# check for valid header version 1 or 2
258050		ulelong		<3
25806>0		ulelong		!0
25807# test for header padding with nulls
25808>>0x100		long		0
25809>>>0		use		firmware-tplink
25810
258110		name		firmware-tplink
25812>0		ubyte		x		firmware
25813!:mime application/x-tplink-bin
25814!:ext	bin
25815# hardware id like 10430001 07410001 09410004 09410006
25816>0x40		ubeshort	x		%x
25817>0x42		ubeshort	x		v%x
25818# hardware revision like 1
25819>0x44		ubelong		!1		(revision %u)
25820# vendor_name[24] like OpenWrt or TP-LINK Technologies
25821>4		string		x		%.24s
25822# fw_version[36] like r49389 or ver. 1.0
25823>0x1c		string		x		%.36s
25824# header version 1 or 2
25825>0		ubyte		!1		V%X
25826# ver_hi.ver_mid.ver_lo
25827>0x98		long		!0		\b, version
25828>>0x98		ubeshort	x		%u
25829>>0x9A		ubeshort	x		\b.%u
25830>>0x9C		ubeshort	x		\b.%u
25831# region code 0~universal 1~US
25832>0x48		ubelong		x
25833#>>0x48		ubelong		0		(universal)
25834>>0x48		ubelong		1		(US)
25835>>0x48		ubelong		>1		(region %u)
25836# total length of the firmware. not always true
25837>0x7C		ubelong		x		\b, %u bytes or less
25838# unknown 1
25839>0x48		ubelong		!0		\b, UNKNOWN1 0x%x
25840# md5sum1[16]
25841#>0x4c		ubequad		x		\b, MD5 %llx
25842#>>0x54		ubequad		x		\b%llx
25843# unknown 2
25844>0x5c		ubelong		!0		\b, UNKNOWN2 0x%x
25845# md5sum2[16]
25846#>0x60		ubequad		!0		\b, 2nd MD5 %llx
25847#>>0x68		ubequad		x		\b%llx
25848# unknown 3
25849>0x70		ubelong		!0		\b, UNKNOWN3 0x%x
25850# kernel load address
25851#>0x74		ubelong		x		\b, 0x%x load
25852# kernel entry point
25853#>0x78		ubelong		x		\b, 0x%x entry
25854# kernel data offset. 200h means direct after header
25855>0x80		ubelong		x		\b, at 0x%x
25856# kernel data length and 1 space
25857>0x84		ubelong		x		%u bytes
25858# look for kernel type (gzip compressed vmlinux.bin by ./compress)
25859>(0x80.L)	indirect	x
25860# root file system data offset
25861>0x88		ubelong		x		\b, at 0x%x
25862# rootfs data length and 1 space
25863>0x8C		ubelong		x		%u bytes
25864# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h
25865>(0x88.L)	indirect	x
25866#>(0x88.L)	string		x		\b, file system '%.4s'
25867#>(0x88.L)	ubequad		x		\b, file system 0x%llx
25868# bootloader data offset
25869>0x90		ubelong		!0		\b, at 0x%x
25870# bootloader data length only resonable if bootloader offset not null
25871>>0x94		ubelong		!0		%u bytes
25872# pad[354] should be 354 null bytes.
25873#>0x9E		ubequad		!0		\b, padding 0x%llx
25874# But at 0x120 18 non null bytes in examples like
25875# wr940nv4_eu_3_16_9_up_boot(160620).bin
25876# wr940nv6_us_3_18_1_up_boot(171030).bin
25877#>0x120		ubequad		!0		\b, other padding 0x%llx
25878
25879#------------------------------------------------------------------------------
25880# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $
25881# troff:  file(1) magic for *roff
25882#
25883# updated by Daniel Quinlan (quinlan@yggdrasil.com)
25884
25885# troff input
258860	search/1	.\\"		troff or preprocessor input text
25887!:mime	text/troff
258880	search/1	'\\"		troff or preprocessor input text
25889!:mime	text/troff
258900	search/1	'.\\"		troff or preprocessor input text
25891!:mime	text/troff
258920	search/1	\\"		troff or preprocessor input text
25893!:mime	text/troff
258940	search/1	'''		troff or preprocessor input text
25895!:mime	text/troff
258960	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9][\ \t]	troff or preprocessor input text
25897!:mime	text/troff
258980	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9]$	troff or preprocessor input text
25899!:mime	text/troff
25900
25901# ditroff intermediate output text
259020	search/1	x\ T		ditroff output text
25903>4	search/1	cat		for the C/A/T phototypesetter
25904>4	search/1	ps		for PostScript
25905>4	search/1	dvi		for DVI
25906>4	search/1	ascii		for ASCII
25907>4	search/1	lj4		for LaserJet 4
25908>4	search/1	latin1		for ISO 8859-1 (Latin 1)
25909>4	search/1	X75		for xditview at 75dpi
25910>>7	search/1	-12		(12pt)
25911>4	search/1	X100		for xditview at 100dpi
25912>>8	search/1	-12		(12pt)
25913
25914# output data formats
259150	string		\100\357	very old (C/A/T) troff output data
25916
25917#------------------------------------------------------------------------------
25918# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
25919# tuxedo:	file(1) magic for BEA TUXEDO data files
25920#
25921# from Ian Springer <ispringer@hotmail.com>
25922#
259230	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
25924
25925#------------------------------------------------------------------------------
25926# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
25927# typeset:  file(1) magic for other typesetting
25928#
259290	string		Interpress/Xerox	Xerox InterPress data
25930>16	string		/			(version
25931>>17	string		>\0			%s)
25932
25933#------------------------------------------------------------------------------
25934# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $
25935# Unicode:  BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
25936# GRR: These types should be recognised in file_ascmagic so these
25937# encodings can be treated by text patterns.
25938# Missing types are already dealt with internally.
25939#
259400	string	+/v8			Unicode text, UTF-7
259410	string	+/v9			Unicode text, UTF-7
259420	string	+/v+			Unicode text, UTF-7
259430	string	+/v/			Unicode text, UTF-7
259440	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
259450	string	\000\000\376\377	Unicode text, UTF-32, big-endian
259460	string	\377\376\000\000	Unicode text, UTF-32, little-endian
259470	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)
25948
25949#------------------------------------------------------------------------------
25950# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
25951# unknown:  file(1) magic for unknown machines
25952#
25953# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
25954# (executable, pure, and split I&D, respectively), but the PDP-11 version
25955# doesn't have the "version %ld", which may be a bogus COFFism (I don't
25956# think there was ever COFF for the PDP-11).
25957#
25958# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
25959# long, as it would be on a VAX.  In any case, that could collide with
25960# VAX demand-paged files, as the magic number is little-endian on those
25961# binaries, so the first 16 bits of the file would contain 0x10B.
25962#
25963# Therefore, those entries are commented out.
25964#
25965# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
25966#
25967#0	short		0x107		unknown machine executable
25968#>8	short		>0		not stripped
25969#>15	byte		>0		- version %ld
25970#0	short		0x108		unknown pure executable
25971#>8	short		>0		not stripped
25972#>15	byte		>0		- version %ld
25973#0	short		0x109		PDP-11 separate I&D
25974#>8	short		>0		not stripped
25975#>15	byte		>0		- version %ld
25976#0	short		0x10b		unknown pure executable
25977#>8	short		>0		not stripped
25978#>15	byte		>0		- version %ld
259790	long		0x10c		unknown demand paged pure executable
25980>16	long		>0		not stripped
259810	long		0x10e		unknown readable demand paged pure executable
25982
25983#------------------------------------------------------------------------------
25984# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
25985# file(1) magic for uterus files
25986# http://freecode.com/projects/uterus
25987#
259880	string		UTE+	uterus file
25989>4	string		v	\b, version
25990>5	byte		x	%c
25991>6	string		.	\b.
25992>7	byte		x	\b%c
25993>8	string		\<\>	\b, big-endian
25994>>16	belong		>0	\b, slut size %u
25995>8	string		\>\<	\b, litte-endian
25996>>16	lelong		>0	\b, slut size %u
25997>10	byte		&8	\b, compressed
25998
25999#------------------------------------------------------------------------------
26000# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
26001# uuencode:  file(1) magic for ASCII-encoded files
26002#
26003
26004# GRR:  the first line of xxencoded files is identical to that in uuencoded
26005# files, but the first character in most subsequent lines is 'h' instead of
26006# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
26007# punctuation and survives BITNET gateways better.)  If regular expressions
26008# were supported, this entry could possibly be split into two with
26009# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
260100	search/1	begin\ 		uuencoded or xxencoded text
26011
26012# btoa(1) is an alternative to uuencode that requires less space.
260130	search/1	xbtoa\ Begin	btoa'd text
26014
26015# ship(1) is another, much cooler alternative to uuencode.
26016# Greg Roelofs, newt@uchicago.edu
260170	search/1	$\012ship	ship'd binary text
26018
26019# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
26020# Greg Roelofs, newt@uchicago.edu
260210	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text
26022
26023# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
26024# Daniel Quinlan, quinlan@yggdrasil.com
2602511	search/1	must\ be\ converted\ with\ BinHex	BinHex binary text
26026>41	search/1	x					\b, version %.3s
26027
26028# GRR: handle BASE64
26029
26030#------------------------------------------------------------------------------
26031# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $
26032# vacuum cleaner magic by Thomas M. Ott (ThMO)
26033#
26034# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx
26035# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk
26036# -> yyyymmdd: year, month, day of cleaning
26037# -> hhmmss: hour, minute, second of cleaning
26038# -> xxxxxx: 6 digits
26039# -> cc: cleaning runs counter
26040# size: 136044 bytes
26041#
26042# struct maphdr {
26043#     int32_t  map_cnt;	     /*  0: single map */
26044#     int32_t  min_ceil;     /*  4: 100 mm == 10 cm == min. ceil */
26045#     int32_t  max_ceil;     /*  8: 10000 mm == 100 m == max. ceil */
26046#     int32_t  max_climb;    /* 12: 50 mm = 5 cm == max. height to climb */
26047#     int32_t  unknown;	     /* 16: 50000 ??? */
26048#     int32_t  cell_bytes;   /* 20: # of bytes for cells per block */
26049#     int32_t  block_max;    /* 24: 1000 == max. # of blocks */
26050#     int32_t  route_max;    /* 28: 1000 == max. # of routes */
26051#     int32_t  used_blocks;  /* 32: 5/45/33/... == # of block entries used! */
26052#     int32_t  cell_dim;     /* 36: 10 == cell dimension */
26053#     int32_t  clock_tick;   /* 40: 100 == clock ticks */
26054# #if	0
26055#     struct {		     /* 44: 1000 blocks for 10x10 cells */
26056#         int32_t  yoffset;
26057#         int32_t  xoffset;
26058#         int32_t  posxy;
26059#         int32_t  timecode;
26060#       }      blocks[ 1000];
26061#     char     cells[ 1000* 100]; /* 16044: 1000 10x10 cells */
26062#     int16_t  routes[ 1000* 10]; /* 116044: 1000 10-routes */
26063# #endif
26064#   };
26065
260660                lelong =1
26067>4               lelong =100
26068>>8              lelong =10000
26069>>>12            lelong =50
26070>>>>16           lelong =50000
26071>>>>>20          lelong =100
26072>>>>>>24         lelong =1000
26073>>>>>>>28        lelong =1000
26074>>>>>>>>36       lelong =10
26075>>>>>>>>>40      lelong =100
26076>>>>>>>>>>32     lelong x       LG robot VR6[234]xx %dm^2 navigation
26077>>>>>>>>>>136040 lelong =-1     reuse map data
26078>>>>>>>>>>136040 lelong =0      map data
26079>>>>>>>>>>136040 lelong >0      spurious map data
26080>>>>>>>>>>136040 lelong <-1     spurious map data
26081
26082
26083
26084#------------------------------------------------------------------------------
26085# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
26086# varied.out:  file(1) magic for various USG systems
26087#
26088#	Herewith many of the object file formats used by USG systems.
26089#	Most have been moved to files for a particular processor,
26090#	and deleted if they duplicate other entries.
26091#
260920	short		0610		Perkin-Elmer executable
26093# AMD 29K
260940	beshort		0572		amd 29k coff noprebar executable
260950	beshort		01572		amd 29k coff prebar executable
260960	beshort		0160007		amd 29k coff archive
26097# Cray
260986	beshort		0407		unicos (cray) executable
26099# Ultrix 4.3
26100596	string		\130\337\377\377	Ultrix core file
26101>600	string		>\0		from '%s'
26102# BeOS and MAcOS PEF executables
26103# From: hplus@zilker.net (Jon Watte)
261040	string		Joy!peffpwpc	header for PowerPC PEF executable
26105#
26106# ava assembler/linker Uros Platise <uros.platise@ijs.si>
261070       string          avaobj  AVR assembler object code
26108>7      string          >\0     version '%s'
26109# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
261100	string		gmon		GNU prof performance data
26111>4	long		x		- version %d
26112# From: Dave Pearson <davep@davep.org>
26113# Harbour <URL:http://harbour-project.org/> HRB files.
261140	string		\xc0HRB		Harbour HRB file
26115>4	leshort		x		version %d
26116# Harbour HBV files
261170	string		\xc0HBV		Harbour variable dump file
26118>4	leshort		x		version %d
26119
26120# From: Alex Beregszaszi <alex@fsn.hu>
26121# 0	string		exec 		BugOS executable
26122# 0	string		pack		BugOS archive
26123
26124# From: Jason Spence <jspence@lightconsulting.com>
26125# Generated by the "examples" in STM's ST40 devkit, and derived code.
261260	lelong		0x13a9f17e	ST40 component image format
26127>4	string		>\0		\b, name '%s'
26128
26129#------------------------------------------------------------------------------
26130# $File: varied.script,v 1.11 2015/03/27 17:59:39 christos Exp $
26131# varied.script:  file(1) magic for various interpreter scripts
26132
261330	string/t		#!\ /			a
26134>3	string		>\0			%s script text executable
26135
261360	string/b		#!\ /			a
26137>3	string		>\0			%s script executable (binary data)
26138
261390	string/t		#!\t/			a
26140>3	string		>\0			%s script text executable
26141
261420	string/b		#!\t/			a
26143>3	string		>\0			%s script executable (binary data)
26144
261450	string/t		#!/			a
26146>2	string		>\0			%s script text executable
26147
261480	string/b		#!/			a
26149>2	string		>\0			%s script executable (binary data)
26150
261510	string/t		#!\ 			script text executable
26152>3	string		>\0			for %s
26153
261540	string/b		#!\ 			script executable
26155>3	string		>\0			for %s (binary data)
26156
26157# using env
261580	string/t	#!/usr/bin/env		a
26159>15	string/t	>\0			%s script text executable
26160!:strength / 10
26161
261620	string/b	#!/usr/bin/env		a
26163>15	string/b	>\0			%s script executable (binary data)
26164!:strength / 10
26165
261660	string/t	#!\ /usr/bin/env	a
26167>16	string/t	>\0			%s script text executable
26168!:strength / 10
26169
261700	string/b	#!\ /usr/bin/env	a
26171>16	string/b	>\0			%s script executable (binary data)
26172!:strength / 10
26173
26174# From: arno <arenevier@fdn.fr>
26175# mozilla xpconnect typelib
26176# see http://www.mozilla.org/scriptable/typelib_file.html
261770	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
26178>0x10  byte        x       version %d
26179>>0x11 byte        x      \b.%d
26180
26181#------------------------------------------------------------------------------
26182# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $
26183# vax:  file(1) magic for VAX executable/object and APL workspace
26184#
261850	lelong		0101557		VAX single precision APL workspace
261860	lelong		0101556		VAX double precision APL workspace
26187
26188#
26189# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
26190# executables, and are handled in aout)
26191#
261920	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
26193>16	lelong		>0		not stripped
26194
26195#
26196# VAX COFF
26197#
26198# The `versions' were commented out, but have been un-commented out.
26199# (Was the problem just one of endianness?)
26200#
262010	leshort		0570		VAX COFF executable
26202>12	lelong		>0		not stripped
26203>22	leshort		>0		- version %d
262040	leshort		0575		VAX COFF pure executable
26205>12	lelong		>0		not stripped
26206>22	leshort		>0		- version %d
26207
26208#------------------------------------------------------------------------------
26209# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
26210# vicar:  file(1) magic for VICAR files.
26211#
26212# From: Ossama Othman <othman@astrosun.tn.cornell.edu
26213# VICAR is JPL's in-house spacecraft image processing program
26214# VICAR image
262150	string	LBLSIZE=	VICAR image data
26216>32	string	BYTE		\b, 8 bits  = VAX byte
26217>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
26218>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
26219>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
26220>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
26221>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
26222# VICAR label file
2622343	string	SFDU_LABEL	VICAR label file
26224
26225#------------------------------------------------------------------------------
26226# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $
26227# From: James Nobis <quel@quelrod.net>
26228# Microsoft hard disk images for:
26229# Virtual Server
26230# Virtual PC
26231# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
26232# .vhd
262330	string	conectix	Microsoft Disk Image, Virtual Server or Virtual PC
26234
26235# libvirt
26236# From: Philipp Hahn <hahn@univention.de>
262370	string	LibvirtQemudSave	Libvirt QEMU Suspend Image
26238>0x10	lelong	x	\b, version %u
26239>0x14	lelong	x	\b, XML length %u
26240>0x18	lelong	1	\b, running
26241>0x1c	lelong	1	\b, compressed
26242
262430	string	LibvirtQemudPart	Libvirt QEMU partial Suspend Image
26244# From: Alex Beregszaszi <alex@fsn.hu>
262450	string/b	COWD		VMWare3
26246>4	byte	3		disk image
26247>>32	lelong	x		(%d/
26248>>36	lelong	x		\b%d/
26249>>40	lelong	x		\b%d)
26250>4	byte	2		undoable disk image
26251>>32	string	>\0		(%s)
26252
262530	string/b	VMDK		 VMware4 disk image
262540	string/b	KDMV		 VMware4 disk image
26255
26256#--------------------------------------------------------------------
26257# Qemu Emulator Images
26258# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
26259# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
26260# Made by reading sources, reading documentation, and doing trial and error
26261# on existing QCOW files
262620	string/b	QFI\xFB	QEMU QCOW Image
26263
26264# Uncomment the following line to display Magic (only used for debugging
26265# this magic number)
26266#>0	string/b	x	, Magic: %s
26267
26268# There are currently 2 Versions: "1" and "2".
26269# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
26270>4	belong	1	(v1)
26271
26272# Using the existence of the Backing File Offset to determine whether
26273# to read Backing File Information
26274>>12	belong	 >0	 \b, has backing file (
26275# Note that this isn't a null-terminated string; the length is actually
26276# (16.L). Assuming a null-terminated string happens to work usually, but it
26277# may spew junk until it reaches a \0 in some cases.
26278>>>(12.L)	 string >\0	\bpath %s
26279
26280# Modification time of the Backing File
26281# Really useful if you want to know if your backing
26282# file is still usable together with this image
26283>>>>20	bedate >0	\b, mtime %s)
26284>>>>20	default x	\b)
26285
26286# Size is stored in bytes in a big-endian u64.
26287>>24	bequad	x	 \b, %lld bytes
26288
26289# 1 for AES encryption, 0 for none.
26290>>36	belong	1	\b, AES-encrypted
26291
26292# http://www.gnome.org/~markmc/qcow-image-format.html
26293>4	belong	2	(v2)
26294# Using the existence of the Backing File Offset to determine whether
26295# to read Backing File Information
26296>>8	bequad  >0	 \b, has backing file
26297# Note that this isn't a null-terminated string; the length is actually
26298# (16.L). Assuming a null-terminated string happens to work usually, but it
26299# may spew junk until it reaches a \0 in some cases. Also, since there's no
26300# .Q modifier, we just use the bottom four bytes as an offset. Note that if
26301# the file is over 4G, and the backing file path is stored after the first 4G,
26302# the wrong filename will be printed. (This should be (8.Q), when that syntax
26303# is introduced.)
26304>>>(12.L)	 string >\0	(path %s)
26305>>24	bequad	x	\b, %lld bytes
26306>>32	belong	1	\b, AES-encrypted
26307
26308>4	belong	3	(v3)
26309# Using the existence of the Backing File Offset to determine whether
26310# to read Backing File Information
26311>>8	bequad  >0	 \b, has backing file
26312# Note that this isn't a null-terminated string; the length is actually
26313# (16.L). Assuming a null-terminated string happens to work usually, but it
26314# may spew junk until it reaches a \0 in some cases. Also, since there's no
26315# .Q modifier, we just use the bottom four bytes as an offset. Note that if
26316# the file is over 4G, and the backing file path is stored after the first 4G,
26317# the wrong filename will be printed. (This should be (8.Q), when that syntax
26318# is introduced.)
26319>>>(12.L)	 string >\0	(path %s)
26320>>24	bequad	x	\b, %lld bytes
26321>>32	belong	1	\b, AES-encrypted
26322
26323>4	default x	(unknown version)
26324
263250	string/b	QEVM		QEMU suspend to disk image
26326
26327# QEMU QED Image
26328# http://wiki.qemu.org/Features/QED/Specification
263290	string/b	QED\0		QEMU QED Image
26330
26331# VDI Image
26332# Sun xVM VirtualBox Disk Image
26333# From: Richard W.M. Jones <rich@annexia.org>
26334# VirtualBox Disk Image
263350x40	ulelong		0xbeda107f	VirtualBox Disk Image
26336>0x44	uleshort	>0		\b, major %u
26337>0x46	uleshort	>0		\b, minor %u
26338>0	string		>\0		(%s)
26339>368	lequad		x		 \b, %lld bytes
26340
263410	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
26342>32	string	x				type %s,
26343>48	string	x				subtype %s
26344
263450	lelong	0x02468ace			Bochs Sparse disk image
26346
26347
26348#------------------------------------------------------------------------------
26349# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
26350# Virtutech Compressed Random Access File Format
26351#
26352# From <gustav@virtutech.com>
263530      string          \211\277\036\203        Virtutech CRAFF
26354>4     belong          x               v%d
26355>20    belong          0               uncompressed
26356>20    belong          1               bzipp2ed
26357>20    belong          2               gzipped
26358>24    belong          0               not clean
26359
26360#------------------------------------------------------------------------------
26361# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
26362# visx:  file(1) magic for Visx format files
26363#
263640	short		0x5555		VISX image file
26365>2	byte		0		(zero)
26366>2	byte		1		(unsigned char)
26367>2	byte		2		(short integer)
26368>2	byte		3		(float 32)
26369>2	byte		4		(float 64)
26370>2	byte		5		(signed char)
26371>2	byte		6		(bit-plane)
26372>2	byte		7		(classes)
26373>2	byte		8		(statistics)
26374>2	byte		10		(ascii text)
26375>2	byte		15		(image segments)
26376>2	byte		100		(image set)
26377>2	byte		101		(unsigned char vector)
26378>2	byte		102		(short integer vector)
26379>2	byte		103		(float 32 vector)
26380>2	byte		104		(float 64 vector)
26381>2	byte		105		(signed char vector)
26382>2	byte		106		(bit plane vector)
26383>2	byte		121		(feature vector)
26384>2	byte		122		(feature vector library)
26385>2	byte		124		(chain code)
26386>2	byte		126		(bit vector)
26387>2	byte		130		(graph)
26388>2	byte		131		(adjacency graph)
26389>2	byte		132		(adjacency graph library)
26390>2	string		.VISIX		(ascii text)
26391
26392#------------------------------------------------------------------------------
26393# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
26394# vms:  file(1) magic for VMS executables (experimental)
26395#
26396# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
26397
26398# GRR 950122:  I'm just guessing on these, based on inspection of the headers
26399# of three executables each for Alpha and VAX architectures.  The VAX files
26400# all had headers similar to this:
26401#
26402#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
26403#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
26404#
264050	string	\xb0\0\x30\0	VMS VAX executable
26406>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
26407#
26408# The AXP files all looked like this, except that the byte at offset 0x22
26409# was 06 in some of them and 07 in others:
26410#
26411#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
26412#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
26413#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
26414#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
26415#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
26416#
26417# GRR this test is still too general as it catches example adressen.dbt
264180	belong	0x03000000
26419>8	ubelong	0xec020000	VMS Alpha executable
26420>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
26421
26422#------------------------------------------------------------------------------
26423# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
26424# VMware specific files (deducted from version 1.1 and log file entries)
26425# Anthon van der Neut (anthon@mnt.org)
264260	belong	0x4d52564e	VMware nvram
26427
26428#------------------------------------------------------------------------------
26429# $File: vorbis,v 1.24 2018/03/14 04:38:44 christos Exp $
26430# vorbis:  file(1) magic for Ogg/Vorbis files
26431#
26432# From Felix von Leitner <leitner@fefe.de>
26433# Extended by Beni Cherniavsky <cben@crosswinds.net>
26434# Further extended by Greg Wooledge <greg@wooledge.org>
26435#
26436# Most (everything but the number of channels and bitrate) is commented
26437# out with `##' as it's not interesting to the average user.  The most
26438# probable things advanced users would want to uncomment are probably
26439# the number of comments and the encoder version.
26440#
26441# FIXME: The first match has been made a search, so that it can skip
26442# over prepended ID3 tags. This will work for MIME type detection, but
26443# won't work for detecting other properties of the file (they all need
26444# to be made relative to the search). In any case, if the file has ID3
26445# tags, the ID3 information will be printed, not the Ogg information,
26446# so until that's fixed, this doesn't matter.
26447# FIXME[2]: Disable the above for now, since search assumes text mode.
26448#
26449# --- Ogg Framing ---
26450#0		search/1000	OggS		Ogg data
264510		string	OggS		Ogg data
26452>4		byte		!0		UNKNOWN REVISION %u
26453##>4		byte		0		revision 0
26454>4		byte		0
26455##>>14		lelong		x		(Serial %lX)
26456# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
26457>>28		string		\x7fFLAC	\b, FLAC audio
26458# non-Vorbis content: Theora
26459!:mime		audio/ogg
26460>>28		string		\x80theora	\b, Theora video
26461!:mime		video/ogg
26462# non-Vorbis content: Kate
26463>>28		string		\x80kate\0\0\0\0	\b, Kate (Karaoke and Text)
26464!:mime		application/ogg
26465>>>37		ubyte		x		v%u
26466>>>38		ubyte		x		\b.%u,
26467>>>40		byte		0		utf8 encoding,
26468>>>40		byte		!0		unknown character encoding,
26469>>>60		string		>\0		language %s,
26470>>>60		string		\0		no language set,
26471>>>76		string		>\0		category %s
26472>>>76		string		\0		no category set
26473# non-Vorbis content: Skeleton
26474>>28		string		fishead\0	\b, Skeleton
26475!:mime		video/ogg
26476>>>36		leshort		x		v%u
26477>>>40		leshort		x		\b.%u
26478# non-Vorbis content: Speex
26479>>28		string		Speex\ \ \ 	\b, Speex audio
26480!:mime		audio/ogg
26481# non-Vorbis content: OGM
26482>>28		string		\x01video\0\0\0	\b, OGM video
26483!:mime		video/ogg
26484>>>37		string/c	div3		(DivX 3)
26485>>>37		string/c	divx		(DivX 4)
26486>>>37		string/c	dx50		(DivX 5)
26487>>>37		string/c	xvid		(XviD)
26488# --- First vorbis packet - general header ---
26489>>28		string		\x01vorbis	\b, Vorbis audio,
26490!:mime		audio/ogg
26491>>>35		lelong		!0		UNKNOWN VERSION %u,
26492##>>>35		lelong		0		version 0,
26493>>>35		lelong		0
26494>>>>39		ubyte		1		mono,
26495>>>>39		ubyte		2		stereo,
26496>>>>39		ubyte		>2		%u channels,
26497>>>>40		lelong		x		%u Hz
26498# Minimal, nominal and maximal bitrates specified when encoding
26499>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
26500# The above tests if at least one of these is specified:
26501>>>>>52		lelong		!-1
26502# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
26503# instead of -1.
26504# Vorbis 1.0 uses 0 instead of -1.
26505>>>>>>52	lelong		!0
26506>>>>>>>52	lelong		!-1000
26507>>>>>>>>52	lelong		x		<%u
26508>>>>>48		lelong		!-1
26509>>>>>>48	lelong		x		~%u
26510>>>>>44		lelong		!-1
26511>>>>>>44	lelong		!-1000
26512>>>>>>>44	lelong		!0
26513>>>>>>>>44	lelong		x		>%u
26514>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
26515# -- Second vorbis header packet - the comments
26516# A kludge to read the vendor string.  It's a counted string, not a
26517# zero-terminated one, so file(1) can't read it in a generic way.
26518# libVorbis is the only one existing currently, so I detect specifically
26519# it.  The interesting value is the cvs date (8 digits decimal).
26520# Post-RC1 Ogg files have the second header packet (and thus the version)
26521# in a different place, so we must use an indirect offset.
26522>>>(84.b+85)		string		\x03vorbis
26523>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
26524>>>>>(84.b+120)		string		>00000000
26525# Map to beta version numbers:
26526>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
26527>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
26528>>>>>>(84.b+120)	string		>20000508
26529>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
26530>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
26531>>>>>>(84.b+120)	string		>20001031
26532>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
26533>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
26534>>>>>>(84.b+120)	string		>20010225
26535>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
26536>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
26537>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
26538>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
26539>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
26540>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
26541>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
26542# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
26543>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
26544# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
26545>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
26546>>>>>(84.b+117)		string		>00000000
26547>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
26548>>>>>>(84.b+117)	string		20020717	(1.0)
26549>>>>>>(84.b+117)	string		20030909	(1.0.1)
26550>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
26551>>>>>>(84.b+117)	string		20050304	(1.1.2)
26552>>>>>>(84.b+117)	string		20070622	(1.2.0)
26553>>>>>>(84.b+117)	string		20090624	(1.2.2)
26554>>>>>>(84.b+117)	string		20090709	(1.2.3)
26555>>>>>>(84.b+117)	string		20100325	(1.3.1)
26556>>>>>>(84.b+117)	string		20101101	(1.3.2)
26557>>>>>>(84.b+117)	string		20120203	(1.3.3)
26558>>>>>>(84.b+117)	string		20140122	(1.3.4)
26559>>>>>>(84.b+117)	string		20150105	(1.3.5)
26560
26561# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5
26562>>28		string		OpusHead	\b, Opus audio,
26563!:mime		audio/ogg
26564>>>36		ubyte		>0x0F		UNKNOWN VERSION %u,
26565>>>36		ubyte		&0x0F		version 0.%d
26566>>>>46		ubyte		>1
26567>>>>>46		ubyte		!255		unknown channel mapping family %u,
26568>>>>>37		ubyte		x		%u channels
26569>>>>46		ubyte		0
26570>>>>>37		ubyte		1		mono
26571>>>>>37		ubyte		2		stereo
26572>>>>46		ubyte		1
26573>>>>>37		ubyte		1		mono
26574>>>>>37		ubyte		2		stereo
26575>>>>>37		ubyte		3		linear surround
26576>>>>>37		ubyte		4		quadraphonic
26577>>>>>37		ubyte		5		5.0 surround
26578>>>>>37		ubyte		6		5.1 surround
26579>>>>>37		ubyte		7		6.1 surround
26580>>>>>37		ubyte		8		7.1 surround
26581>>>>40		lelong		!0		\b, %u Hz
26582
26583#------------------------------------------------------------------------------
26584# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
26585# VXL: file(1) magic for VXL binary IO data files
26586#
26587# from Ian Scott <scottim@sf.net>
26588#
26589# VXL is a collection of C++ libraries for Computer Vision.
26590# See the vsl chapter in the VXL Book for more info
26591# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
26592# http:/vxl.sf.net
26593
265942	lelong	0x472b2c4e	VXL data file,
26595>0	leshort	>0		schema version no %d
26596
26597#------------------------------------------------------------------------------
26598# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $
26599# warc:  file(1) magic for WARC files
26600
266010	string	WARC/	WARC Archive
26602>5	string	x	version %.4s
26603!:mime application/warc
26604
26605#------------------------------------------------------------------------------
26606# Arc File Format from Internet Archive
26607# see http://www.archive.org/web/researcher/ArcFileFormat.php
266080      string          filedesc://     Internet Archive File
26609!:mime application/x-ia-arc
26610>11    search/256      \x0A    \b
26611>>&0   ubyte   >0      \b version %c
26612
26613#------------------------------------------------------------------------------
26614# weak:  file(1) magic for very weak magic entries, disabled by default
26615#
26616# These entries are so weak that they might interfere identification of
26617# other formats. Example include:
26618# - Only identify for 1 or 2 bytes
26619# - Match against very wide range of values
26620# - Match against generic word in some spoken languages (e.g. English)
26621
26622# Summary: Computer Graphics Metafile
26623# Extension: .cgm
26624#0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
26625#0	beshort		0x3020		character Computer Graphics Metafile
26626
26627#0	string		=!!		Bennet Yee's "face" format
26628#------------------------------------------------------------------------------
26629# $File: webassembly,v 1.2 2017/05/02 14:05:29 christos Exp $
26630# webassembly:  file(1) magic for WebAssembly modules
26631#
26632# WebAssembly is a virtual architecture developed by a W3C Community
26633# Group at http://webassembly.org/. The file extension is .wasm, and
26634# the MIME type is application/wasm.
26635#
26636# http://webassembly.org/docs/binary-encoding/ is the main
26637# document describing the binary format.
26638# From: Pip Cet <pipcet@gmail.com> and Joel Martin
26639
266400	string	\0asm	WebAssembly (wasm) binary module
26641>4	lelong	=1	version %#x (MVP)
26642>4	lelong	>1	version %#x
26643
26644#------------------------------------------------------------------------------
26645# $File: windows,v 1.22 2018/02/16 15:44:00 christos Exp $
26646# windows:  file(1) magic for Microsoft Windows
26647#
26648# This file is mainly reserved for files where programs
26649# using them are run almost always on MS Windows 3.x or
26650# above, or files only used exclusively in Windows OS,
26651# where there is no better category to allocate for.
26652# For example, even though WinZIP almost run on Windows
26653# only, it is better to treat them as "archive" instead.
26654# For format usable in DOS, such as generic executable
26655# format, please specify under "msdos" file.
26656#
26657
26658
26659# Summary: Outlook Express DBX file
26660# Extension: .dbx
26661# Created by: Christophe Monniez
266620	string	\xCF\xAD\x12\xFE	MS Outlook Express DBX file
26663>4	byte	=0xC5			\b, message database
26664>4	byte	=0xC6			\b, folder database
26665>4	byte	=0xC7			\b, account information
26666>4	byte	=0x30			\b, offline database
26667
26668
26669# Summary: Windows crash dump
26670# Extension: .dmp
26671# Created by: Andreas Schuster (http://computer.forensikblog.de/)
26672# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
26673# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
266740	string		PAGE
26675>4	string		DUMP		MS Windows 32bit crash dump
26676>>0x05c	byte            0		\b, no PAE
26677>>0x05c	byte            1		\b, PAE
26678>>0xf88	lelong		1		\b, full dump
26679>>0xf88	lelong		2		\b, kernel dump
26680>>0xf88	lelong		3		\b, small dump
26681>>0x068	lelong		x		\b, %d pages
26682>4	string		DU64		MS Windows 64bit crash dump
26683>>0xf98	lelong		1		\b, full dump
26684>>0xf98	lelong		2		\b, kernel dump
26685>>0xf98	lelong		3		\b, small dump
26686>>0x090	lequad		x		\b, %lld pages
26687
26688
26689# Summary: Vista Event Log
26690# Extension: .evtx
26691# Created by: Andreas Schuster (http://computer.forensikblog.de/)
26692# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
266930	string		ElfFile\0	MS Windows Vista Event Log
26694>0x2a	leshort		x		\b, %d chunks
26695>>0x10	lelong		x		\b (no. %d in use)
26696>0x18	lelong		>1		\b, next record no. %d
26697>0x18	lelong		=1		\b, empty
26698>0x78	lelong		&1		\b, DIRTY
26699>0x78	lelong		&2		\b, FULL
26700
26701
26702# Summary: Windows 3.1 group files
26703# Extension: .grp
26704# Created by: unknown
267050	string		\120\115\103\103	MS Windows 3.1 group files
26706
26707
26708# Summary: Old format help files
26709# URL: https://en.wikipedia.org/wiki/WinHelp
26710# Reference: http://www.oocities.org/mwinterhoff/helpfile.htm
26711# Update: Joerg Jenderek
26712# Created by: Dirk Jagdmann <doj@cubic.org>
26713#
26714# check and then display version and date inside MS Windows HeLP file fragment
267150	name				help-ver-date
26716# look for Magic of SYSTEMHEADER
26717>0	leshort		0x036C
26718# version Major		1 for right file fragment
26719>>4	leshort		1		Windows
26720# print non empty string above to avoid error message
26721# Warning: Current entry does not yet have a description for adding a MIME type
26722!:mime	application/winhelp
26723!:ext	hlp
26724# version Minor of help file format is hint for windows version
26725>>>2	leshort		0x0F		3.x
26726>>>2	leshort		0x15		3.0
26727>>>2	leshort		0x21		3.1
26728>>>2	leshort		0x27		x.y
26729>>>2	leshort		0x33		95
26730>>>2	default		x		y.z
26731>>>>2	leshort		x		0x%x
26732# to complete message string like "MS Windows 3.x help file"
26733>>>2	leshort		x		help
26734# GenDate often older than file creation date
26735>>>6	ldate		x		\b, %s
26736#
26737# Magic for HeLP files
267380	lelong		0x00035f3f
26739# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file"
26740# file header magic 0x293B at DirectoryStart+9
26741>(4.l+9)	uleshort	0x293B		MS
26742# look for @VERSION	bmf.. like IBMAVW.ANN
26743>>0xD4		string	=\x62\x6D\x66\x01\x00	Windows help annotation
26744!:mime	application/x-winhelp
26745!:ext	ann
26746>>0xD4		string	!\x62\x6D\x66\x01\x00
26747# "GID Help index" by TrID
26748>>>(4.l+0x65)	string	=|Pete			Windows help Global Index
26749!:mime	application/x-winhelp
26750!:ext	gid
26751# HeLP Bookmark or
26752# "Windows HELP File" by TrID
26753>>>(4.l+0x65)		string		!|Pete
26754# maybe there exist a cleaner way to detect HeLP fragments
26755# brute search for Magic 0x036C with matching Major maximal 7 iterations
26756# discapp.hlp
26757>>>>16			search/0x49AF/s	\x6c\x03
26758>>>>>&0			use 		help-ver-date
26759>>>>>&4			leshort		!1
26760# putty.hlp
26761>>>>>>&0		search/0x69AF/s	\x6c\x03
26762>>>>>>>&0		use 		help-ver-date
26763>>>>>>>&4		leshort		!1
26764>>>>>>>>&0		search/0x49AF/s	\x6c\x03
26765>>>>>>>>>&0		use 		help-ver-date
26766>>>>>>>>>&4		leshort		!1
26767>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
26768>>>>>>>>>>>&0		use 		help-ver-date
26769>>>>>>>>>>>&4		leshort		!1
26770>>>>>>>>>>>>&0		search/0x49AF/s	\x6c\x03
26771>>>>>>>>>>>>>&0		use 		help-ver-date
26772>>>>>>>>>>>>>&4		leshort		!1
26773>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
26774>>>>>>>>>>>>>>>&0	use 		help-ver-date
26775>>>>>>>>>>>>>>>&4	leshort		!1
26776>>>>>>>>>>>>>>>>&0	search/0x49AF/s	\x6c\x03
26777# GCC.HLP is detected after 7 iterations
26778>>>>>>>>>>>>>>>>>&0	use 		help-ver-date
26779# this only happens if bigger hlp file is detected after used search iterations
26780>>>>>>>>>>>>>>>>>&4	leshort		!1		Windows y.z help
26781!:mime	application/winhelp
26782!:ext	hlp
26783# repeat search again or following default line does not work
26784>>>>16			search/0x49AF/s	\x6c\x03
26785# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
26786>>>>16	default				x	Windows help Bookmark
26787!:mime	application/x-winhelp
26788!:ext	bmk
26789## FirstFreeBlock normally FFFFFFFFh 10h for *ANN
26790##>>8	lelong			x		\b, FirstFreeBlock 0x%8.8x
26791# EntireFileSize
26792>>12	lelong			x		\b, %d bytes
26793## ReservedSpace normally 042Fh AFh for *.ANN
26794#>>(4.l)	lelong		x		\b, ReservedSpace 0x%8.8x
26795## UsedSpace normally 0426h A6h for *.ANN
26796#>>(4.l+4)	lelong		x		\b, UsedSpace 0x%8.8x
26797## FileFlags normally 04...
26798#>>(4.l+5)	lelong		x		\b, FileFlags 0x%8.8x
26799## file header magic 0x293B
26800#>>(4.l+9)	uleshort	x		\b, file header magic 0x%4.4x
26801## file header Flags		0x0402
26802#>>(4.l+11)	uleshort	x		\b, file header Flags 0x%4.4x
26803## file header PageSize	0400h 80h for *.ANN
26804#>>(4.l+13)	uleshort	x		\b, PageSize 0x%4.4x
26805## Structure[16]		z4
26806#>>(4.l+15)	string		>\0		\b, Structure_"%-.16s"
26807## MustBeZero			0
26808#>>(4.l+31)	uleshort	x		\b, MustBeZero 0x%4.4x
26809## PageSplits
26810#>>(4.l+33)	uleshort	x		\b, PageSplits 0x%4.4x
26811## RootPage
26812#>>(4.l+35)	uleshort	x		\b, RootPage 0x%4.4x
26813## MustBeNegOne			0xffff
26814#>>(4.l+37)	uleshort	x		\b, MustBeNegOne 0x%4.4x
26815## TotalPages			1
26816#>>(4.l+39)	uleshort	x		\b, TotalPages 0x%4.4x
26817## NLevels			0x0001
26818#>>(4.l+41)	uleshort	x		\b, NLevels 0x%4.4x
26819## TotalBtreeEntries
26820#>>(4.l+43)	ulelong		x		\b, TotalBtreeEntries 0x%8.8x
26821## pages of the B+ tree
26822#>>(4.l+47)	ubequad		x		\b, PageStart 0x%16.16llx
26823
26824# start with colon or semicolon for comment line like Back2Life.cnt
268250		regex		\^(:|;)
26826# look for first keyword Base
26827>0		search/45	:Base
26828>>&0				use 		cnt-name
26829# only solution to search again from beginning , because relative offsets changes when use is called
26830>0		search/45	:Base
26831>0		default		x
26832# look for other keyword Title like in putty.cnt
26833>>0		search/45	:Title
26834>>>&0				use 		cnt-name
26835#
26836# display mime type and name of Windows help Content source
268370	name				cnt-name
26838# skip space at beginning
26839>0     string		\040
26840# name without extension and greater character or name with hlp extension
26841>>1	regex/c		\^([^\xd>]*|.*\.hlp)	MS Windows help file Content, based "%s"
26842!:mime	text/plain
26843!:apple	????TEXT
26844!:ext	cnt
26845#
26846# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing
268470	string		tfMR			MS Windows help Full Text Search index
26848!:mime application/x-winhelp-fts
26849!:ext	fts
26850>16	string		>\0			for "%s"
26851
26852# Summary: Hyper terminal
26853# Extension: .ht
26854# Created by: unknown
268550	string		HyperTerminal\040
26856>15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile
26857
26858# http://ithreats.files.wordpress.com/2009/05/\040
26859# lnk_the_windows_shortcut_file_format.pdf
26860# Summary: Windows shortcut
26861# Extension: .lnk
26862# Created by: unknown
26863# 'L' + GUUID
268640	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
26865>20	lelong&1	1	\b, Item id list present
26866>20	lelong&2	2	\b, Points to a file or directory
26867>20	lelong&4	4	\b, Has Description string
26868>20	lelong&8	8	\b, Has Relative path
26869>20	lelong&16	16	\b, Has Working directory
26870>20	lelong&32	32	\b, Has command line arguments
26871>20	lelong&64	64	\b, Icon
26872>>56	lelong		x	\b number=%d
26873>24	lelong&1	1	\b, Read-Only
26874>24	lelong&2	2	\b, Hidden
26875>24	lelong&4	4	\b, System
26876>24	lelong&8	8	\b, Volume Label
26877>24	lelong&16	16	\b, Directory
26878>24	lelong&32	32	\b, Archive
26879>24	lelong&64	64	\b, Encrypted
26880>24	lelong&128	128	\b, Normal
26881>24	lelong&256	256	\b, Temporary
26882>24	lelong&512	512	\b, Sparse
26883>24	lelong&1024	1024	\b, Reparse point
26884>24	lelong&2048	2048	\b, Compressed
26885>24	lelong&4096	4096	\b, Offline
26886>28	leqwdate	x	\b, ctime=%s
26887>36	leqwdate	x	\b, mtime=%s
26888>44	leqwdate	x	\b, atime=%s
26889>52	lelong		x	\b, length=%u, window=
26890>60	lelong&1	1	\bhide
26891>60	lelong&2	2	\bnormal
26892>60	lelong&4	4	\bshowminimized
26893>60	lelong&8	8	\bshowmaximized
26894>60	lelong&16	16	\bshownoactivate
26895>60	lelong&32	32	\bminimize
26896>60	lelong&64	64	\bshowminnoactive
26897>60	lelong&128	128	\bshowna
26898>60	lelong&256	256	\brestore
26899>60	lelong&512	512	\bshowdefault
26900#>20	lelong&1	0
26901#>>20	lelong&2	2
26902#>>>(72.l-64)	pstring/h	x	\b [%s]
26903#>20	lelong&1	1
26904#>>20	lelong&2	2
26905#>>>(72.s)	leshort	x
26906#>>>&75	pstring/h	x	\b [%s]
26907
26908# Summary: Outlook Personal Folders
26909# Created by: unknown
269100	lelong		0x4E444221	Microsoft Outlook email folder
26911>10	leshort		0x0e		(<=2002)
26912>10	leshort		0x17		(>=2003)
26913
26914
26915# Summary: Windows help cache
26916# Created by: unknown
269170	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
26918
26919
26920# Summary: IE cache file
26921# Created by: Christophe Monniez
269220	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
26923>20	string	>\0			version %s
26924
26925
26926# Summary: Registry files
26927# Created by: unknown
26928# Modified by (1): Joerg Jenderek
269290	string		regf		MS Windows registry file, NT/2000 or above
269300	string		CREG		MS Windows 95/98/ME registry file
269310	string		SHCC3		MS Windows 3.1 registry file
26932
26933
26934# Summary: Windows Registry text
26935# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files
26936# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry
26937# Submitted by: Abel Cheung <abelcheung@gmail.com>
26938# Update: Joerg Jenderek
26939#		Windows 3-9X variant
269400	string		REGEDIT
26941# skip ASCII text like "REGEDITor.txt" but match
26942# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL
26943>7	search/3	\n			Windows Registry text
26944!:mime	text/x-ms-regedit
26945!:ext	reg
26946#		Windows 9X variant
26947>>0	string		REGEDIT4		(Win95 or above)
26948#		Windows 2K ANSI variant
269490	string		Windows\ Registry\ Editor\
26950>&0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
26951!:mime	text/x-ms-regedit
26952!:ext	reg
26953#		Windows 2K UTF-16 variant
269542	lestring16	Windows\ Registry\ Editor\
26955>0x32	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
26956# relative offset not working
26957#>&0	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
26958!:mime	text/x-ms-regedit
26959!:ext	reg
26960#		WINE variant
26961# URL: https://en.wikipedia.org/wiki/Wine_(software)
26962# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html
26963# Note:	WINE use text based registry (system.reg,user.reg,userdef.reg)
26964#	instead binary hiv structure like Windows
269650	string	WINE\ REGISTRY\ Version\ 	WINE registry text
26966# version 2
26967>&0	string	x				\b, version %s
26968!:mime	text/x-wine-extension-reg
26969!:ext	reg
26970
26971# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018
26972# empty ,comment , section
26973# PR/383: remove unicode BOM because it is not portable across regex impls
26974#0	regex/s		\\`(\\r\\n|;|[[])
26975# empty line CRLF
269760	ubeshort	0x0D0A
26977>0	use		ini-file
26978# comment line
269790	string		;
26980>0	use		ini-file
26981# section line
269820	string		[
26983>0	use		ini-file
26984# check and then display Windows INItialization configuration
269850	name		ini-file
26986# look for left bracket in section line
26987>0	search/8192	[
26988# http://en.wikipedia.org/wiki/Autorun.inf
26989# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
26990# space after right bracket
26991# or AutoRun.Amd64 for 64 bit systems
26992# or only NL separator
26993>>&0	regex/c		\^(autorun)
26994# but sometimes total commander directory tree file "treeinfo.wc" with lines like
26995# [AUTORUN]
26996# [boot]
26997>>>&0	string		=]\r\n[					Total commander directory treeinfo.wc
26998!:mime text/plain
26999!:ext	wc
27000# From: Pal Tamas <folti@balabit.hu>
27001# Autorun File
27002>>>&0	string		!]\r\n[					Microsoft Windows Autorun file
27003!:mime application/x-setupscript
27004!:ext	inf
27005# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
27006# version strings ASCII coded case-independent for Windows setup information script file
27007>>&0	regex/c		\^(version|strings)]				Windows setup INFormation
27008!:mime	application/x-setupscript
27009#!:mime application/x-wine-extension-inf
27010!:ext	inf
27011# NETCRC.INF OEMCPL.INF
27012>>&0	regex/c		\^(WinsockCRCList|OEMCPL)]			Windows setup INFormation
27013!:mime	application/x-setupscript
27014!:ext	inf
27015# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
27016# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
27017# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
27018>>&0	regex/c	\^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)]	Windows desktop.ini
27019!:mime application/x-wine-extension-ini
27020#!:mime text/plain
27021# http://support.microsoft.com/kb/84709/
27022>>&0	regex/c		\^(don't\ load)]				Windows CONTROL.INI
27023!:mime application/x-wine-extension-ini
27024!:ext	ini
27025>>&0	regex/c		\^(ndishlp\\$|protman\\$|NETBEUI\\$)]		Windows PROTOCOL.INI
27026!:mime application/x-wine-extension-ini
27027!:ext	ini
27028# http://technet.microsoft.com/en-us/library/cc722567.aspx
27029# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
27030>>&0	regex/c		\^(windows|Compatibility|embedding)]		Windows WIN.INI
27031!:mime application/x-wine-extension-ini
27032!:ext	ini
27033# http://en.wikipedia.org/wiki/SYSTEM.INI
27034>>&0	regex/c		\^(boot|386enh|drivers)]			Windows SYSTEM.INI
27035!:mime application/x-wine-extension-ini
27036!:ext	ini
27037# http://www.mdgx.com/newtip6.htm
27038>>&0	regex/c		\^(SafeList)]					Windows IOS.INI
27039!:mime application/x-wine-extension-ini
27040!:ext	ini
27041# http://en.wikipedia.org/wiki/NTLDR	Windows Boot Loader information
27042>>&0	regex/c		\^(boot\x20loader)]				Windows boot.ini
27043!:mime application/x-wine-extension-ini
27044!:ext	ini
27045# http://en.wikipedia.org/wiki/CONFIG.SYS
27046>>&0	regex/c		\^(menu)]					MS-DOS CONFIG.SYS
27047# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE
27048# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYTEM\MSCONFIG.EXE
27049# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYTEM\MSCONFIG.EXE
27050# dos and w40 used in dual booting scene
27051!:ext	sys/dos/w40
27052# http://support.microsoft.com/kb/118579/
27053>>&0	regex/c		\^(Paths)]\r\n					MS-DOS MSDOS.SYS
27054!:ext	sys/dos
27055# http://chmspec.nongnu.org/latest/INI.html#HHP
27056>>&0	regex/c		\^(options)]\r\n				Microsoft HTML Help Project
27057!:mime text/plain
27058!:ext	hhp
27059# unknown keyword after opening bracket
27060>>&0	default				x
27061#>>>&0	string/c			x	UNKNOWN [%s
27062# look for left bracket of second section
27063>>>&0	search/8192			[
27064# version Strings FileIdentification
27065>>>>&0	string/c			version				Windows setup INFormation
27066!:mime application/x-setupscript
27067!:ext	inf
27068# http://en.wikipedia.org/wiki/Initialization_file	Windows Initialization File or other
27069>>>>&0	default				x
27070>>>>>&0	ubyte				x
27071# characters, digits, underscore and white space followed by right bracket
27072# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT
27073>>>>>>&-1	regex			\^([A-Za-z0-9_\(\)\ ]+)\]\r	Generic INItialization configuration [%-.40s
27074# NETDEF.INF multiarc.ini
27075#!:mime	application/x-setupscript
27076!:mime	application/x-wine-extension-ini
27077#!:mime	text/plain
27078!:ext	ini/inf
27079# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
270800	ubelong&0xFFff89FF	=0xFFFE0900
27081# look for left bracket in section line
27082>2	search/8192		[
27083# keyword without 1st letter which is maybe up-/down-case
27084>>&3	lestring16		ersion]			Windows setup INFormation
27085!:mime	application/x-setupscript
27086!:ext	inf
27087>>&3	lestring16		trings]			Windows setup INFormation
27088!:mime	application/x-setupscript
27089!:ext	inf
27090>>&3	lestring16		ourceDisksNames]	Windows setup INFormation
27091!:mime	application/x-setupscript
27092!:ext	inf
27093# netnwcli.inf start with ;---[ NetNWCli.INX ]
27094>>&3	default			x
27095# look for NL followed by left bracket
27096>>>&0	search/8192		\x0A\x00\x5b
27097>>>>&3	lestring16		ersion]			Windows setup INFormation
27098!:mime	application/x-setupscript
27099!:ext	inf
27100
27101# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
27102# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
27103# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
271040		leshort&0xFeFe	0x0000
27105!:strength -5
27106# test for unused null bits in PNF_FLAGs
27107>4	ulelong&0xFCffFe00	0x00000000
27108# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
27109>>68		ulelong		>0x57
27110# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
27111# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
27112>>>(68.l-1)	ubelong&0xffE0C519	=0x00400018	Windows Precompiled iNF
27113!:mime	application/x-pnf
27114# currently only found Major Version=1 and Minor Version=1
27115#>>>>0		uleshort	=0x0101
27116#>>>>>1		ubyte		x		\b, version %u
27117#>>>>>0		ubyte		x		\b.%u
27118>>>>0		uleshort	!0x0101
27119>>>>>1		ubyte		x		\b, version %u
27120>>>>>0		ubyte		x		\b.%u
27121# 1 ,2 (windows 98 SE)
27122#>>>>2		uleshort	=2		\b, InfStyle %u
27123>>>>2		uleshort	!2		\b, InfStyle %u
27124#	PNF_FLAG_IS_UNICODE		0x00000001
27125#	PNF_FLAG_HAS_STRINGS		0x00000002
27126#	PNF_FLAG_SRCPATH_IS_URL		0x00000004
27127#	PNF_FLAG_HAS_VOLATILE_DIRIDS	0x00000008
27128#	PNF_FLAG_INF_VERIFIED		0x00000010
27129#	PNF_FLAG_INF_DIGITALLY_SIGNED	0x00000020
27130#	??				0x00000100
27131#	??				0x01000000
27132#	??				0x02000000
27133>>>>4	ulelong&0x00000001	0x00000001	\b, unicoded
27134>>>>4	ulelong&0x00000020	0x00000020	\b, digitally signed
27135#>>>>8		ulelong		x		\b, InfSubstValueListOffset 0x%x
27136# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
27137#>>>>12		uleshort	x		\b, InfSubstValueCount 0x%x
27138# only < 9 found
27139#>>>>14		uleshort	x		\b, InfVersionDatumCount 0x%x
27140# only found values lower 0x0000ffff
27141#>>>>16		ulelong		x		\b, InfVersionDataSize 0x%x
27142# only found positive values lower 0x00ffFFff for InfVersionDataOffset
27143>>>>20		ulelong		x		\b, at 0x%x
27144>>>>4	ulelong&0x00000001	=0x00000001
27145# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
27146>>>>>(20.l)	lestring16	x		"%s"
27147>>>>4	ulelong&0x00000001	!0x00000001
27148>>>>>(20.l)	string		x		"%s"
27149# FILETIME is number of 100-nanosecond intervals since 1 January 1601
27150#>>>>24		ulequad		x		\b, InfVersionLastWriteTime %16.16llx
27151# only found values lower 0x00ffFFff
27152#>>>>32		ulelong		x		\b, StringTableBlockOffset 0x%x
27153#>>>>36		ulelong		x		\b, StringTableBlockSize 0x%x
27154#>>>>40		ulelong		x		\b, InfSectionCount 0x%x
27155#>>>>44		ulelong		x		\b, InfSectionBlockOffset 0x%x
27156#>>>>48		ulelong		x		\b, InfSectionBlockSize 0x%x
27157#>>>>52		ulelong		x		\b, InfLineBlockOffset 0x%x
27158#>>>>56		ulelong		x		\b, InfLineBlockSize 0x%x
27159#>>>>60		ulelong		x		\b, InfValueBlockOffset 0x%x
27160#>>>>64		ulelong		x		\b, InfValueBlockSize 0x%x
27161# WinDirPathOffset
27162#>>>>68		ulelong		x		\b, at 0x%x
27163>>>>68		ulelong		>0x57
27164>>>>>4	ulelong&0x00000001	=0x00000001
27165>>>>>>(68.l)	ubequad		=0x43003a005c005700
27166# normally unicoded C:\Windows
27167#>>>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
27168>>>>>>(68.l)	ubequad		!0x43003a005c005700
27169>>>>>>>(68.l)	lestring16	x		\b, WinDirPath "%s"
27170>>>>>4	ulelong&0x00000001	!0x00000001
27171# normally ASCII C:\WINDOWS
27172#>>>>>>(68.l)	string		=C:\\WINDOWS	\b, WinDirPath "%s"
27173>>>>>>(68.l)	string		!C:\\WINDOWS	\b, WinDirPath "%s"
27174# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
27175#>>>>72		ulelong		>0		\b, at 0x%x
27176>>>>72		ulelong		>0		\b,
27177>>>>>4	ulelong&0x00000001	=0x00000001
27178>>>>>>(72.l)	lestring16	x		OsLoaderPath "%s"
27179>>>>>4	ulelong&0x00000001	!0x00000001
27180# seldom C:\ instead empty
27181>>>>>>(72.l)	string		x		OsLoaderPath "%s"
27182# 1fdh
27183#>>>>76		uleshort	x		\b, StringTableHashBucketCount 0x%x
27184>>>>78		uleshort	!0x407		\b, LanguageId %x
27185# only 407h found
27186#>>>>78		uleshort	=0x407		\b, LanguageId %x
27187# InfSourcePathOffset often 0
27188#>>>>80		ulelong		>0		\b, at 0x%x
27189>>>>80		ulelong		>0		\b,
27190>>>>>4	ulelong&0x00000001	=0x00000001
27191>>>>>>(80.l)	lestring16	x		SourcePath "%s"
27192>>>>>4	ulelong&0x00000001	!0x00000001
27193>>>>>>(80.l)	string		>\0		SourcePath "%s"
27194# OriginalInfNameOffset often 0
27195#>>>>84		ulelong		>0		\b, at 0x%x
27196>>>>84		ulelong		>0		\b,
27197>>>>>4	ulelong&0x00000001	=0x00000001
27198>>>>>>(84.l)	lestring16	x		InfName "%s"
27199>>>>>4	ulelong&0x00000001	!0x00000001
27200>>>>>>(84.l)	string		>\0		InfName "%s"
27201
27202# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
27203# Extension: .bkf
27204# Created by: Joerg Jenderek
27205# URL: http://en.wikipedia.org/wiki/NTBackup
27206# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
27207# Descriptor BloCK name of Microsoft Tape Format
272080	string			TAPE
27209# Format Logical Address is zero
27210>20	ulequad			0
27211# Reserved for MBC is zero
27212>>28	uleshort		0
27213# Control Block ID is zero
27214>>>36	ulelong			0
27215# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
27216>>>>4	ulelong&0xFFfcFFe0	0		Windows NTbackup archive
27217#!:mime application/x-ntbackup
27218!:ext bkf
27219# OS ID
27220>>>>>10	ubyte			1		\b NetWare
27221>>>>>10	ubyte			13		\b NetWare SMS
27222>>>>>10	ubyte			14		\b NT
27223>>>>>10	ubyte			24		\b 3
27224>>>>>10	ubyte			25		\b OS/2
27225>>>>>10	ubyte			26		\b 95
27226>>>>>10	ubyte			27		\b Macintosh
27227>>>>>10	ubyte			28		\b UNIX
27228# OS Version (2)
27229#>>>>>11	ubyte			x		OS V=%x
27230# MTF_CONTINUATION	Media Sequence Number > 1
27231#>>>>>4	ulelong&0x00000001	!0		\b, continued
27232# MTF_COMPRESSION
27233>>>>>4	ulelong&0x00000004	!0		\b, compressed
27234# MTF_EOS_AT_EOM	End Of Medium was hit during end of set processing
27235>>>>>4	ulelong&0x00000008	!0		\b, End Of Medium hit
27236>>>>>4	ulelong&0x00020000	0
27237# MTF_SET_MAP_EXISTS	A Media Based Catalog Set Map may exist on tape
27238>>>>>>4	ulelong&0x00010000	!0		\b, with catalog
27239# MTF_FDD_ALLOWED	However File/Directory Detail can only exist if a Set Map is also present
27240>>>>>4	ulelong&0x00020000	!0		\b, with file catalog
27241# Offset To First Event 238h,240h,28Ch
27242#>>>>>8	uleshort		x		\b, event offset %4.4x
27243# Displayable Size (20e0230h 20e024ch 20e0224h)
27244#>>>>>8	ulequad			x		dis. size %16.16llx
27245# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h)
27246#>>>>>52	ulelong			x		family ID %8.8x
27247# TAPE Attributes (3)
27248#>>>>>56	ulelong			x		TAPE %8.8x
27249# Media Sequence Number
27250>>>>>60	uleshort		>1		\b, sequence %u
27251# Password Encryption Algorithm (3)
27252>>>>>62	uleshort		>0		\b, 0x%x encrypted
27253# Soft Filemark Block Size * 512 (2)
27254#>>>>>64	uleshort		=2		\b, soft size %u*512
27255>>>>>64	uleshort		!2		\b, soft size %u*512
27256# Media Based Catalog Type (1,2)
27257#>>>>>66	uleshort		x		\b, catalog type %4.4x
27258# size of Media Name (66,68,6Eh)
27259>>>>>68	uleshort		>0
27260# offset of Media Name (5Eh)
27261>>>>>>70	uleshort	>0
27262# 0~, 1~ANSI, 2~UNICODE
27263>>>>>>>48	ubyte		1
27264# size terminated ansi coded string normally followed by "MTF Media Label"
27265>>>>>>>>(70.s)	string		>\0		\b, name: %s
27266>>>>>>>48	ubyte		2
27267# Not null, but size terminated unicoded string
27268>>>>>>>>(70.s)	lestring16	x		\b, name: %s
27269# size of Media Label (104h)
27270>>>>>72	uleshort		>0
27271# offset of Media Label (C4h,C6h,CCh)
27272>>>>>74		uleshort	>0
27273>>>>>>48	ubyte		1
27274#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
27275>>>>>>>(74.s)	string		>\0		\b, label: %s
27276>>>>>>48	ubyte		2
27277>>>>>>>(74.s)	lestring16	x		\b, label: %s
27278# size of password name (0,1Ch)
27279#>>>>>76	uleshort		>0		\b, password size %4.4x
27280# Software Vendor ID (CBEh)
27281>>>>>86	uleshort		x		\b, software (0x%x)
27282# size of Software Name (6Eh)
27283>>>>>80	uleshort		>0
27284# offset of Software Name (1C8h,1CAh,1D0h)
27285>>>>>>82	uleshort	>0
27286# 1~ANSI, 2~UNICODE
27287>>>>>>>48	ubyte		1
27288>>>>>>>>(82.s)	string		>\0		\b: %s
27289>>>>>>>48	ubyte		2
27290# size terminated unicoded coded string normally followed by "SPAD"
27291>>>>>>>>(82.s)	lestring16	x		\b: %s
27292# Format Logical Block Size (512,1024)
27293#>>>>>84	uleshort		=1024		\b, block size %u
27294>>>>>84	uleshort		!1024		\b, block size %u
27295# Media Date of MTF_DATE_TIME type with 5 bytes
27296#>>>>>>88	ubequad			x		DATE %16.16llx
27297# MTF Major Version (1)
27298#>>>>>>93	ubyte		x		\b, MFT version %x
27299#
27300
27301# URL: https://en.wikipedia.org/wiki/PaintShop_Pro
27302# Reference: http://www.cryer.co.uk/file-types/p/pal.htm
27303# Created by: Joerg Jenderek
27304# Note: there exist other color palette formats also with .pal extension
273050	string	JASC-PAL\r\n	PaintShop Pro color palette
27306#!:mime	text/plain
27307# PspPalette extension is used by newer (probably 8) PaintShopPro versions
27308!:ext	pal/PspPalette
27309# 2nd line contains palette file version. For example "0100"
27310>10	string	!0100		\b, version %.4s
27311# third line contains the number of colours: 16 256 ...
27312>16	string	x		\b, %.3s colors
27313
27314# URL: http://en.wikipedia.org/wiki/Innosetup
27315# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas
27316# Created by: Joerg Jenderek
27317# Note:	created by like "InnoSetup self-extracting archive" inside ./msdos
27318# TrID labeles the entry as "Inno Setup Uninstall Log"
27319#	TUninstallLogID
273200	string	Inno\ Setup\ Uninstall\ Log\ (b)	InnoSetup Log
27321!:mime	application/x-innosetup
27322# unins000.dat, unins001.dat, ...
27323!:ext	dat
27324# " 64-bit" variant
27325>0x1c	string		>\0				\b%.7s
27326# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ...
27327>0xc0	string		x				%s
27328# AppId[0x80] is simliar to AppName or
27329# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
27330>0x40	ubyte		0x7b
27331>>0x40	string		x				%-.38s
27332# do not know how this log version correlates to program version
27333>0x140	ulelong		x				\b, version 0x%x
27334# NumRecs
27335#>0x144	ulelong		x				\b, 0x%4.4x records
27336# EndOffset means files size
27337>0x148	ulelong		x				\b, %u bytes
27338# Flags 5 25h 35h
27339#>0x14c	ulelong		x				\b, flags %8.8x
27340# Reserved: array[0..26] of Longint
27341# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000
27342>0x140	ulelong		<1000
27343# hostname
27344>>0x1d6	pstring		x				\b, %s
27345# user name
27346>>>&0	pstring		x				\b\%s
27347# directory like C:\Program Files (x86)\GnuWin32
27348>>>>&0	pstring		x				\b, "%s"
27349# version 1000 or higher implies unicode
27350>0x140	ulelong		>999
27351# hostname
27352>>0x1db	lestring16	x				\b, %-.9s
27353# utf string variant with prepending fe??ffFFff
27354>>0x1db	search/43	\xFF\xFF\xFF
27355# user name
27356>>>&0	lestring16	x				\b\%-.9s
27357>>>&0	search/43	\xFF\xFF\xFF
27358# directory like C:\Program Files\GIMP 2
27359>>>>&0	lestring16	x				\b, %-.42s
27360
27361
27362#------------------------------------------------------------------------------
27363# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
27364# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
27365#
273660	string	RGDB	CRDA wireless regulatory database file
27367>4	belong	19	(Version 1)
27368
27369#------------------------------------------------------------------------------
27370# $File: wordprocessors,v 1.19 2015/10/16 15:11:07 christos Exp $
27371# wordprocessors:  file(1) magic fo word processors.
27372#
27373####### PWP file format used on Smith Corona Personal Word Processors:
273742	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040'92	Smith Corona PWP
27375>24	byte	2	\b, single spaced
27376>24	byte	3	\b, 1.5 spaced
27377>24	byte	4	\b, double spaced
27378>25	byte	0x42	\b, letter
27379>25	byte	0x54	\b, legal
27380>26	byte	0x46	\b, A4
27381
27382# Corel/WordPerfect
273830	string	\xffWPC
27384# WordPerfect
27385>8	byte	1
27386>>9	byte	1	WordPerfect macro
27387>>9	byte	2	WordPerfect help file
27388>>9	byte	3	WordPerfect keyboard file
27389>>9	byte	10	WordPerfect document
27390>>9	byte	11	WordPerfect dictionary
27391>>9	byte	12	WordPerfect thesaurus
27392>>9	byte	13	WordPerfect block
27393>>9	byte	14	WordPerfect rectangular block
27394>>9	byte	15	WordPerfect column block
27395>>9	byte	16	WordPerfect printer data
27396>>9	byte	19	WordPerfect printer data
27397>>9	byte	20	WordPerfect driver resource data
27398>>9	byte	22	WordPerfect graphic image
27399>>9	byte	23	WordPerfect hyphenation code
27400>>9	byte	24	WordPerfect hyphenation data
27401>>9	byte	25	WordPerfect macro resource data
27402>>9	byte	27	WordPerfect hyphenation lex
27403>>9	byte	29	WordPerfect wordlist
27404>>9	byte	30	WordPerfect equation resource data
27405>>9	byte	33	WordPerfect spell rules
27406>>9	byte	34	WordPerfect dictionary rules
27407>>9	byte	39	WordPerfect spell rules (Microlytics)
27408>>9	byte	43	WordPerfect settings file
27409>>9	byte	44	WordPerfect 3.5 document
27410>>9	byte	45	WordPerfect 4.2 document
27411>>9	byte	69	WordPerfect dialog file
27412>>9	byte	76	WordPerfect button bar
27413>>9	default x
27414>>>9	byte	x	Corel WordPerfect: Unknown filetype %d
27415# Corel Shell
27416>8	byte	2
27417>>9	byte	1	Corel shell macro
27418>>9	byte	10	Corel shell definition
27419>>9	default x
27420>>>9	byte	x	Corel Shell: Unknown filetype %d
27421# Corel Notebook
27422>8	byte	3
27423>>9	byte	1	Corel Notebook macro
27424>>9	byte	2	Corel Notebook help file
27425>>9	byte	3	Corel Notebook keyboard file
27426>>9	byte	10	Corel Notebook definition
27427>>9	default	x
27428>>>9	byte	x	Corel Notebook: Unknown filetype %d
27429# Corel Calculator
27430>8	byte	4
27431>>9	byte	2	Corel Calculator help file
27432>>9	default	x
27433>>>9	byte	x	Corel Calculator: Unknown filetype %d
27434# Corel File Manager
27435>8	byte	5
27436>>9	default	x
27437>>>9	byte	x	Corel File Manager: Unknown filetype %d
27438# Corel Calendar
27439>8	byte	6
27440>>9	byte 	2	Corel Calendar help file
27441>>9	byte 	10	Corel Calendar data file
27442>>9	default	x
27443>>>9	byte	x	Corel Calendar: Unknown filetype %d
27444# Corel Program Editor/Ed Editor
27445>8	byte	7
27446>>9	byte	1	Corel Editor macro
27447>>9	byte	2	Corel Editor help file
27448>>9	byte	3	Corel Editor keyboard file
27449>>9	byte	25	Corel Editor macro resource file
27450>>9	default	x
27451>>>9	byte	x	Corel Program Editor/Ed Editor: Unknown filetype %d
27452# Corel Macro Editor
27453>8	byte	8
27454>>9	byte 	1	Corel Macro editor macro
27455>>9	byte 	2	Corel Macro editor help file
27456>>9	byte	3	Corel Macro editor keyboard file
27457>>9	default	x
27458>>>9	byte	x	Corel Macro Editor: Unknown filetype %d
27459# Corel Plan Perfect
27460>8	byte	9
27461>>9	default	x
27462>>>9	byte	x	Corel Plan Perfect: Unknown filetype %d
27463# Corel DataPerfect
27464>8	byte	10
27465# CHECK: Don't these belong into product 9?
27466>>9	byte	1	Corel PlanPerfect macro
27467>>9	byte	2	Corel PlanPerfect help file
27468>>9	byte	3	Corel PlanPerfect keyboard file
27469>>9	byte	10	Corel PlanPerfect worksheet
27470>>9	byte	15	Corel PlanPerfect printer definition
27471>>9	byte	18	Corel PlanPerfect graphic definition
27472>>9	byte	19	Corel PlanPerfect data
27473>>9	byte	20	Corel PlanPerfect temporary printer
27474>>9	byte	25	Corel PlanPerfect macro resource data
27475>>9	default	x
27476>>>9	byte	x	Corel DataPerfect: Unknown filetype %d
27477# Corel Mail
27478>8	byte	11
27479>>9	byte	2	Corel Mail help file
27480>>9	byte	5	Corel Mail distribution list
27481>>9	byte	10	Corel Mail out box
27482>>9	byte	11	Corel Mail in box
27483>>9	byte	20	Corel Mail users archived mailbox
27484>>9	byte	21	Corel Mail archived message database
27485>>9	byte	22	Corel Mail archived attachments
27486>>9	default	x
27487>>>9	byte	x	Corel Mail: Unknown filetype %d
27488# Corel Printer
27489>8	byte	12
27490>>9	byte	11	Corel Printer temporary file
27491>>9	default	x
27492>>>9	byte	x	Corel Printer: Unknown filetype %d
27493# Corel Scheduler
27494>8	byte	13
27495>>9	byte	2	Corel Scheduler help file
27496>>9	byte	10	Corel Scheduler in file
27497>>9	byte	11	Corel Scheduler out file
27498>>9	default	x
27499>>>9	byte	x	Corel Scheduler: Unknown filetype %d
27500# Corel WordPerfect Office
27501>8	byte	14
27502>>9	byte	10	Corel GroupWise settings file
27503>>9	byte	17	Corel GroupWise directory services
27504>>9	byte	43	Corel GroupWise settings file
27505>>9	default	x
27506>>>9	byte	x	Corel WordPerfect Office: Unknown filetype %d
27507# Corel DrawPerfect
27508>8	byte	15
27509>>9	default	x
27510>>>9	byte	x	Corel DrawPerfect: Unknown filetype %d
27511# Corel LetterPerfect
27512>8	byte	16
27513>>9	default	x
27514>>>9	byte	x	Corel LetterPerfect: Unknown filetype %d
27515# Corel Terminal
27516>8	byte	17
27517>>9	byte	10	Corel Terminal resource data
27518>>9	byte	11	Corel Terminal resource data
27519>>9	byte	43	Corel Terminal resource data
27520>>9	default	x
27521>>>9	byte	x	Corel Terminal: Unknown filetype %d
27522# Corel loadable file
27523>8	byte	18
27524>>9	byte	10	Corel loadable file
27525>>9	byte	11	Corel GUI loadable text
27526>>9	byte	12	Corel graphics resource data
27527>>9	byte	13	Corel printer settings file
27528>>9	byte	14	Corel port definition file
27529>>9	byte	15	Corel print queue parameters
27530>>9	byte	16	Corel compressed file
27531>>9	default	x
27532>>>9	byte	x	Corel loadable file: Unknown filetype %d
27533>>15	byte	0	\b, optimized for Intel
27534>>15	byte	1	\b, optimized for Non-Intel
27535# Network service
27536>8	byte	20
27537>>9	byte	10	Corel Network service msg file
27538>>9	byte	11	Corel Network service msg file
27539>>9	byte	12	Corel Async gateway login msg
27540>>9	byte	14	Corel GroupWise message file
27541>>9	default	x
27542>>>9	byte	x	Corel Network service: Unknown filetype %d
27543# GroupWise
27544>8	byte	31
27545>>9	byte	20	GroupWise admin domain database
27546>>9	byte	21	GroupWise admin host database
27547>>9	byte	23	GroupWise admin remote host database
27548>>9	byte	24	GroupWise admin ADS deferment data file
27549>>9	default	x
27550>>>9	byte	x	GroupWise: Unknown filetype %d
27551# IntelliTAG
27552>8	byte	33
27553>>9	byte	10	IntelliTAG (SGML) compiled DTD
27554>>9	default	x
27555>>>9	byte	x	IntelliTAG: Unknown filetype %d
27556# everything else
27557>8	default x
27558>>8	byte	x	Unknown Corel/Wordperfect product %d,
27559>>>9	byte	x	file type %d
27560>10	byte	0	\b, v5.
27561>10	byte	!0	\b, v%d.
27562>11	byte	x	\b%d
27563
27564# Hangul (Korean) Word Processor File
275650	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
27566# From: Won-Kyu Park <wkpark@kldp.org>
27567512	string		R\0o\0o\0t\0	Hangul (Korean) Word Processor File 2000
27568!:mime	application/x-hwp
27569
27570# CosmicBook, from Benoit Rouits
275710       string  CSBK    Ted Neslson's CosmicBook hypertext file
27572
275732       string  EYWR    AmigaWriter file
27574
27575# chi:  file(1) magic for ChiWriter files
275760       string          \\1cw\          ChiWriter file
27577>5      string          >\0             version %s
275780       string          \\1cw           ChiWriter file
27579
27580# Quark Express from http://www.garykessler.net/library/file_sigs.html
275812	string	IIXPR3			Intel Quark Express Document (English)
275822	string	IIXPRa			Intel Quark Express Document (Korean)
275832	string	MMXPR3			Motorola Quark Express Document (English)
27584!:mime	application/x-quark-xpress-3
275852	string	MMXPRa			Motorola Quark Express Document (Korean)
27586
27587# adobe indesign (document, whatever...) from querkan
275880	belong	0x0606edf5		Adobe InDesign
27589>16	string	DOCUMENT		Document
27590
27591#------------------------------------------------------------------------------
27592# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
27593#
27594# Contributor kenzo-:
27595# Reversed-engineered JS Ichitaro magic numbers
27596#
27597
275980	string		DOC
27599>43	byte		0x14	Just System Word Processor Ichitaro v4
27600!:mime	application/x-ichitaro4
27601>144	string	JDASH		application/x-ichitaro4
27602
276030	string		DOC
27604>43	byte		0x15	Just System Word Processor Ichitaro v5
27605!:mime	application/x-ichitaro5
27606
276070	string		DOC
27608>43	byte		0x16	Just System Word Processor Ichitaro v6
27609!:mime	application/x-ichitaro6
27610
27611# Type: Freemind mindmap documents
27612# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk>
276130	string/w	\<map\ version	Freemind document
27614!:mime	application/x-freemind
27615
27616# Type: Freeplane mindmap documents
27617# From: Felix Natter <fnatter@gmx.net>
276180       string/w        \<map\ version="freeplane  Freeplane document
27619!:mime  application/x-freeplane
27620
27621# Type:        Scribus
27622# From:        Werner Fink <werner@suse.de>
276230	string	\<SCRIBUSUTF8\ Version		Scribus Document
276240	string	\<SCRIBUSUTF8NEW\ Version	Scribus Document
27625!:mime	application/x-scribus
27626
27627# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
27628# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14
276290	ulelong&0x8080FFFF	0x00001204	gfxboot compiled html help file
27630
27631#------------------------------------------------------------------------------
27632# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $
27633# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
27634# Cache format extracted from source:
27635# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup
27636# Requires file >= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
27637# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011
276380		string		wsdl		PHP WSDL cache,
27639>4		byte		x		version 0x%02x
27640>6		ledate		x		\b, created %s
27641
27642# uri
27643>10		lelong		<0x7fffffff
27644>>10		pstring/l	x		\b, uri: "%s"
27645
27646# source
27647>>>&0		lelong		<0x7fffffff
27648>>>>&-4		pstring/l	x		\b, source: "%s"
27649
27650# target_ns
27651>>>>>&0		lelong		<0x7fffffff
27652>>>>>>&-4	pstring/l	x		\b, target_ns: "%s"
27653#------------------------------------------------------------------------------
27654# x68000:  file(1) magic for the Sharp Home Computer
27655# v1.0
27656# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
27657
27658# Yanagisawa PIC picture
276590	string		PIC
27660>3	search/0x200	\x1A
27661>>&0	search/0x200	\x0
27662>>>&0	ubyte		0		Yanagisawa PIC image file,
27663>>>>&0	ubyte&15	0		model: X68000,
27664>>>>&0	ubyte&15	1		model: PC-88VA,
27665>>>>&0	ubyte&15	2		model: FM-TOWNS,
27666>>>>&0	ubyte&15	3		model: MAC,
27667>>>>&0	ubyte&15	15		model: Generic,
27668>>>>&3	ubeshort	x		%dx
27669>>>>&5	ubeshort	x		\b%d,
27670>>>>&1	ubeshort	4		colors: 16
27671>>>>&1	ubeshort	8		colors: 256
27672>>>>&1	ubeshort	12		colors: 4096
27673>>>>&1	ubeshort	15		colors: 32768
27674>>>>&1	ubeshort	16		colors: 65536
27675>>>>&1	ubeshort	>16		colors: %d-bit
27676
27677
27678
27679#------------------------------------------------------------------------------
27680# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
27681# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
27682#
276830	string	%XDELTA%	XDelta binary patch file 0.14
276840	string	%XDZ000%	XDelta binary patch file 0.18
276850	string	%XDZ001%	XDelta binary patch file 0.20
276860	string	%XDZ002%	XDelta binary patch file 1.0
276870	string	%XDZ003%	XDelta binary patch file 1.0.4
276880	string	%XDZ004%	XDelta binary patch file 1.1
27689
276900	string \xD6\xC3\xC4\x00	VCDIFF binary diff
27691
27692#------------------------------------------------------------------------------
27693# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $
27694# xenix:  file(1) magic for Microsoft Xenix
27695#
27696# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
27697# model" lifted from "magic.xenix", with comment "derived empirically;
27698# treat as folklore until proven"
27699#
27700# "small model", "large model", "huge model" stuff lifted from XXX
27701#
27702# XXX - "x.out" collides with PDP-11 archives
27703#
277040	string		core		core file (Xenix)
27705# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix
27706# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
27707# Update: Joerg Jenderek
27708# recordtype~TranslatorHEADerRecord
277090	byte		0x80
27710# GRR: line above is too general as it catches also Extensible storage engine DataBase
27711# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
27712>1	uleshort	<1022
27713# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length
27714>>1	uleshort	>0
27715# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length
27716>>>3	ubyte		>0
27717# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c"
27718>>>>4	regex	[a-zA-Z_/]{1,8}[.]	8086 relocatable (Microsoft)
27719#!:mime	application/octet-stream
27720!:mime	application/x-object
27721!:ext	o/a
27722>>>>>3	pstring		x		\b, "%s"
27723# checksum
27724#>>>>>(3.b+4)	ubyte	x		\b, checksum 0x%2.2x
277250	leshort		0xff65		x.out
27726>2	string		__.SYMDEF	 randomized
27727>0	byte		x		archive
277280	leshort		0x206		Microsoft a.out
27729>8	leshort		1		Middle model
27730>0x1e	leshort		&0x10		overlay
27731>0x1e	leshort		&0x2		separate
27732>0x1e	leshort		&0x4		pure
27733>0x1e	leshort		&0x800		segmented
27734>0x1e	leshort		&0x400		standalone
27735>0x1e	leshort		&0x8		fixed-stack
27736>0x1c	byte		&0x80		byte-swapped
27737>0x1c	byte		&0x40		word-swapped
27738>0x10	lelong		>0		not-stripped
27739>0x1e	leshort		^0xc000		pre-SysV
27740>0x1e	leshort		&0x4000		V2.3
27741>0x1e	leshort		&0x8000		V3.0
27742>0x1c	byte		&0x4		86
27743>0x1c	byte		&0xb		186
27744>0x1c	byte		&0x9		286
27745>0x1c	byte		&0xa		386
27746>0x1f	byte		<0x040		small model
27747>0x1f	byte		=0x048		large model
27748>0x1f	byte		=0x049		huge model
27749>0x1e	leshort		&0x1		executable
27750>0x1e	leshort		^0x1		object file
27751>0x1e	leshort		&0x40		Large Text
27752>0x1e	leshort		&0x20		Large Data
27753>0x1e	leshort		&0x120		Huge Objects Enabled
27754>0x10	lelong		>0		not stripped
27755
277560	leshort		0x140		old Microsoft 8086 x.out
27757>0x3	byte		&0x4		separate
27758>0x3	byte		&0x2		pure
27759>0	byte		&0x1		executable
27760>0	byte		^0x1		relocatable
27761>0x14	lelong		>0		not stripped
27762
277630	lelong		0x206		b.out
27764>0x1e	leshort		&0x10		overlay
27765>0x1e	leshort		&0x2		separate
27766>0x1e	leshort		&0x4		pure
27767>0x1e	leshort		&0x800		segmented
27768>0x1e	leshort		&0x400		standalone
27769>0x1e	leshort		&0x1		executable
27770>0x1e	leshort		^0x1		object file
27771>0x1e	leshort		&0x4000		V2.3
27772>0x1e	leshort		&0x8000		V3.0
27773>0x1c	byte		&0x4		86
27774>0x1c	byte		&0xb		186
27775>0x1c	byte		&0x9		286
27776>0x1c	byte		&0x29		286
27777>0x1c	byte		&0xa		386
27778>0x1e	leshort		&0x4		Large Text
27779>0x1e	leshort		&0x2		Large Data
27780>0x1e	leshort		&0x102		Huge Objects Enabled
27781
277820	leshort		0x580		XENIX 8086 relocatable or 80286 small model
27783
27784#------------------------------------------------------------------------------
27785# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $
27786# This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
27787# Xilinx-Magic@RevRagnarok.com
27788# Got the info from FPGA-FAQ 0026
27789#
27790# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
27791# fixes at least reading of bitfiles from Spartan 2, 3, 6.
27792# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
27793#
27794# First there is the sync header and its length
277950	beshort 0x0009
27796>2 	belong	=0x0ff00ff0
27797>>&0	belong  =0x0ff00ff0
27798>>>&0	byte    =0x00
27799>>>&1   beshort =0x0001
27800>>>&3	string	a	Xilinx BIT data
27801# Next is a Pascal-style string with the NCD name. We want to capture that.
27802>>>>&0	   pstring/H	x	- from %s
27803# And then 'b'
27804>>>>>&1    string b
27805# Then the model / part number:
27806>>>>>>&0   pstring/H    x       - for %s
27807# Then 'c'
27808>>>>>>>&1 string c
27809# Then the build-date
27810>>>>>>>>&0 pstring/H    x       - built %s
27811# Then 'd'
27812>>>>>>>>>&1   string d
27813# Then the build-time
27814>>>>>>>>>>&0  pstring/H x        \b(%s)
27815# Then 'e'
27816>>>>>>>>>>>&1  string e
27817# And length of data
27818>>>>>>>>>>>>&0 belong x          - data length 0x%x
27819
27820# Raw bitstream files
278210      long    0xffffffff
27822>&0    belong  0xaa995566      Xilinx RAW bitstream (.BIN)
27823
27824#------------------------------------------------------------------------------
27825# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
27826# xo65 object files
27827# From: "Ullrich von Bassewitz" <uz@cc65.org>
27828#
278290	string		\x55\x7A\x6E\x61	xo65 object,
27830>4	leshort		x			version %d,
27831>6	leshort&0x0001 =0x0001			with debug info
27832>6	leshort&0x0001 =0x0000			no debug info
27833
27834# xo65 library files
278350	string		\x6E\x61\x55\x7A	xo65 library,
27836>4	leshort		x			version %d
27837
27838# o65 object files
278390	string		\x01\x00\x6F\x36\x35	o65
27840>6	leshort&0x1000	=0x0000			executable,
27841>6	leshort&0x1000	=0x1000			object,
27842>5	byte		x			version %d,
27843>6	leshort&0x8000	=0x8000			65816,
27844>6	leshort&0x8000	=0x0000			6502,
27845>6	leshort&0x2000	=0x2000			32 bit,
27846>6	leshort&0x2000	=0x0000			16 bit,
27847>6	leshort&0x4000	=0x4000			page reloc,
27848>6	leshort&0x4000	=0x0000			byte reloc,
27849>6	leshort&0x0003	=0x0000			alignment 1
27850>6	leshort&0x0003	=0x0001			alignment 2
27851>6	leshort&0x0003	=0x0002			alignment 4
27852>6	leshort&0x0003	=0x0003			alignment 256
27853
27854#------------------------------------------------------------------------------
27855# $File: xwindows,v 1.10 2017/03/17 21:35:28 christos Exp $
27856# xwindows:  file(1) magic for various X/Window system file formats.
27857
27858# Compiled X Keymap
27859# XKM (compiled X keymap) files (including version and byte ordering)
278601	string	mkx				Compiled XKB Keymap: lsb,
27861>0	byte	>0				version %d
27862>0	byte	=0				obsolete
278630	string	xkm				Compiled XKB Keymap: msb,
27864>3	byte	>0				version %d
27865>3	byte	=0				obsolete
27866
27867# xfsdump archive
278680	string	xFSdump0			xfsdump archive
27869>8	belong	x	(version %d)
27870
27871# Jaleo XFS files
278720	long	395726				Jaleo XFS file
27873>4	long	x				- version %d
27874>8	long	x				- [%d -
27875>20	long	x				\b%dx
27876>24	long	x				\b%dx
27877>28	long	1008				\bYUV422]
27878>28	long	1000				\bRGB24]
27879
27880# Xcursor data
27881# X11 mouse cursor format defined in libXcursor, see
27882# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
27883# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
278840	string		Xcur		Xcursor data
27885!:mime	image/x-xcursor
27886>10	leshort		x		version %d
27887>>8	leshort		x		\b.%d
27888
27889
27890#------------------------------------------------------------------------------
27891# $File: yara,v 1.2 2017/05/25 20:07:23 christos Exp $
27892# yara:  file(1) magic for http://virustotal.github.io/yara/
27893#
27894
278950	string	YARA
27896>4	lelong	>2047
27897>8	byte	<20	YARA 3.x compiled rule set
27898# version
27899>>8	clear	x
27900>>8	byte	6	created with version 3.3.0
27901>>8	byte	8	created with version 3.4.0
27902>>8	byte	11	created with version 3.5.0
27903>>8	default	x
27904>>>8	byte	x	development version 0x%02x
27905#------------------------------------------------------------------------------
27906# zfs:	file(1) magic for ZFS dumps
27907#
27908# From <rea-fbsd@codelabs.ru>
27909# ZFS dump header has the following structure (as per zfs_ioctl.h
27910# in FreeBSD with drr_type is set to DRR_BEGIN)
27911#
27912#   enum {
27913#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
27914#	DRR_WRITE, DRR_FREE, DRR_END,
27915#   } drr_type;
27916#   uint32_t drr_pad;
27917#   uint64_t drr_magic;
27918#   uint64_t drr_version;
27919#   uint64_t drr_creation_time;
27920#   dmu_objset_type_t drr_type;
27921#   uint32_t drr_pad;
27922#   uint64_t drr_toguid;
27923#   uint64_t drr_fromguid;
27924#   char drr_toname[MAXNAMELEN];
27925#
27926# Backup magic is 0x00000002f5bacbac (quad word)
27927# The drr_type is defined as
27928#   typedef enum dmu_objset_type {
27929#	  DMU_OST_NONE,
27930#	  DMU_OST_META,
27931#	  DMU_OST_ZFS,
27932#	  DMU_OST_ZVOL,
27933#	  DMU_OST_OTHER,		  /* For testing only! */
27934#	  DMU_OST_ANY,			  /* Be careful! */
27935#	  DMU_OST_NUMTYPES
27936#  } dmu_objset_type_t;
27937#
27938# Almost all uint64_t fields are printed as the 32-bit ones (with high
27939# 32 bits zeroed), because there is no simple way to print them as the
27940# full 64-bit values.
27941
27942# Big-endian values
279438	string	\000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
27944>20	belong	x	version %u,
27945>32	belong	0	type: NONE,
27946>32	belong	1	type: META,
27947>32	belong	2	type: ZFS,
27948>32	belong	3	type: ZVOL,
27949>32	belong	4	type: OTHER,
27950>32	belong	5	type: ANY,
27951>32	belong	>5	type: UNKNOWN (%u),
27952>40	byte	x	destination GUID: %02X
27953>41	byte	x	%02X
27954>42	byte	x	%02X
27955>43	byte	x	%02X
27956>44	byte	x	%02X
27957>45	byte	x	%02X
27958>46	byte	x	%02X
27959>47	byte	x	%02X,
27960>48	ulong	>0
27961>>52	ulong	>0
27962>>>48	byte	x	source GUID: %02X
27963>>>49	byte	x	%02X
27964>>>50	byte	x	%02X
27965>>>51	byte	x	%02X
27966>>>52	byte	x	%02X
27967>>>53	byte	x	%02X
27968>>>54	byte	x	%02X
27969>>>55	byte	x	%02X,
27970>56	string	>\0	name: '%s'
27971
27972# Little-endian values
279738	string	\254\313\272\365\002\000\000\000	ZFS shapshot (little-endian machine),
27974>16	lelong	x	version %u,
27975>32	lelong	0	type: NONE,
27976>32	lelong	1	type: META,
27977>32	lelong	2	type: ZFS,
27978>32	lelong	3	type: ZVOL,
27979>32	lelong	4	type: OTHER,
27980>32	lelong	5	type: ANY,
27981>32	lelong	>5	type: UNKNOWN (%u),
27982>47	byte	x	destination GUID: %02X
27983>46	byte	x	%02X
27984>45	byte	x	%02X
27985>44	byte	x	%02X
27986>43	byte	x	%02X
27987>42	byte	x	%02X
27988>41	byte	x	%02X
27989>40	byte	x	%02X,
27990>48	ulong	>0
27991>>52	ulong	>0
27992>>>55	byte	x	source GUID: %02X
27993>>>54	byte	x	%02X
27994>>>53	byte	x	%02X
27995>>>52	byte	x	%02X
27996>>>51	byte	x	%02X
27997>>>50	byte	x	%02X
27998>>>49	byte	x	%02X
27999>>>48	byte	x	%02X,
28000>56	string	>\0	name: '%s'
28001
28002#------------------------------------------------------------------------------
28003# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
28004# zilog:  file(1) magic for Zilog Z8000.
28005#
28006# Was it big-endian or little-endian?  My Product Specification doesn't
28007# say.
28008#
280090	long		0xe807		object file (z8000 a.out)
280100	long		0xe808		pure object file (z8000 a.out)
280110	long		0xe809		separate object file (z8000 a.out)
280120	long		0xe805		overlay object file (z8000 a.out)
28013#------------------------------------------------------------------------------
28014# $File: zip,v 1.1 2017/11/03 23:36:17 christos Exp $
28015# zip:  file(1) magic for zip files; this is not use
28016# Note the version of magic in archive is currently stronger, this is
28017# just an example until negative offsets are supported better
28018
28019# Zip Central Cirectory record
280200	name		zipcd
28021>0	string		PK\001\002
28022>>4	leshort		x		\b, made by
28023>>4	use		zipversion
28024>>6	leshort		x		\b, extract using at least
28025>>6	use		zipversion
28026>>12	ledate		x		\b, last modified %s
28027>>24	lelong		>0		\b, uncompressed size %d
28028>>10	leshort		x		\b, method=
28029>>10	use		zipcompression
28030
28031# Zip known compressions
280320	name		zipcompression
28033>0	leshort		0		\bstore
28034>0	leshort		8		\bdeflate
28035>0	leshort		9		\bdeflate64
28036>0	leshort		12		\bbzip2
28037>0	leshort		14		\blzma
28038>0	leshort		94		\bMP3
28039>0	leshort		95		\bxz
28040>0	leshort		96		\bJpeg
28041>0	leshort		97		\bWavPack
28042>0	leshort		98		\bPPMd
28043>0	leshort		99		\bAES Encrypted
28044>0	default		x
28045>>0	leshort		x		\b[%#x]
28046
28047# Zip known versions
280480	name		zipversion
28049>0	leshort		0x09		v0.9
28050>0	leshort		0x0a		v1.0
28051>0	leshort		0x0b		v1.1
28052>0	leshort		0x14		v2.0
28053>0	leshort		0x15		v2.1
28054>0	leshort		0x19		v2.5
28055>0	leshort		0x1b		v2.7
28056>0	leshort		0x2d		v4.5
28057>0	leshort		0x2e		v4.6
28058>0	leshort		0x32		v5.0
28059>0	leshort		0x33		v5.1
28060>0	leshort		0x34		v5.2
28061>0	leshort		0x3d		v6.1
28062>0	leshort		0x3e		v6.2
28063>0	leshort		0x3f		v6.3
28064>0	default		x
28065>>0	leshort		x		v?[%#x]
28066
28067# Zip End Of Central Directory record
28068-22	string		PK\005\006	Zip archive data
28069#>4	leshort		>1		\b, %d disks
28070#>6	leshort		>1		\b, central directory disk %d
28071#>8	leshort		>1		\b, %d central directories on this disk
28072#>10	leshort		>1		\b, %d central directories
28073#>12	lelong		x		\b, %d central directory bytes
28074>(16.l)	use		zipcd
28075>20	pstring/l	>0		\b, %s
28076
28077#------------------------------------------------------------------------------
28078# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
28079# zyxel:  file(1) magic for ZyXEL modems
28080#
28081# From <rob@pe1chl.ampr.org>
28082# These are the /etc/magic entries to decode datafiles as used for the
28083# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
28084# ZyXEL-defined standard)
28085
280860	string		ZyXEL\002	ZyXEL voice data
28087>10	byte		0		- CELP encoding
28088>10	byte&0x0B	1		- ADPCM2 encoding
28089>10	byte&0x0B	2		- ADPCM3 encoding
28090>10	byte&0x0B	3		- ADPCM4 encoding
28091>10	byte&0x0B	8		- New ADPCM3 encoding
28092>10	byte&0x04	4		with resync
28093