1# Magic data for file(1) command. 2# Format is described in magic(files), where: 3# files is 5 on V7 and BSD, 4 on SV, and ?? on SVID. 4# Don't edit this file, edit /etc/magic or send your magic improvements 5# to the maintainers, at file@astron.com 6 7#------------------------------------------------------------------------------ 8# Localstuff: file(1) magic for locally observed files 9# 10# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $ 11# Add any locally observed files here. Remember: 12# text if readable, executable if runnable binary, data if unreadable. 13 14#------------------------------------------------------------------------------ 15# $File: acorn,v 1.7 2019/04/19 00:42:27 christos Exp $ 16# acorn: file(1) magic for files found on Acorn systems 17# 18 19# RISC OS Chunk File Format 20# From RISC OS Programmer's Reference Manual, Appendix D 21# We guess the file type from the type of the first chunk. 220 lelong 0xc3cbc6c5 RISC OS Chunk data 23>12 string OBJ_ \b, AOF object 24>12 string LIB_ \b, ALF library 25 26# RISC OS AIF, contains "SWI OS_Exit" at offset 16. 2716 lelong 0xef000011 RISC OS AIF executable 28 29# RISC OS Draw files 30# From RISC OS Programmer's Reference Manual, Appendix E 310 string Draw RISC OS Draw file data 32 33# RISC OS new format font files 34# From RISC OS Programmer's Reference Manual, Appendix E 350 string FONT\0 RISC OS outline font data, 36>5 byte x version %d 370 string FONT\1 RISC OS 1bpp font data, 38>5 byte x version %d 390 string FONT\4 RISC OS 4bpp font data 40>5 byte x version %d 41 42# RISC OS Music files 43# From RISC OS Programmer's Reference Manual, Appendix E 440 string Maestro\r RISC OS music file 45>8 byte x version %d 46 47>8 byte x type %d 48 49# Digital Symphony data files 50# From: Bernard Jungen (bern8817@euphonynet.be) 510 string \x02\x01\x13\x13\x13\x01\x0d\x10 Digital Symphony sound sample (RISC OS), 52>8 byte x version %d, 53>9 pstring x named "%s", 54>(9.b+19) byte =0 8-bit logarithmic 55>(9.b+19) byte =1 LZW-compressed linear 56>(9.b+19) byte =2 8-bit linear signed 57>(9.b+19) byte =3 16-bit linear signed 58>(9.b+19) byte =4 SigmaDelta-compressed linear 59>(9.b+19) byte =5 SigmaDelta-compressed logarithmic 60>(9.b+19) byte >5 unknown format 61 620 string \x02\x01\x13\x13\x14\x12\x01\x0b Digital Symphony song (RISC OS), 63>8 byte x version %d, 64>9 byte =1 1 voice, 65>9 byte !1 %d voices, 66>10 leshort =1 1 track, 67>10 leshort !1 %d tracks, 68>12 leshort =1 1 pattern 69>12 leshort !1 %d patterns 70 710 string \x02\x01\x13\x13\x10\x14\x12\x0e 72>9 byte =0 Digital Symphony sequence (RISC OS), 73>>8 byte x version %d, 74>>10 byte =1 1 line, 75>>10 byte !1 %d lines, 76>>11 leshort =1 1 position 77>>11 leshort !1 %d positions 78>9 byte =1 Digital Symphony pattern data (RISC OS), 79>>8 byte x version %d, 80>>10 leshort =1 1 pattern 81>>10 leshort !1 %d patterns 82 83# From: Joerg Jenderek 84# URL: https://www.kyzer.me.uk/pack/xad/#PackDir 85# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c 86# GRR: line below is too general as it matches also "Git pack" in ./revision 870 string PACK\0 88# check for valid compression method 0-4 89>5 ulelong <5 90# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems 91# To skip "Git pack" version 0 test for root directory object like 92# ADFS::RPC.$.websitezip.FONTFIX 93>>9 string >ADFS\ PackDir archive (RISC OS) 94# TrID labels above as "Acorn PackDir compressed Archive" 95# compression mode y (0 - 4) for GIF LZW with a maximum n bits 96# (y~n,0~12,1~13,2~14,3~15,4~16) 97>>>5 ulelong+12 x \b, LZW %u-bits compression 98# https://www.filebase.org.uk/filetypes 99# !Packdir compressed archive has three hexadecimal digits code 68E 100!:mime application/x-acorn-68E 101!:ext pkd/bin 102# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo 103>>>9 string x \b, root "%s" 104# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time 105>>>>&1 ulelong x \b, load address 0x%x 106# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC 107>>>>&5 ulelong x \b, exec address 0x%x 108# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) 109>>>>&9 ulelong x \b, attributes 0x%x 110# number of entries in this directory. for root dir 0 111#>>>&13 ulelong x \b, entries 0x%x 112# the entries start here with object name 113>>>>&17 string x \b, 1st object "%s" 114 115 116#------------------------------------------------------------------------------ 117# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $ 118# adi: file(1) magic for ADi's objects 119# From Gregory McGarry <g.mcgarry@ieee.org> 120# 1210 leshort 0x521c COFF DSP21k 122>18 lelong &02 executable, 123>18 lelong ^02 124>>18 lelong &01 static object, 125>>18 lelong ^01 relocatable object, 126>18 lelong &010 stripped 127>18 lelong ^010 not stripped 128 129#------------------------------------------------------------------------------ 130# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $ 131# adventure: file(1) magic for Adventure game files 132# 133# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> 134# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 135# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 136# 137# ALAN 138# I assume there are other, lower versions, but these are the only ones I 139# saw in the archive. 1400 beshort 0x0206 ALAN game data 141>2 byte <10 version 2.6%d 142 143 144# Infocom (see z-machine) 145#------------------------------------------------------------------------------ 146# Z-machine: file(1) magic for Z-machine binaries. 147# Sanity checks by David Griffith <dave@661.org> 148# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 149# 150#http://www.gnelson.demon.co.uk/zspec/sect11.html 151#https://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt 152#https://en.wikipedia.org/wiki/Z-machine 153# The first byte is the Z-machine revision; it is always between 1 and 8. We 154# had false matches (for instance, inbig5.ocp from the Omega TeX extension as 155# well as an occasional MP3 file), so we sanity-check the version number. 156# 157# It might be possible to sanity-check the release number as well, as it seems 158# (at least in classic Infocom games) to always be a relatively small number, 159# always under 150 or so, but as this isn't rigorous, we'll wait on that until 160# it becomes clear that it's needed. 161# 1620 ubyte >0 163>0 ubyte <9 164>>16 belong&0xfe00f0f0 0x3030 165>>>0 ubyte < 10 166>>>>2 ubeshort x 167>>>>>18 regex [0-9][0-9][0-9][0-9][0-9][0-9] 168>>>>>>0 ubyte < 10 Infocom (Z-machine %d 169>>>>>>>2 ubeshort x \b, Release %d 170>>>>>>>>18 string >\0 \b, Serial %.6s 171>>>>>>>>18 string x \b) 172!:strength + 40 173!:mime application/x-zmachine 174 175#------------------------------------------------------------------------------ 176# Glulx: file(1) magic for Glulx binaries. 177# 178# David Griffith <dave@661.org> 179# I haven't checked for false matches yet. 180# 1810 string Glul Glulx game data 182>4 beshort x (Version %d 183>>6 byte x \b.%d 184>>8 byte x \b.%d) 185>36 string Info Compiled by Inform 186!:mime application/x-glulx 187 188 189# For Quetzal and blorb magic see iff 190 191 192# TADS (Text Adventure Development System) version 2 193# All files are machine-independent (games compile to byte-code) and are tagged 194# with a version string of the form "V2.<digit>.<digit>\0". 195# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. 1960 string TADS2\ bin TADS 197>9 belong !0x0A0D1A00 game data, CORRUPTED 198>9 belong 0x0A0D1A00 199>>13 string >\0 %s game data 200!:mime application/x-tads 201# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. 2020 string TADS2\ rsc TADS 203>9 belong !0x0A0D1A00 resource data, CORRUPTED 204>9 belong 0x0A0D1A00 205>>13 string >\0 %s resource data 206!:mime application/x-tads 207# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian 208# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), 209# "TADS2 save\n\r\032\0" and the interpreter version. 2100 string TADS2\ save/g TADS 211>12 belong !0x0A0D1A00 saved game data, CORRUPTED 212>12 belong 0x0A0D1A00 213>>(16.s+32) string >\0 %s saved game data 214!:mime application/x-tads 215# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter 216# version. 2170 string TADS2\ save TADS 218>10 belong !0x0A0D1A00 saved game data, CORRUPTED 219>10 belong 0x0A0D1A00 220>>14 string >\0 %s saved game data 221!:mime application/x-tads 222 223# TADS (Text Adventure Development System) version 3 224# Game files start with "T3-image\015\012\032" 2250 string T3-image\015\012\032 226>11 leshort x TADS 3 game data (format version %d) 227# Saved game files start with "T3-state-v####\015\012\032" 228# where #### is a format version number 2290 string T3-state-v 230>14 string \015\012\032 TADS 3 saved game data (format version 231>>10 byte x %c 232>>11 byte x \b%c 233>>12 byte x \b%c 234>>13 byte x \b%c) 235!:mime application/x-t3vm-image 236 237# edited by David Griffith <dave@661.org> 238# Danny Milosavljevic <danny.milo@gmx.net> 239# These are ADRIFT (adventure game standard) game files, extension .taf 240# Checked from source at (http://www.adrift.co/) and various taf files 241# found at the Interactive Fiction Archive (https://ifarchive.org/) 2420 belong 0x3C423FC9 243>4 belong 0x6A87C2CF Adrift game file version 244>>8 belong 0x94453661 3.80 245>>8 belong 0x94453761 3.90 246>>8 belong 0x93453E61 4.0 247>>8 belong 0x92453E61 5.0 248>>8 default x unknown 249!:mime application/x-adrift 250 251#------------------------------------------------------------------------------ 252# $File: algol68,v 1.3 2018/10/19 01:04:21 christos Exp $ 253# algol68: file(1) magic for Algol 68 source 254# 2550 search/8192 (input, Algol 68 source text 256!:mime text/x-Algol68 2570 regex/1024 \^PROC Algol 68 source text 258!:mime text/x-Algol68 2590 regex/1024 \bMODE[\t\ ] Algol 68 source text 260!:mime text/x-Algol68 2610 regex/1024 \bREF[\t\ ] Algol 68 source text 262!:mime text/x-Algol68 2630 regex/1024 \bFLEX[\t\ ]\*\\[ Algol 68 source text 264!:mime text/x-Algol68 265#0 regex [\t\ ]OD Algol 68 source text 266#!:mime text/x-Algol68 267#0 regex [\t\ ]FI Algol 68 source text 268#!:mime text/x-Algol68 269 270#------------------------------------------------------------------------------ 271# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $ 272# allegro: file(1) magic for Allegro datafiles 273# Toby Deshane <hac@shoelace.digivill.net> 274# 2750 belong 0x736C6821 Allegro datafile (packed) 2760 belong 0x736C682E Allegro datafile (not packed/autodetect) 2770 belong 0x736C682B Allegro datafile (appended exe data) 278 279#------------------------------------------------------------------------------ 280# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $ 281# alliant: file(1) magic for Alliant FX series a.out files 282# 283# If the FX series is the one that had a processor with a 68K-derived 284# instruction set, the "short" should probably become "beshort" and the 285# "long" should probably become "belong". 286# If it's the i860-based one, they should probably become either the 287# big-endian or little-endian versions, depending on the mode they ran 288# the 860 in.... 289# 2900 short 0420 0420 Alliant virtual executable 291>2 short &0x0020 common library 292>16 long >0 not stripped 2930 short 0421 0421 Alliant compact executable 294>2 short &0x0020 common library 295>16 long >0 not stripped 296 297#------------------------------------------------------------------------------ 298# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $ 299# amanda: file(1) magic for amanda file format 300# 3010 string AMANDA:\ AMANDA 302>8 string TAPESTART\ DATE tape header file, 303>>23 string X 304>>>25 string >\ Unused %s 305>>23 string >\ DATE %s 306>8 string FILE\ dump file, 307>>13 string >\ DATE %s 308 309#------------------------------------------------------------------------------ 310# $File: amigaos,v 1.17 2018/10/16 18:57:19 christos Exp $ 311# amigaos: file(1) magic for AmigaOS binary formats: 312 313# 314# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) 315# 3160 belong 0x000003fa AmigaOS shared library 3170 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 3180 belong 0x000003e7 AmigaOS object/library data 319# 3200 beshort 0xe310 Amiga Workbench 321>2 beshort 1 322>>48 byte 1 disk icon 323>>48 byte 2 drawer icon 324>>48 byte 3 tool icon 325>>48 byte 4 project icon 326>>48 byte 5 garbage icon 327>>48 byte 6 device icon 328>>48 byte 7 kickstart icon 329>>48 byte 8 workbench application icon 330>2 beshort >1 icon, vers. %d 331# 332# various sound formats from the Amiga 333# G=F6tz Waschk <waschk@informatik.uni-rostock.de> 334# 3350 string FC14 Future Composer 1.4 Module sound file 3360 string SMOD Future Composer 1.3 Module sound file 3370 string AON4artofnoise Art Of Noise Module sound file 3381 string MUGICIAN/SOFTEYES Mugician Module sound file 33958 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file 3400 string Synth4.0 Synthesis Module sound file 3410 string ARP. The Holy Noise Module sound file 3420 string BeEp\0 JamCracker Module sound file 3430 string COSO\0 Hippel-COSO Module sound file 344# Too simple (short, pure ASCII, deep), MPi 345#26 string V.3 Brian Postma's Soundmon Module sound file v3 346#26 string BPSM Brian Postma's Soundmon Module sound file v3 347#26 string V.2 Brian Postma's Soundmon Module sound file v2 348 349# The following are from: "Stefan A. Haubenthal" <polluks@web.de> 3500 beshort 0x0f00 AmigaOS bitmap font 3510 beshort 0x0f03 AmigaOS outline font 3520 belong 0x80001001 AmigaOS outline tag 3530 string ##\ version catalog translation 3540 string EMOD\0 Amiga E module 3558 string ECXM\0 ECX module 3560 string/c @database AmigaGuide file 357 358# Amiga disk types 359# 3600 string RDSK Rigid Disk Block 361>160 string x on %.24s 3620 string DOS\0 Amiga DOS disk 3630 string DOS\1 Amiga FFS disk 3640 string DOS\2 Amiga Inter DOS disk 3650 string DOS\3 Amiga Inter FFS disk 3660 string DOS\4 Amiga Fastdir DOS disk 3670 string DOS\5 Amiga Fastdir FFS disk 3680 string KICK Kickstart disk 369 370# From: Alex Beregszaszi <alex@fsn.hu> 3710 string LZX LZX compressed archive (Amiga) 372 373# From: Przemek Kramarczyk <pkramarczyk@gmail.com> 3740 string .KEY AmigaDOS script 3750 string .key AmigaDOS script 376 377# AMOS Basic file formats 378# https://www.exotica.org.uk/wiki/AMOS_file_formats 3790 string AMOS\040Basic\040 AMOS Basic source code 380>11 byte =0x56 \b, tested 381>11 byte =0x76 \b, untested 3820 string AMOS\040Pro AMOS Basic source code 383>11 byte =0x56 \b, tested 384>11 byte =0x76 \b, untested 3850 string AmSp AMOS Basic sprite bank 386>4 beshort x \b, %d sprites 3870 string AmIc AMOS Basic icon bank 388>4 beshort x \b, %d icons 3890 string AmBk AMOS Basic memory bank 390>4 beshort x \b, bank number %d 391>8 belong&0xFFFFFFF x \b, length %d 392>12 regex .{8} \b, type %s 3930 string AmBs AMOS Basic memory banks 394>4 beshort x \b, %d banks 395 396#------------------------------------------------------------ 397# $File: android,v 1.12 2019/04/19 00:42:27 christos Exp $ 398# Various android related magic entries 399#------------------------------------------------------------ 400 401# Dalvik .dex format. http://retrodev.com/android/dexformat.html 402# From <mkf@google.com> "Mike Fleming" 403# Fixed to avoid regexec 17 errors on some dex files 404# From <diff@lookout.com> "Tim Strazzere" 4050 string dex\n 406>0 regex dex\n[0-9]{2}\0 Dalvik dex file 407>4 string >000 version %s 4080 string dey\n 409>0 regex dey\n[0-9]{2}\0 Dalvik dex file (optimized for host) 410>4 string >000 version %s 411 412# Android bootimg format 413# From https://android.googlesource.com/\ 414# platform/system/core/+/master/mkbootimg/bootimg.h 4150 string ANDROID! Android bootimg 416>1024 string LOKI\01 \b, LOKI'd 417>8 lelong >0 \b, kernel 418>>12 lelong >0 \b (0x%x) 419>16 lelong >0 \b, ramdisk 420>>20 lelong >0 \b (0x%x) 421>24 lelong >0 \b, second stage 422>>28 lelong >0 \b (0x%x) 423>36 lelong >0 \b, page size: %d 424>38 string >0 \b, name: %s 425>64 string >0 \b, cmdline (%s) 426 427# Android Backup archive 428# From: Ariel Shkedi 429# Update: Joerg Jenderek 430# URL: https://github.com/android/platform_frameworks_base/blob/\ 431# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\ 432# android/server/BackupManagerService.java#L2367 433# Reference: https://sourceforge.net/projects/adbextractor/ 434# android-backup-extractor/perl/backupencrypt.pl 435# Note: only unix line feeds "\n" found 436# After the header comes a tar file 437# If compressed, the entire tar file is compressed with JAVA deflate 438# 439# Include the version number hardcoded with the magic string to avoid 440# false positives 4410 string/b ANDROID\ BACKUP\n Android Backup 442# maybe look for some more characteristics like linefeed '\n' or version 443#>16 string \n 444# No mime-type defined offically 445!:mime application/x-google-ab 446!:ext ab 447# on 2nd line version (often 1, 2 on kitkat 4.4.3+, 4 on 7.1.2) 448>15 string >\0 \b, version %s 449# "1" on 3rd line means compressed 450>17 string 0\n \b, Not-Compressed 451>17 string 1\n \b, Compressed 452# The 4th line is encryption "none" or "AES-256" 453# any string as long as it's not the word none (which is matched below) 454>19 string none\n \b, Not-Encrypted 455# look for backup content after line with encryption info 456#>>19 search/7 \n 457# data part after header for not encrypted Android Backup 458#>>>&0 ubequad x \b, content 0x%16.16llx... 459# look for zlib compressed by ./compress after message with 1 space at end 460#>>>&0 indirect x \b; contains 461# look for tar archive block by ./archive for package name manifest 462>>288 string ustar \b; contains 463>>>31 use tar-file 464# look for zip/jar archive by ./archive ./zip after message with 1 space at end 465#>>2079 search/1025/s PK\003\004 \b; contains 466#>>>&0 indirect x 467>19 string !none 468>>19 regex/1l \^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).* \b, Encrypted (%s) 469# Commented out because they don't seem useful to print 470# (but they are part of the header - the tar file comes after them): 471# The 5th line is User Password Salt (128 Hex) 472# string length too high with standard src configuration 473#>>>&1 string >\0 \b, PASSWORD salt: "%-128.128s" 474#>>>&1 regex/1l .* \b, Password salt: %s 475# The 6th line is Master Key Checksum Salt (128 Hex) 476#>>>>&1 regex/1l .* \b, Master salt: %s 477# The 7th line is Number of PBDKF2 Rounds (10000) 478#>>>>>&1 regex/1l .* \b, PBKDF2 rounds: %s 479# The 8th line is User key Initialization Vector (IV) (32 Hex) 480#>>>>>>&1 regex/1l .* \b, IV: %s 481#>>>>>>&1 regex/1l .* \b, IV: %s 482# The 9th line is Master IV+Key+Checksum (192 Hex) 483#>>>>>>>&1 regex/1l .* \b, Key: %s 484# look for new line separator char after line number 9 485#>>>0x204 ubyte 0x0a NL found 486#>>>>&1 ubequad x \b, Content magic %16.16llx 487 488# *.pit files by Joerg Jenderek 489# https://forum.xda-developers.com/showthread.php?p=9122369 490# https://forum.xda-developers.com/showthread.php?t=816449 491# Partition Information Table for Samsung's smartphone with Android 492# used by flash software Odin 4930 ulelong 0x12349876 494# 1st pit entry marker 495>0x01C ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 496# minimal 13 and maximal 18 PIT entries found 497>>4 ulelong <128 Partition Information Table for Samsung smartphone 498>>>4 ulelong x \b, %d entries 499# 1. pit entry 500>>>4 ulelong >0 \b; #1 501>>>0x01C use PIT-entry 502>>>4 ulelong >1 \b; #2 503>>>0x0A0 use PIT-entry 504>>>4 ulelong >2 \b; #3 505>>>0x124 use PIT-entry 506>>>4 ulelong >3 \b; #4 507>>>0x1A8 use PIT-entry 508>>>4 ulelong >4 \b; #5 509>>>0x22C use PIT-entry 510>>>4 ulelong >5 \b; #6 511>>>0x2B0 use PIT-entry 512>>>4 ulelong >6 \b; #7 513>>>0x334 use PIT-entry 514>>>4 ulelong >7 \b; #8 515>>>0x3B8 use PIT-entry 516>>>4 ulelong >8 \b; #9 517>>>0x43C use PIT-entry 518>>>4 ulelong >9 \b; #10 519>>>0x4C0 use PIT-entry 520>>>4 ulelong >10 \b; #11 521>>>0x544 use PIT-entry 522>>>4 ulelong >11 \b; #12 523>>>0x5C8 use PIT-entry 524>>>4 ulelong >12 \b; #13 525>>>>0x64C use PIT-entry 526# 14. pit entry 527>>>4 ulelong >13 \b; #14 528>>>>0x6D0 use PIT-entry 529>>>4 ulelong >14 \b; #15 530>>>0x754 use PIT-entry 531>>>4 ulelong >15 \b; #16 532>>>0x7D8 use PIT-entry 533>>>4 ulelong >16 \b; #17 534>>>0x85C use PIT-entry 535# 18. pit entry 536>>>4 ulelong >17 \b; #18 537>>>0x8E0 use PIT-entry 538 5390 name PIT-entry 540# garbage value implies end of pit entries 541>0x00 ulequad&0xFFFFFFFCFFFFFFFC =0x0000000000000000 542# skip empty partition name 543>>0x24 ubyte !0 544# partition name 545>>>0x24 string >\0 %-.32s 546# flags 547>>>0x0C ulelong&0x00000002 2 \b+RW 548# partition ID: 549# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER 550# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW 551>>>0x08 ulelong x (0x%x) 552# filename 553>>>0x44 string >\0 "%-.64s" 554#>>>0x18 ulelong >0 555# blocksize in 512 byte units ? 556#>>>>0x18 ulelong x \b, %db 557# partition size in blocks ? 558#>>>>0x22 ulelong x \b*%d 559 560# Android sparse img format 561# From https://android.googlesource.com/\ 562# platform/system/core/+/master/libsparse/sparse_format.h 5630 lelong 0xed26ff3a Android sparse image 564>4 leshort x \b, version: %d 565>6 leshort x \b.%d 566>16 lelong x \b, Total of %d 567>12 lelong x \b %d-byte output blocks in 568>20 lelong x \b %d input chunks. 569 570# Android binary XML magic 571# In include/androidfw/ResourceTypes.h: 572# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header), 573# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size). 5740 lelong 0x00080003 Android binary XML 575 576#------------------------------------------------------------------------------ 577# $File: animation,v 1.71 2019/04/19 00:42:27 christos Exp $ 578# animation: file(1) magic for animation/movie formats 579# 580# animation formats 581# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 582# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 583 584# SGI and Apple formats 5850 string MOVI Silicon Graphics movie file 586!:mime video/x-sgi-movie 5874 string moov Apple QuickTime 588!:mime video/quicktime 589>12 string mvhd \b movie (fast start) 590>12 string mdra \b URL 591>12 string cmov \b movie (fast start, compressed header) 592>12 string rmra \b multiple URLs 5934 string mdat Apple QuickTime movie (unoptimized) 594!:mime video/quicktime 595#4 string wide Apple QuickTime movie (unoptimized) 596#!:mime video/quicktime 597#4 string skip Apple QuickTime movie (modified) 598#!:mime video/quicktime 599#4 string free Apple QuickTime movie (modified) 600#!:mime video/quicktime 6014 string idsc Apple QuickTime image (fast start) 602!:mime image/x-quicktime 603#4 string idat Apple QuickTime image (unoptimized) 604#!:mime image/x-quicktime 6054 string pckg Apple QuickTime compressed archive 606!:mime application/x-quicktime-player 6074 string/W jP JPEG 2000 image 608!:mime image/jp2 609# https://www.ftyps.com/ with local additions 6104 string ftyp ISO Media 611# https://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/ 612>8 string XAVC \b, MPEG v4 system, Sony XAVC Codec 613>>96 string x \b, Audio "%.4s" 614>>118 beshort x at %dHz 615>>140 string x \b, Video "%.4s" 616>>168 beshort x %d 617>>170 beshort x \bx%d 618>8 string 3g2 \b, MPEG v4 system, 3GPP2 619!:mime video/3gpp2 620>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) 621>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) 622>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) 623# https://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf 624# Section 8.1.1, corresponds to a, b, c 625>>11 byte 0x61 \b C.S0050-0 V1.0 626>>11 byte 0x62 \b C.S0050-0-A V1.0.0 627>>11 byte 0x63 \b C.S0050-0-B V1.0 628>8 string 3ge \b, MPEG v4 system, 3GPP 629!:mime video/3gpp 630>>11 byte 6 \b, Release 6 MBMS Extended Presentations 631>>11 byte 7 \b, Release 7 MBMS Extended Presentations 632>8 string 3gg \b, MPEG v4 system, 3GPP 633!:mime video/3gpp 634>>11 byte 6 \b, Release 6 General Profile 635>8 string 3gp \b, MPEG v4 system, 3GPP 636!:mime video/3gpp 637>>11 byte 1 \b, Release %d (non existent) 638>>11 byte 2 \b, Release %d (non existent) 639>>11 byte 3 \b, Release %d (non existent) 640>>11 byte 4 \b, Release %d 641>>11 byte 5 \b, Release %d 642>>11 byte 6 \b, Release %d 643>>11 byte 7 \b, Release %d Streaming Servers 644>8 string 3gs \b, MPEG v4 system, 3GPP 645!:mime video/3gpp 646>>11 byte 7 \b, Release %d Streaming Servers 647>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005] 648!:mime video/mp4 649>8 string/W qt \b, Apple QuickTime movie 650!:mime video/quicktime 651>8 string CAEP \b, Canon Digital Camera 652>8 string caqv \b, Casio Digital Camera 653>8 string CDes \b, Convergent Design 654>8 string da0a \b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG 655>8 string da0b \b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP 656>8 string da1a \b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images 657>8 string da1b \b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP 658>8 string da2a \b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG 659>8 string da2b \b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP 660>8 string da3a \b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images 661>8 string da3b \b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP 662>8 string dash \b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP 663!:mime video/mp4 664>8 string dmb1 \b, DMB MAF supporting all the components defined in the spec 665>8 string dmpf \b, Digital Media Project 666>8 string drc1 \b, Dirac (wavelet compression), encap in ISO base media (MP4) 667>8 string dv1a \b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS 668>8 string dv1b \b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP 669>8 string dv2a \b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS 670>8 string dv2b \b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP 671>8 string dv3a \b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS 672>8 string dv3b \b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP 673>8 string dvr1 \b, DVB (.DVB) over RTP 674!:mime video/vnd.dvb.file 675>8 string dvt1 \b, DVB (.DVB) over MPEG-2 Transport Stream 676!:mime video/vnd.dvb.file 677>8 string F4V \b, Video for Adobe Flash Player 9+ (.F4V) 678!:mime video/mp4 679>8 string F4P \b, Protected Video for Adobe Flash Player 9+ (.F4P) 680!:mime video/mp4 681>8 string F4A \b, Audio for Adobe Flash Player 9+ (.F4A) 682!:mime audio/mp4 683>8 string F4B \b, Audio Book for Adobe Flash Player 9+ (.F4B) 684!:mime audio/mp4 685>8 string isc2 \b, ISMACryp 2.0 Encrypted File 686# ?/enc-isoff-generic 687>8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005] 688!:mime video/mp4 689>8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003] 690!:mime video/mp4 691>8 string/W jp2 \b, JPEG 2000 692!:mime image/jp2 693>8 string JP2 \b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?] 694!:mime image/jp2 695>8 string JP20 \b, Unknown, from GPAC samples (prob non-existent) 696>8 string jpm \b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6] 697!:mime image/jpm 698>8 string jpx \b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2] 699!:mime image/jpx 700>8 string KDDI \b, 3GPP2 EZmovie for KDDI 3G cellphones 701!:mime video/3gpp2 702>8 string M4A \b, Apple iTunes ALAC/AAC-LC (.M4A) Audio 703!:mime audio/x-m4a 704>8 string M4B \b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book 705!:mime audio/mp4 706>8 string M4P \b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio 707!:mime video/mp4 708>8 string M4V \b, Apple iTunes Video (.M4V) Video 709!:mime video/x-m4v 710>8 string M4VH \b, Apple TV (.M4V) 711!:mime video/x-m4v 712>8 string M4VP \b, Apple iPhone (.M4V) 713!:mime video/x-m4v 714>8 string mj2s \b, Motion JPEG 2000 [ISO 15444-3] Simple Profile 715!:mime video/mj2 716>8 string mjp2 \b, Motion JPEG 2000 [ISO 15444-3] General Profile 717!:mime video/mj2 718>8 string mmp4 \b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT) 719!:mime video/mp4 720>8 string mobi \b, MPEG-4, MOBI format 721!:mime video/mp4 722>8 string mp21 \b, MPEG-21 [ISO/IEC 21000-9] 723>8 string mp41 \b, MP4 v1 [ISO 14496-1:ch13] 724!:mime video/mp4 725>8 string mp42 \b, MP4 v2 [ISO 14496-14] 726!:mime video/mp4 727>8 string mp71 \b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12] 728>8 string mp7t \b, MPEG v4 system, MPEG v7 XML 729>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML 730>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile 731!:mime video/mp4 732>8 string MPPI \b, Photo Player, MAF [ISO/IEC 23000-3] 733>8 string mqt \b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830 734!:mime video/quicktime 735>8 string MSNV \b, MPEG-4 (.MP4) for SonyPSP 736!:mime audio/mp4 737>8 string NDAS \b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio 738!:mime audio/mp4 739>8 string NDSC \b, MPEG-4 (.MP4) Nero Cinema Profile 740!:mime video/mp4 741>8 string NDSH \b, MPEG-4 (.MP4) Nero HDTV Profile 742!:mime video/mp4 743>8 string NDSM \b, MPEG-4 (.MP4) Nero Mobile Profile 744!:mime video/mp4 745>8 string NDSP \b, MPEG-4 (.MP4) Nero Portable Profile 746!:mime video/mp4 747>8 string NDSS \b, MPEG-4 (.MP4) Nero Standard Profile 748!:mime video/mp4 749>8 string NDXC \b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile 750!:mime video/mp4 751>8 string NDXH \b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile 752!:mime video/mp4 753>8 string NDXM \b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile 754!:mime video/mp4 755>8 string NDXP \b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile 756!:mime video/mp4 757>8 string NDXS \b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile 758!:mime video/mp4 759>8 string odcf \b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A) 760>8 string opf2 \b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C) 761>8 string opx2 \b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C) 762>8 string pana \b, Panasonic Digital Camera 763>8 string qt \b, Apple QuickTime (.MOV/QT) 764!:mime video/quicktime 765# HEIF image format 766# see https://nokiatech.github.io/heif/technical.html 767>8 string mif1 \b, HEIF Image 768!:mime image/heif 769>8 string msf1 \b, HEIF Image Sequence 770!:mime image/heif-sequence 771>8 string heic \b, HEIF Image HEVC Main or Main Still Picture Profile 772!:mime image/heic 773>8 string heix \b, HEIF Image HEVC Main 10 Profile 774!:mime image/heic 775>8 string hevc \b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile 776!:mime image/heic-sequence 777>8 string hevx \b, HEIF Image Sequence HEVC Main 10 Profile 778!:mime image/heic-sequence 779# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017) 780# but used in the reference implementation: 781# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp 782>8 string heim \b, HEIF Image L-HEVC 783!:mime image/heif 784>8 string heis \b, HEIF Image L-HEVC 785!:mime image/heif 786>8 string avic \b, HEIF Image AVC 787!:mime image/heif 788>8 string hevm \b, HEIF Image Sequence L-HEVC 789!:mime image/heif-sequence 790>8 string hevs \b, HEIF Image Sequence L-HEVC 791!:mime image/heif-sequence 792>8 string avcs \b, HEIF Image Sequence AVC 793!:mime image/heif-sequence 794 795>8 string ROSS \b, Ross Video 796>8 string sdv \b, SD Memory Card Video 797>8 string ssc1 \b, Samsung stereo, single stream (patent pending) 798>8 string ssc2 \b, Samsung stereo, dual stream (patent pending) 799 800# MPEG sequences 801# Scans for all common MPEG header start codes 8020 belong 0x00000001 803>4 byte&0x1F 0x07 JVT NAL sequence, H.264 video 804>>5 byte 66 \b, baseline 805>>5 byte 77 \b, main 806>>5 byte 88 \b, extended 807>>7 byte x \b @ L %u 8080 belong&0xFFFFFF00 0x00000100 809>3 byte 0xBA MPEG sequence 810!:mime video/mpeg 811>>4 byte &0x40 \b, v2, program multiplex 812>>4 byte ^0x40 \b, v1, system multiplex 813>3 byte 0xBB MPEG sequence, v1/2, multiplex (missing pack header) 814>3 byte&0x1F 0x07 MPEG sequence, H.264 video 815>>4 byte 66 \b, baseline 816>>4 byte 77 \b, main 817>>4 byte 88 \b, extended 818>>6 byte x \b @ L %u 819# GRR too general as it catches also FoxPro Memo example NG.FPT 820>3 byte 0xB0 MPEG sequence, v4 821# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000 822#>>4 byte !0 MPEG sequence, v4 823!:mime video/mpeg4-generic 824>>5 belong 0x000001B5 825>>>9 byte &0x80 826>>>>10 byte&0xF0 16 \b, video 827>>>>10 byte&0xF0 32 \b, still texture 828>>>>10 byte&0xF0 48 \b, mesh 829>>>>10 byte&0xF0 64 \b, face 830>>>9 byte&0xF8 8 \b, video 831>>>9 byte&0xF8 16 \b, still texture 832>>>9 byte&0xF8 24 \b, mesh 833>>>9 byte&0xF8 32 \b, face 834>>4 byte 1 \b, simple @ L1 835>>4 byte 2 \b, simple @ L2 836>>4 byte 3 \b, simple @ L3 837>>4 byte 4 \b, simple @ L0 838>>4 byte 17 \b, simple scalable @ L1 839>>4 byte 18 \b, simple scalable @ L2 840>>4 byte 33 \b, core @ L1 841>>4 byte 34 \b, core @ L2 842>>4 byte 50 \b, main @ L2 843>>4 byte 51 \b, main @ L3 844>>4 byte 53 \b, main @ L4 845>>4 byte 66 \b, n-bit @ L2 846>>4 byte 81 \b, scalable texture @ L1 847>>4 byte 97 \b, simple face animation @ L1 848>>4 byte 98 \b, simple face animation @ L2 849>>4 byte 99 \b, simple face basic animation @ L1 850>>4 byte 100 \b, simple face basic animation @ L2 851>>4 byte 113 \b, basic animation text @ L1 852>>4 byte 114 \b, basic animation text @ L2 853>>4 byte 129 \b, hybrid @ L1 854>>4 byte 130 \b, hybrid @ L2 855>>4 byte 145 \b, advanced RT simple @ L! 856>>4 byte 146 \b, advanced RT simple @ L2 857>>4 byte 147 \b, advanced RT simple @ L3 858>>4 byte 148 \b, advanced RT simple @ L4 859>>4 byte 161 \b, core scalable @ L1 860>>4 byte 162 \b, core scalable @ L2 861>>4 byte 163 \b, core scalable @ L3 862>>4 byte 177 \b, advanced coding efficiency @ L1 863>>4 byte 178 \b, advanced coding efficiency @ L2 864>>4 byte 179 \b, advanced coding efficiency @ L3 865>>4 byte 180 \b, advanced coding efficiency @ L4 866>>4 byte 193 \b, advanced core @ L1 867>>4 byte 194 \b, advanced core @ L2 868>>4 byte 209 \b, advanced scalable texture @ L1 869>>4 byte 210 \b, advanced scalable texture @ L2 870>>4 byte 211 \b, advanced scalable texture @ L3 871>>4 byte 225 \b, simple studio @ L1 872>>4 byte 226 \b, simple studio @ L2 873>>4 byte 227 \b, simple studio @ L3 874>>4 byte 228 \b, simple studio @ L4 875>>4 byte 229 \b, core studio @ L1 876>>4 byte 230 \b, core studio @ L2 877>>4 byte 231 \b, core studio @ L3 878>>4 byte 232 \b, core studio @ L4 879>>4 byte 240 \b, advanced simple @ L0 880>>4 byte 241 \b, advanced simple @ L1 881>>4 byte 242 \b, advanced simple @ L2 882>>4 byte 243 \b, advanced simple @ L3 883>>4 byte 244 \b, advanced simple @ L4 884>>4 byte 245 \b, advanced simple @ L5 885>>4 byte 247 \b, advanced simple @ L3b 886>>4 byte 248 \b, FGS @ L0 887>>4 byte 249 \b, FGS @ L1 888>>4 byte 250 \b, FGS @ L2 889>>4 byte 251 \b, FGS @ L3 890>>4 byte 252 \b, FGS @ L4 891>>4 byte 253 \b, FGS @ L5 892>3 byte 0xB5 MPEG sequence, v4 893!:mime video/mpeg4-generic 894>>4 byte &0x80 895>>>5 byte&0xF0 16 \b, video (missing profile header) 896>>>5 byte&0xF0 32 \b, still texture (missing profile header) 897>>>5 byte&0xF0 48 \b, mesh (missing profile header) 898>>>5 byte&0xF0 64 \b, face (missing profile header) 899>>4 byte&0xF8 8 \b, video (missing profile header) 900>>4 byte&0xF8 16 \b, still texture (missing profile header) 901>>4 byte&0xF8 24 \b, mesh (missing profile header) 902>>4 byte&0xF8 32 \b, face (missing profile header) 903>3 byte 0xB3 MPEG sequence 904!:mime video/mpeg 905>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 906>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 907>>12 belong 0x000001B5 \b, v2, 908>>>16 byte&0x0F 1 \b HP 909>>>16 byte&0x0F 2 \b Spt 910>>>16 byte&0x0F 3 \b SNR 911>>>16 byte&0x0F 4 \b MP 912>>>16 byte&0x0F 5 \b SP 913>>>17 byte&0xF0 64 \b@HL 914>>>17 byte&0xF0 96 \b@H-14 915>>>17 byte&0xF0 128 \b@ML 916>>>17 byte&0xF0 160 \b@LL 917>>>17 byte &0x08 \b progressive 918>>>17 byte ^0x08 \b interlaced 919>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video 920>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video 921>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video 922>>11 byte &0x02 923>>>75 byte &0x01 924>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 925>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 926>>>>140 belong 0x000001B5 \b, v2, 927>>>>>144 byte&0x0F 1 \b HP 928>>>>>144 byte&0x0F 2 \b Spt 929>>>>>144 byte&0x0F 3 \b SNR 930>>>>>144 byte&0x0F 4 \b MP 931>>>>>144 byte&0x0F 5 \b SP 932>>>>>145 byte&0xF0 64 \b@HL 933>>>>>145 byte&0xF0 96 \b@H-14 934>>>>>145 byte&0xF0 128 \b@ML 935>>>>>145 byte&0xF0 160 \b@LL 936>>>>>145 byte &0x08 \b progressive 937>>>>>145 byte ^0x08 \b interlaced 938>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video 939>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video 940>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video 941>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video 942>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video 943>>76 belong 0x000001B5 \b, v2, 944>>>80 byte&0x0F 1 \b HP 945>>>80 byte&0x0F 2 \b Spt 946>>>80 byte&0x0F 3 \b SNR 947>>>80 byte&0x0F 4 \b MP 948>>>80 byte&0x0F 5 \b SP 949>>>81 byte&0xF0 64 \b@HL 950>>>81 byte&0xF0 96 \b@H-14 951>>>81 byte&0xF0 128 \b@ML 952>>>81 byte&0xF0 160 \b@LL 953>>>81 byte &0x08 \b progressive 954>>>81 byte ^0x08 \b interlaced 955>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video 956>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video 957>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video 958>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P 959>>>7 byte&0xF0 0x10 \b, 16:9 960>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I 961>>>7 byte&0xF0 0x10 \b, 16:9 962>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture 963>>>7 byte&0xF0 0x10 \b, 4:3 964>>4 beshort&0xFFF0 0x2C00 \b, 4CIF 965>>>5 beshort&0x0FFF 0x01E0 \b NTSC 966>>>5 beshort&0x0FFF 0x0240 \b PAL 967>>>7 byte&0xF0 0x20 \b, 4:3 968>>>7 byte&0xF0 0x30 \b, 16:9 969>>>7 byte&0xF0 0x40 \b, 11:5 970>>>7 byte&0xF0 0x80 \b, PAL 4:3 971>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 972>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P 973>>>7 byte&0xF0 0x10 \b, 4:3 974>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 975>>>7 byte&0xF0 0x10 \b, 4:3 976>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 977>>>7 byte&0xF0 0x10 \b, 4:3 978>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 979>>>7 byte&0xF0 0x10 \b, 4:3 980>>4 beshort&0xFFF0 0x1600 \b, CIF 981>>>5 beshort&0x0FFF 0x00F0 \b NTSC 982>>>5 beshort&0x0FFF 0x0120 \b PAL 983>>>7 byte&0xF0 0x20 \b, 4:3 984>>>7 byte&0xF0 0x30 \b, 16:9 985>>>7 byte&0xF0 0x40 \b, 11:5 986>>>7 byte&0xF0 0x80 \b, PAL 4:3 987>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 988>>>5 beshort&0x0FFF 0x0240 \b PAL 625 989>>>>7 byte&0xF0 0x20 \b, 4:3 990>>>>7 byte&0xF0 0x30 \b, 16:9 991>>>>7 byte&0xF0 0x40 \b, 11:5 992>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU 993>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 994>>>5 beshort&0x0FFF 0x0240 \b PAL 625 995>>>7 byte&0xF0 0x20 \b, 4:3 996>>>7 byte&0xF0 0x30 \b, 16:9 997>>>7 byte&0xF0 0x40 \b, 11:5 998>>4 beshort&0xFFF0 0x1E00 \b, SVCD 999>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 1000>>>5 beshort&0x0FFF 0x0240 \b PAL 625 1001>>>7 byte&0xF0 0x20 \b, 4:3 1002>>>7 byte&0xF0 0x30 \b, 16:9 1003>>>7 byte&0xF0 0x40 \b, 11:5 1004>>7 byte&0x0F 1 \b, 23.976 fps 1005>>7 byte&0x0F 2 \b, 24 fps 1006>>7 byte&0x0F 3 \b, 25 fps 1007>>7 byte&0x0F 4 \b, 29.97 fps 1008>>7 byte&0x0F 5 \b, 30 fps 1009>>7 byte&0x0F 6 \b, 50 fps 1010>>7 byte&0x0F 7 \b, 59.94 fps 1011>>7 byte&0x0F 8 \b, 60 fps 1012>>11 byte &0x04 \b, Constrained 1013 1014# MPEG ADTS Audio (*.mpx/mxa/aac) 1015# from dreesen@math.fu-berlin.de 1016# modified to fully support MPEG ADTS 1017 1018# MP3, M1A 1019# modified by Joerg Jenderek 1020# GRR the original test are too common for many DOS files 1021# so don't accept as MP3 until we've tested the rate 10220 beshort&0xFFFE 0xFFFA 1023# rates 1024>2 byte&0xF0 0x10 MPEG ADTS, layer III, v1, 32 kbps 1025!:mime audio/mpeg 1026>2 byte&0xF0 0x20 MPEG ADTS, layer III, v1, 40 kbps 1027!:mime audio/mpeg 1028>2 byte&0xF0 0x30 MPEG ADTS, layer III, v1, 48 kbps 1029!:mime audio/mpeg 1030>2 byte&0xF0 0x40 MPEG ADTS, layer III, v1, 56 kbps 1031!:mime audio/mpeg 1032>2 byte&0xF0 0x50 MPEG ADTS, layer III, v1, 64 kbps 1033!:mime audio/mpeg 1034>2 byte&0xF0 0x60 MPEG ADTS, layer III, v1, 80 kbps 1035!:mime audio/mpeg 1036>2 byte&0xF0 0x70 MPEG ADTS, layer III, v1, 96 kbps 1037!:mime audio/mpeg 1038>2 byte&0xF0 0x80 MPEG ADTS, layer III, v1, 112 kbps 1039!:mime audio/mpeg 1040>2 byte&0xF0 0x90 MPEG ADTS, layer III, v1, 128 kbps 1041!:mime audio/mpeg 1042>2 byte&0xF0 0xA0 MPEG ADTS, layer III, v1, 160 kbps 1043!:mime audio/mpeg 1044>2 byte&0xF0 0xB0 MPEG ADTS, layer III, v1, 192 kbps 1045!:mime audio/mpeg 1046>2 byte&0xF0 0xC0 MPEG ADTS, layer III, v1, 224 kbps 1047!:mime audio/mpeg 1048>2 byte&0xF0 0xD0 MPEG ADTS, layer III, v1, 256 kbps 1049!:mime audio/mpeg 1050>2 byte&0xF0 0xE0 MPEG ADTS, layer III, v1, 320 kbps 1051!:mime audio/mpeg 1052# timing 1053>2 byte&0x0C 0x00 \b, 44.1 kHz 1054>2 byte&0x0C 0x04 \b, 48 kHz 1055>2 byte&0x0C 0x08 \b, 32 kHz 1056# channels/options 1057>3 byte&0xC0 0x00 \b, Stereo 1058>3 byte&0xC0 0x40 \b, JntStereo 1059>3 byte&0xC0 0x80 \b, 2x Monaural 1060>3 byte&0xC0 0xC0 \b, Monaural 1061#>1 byte ^0x01 \b, Data Verify 1062#>2 byte &0x02 \b, Packet Pad 1063#>2 byte &0x01 \b, Custom Flag 1064#>3 byte &0x08 \b, Copyrighted 1065#>3 byte &0x04 \b, Original Source 1066#>3 byte&0x03 1 \b, NR: 50/15 ms 1067#>3 byte&0x03 3 \b, NR: CCIT J.17 1068 1069# MP2, M1A 10700 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 1071!:mime audio/mpeg 1072# rates 1073>2 byte&0xF0 0x10 \b, 32 kbps 1074>2 byte&0xF0 0x20 \b, 48 kbps 1075>2 byte&0xF0 0x30 \b, 56 kbps 1076>2 byte&0xF0 0x40 \b, 64 kbps 1077>2 byte&0xF0 0x50 \b, 80 kbps 1078>2 byte&0xF0 0x60 \b, 96 kbps 1079>2 byte&0xF0 0x70 \b, 112 kbps 1080>2 byte&0xF0 0x80 \b, 128 kbps 1081>2 byte&0xF0 0x90 \b, 160 kbps 1082>2 byte&0xF0 0xA0 \b, 192 kbps 1083>2 byte&0xF0 0xB0 \b, 224 kbps 1084>2 byte&0xF0 0xC0 \b, 256 kbps 1085>2 byte&0xF0 0xD0 \b, 320 kbps 1086>2 byte&0xF0 0xE0 \b, 384 kbps 1087# timing 1088>2 byte&0x0C 0x00 \b, 44.1 kHz 1089>2 byte&0x0C 0x04 \b, 48 kHz 1090>2 byte&0x0C 0x08 \b, 32 kHz 1091# channels/options 1092>3 byte&0xC0 0x00 \b, Stereo 1093>3 byte&0xC0 0x40 \b, JntStereo 1094>3 byte&0xC0 0x80 \b, 2x Monaural 1095>3 byte&0xC0 0xC0 \b, Monaural 1096#>1 byte ^0x01 \b, Data Verify 1097#>2 byte &0x02 \b, Packet Pad 1098#>2 byte &0x01 \b, Custom Flag 1099#>3 byte &0x08 \b, Copyrighted 1100#>3 byte &0x04 \b, Original Source 1101#>3 byte&0x03 1 \b, NR: 50/15 ms 1102#>3 byte&0x03 3 \b, NR: CCIT J.17 1103 1104# MPA, M1A 1105# updated by Joerg Jenderek 1106# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 1107# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE) 1108# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries 1109#0 beshort&0xFFFE 0xFFFE 1110#>2 ubyte&0xF0 >0x0F 1111#>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 1112## rate 1113#>>>2 byte&0xF0 0x10 \b, 32 kbps 1114#>>>2 byte&0xF0 0x20 \b, 64 kbps 1115#>>>2 byte&0xF0 0x30 \b, 96 kbps 1116#>>>2 byte&0xF0 0x40 \b, 128 kbps 1117#>>>2 byte&0xF0 0x50 \b, 160 kbps 1118#>>>2 byte&0xF0 0x60 \b, 192 kbps 1119#>>>2 byte&0xF0 0x70 \b, 224 kbps 1120#>>>2 byte&0xF0 0x80 \b, 256 kbps 1121#>>>2 byte&0xF0 0x90 \b, 288 kbps 1122#>>>2 byte&0xF0 0xA0 \b, 320 kbps 1123#>>>2 byte&0xF0 0xB0 \b, 352 kbps 1124#>>>2 byte&0xF0 0xC0 \b, 384 kbps 1125#>>>2 byte&0xF0 0xD0 \b, 416 kbps 1126#>>>2 byte&0xF0 0xE0 \b, 448 kbps 1127## timing 1128#>>>2 byte&0x0C 0x00 \b, 44.1 kHz 1129#>>>2 byte&0x0C 0x04 \b, 48 kHz 1130#>>>2 byte&0x0C 0x08 \b, 32 kHz 1131## channels/options 1132#>>>3 byte&0xC0 0x00 \b, Stereo 1133#>>>3 byte&0xC0 0x40 \b, JntStereo 1134#>>>3 byte&0xC0 0x80 \b, 2x Monaural 1135#>>>3 byte&0xC0 0xC0 \b, Monaural 1136##>1 byte ^0x01 \b, Data Verify 1137##>2 byte &0x02 \b, Packet Pad 1138##>2 byte &0x01 \b, Custom Flag 1139##>3 byte &0x08 \b, Copyrighted 1140##>3 byte &0x04 \b, Original Source 1141##>3 byte&0x03 1 \b, NR: 50/15 ms 1142##>3 byte&0x03 3 \b, NR: CCIT J.17 1143 1144# MP3, M2A 11450 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 1146!:mime audio/mpeg 1147# rate 1148>2 byte&0xF0 0x10 \b, 8 kbps 1149>2 byte&0xF0 0x20 \b, 16 kbps 1150>2 byte&0xF0 0x30 \b, 24 kbps 1151>2 byte&0xF0 0x40 \b, 32 kbps 1152>2 byte&0xF0 0x50 \b, 40 kbps 1153>2 byte&0xF0 0x60 \b, 48 kbps 1154>2 byte&0xF0 0x70 \b, 56 kbps 1155>2 byte&0xF0 0x80 \b, 64 kbps 1156>2 byte&0xF0 0x90 \b, 80 kbps 1157>2 byte&0xF0 0xA0 \b, 96 kbps 1158>2 byte&0xF0 0xB0 \b, 112 kbps 1159>2 byte&0xF0 0xC0 \b, 128 kbps 1160>2 byte&0xF0 0xD0 \b, 144 kbps 1161>2 byte&0xF0 0xE0 \b, 160 kbps 1162# timing 1163>2 byte&0x0C 0x00 \b, 22.05 kHz 1164>2 byte&0x0C 0x04 \b, 24 kHz 1165>2 byte&0x0C 0x08 \b, 16 kHz 1166# channels/options 1167>3 byte&0xC0 0x00 \b, Stereo 1168>3 byte&0xC0 0x40 \b, JntStereo 1169>3 byte&0xC0 0x80 \b, 2x Monaural 1170>3 byte&0xC0 0xC0 \b, Monaural 1171#>1 byte ^0x01 \b, Data Verify 1172#>2 byte &0x02 \b, Packet Pad 1173#>2 byte &0x01 \b, Custom Flag 1174#>3 byte &0x08 \b, Copyrighted 1175#>3 byte &0x04 \b, Original Source 1176#>3 byte&0x03 1 \b, NR: 50/15 ms 1177#>3 byte&0x03 3 \b, NR: CCIT J.17 1178 1179# MP2, M2A 11800 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 1181!:mime audio/mpeg 1182# rate 1183>2 byte&0xF0 0x10 \b, 8 kbps 1184>2 byte&0xF0 0x20 \b, 16 kbps 1185>2 byte&0xF0 0x30 \b, 24 kbps 1186>2 byte&0xF0 0x40 \b, 32 kbps 1187>2 byte&0xF0 0x50 \b, 40 kbps 1188>2 byte&0xF0 0x60 \b, 48 kbps 1189>2 byte&0xF0 0x70 \b, 56 kbps 1190>2 byte&0xF0 0x80 \b, 64 kbps 1191>2 byte&0xF0 0x90 \b, 80 kbps 1192>2 byte&0xF0 0xA0 \b, 96 kbps 1193>2 byte&0xF0 0xB0 \b, 112 kbps 1194>2 byte&0xF0 0xC0 \b, 128 kbps 1195>2 byte&0xF0 0xD0 \b, 144 kbps 1196>2 byte&0xF0 0xE0 \b, 160 kbps 1197# timing 1198>2 byte&0x0C 0x00 \b, 22.05 kHz 1199>2 byte&0x0C 0x04 \b, 24 kHz 1200>2 byte&0x0C 0x08 \b, 16 kHz 1201# channels/options 1202>3 byte&0xC0 0x00 \b, Stereo 1203>3 byte&0xC0 0x40 \b, JntStereo 1204>3 byte&0xC0 0x80 \b, 2x Monaural 1205>3 byte&0xC0 0xC0 \b, Monaural 1206#>1 byte ^0x01 \b, Data Verify 1207#>2 byte &0x02 \b, Packet Pad 1208#>2 byte &0x01 \b, Custom Flag 1209#>3 byte &0x08 \b, Copyrighted 1210#>3 byte &0x04 \b, Original Source 1211#>3 byte&0x03 1 \b, NR: 50/15 ms 1212#>3 byte&0x03 3 \b, NR: CCIT J.17 1213 1214# MPA, M2A 12150 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 1216!:mime audio/mpeg 1217# rate 1218>2 byte&0xF0 0x10 \b, 32 kbps 1219>2 byte&0xF0 0x20 \b, 48 kbps 1220>2 byte&0xF0 0x30 \b, 56 kbps 1221>2 byte&0xF0 0x40 \b, 64 kbps 1222>2 byte&0xF0 0x50 \b, 80 kbps 1223>2 byte&0xF0 0x60 \b, 96 kbps 1224>2 byte&0xF0 0x70 \b, 112 kbps 1225>2 byte&0xF0 0x80 \b, 128 kbps 1226>2 byte&0xF0 0x90 \b, 144 kbps 1227>2 byte&0xF0 0xA0 \b, 160 kbps 1228>2 byte&0xF0 0xB0 \b, 176 kbps 1229>2 byte&0xF0 0xC0 \b, 192 kbps 1230>2 byte&0xF0 0xD0 \b, 224 kbps 1231>2 byte&0xF0 0xE0 \b, 256 kbps 1232# timing 1233>2 byte&0x0C 0x00 \b, 22.05 kHz 1234>2 byte&0x0C 0x04 \b, 24 kHz 1235>2 byte&0x0C 0x08 \b, 16 kHz 1236# channels/options 1237>3 byte&0xC0 0x00 \b, Stereo 1238>3 byte&0xC0 0x40 \b, JntStereo 1239>3 byte&0xC0 0x80 \b, 2x Monaural 1240>3 byte&0xC0 0xC0 \b, Monaural 1241#>1 byte ^0x01 \b, Data Verify 1242#>2 byte &0x02 \b, Packet Pad 1243#>2 byte &0x01 \b, Custom Flag 1244#>3 byte &0x08 \b, Copyrighted 1245#>3 byte &0x04 \b, Original Source 1246#>3 byte&0x03 1 \b, NR: 50/15 ms 1247#>3 byte&0x03 3 \b, NR: CCIT J.17 1248 1249# MP3, M25A 12500 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 1251!:mime audio/mpeg 1252# rate 1253>2 byte&0xF0 0x10 \b, 8 kbps 1254>2 byte&0xF0 0x20 \b, 16 kbps 1255>2 byte&0xF0 0x30 \b, 24 kbps 1256>2 byte&0xF0 0x40 \b, 32 kbps 1257>2 byte&0xF0 0x50 \b, 40 kbps 1258>2 byte&0xF0 0x60 \b, 48 kbps 1259>2 byte&0xF0 0x70 \b, 56 kbps 1260>2 byte&0xF0 0x80 \b, 64 kbps 1261>2 byte&0xF0 0x90 \b, 80 kbps 1262>2 byte&0xF0 0xA0 \b, 96 kbps 1263>2 byte&0xF0 0xB0 \b, 112 kbps 1264>2 byte&0xF0 0xC0 \b, 128 kbps 1265>2 byte&0xF0 0xD0 \b, 144 kbps 1266>2 byte&0xF0 0xE0 \b, 160 kbps 1267# timing 1268>2 byte&0x0C 0x00 \b, 11.025 kHz 1269>2 byte&0x0C 0x04 \b, 12 kHz 1270>2 byte&0x0C 0x08 \b, 8 kHz 1271# channels/options 1272>3 byte&0xC0 0x00 \b, Stereo 1273>3 byte&0xC0 0x40 \b, JntStereo 1274>3 byte&0xC0 0x80 \b, 2x Monaural 1275>3 byte&0xC0 0xC0 \b, Monaural 1276#>1 byte ^0x01 \b, Data Verify 1277#>2 byte &0x02 \b, Packet Pad 1278#>2 byte &0x01 \b, Custom Flag 1279#>3 byte &0x08 \b, Copyrighted 1280#>3 byte &0x04 \b, Original Source 1281#>3 byte&0x03 1 \b, NR: 50/15 ms 1282#>3 byte&0x03 3 \b, NR: CCIT J.17 1283 1284# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio 1285 1286# Stored AAC streams (instead of the MP4 format) 12870 string ADIF MPEG ADIF, AAC 1288!:mime audio/x-hx-aac-adif 1289>4 byte &0x80 1290>>13 byte &0x10 \b, VBR 1291>>13 byte ^0x10 \b, CBR 1292>>16 byte&0x1E 0x02 \b, single stream 1293>>16 byte&0x1E 0x04 \b, 2 streams 1294>>16 byte&0x1E 0x06 \b, 3 streams 1295>>16 byte &0x08 \b, 4 or more streams 1296>>16 byte &0x10 \b, 8 or more streams 1297>>4 byte &0x80 \b, Copyrighted 1298>>13 byte &0x40 \b, Original Source 1299>>13 byte &0x20 \b, Home Flag 1300>4 byte ^0x80 1301>>4 byte &0x10 \b, VBR 1302>>4 byte ^0x10 \b, CBR 1303>>7 byte&0x1E 0x02 \b, single stream 1304>>7 byte&0x1E 0x04 \b, 2 streams 1305>>7 byte&0x1E 0x06 \b, 3 streams 1306>>7 byte &0x08 \b, 4 or more streams 1307>>7 byte &0x10 \b, 8 or more streams 1308>>4 byte &0x40 \b, Original Stream(s) 1309>>4 byte &0x20 \b, Home Source 1310 1311# Live or stored single AAC stream (used with MPEG-2 systems) 13120 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC 1313!:mime audio/x-hx-aac-adts 1314>1 byte &0x08 \b, v2 1315>1 byte ^0x08 \b, v4 1316# profile 1317>>2 byte &0xC0 \b LTP 1318>2 byte&0xc0 0x00 \b Main 1319>2 byte&0xc0 0x40 \b LC 1320>2 byte&0xc0 0x80 \b SSR 1321# timing 1322>2 byte&0x3c 0x00 \b, 96 kHz 1323>2 byte&0x3c 0x04 \b, 88.2 kHz 1324>2 byte&0x3c 0x08 \b, 64 kHz 1325>2 byte&0x3c 0x0c \b, 48 kHz 1326>2 byte&0x3c 0x10 \b, 44.1 kHz 1327>2 byte&0x3c 0x14 \b, 32 kHz 1328>2 byte&0x3c 0x18 \b, 24 kHz 1329>2 byte&0x3c 0x1c \b, 22.05 kHz 1330>2 byte&0x3c 0x20 \b, 16 kHz 1331>2 byte&0x3c 0x24 \b, 12 kHz 1332>2 byte&0x3c 0x28 \b, 11.025 kHz 1333>2 byte&0x3c 0x2c \b, 8 kHz 1334# channels 1335>2 beshort&0x01c0 0x0040 \b, monaural 1336>2 beshort&0x01c0 0x0080 \b, stereo 1337>2 beshort&0x01c0 0x00c0 \b, stereo + center 1338>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE 1339>2 beshort&0x01c0 0x0140 \b, surround 1340>2 beshort&0x01c0 0x0180 \b, surround + LFE 1341>2 beshort &0x01C0 \b, surround + side 1342#>1 byte ^0x01 \b, Data Verify 1343#>2 byte &0x02 \b, Custom Flag 1344#>3 byte &0x20 \b, Original Stream 1345#>3 byte &0x10 \b, Home Source 1346#>3 byte &0x08 \b, Copyrighted 1347 1348# Live MPEG-4 audio streams (instead of RTP FlexMux) 13490 beshort&0xFFE0 0x56E0 MPEG-4 LOAS 1350!:mime audio/x-mp4a-latm 1351#>1 beshort&0x1FFF x \b, %hu byte packet 1352>3 byte&0xE0 0x40 1353>>4 byte&0x3C 0x04 \b, single stream 1354>>4 byte&0x3C 0x08 \b, 2 streams 1355>>4 byte&0x3C 0x0C \b, 3 streams 1356>>4 byte &0x08 \b, 4 or more streams 1357>>4 byte &0x20 \b, 8 or more streams 1358>3 byte&0xC0 0 1359>>4 byte&0x78 0x08 \b, single stream 1360>>4 byte&0x78 0x10 \b, 2 streams 1361>>4 byte&0x78 0x18 \b, 3 streams 1362>>4 byte &0x20 \b, 4 or more streams 1363>>4 byte &0x40 \b, 8 or more streams 1364# This magic isn't strong enough (matches plausible ISO-8859-1 text) 1365#0 beshort 0x4DE1 MPEG-4 LO-EP audio stream 1366#!:mime audio/x-mp4a-latm 1367 1368# Summary: FLI animation format 1369# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1370# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 13714 leshort 0xAF11 1372# standard FLI always has 320x200 resolution and 8 bit color 1373>8 leshort 320 1374>>10 leshort 200 1375>>>12 leshort 8 FLI animation, 320x200x8 1376!:mime video/x-fli 1377>>>>6 leshort x \b, %d frames 1378# frame speed is multiple of 1/70s 1379>>>>16 leshort x \b, %d/70s per frame 1380 1381# Summary: FLC animation format 1382# Created by: Daniel Quinlan <quinlan@yggdrasil.com> 1383# Modified by (1): Abel Cheung <abelcheung@gmail.com> (avoid over-generic detection) 13844 leshort 0xAF12 1385# standard FLC always use 8 bit color 1386>12 leshort 8 FLC animation 1387!:mime video/x-flc 1388>>8 leshort x \b, %d 1389>>10 leshort x \bx%dx8 1390>>6 uleshort x \b, %d frames 1391>>16 uleshort x \b, %dms per frame 1392 1393# DL animation format 1394# XXX - collision with most `mips' magic 1395# 1396# I couldn't find a real magic number for these, however, this 1397# -appears- to work. Note that it might catch other files, too, so be 1398# careful! 1399# 1400# Note that title and author appear in the two 20-byte chunks 1401# at decimal offsets 2 and 22, respectively, but they are XOR'ed with 1402# 255 (hex FF)! The DL format is really bad. 1403# 1404#0 byte 1 DL version 1, medium format (160x100, 4 images/screen) 1405#!:mime video/x-unknown 1406#>42 byte x - %d screens, 1407#>43 byte x %d commands 1408#0 byte 2 DL version 2 1409#!:mime video/x-unknown 1410#>1 byte 1 - large format (320x200,1 image/screen), 1411#>1 byte 2 - medium format (160x100,4 images/screen), 1412#>1 byte >2 - unknown format, 1413#>42 byte x %d screens, 1414#>43 byte x %d commands 1415# Based on empirical evidence, DL version 3 have several nulls following the 1416# \003. Most of them start with non-null values at hex offset 0x34 or so. 1417#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 1418 1419# iso 13818 transport stream 1420# 1421# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) 1422# syncbyte 8 bit 0x47 1423# error_ind 1 bit - 1424# payload_start 1 bit 1 1425# priority 1 bit - 1426# PID 13 bit 0x0000 1427# scrambling 2 bit - 1428# adaptfld_ctrl 2 bit 1 or 3 1429# conti_count 4 bit - 14300 belong&0xFF5FFF10 0x47400010 1431>188 byte 0x47 MPEG transport stream data 1432!:mime video/MP2T 1433 1434# DIF digital video file format <mpruett@sgi.com> 14350 belong&0xffffff00 0x1f070000 DIF 1436>4 byte &0x01 (DVCPRO) movie file 1437>4 byte ^0x01 (DV) movie file 1438>3 byte &0x80 (PAL) 1439>3 byte ^0x80 (NTSC) 1440 1441# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com> 14420 belong 0x3026b275 Microsoft ASF 1443!:mime video/x-ms-asf 1444 1445# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 14460 string \x8aMNG MNG video data, 1447!:mime video/x-mng 1448>4 belong !0x0d0a1a0a CORRUPTED, 1449>4 belong 0x0d0a1a0a 1450>>16 belong x %d x 1451>>20 belong x %d 1452 1453# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/> 14540 string \x8bJNG JNG video data, 1455!:mime video/x-jng 1456>4 belong !0x0d0a1a0a CORRUPTED, 1457>4 belong 0x0d0a1a0a 1458>>16 belong x %d x 1459>>20 belong x %d 1460 1461# Vivo video (Wolfram Kleff) 14623 string \x0D\x0AVersion:Vivo Vivo video data 1463 1464# VRML (Virtual Reality Modelling Language) 14650 string/w #VRML\ V1.0\ ascii VRML 1 file 1466!:mime model/vrml 14670 string/w #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file 1468!:mime model/vrml 1469 1470# X3D (Extensible 3D) [https://www.web3d.org/specifications/x3d-3.0.dtd] 1471# From Michel Briand <michelbriand@free.fr> 1472# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml 1473# Example https://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d 14740 string/w \<?xml\ version= 1475!:strength + 5 1476>20 search/1000/w \<!DOCTYPE\ X3D X3D (Extensible 3D) model xml text 1477!:mime model/x3d+xml 1478 1479#--------------------------------------------------------------------------- 1480# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube 1481# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03 1482# 14830 string HVQM4 %s 1484>6 string >\0 v%s 1485>0 byte x GameCube movie, 1486>0x34 ubeshort x %d x 1487>0x36 ubeshort x %d, 1488>0x26 ubeshort x %dus, 1489>0x42 ubeshort 0 no audio 1490>0x42 ubeshort >0 %dHz audio 1491 1492# From: "Stefan A. Haubenthal" <polluks@web.de> 14930 string DVDVIDEO-VTS Video title set, 1494>0x21 byte x v%x 14950 string DVDVIDEO-VMG Video manager, 1496>0x21 byte x v%x 1497 1498# From: Behan Webster <behanw@websterwood.com> 1499# NuppelVideo used by Mythtv (*.nuv) 1500# Note: there are two identical stanzas here differing only in the 1501# initial string matched. It used to be done with a regex, but we're 1502# trying to get rid of those. 15030 string NuppelVideo MythTV NuppelVideo 1504>12 string x v%s 1505>20 lelong x (%d 1506>24 lelong x \bx%d), 1507>36 string P \bprogressive, 1508>36 string I \binterlaced, 1509>40 ledouble x \baspect:%.2f, 1510>48 ledouble x \bfps:%.2f 15110 string MythTV MythTV NuppelVideo 1512>12 string x v%s 1513>20 lelong x (%d 1514>24 lelong x \bx%d), 1515>36 string P \bprogressive, 1516>36 string I \binterlaced, 1517>40 ledouble x \baspect:%.2f, 1518>48 ledouble x \bfps:%.2f 1519 1520# MPEG file 1521# MPEG sequences 1522# FIXME: This section is from the old magic.mime file and needs 1523# integrating with the rest 1524#0 belong 0x000001BA 1525#>4 byte &0x40 1526#!:mime video/mp2p 1527#>4 byte ^0x40 1528#!:mime video/mpeg 1529#0 belong 0x000001BB 1530#!:mime video/mpeg 1531#0 belong 0x000001B0 1532#!:mime video/mp4v-es 1533#0 belong 0x000001B5 1534#!:mime video/mp4v-es 1535#0 belong 0x000001B3 1536#!:mime video/mpv 1537#0 belong&0xFF5FFF10 0x47400010 1538#!:mime video/mp2t 1539#0 belong 0x00000001 1540#>4 byte&0x1F 0x07 1541#!:mime video/h264 1542 1543# Type: Bink Video 1544# Extension: .bik 1545# URL: https://wiki.multimedia.cx/index.php?title=Bink_Container 1546# From: <hoehle@users.sourceforge.net> 2008-07-18 15470 string BIK Bink Video 1548>3 regex =[a-z] rev.%s 1549#>4 ulelong x size %d 1550>20 ulelong x \b, %d 1551>24 ulelong x \bx%d 1552>8 ulelong x \b, %d frames 1553>32 ulelong x at rate %d/ 1554>28 ulelong >1 \b%d 1555>40 ulelong =0 \b, no audio 1556>40 ulelong !0 \b, %d audio track 1557>>40 ulelong !1 \bs 1558# follow properties of the first audio track only 1559>>48 uleshort x %dHz 1560>>51 byte&0x20 0 mono 1561>>51 byte&0x20 !0 stereo 1562#>>51 byte&0x10 0 FFT 1563#>>51 byte&0x10 !0 DCT 1564 1565# Type: NUT Container 1566# URL: https://wiki.multimedia.cx/index.php?title=NUT 1567# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15680 string nut/multimedia\ container\0 NUT multimedia container 1569 1570# Type: Nullsoft Video (NSV) 1571# URL: https://wiki.multimedia.cx/index.php?title=Nullsoft_Video 1572# From: Mike Melanson <mike@multimedia.cx> 15730 string NSVf Nullsoft Video 1574 1575# Type: REDCode Video 1576# URL: https://www.red.com/ ; https://wiki.multimedia.cx/index.php?title=REDCode 1577# From: Mike Melanson <mike@multimedia.cx> 15784 string RED1 REDCode Video 1579 1580# Type: MTV Multimedia File 1581# URL: https://wiki.multimedia.cx/index.php?title=MTV 1582# From: Mike Melanson <mike@multimedia.cx> 15830 string AMVS MTV Multimedia File 1584 1585# Type: ARMovie 1586# URL: https://wiki.multimedia.cx/index.php?title=ARMovie 1587# From: Mike Melanson <mike@multimedia.cx> 15880 string ARMovie\012 ARMovie 1589 1590# Type: Interplay MVE Movie 1591# URL: https://wiki.multimedia.cx/index.php?title=Interplay_MVE 1592# From: Mike Melanson <mike@multimedia.cx> 15930 string Interplay\040MVE\040File\032 Interplay MVE Movie 1594 1595# Type: Windows Television DVR File 1596# URL: https://wiki.multimedia.cx/index.php?title=WTV 1597# From: Mike Melanson <mike@mutlimedia.cx> 1598# This takes the form of a Windows-style GUID 15990 bequad 0xB7D800203749DA11 1600>8 bequad 0xA64E0007E95EAD8D Windows Television DVR Media 1601 1602# Type: Sega FILM/CPK Multimedia 1603# URL: https://wiki.multimedia.cx/index.php?title=Sega_FILM 1604# From: Mike Melanson <mike@multimedia.cx> 16050 string FILM Sega FILM/CPK Multimedia, 1606>32 belong x %d x 1607>28 belong x %d 1608 1609# Type: Nintendo THP Multimedia 1610# URL: https://wiki.multimedia.cx/index.php?title=THP 1611# From: Mike Melanson <mike@multimedia.cx> 16120 string THP\0 Nintendo THP Multimedia 1613 1614# Type: BBC Dirac Video 1615# URL: https://wiki.multimedia.cx/index.php?title=Dirac 1616# From: Mike Melanson <mike@multimedia.cx> 16170 string BBCD BBC Dirac Video 1618 1619# Type: RAD Game Tools Smacker Multimedia 1620# URL: https://wiki.multimedia.cx/index.php?title=Smacker 1621# From: Mike Melanson <mike@multimedia.cx> 16220 string SMK RAD Game Tools Smacker Multimedia 1623>3 byte x version %c, 1624>4 lelong x %d x 1625>8 lelong x %d, 1626>12 lelong x %d frames 1627 1628# Material Exchange Format 1629# More information: 1630# https://en.wikipedia.org/wiki/Material_Exchange_Format 1631# http://www.freemxf.org/ 16320 string \x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02 Material exchange container format 1633!:ext mxf 1634!:mime application/mxf 1635 1636# Recognize LucasArts Smush video files (cf. 1637# https://wiki.multimedia.cx/index.php/Smush) 16380 string ANIM 1639>8 string AHDR LucasArts Smush Animation Format (SAN) video 16400 string SANM 1641>8 string SHDR LucasArts Smush v2 (SANM) video 1642 1643# Type: Scaleform video 1644# Extension: .usm 1645# URL: https://wiki.multimedia.cx/index.php/USM 1646# From: David Korth <gerbilsoft@gerbilsoft.com> 16470 string CRID 1648>32 string @UTF Scaleform video 1649 1650#------------------------------------------------------------------------------ 1651# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $ 1652# aout: file(1) magic for a.out executable/object/etc entries that 1653# handle executables on multiple platforms. 1654# 1655 1656# 1657# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from 1658# BSDI), netbsd, and vax (for UNIX/32V and BSD) 1659# 1660# XXX - is there anything we can look at to distinguish BSD/OS 386 from 1661# NetBSD 386 from various VAX binaries? The BSD/OS shared library flag 1662# works only for binaries using shared libraries. Grabbing the entry 1663# point from the a.out header, using it to find the first code executed 1664# in the program, and looking at that might help. 1665# 16660 lelong 0407 a.out little-endian 32-bit executable 1667>16 lelong >0 not stripped 1668>32 byte 0x6a (uses BSD/OS shared libs) 1669 16700 lelong 0410 a.out little-endian 32-bit pure executable 1671>16 lelong >0 not stripped 1672>32 byte 0x6a (uses BSD/OS shared libs) 1673 16740 lelong 0413 a.out little-endian 32-bit demand paged pure executable 1675>16 lelong >0 not stripped 1676>32 byte 0x6a (uses BSD/OS shared libs) 1677 1678# 1679# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out), 1680# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out). 1681# 1682# XXX - is there anything we can look at to distinguish old SunOS 68010 1683# from old 68020 IRIX from old NetBSD? Again, I guess we could look at 1684# the first instruction or instructions in the program. 1685# 16860 belong 0407 a.out big-endian 32-bit executable 1687>16 belong >0 not stripped 1688 16890 belong 0410 a.out big-endian 32-bit pure executable 1690>16 belong >0 not stripped 1691 16920 belong 0413 a.out big-endian 32-bit demand paged executable 1693>16 belong >0 not stripped 1694 1695 1696#------------------------------------------------------------------------------ 1697# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $ 1698# apache: file(1) magic for Apache Big Data formats 1699 1700# Avro files 17010 string Obj Apache Avro 1702>3 byte x version %d 1703 1704# ORC files 1705# Important information is in file footer, which we can't index to :( 17060 string ORC Apache ORC 1707 1708# Parquet files 17090 string PAR1 Apache Parquet 1710 1711# Hive RC files 17120 string RCF Apache Hive RC file 1713>3 byte x version %d 1714 1715# Sequence files (and the careless first version of RC file) 1716 17170 string SEQ 1718>3 byte <6 Apache Hadoop Sequence file version %d 1719>3 byte >6 Apache Hadoop Sequence file version %d 1720>3 byte =6 1721>>5 string org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer Apache Hive RC file version 0 1722>>3 default x Apache Hadoop Sequence file version 6 1723 1724#------------------------------------------------------------------------------ 1725# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $ 1726# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL 1727# workspaces) 1728# 17290 long 0100554 APL workspace (Ken's original?) 1730 1731#------------------------------------------------------------------------------ 1732# $File: apple,v 1.43 2019/04/19 00:42:27 christos Exp $ 1733# apple: file(1) magic for Apple file formats 1734# 17350 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text 17360 string \x0aGL Binary II (apple ][) data 17370 string \x76\xff Squeezed (apple ][) data 17380 string NuFile NuFile archive (apple ][) data 17390 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data 17400 belong 0x00051600 AppleSingle encoded Macintosh file 17410 belong 0x00051607 AppleDouble encoded Macintosh file 1742 1743# Type: Apple Emulator WOZ format 1744# From: Greg Wildman <greg@apple2.org.za> 1745# Ref: https://applesaucefdc.com/woz/reference/ 1746# Ref: https://applesaucefdc.com/woz/reference2/ 1747# 1748# Note: The following test are mostly identical. I would rather not 1749# use a regex to identify the WOZ format number. 17500 string WOZ1 1751>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image 1752>12 string INFO 1753>>21 byte 01 \b, 5.25 inch 1754>>21 byte 02 \b, 3.5 inch 1755>>22 byte 01 \b, write protected 1756>>23 byte 01 \b, cross track synchronized 1757>>25 string/T x \b, %.32s 17580 string WOZ2 1759>4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image 1760>12 string INFO 1761>>21 byte 01 \b, 5.25 inch 1762>>21 byte 02 \b, 3.5 inch 1763>>22 byte 01 \b, write protected 1764>>23 byte 01 \b, cross track synchronized 1765>>25 string/T x \b, %.32s 1766 1767# Type: Apple Emulator disk images 1768# From: Greg Wildman <greg@apple2.org.za> 1769# ProDOS boot loader? 17700 string \x01\x38\xB0\x03\x4C Apple ProDOS Image 1771# Detect Volume Directory block ($02) 1772>0x400 string \x00\x00\x03\x00 1773>>0x404 byte &0xF0 1774>>>0x405 string x \b, Volume /%s 1775>>>0x429 leshort x \b, %u Blocks 1776# ProDOS ordered ? 1777>0xb00 string \x00\x00\x03\x00 1778>>0xb04 byte &0xF0 1779>>>0xb05 string x \b, Volume /%s 1780>>>0xb29 leshort x \b, %u Blocks 1781# 1782# DOS3.3 boot loader? 17830 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B 1784>0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image 1785>>0x11006 byte x \b, Volume %u 1786>>0x11034 byte x \b, %u Tracks 1787>>0x11035 byte x \b, %u Sectors 1788>>0x11036 leshort x \b, %u bytes per sector 1789# DOS3.2 ? 1790>0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image 1791>>0x11006 byte x \b, Volume %u 1792>>0x11034 byte x \b, %u Tracks 1793>>0x11035 byte x \b, %u Sectors 1794>>0x11036 leshort x \b, %u bytes per sector 1795# DOS3.1 ? 1796>0x11001 string \x11\x0C\x01 1797>>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image 1798# 1799# Pascal boot loader? 18000 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD 1801>0xd6 pstring SYSTEM.APPLE 1802>>0xb00 leshort 0x0000 1803>>>0xb04 leshort 0x0000 Apple Pascal Image 1804>>>>0xb06 pstring x \b, Volume %s: 1805>>>>0xb0e leshort x \b, %u Blocks 1806>>>>0xb10 leshort x \b, %u Files 1807 1808# Type: Apple Emulator 2IMG format 1809# From: Radek Vokal <rvokal@redhat.com> 1810# Update: Greg Wildman <greg@apple2.org.za> 18110 string 2IMG Apple ][ 2IMG Disk Image 1812>4 clear x 1813>4 string XGS! \b, XGS 1814>4 string CTKG \b, Catakig 1815>4 string ShIm \b, Sheppy's ImageMaker 1816>4 string SHEP \b, Sheppy's ImageMaker 1817>4 string WOOF \b, Sweet 16 1818>4 string B2TR \b, Bernie ][ the Rescue 1819>4 string \!nfc \b, ASIMOV2 1820>4 string \>BD\< \b, Brutal Deluxe's Cadius 1821>4 string CdrP \b, CiderPress 1822>4 string Vi][ \b, Virtual ][ 1823>4 string PRFS \b, ProFUSE 1824>4 string FISH \b, FishWings 1825>4 string RVLW \b, Revival for Windows 1826>4 default x 1827>>4 string x \b, Creator tag "%-4.4s" 1828>0xc byte 00 \b, DOS 3.3 sector order 1829>>0x10 byte 00 \b, Volume 254 1830>>0x10 byte&0x7f x \b, Volume %u 1831>0xc byte 01 \b, ProDOS sector order 1832>>0x14 short x \b, %u Blocks 1833>0xc byte 02 \b, NIB data 1834 1835# magic for Newton PDA package formats 1836# from Ruda Moura <ruda@helllabs.org> 18370 string package0 Newton package, NOS 1.x, 1838>12 belong &0x80000000 AutoRemove, 1839>12 belong &0x40000000 CopyProtect, 1840>12 belong &0x10000000 NoCompression, 1841>12 belong &0x04000000 Relocation, 1842>12 belong &0x02000000 UseFasterCompression, 1843>16 belong x version %d 1844 18450 string package1 Newton package, NOS 2.x, 1846>12 belong &0x80000000 AutoRemove, 1847>12 belong &0x40000000 CopyProtect, 1848>12 belong &0x10000000 NoCompression, 1849>12 belong &0x04000000 Relocation, 1850>12 belong &0x02000000 UseFasterCompression, 1851>16 belong x version %d 1852 18530 string package4 Newton package, 1854>8 byte 8 NOS 1.x, 1855>8 byte 9 NOS 2.x, 1856>12 belong &0x80000000 AutoRemove, 1857>12 belong &0x40000000 CopyProtect, 1858>12 belong &0x10000000 NoCompression, 1859 1860# The following entries for the Apple II are for files that have 1861# been transferred as raw binary data from an Apple, without having 1862# been encapsulated by any of the above archivers. 1863# 1864# In general, Apple II formats are hard to identify because Apple DOS 1865# and especially Apple ProDOS have strong typing in the file system and 1866# therefore programmers never felt much need to include type information 1867# in the files themselves. 1868# 1869# Eric Fischer <enf@pobox.com> 1870 1871# AppleWorks word processor: 1872# URL: https://en.wikipedia.org/wiki/AppleWorks 1873# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx 1874# Update: Joerg Jenderek 1875# NOTE: 1876# The "O" is really the magic number, but that's so common that it's 1877# necessary to check the tab stops that follow it to avoid false positives. 1878# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge 1879# the newer AppleWorks is from claris with extension CWK 18804 string O 1881# test for unused bits of zoom- , paginated-boolean bytes 1882>84 ubequad ^0x00Fe00000000Fe00 1883# look for tabstop definitions "=" no tab, "|" no tab 1884# "<" left tab,"^" center tab,">" right tab, "." decimal tab, 1885# unofficial "!" other , "\x8a" other 1886# official only if SFMinVers is nonzero 1887>>5 regex/s [=.<>|!^\x8a]{79} AppleWorks Word Processor 1888# AppleWorks Word Processor File (Apple II) 1889# ./apple (version 5.25) labeled the entry as "AppleWorks word processor data" 1890# application/x-appleworks is mime type for claris version with cwk extension 1891!:mime application/x-appleworks3 1892# http://home.earthlink.net/~hughhood/appleiiworksenvoy/ 1893# ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type') 1894# $70 $1A $F8 $FF is this the apple type ? 1895#:apple pdosp^Z\xf8\xff 1896!:ext awp 1897# minimum version needed to read this files. SFMinVers (0 , 30~3.0 ) 1898>>>183 ubyte 30 3.0 1899>>>183 ubyte !30 1900>>>>183 ubyte !0 0x%x 1901# usual tabstop start sequence "=====<" 1902>>>5 string x \b, tabstop ruler "%6.6s" 1903# tabstop ruler 1904#>>>5 string >\0 \b, tabstops "%-79s" 1905# zoom switch 1906>>>85 byte&0x01 >0 \b, zoomed 1907# whether paginated 1908>>>90 byte&0x01 >0 \b, paginated 1909# contains any mail-merge commands 1910>>>92 byte&0x01 >0 \b, with mail merge 1911# left margin in 1/10 inches ( normally 0 or 10 ) 1912>>>91 ubyte >0 1913>>>>91 ubyte x \b, %d/10 inch left margin 1914 1915# AppleWorks database: 1916# 1917# This isn't really a magic number, but it's the closest thing to one 1918# that I could find. The 1 and 2 really mean "order in which you defined 1919# categories" and "left to right, top to bottom," respectively; the D and R 1920# mean that the cursor should move either down or right when you press Return. 1921 1922#30 string \x01D AppleWorks database data 1923#30 string \x02D AppleWorks database data 1924#30 string \x01R AppleWorks database data 1925#30 string \x02R AppleWorks database data 1926 1927# AppleWorks spreadsheet: 1928# 1929# Likewise, this isn't really meant as a magic number. The R or C means 1930# row- or column-order recalculation; the A or M means automatic or manual 1931# recalculation. 1932 1933#131 string RA AppleWorks spreadsheet data 1934#131 string RM AppleWorks spreadsheet data 1935#131 string CA AppleWorks spreadsheet data 1936#131 string CM AppleWorks spreadsheet data 1937 1938# Applesoft BASIC: 1939# 1940# This is incredibly sloppy, but will be true if the program was 1941# written at its usual memory location of 2048 and its first line 1942# number is less than 256. Yuck. 1943# update by Joerg Jenderek at Feb 2013 1944 1945# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000) 1946#0 belong&0xff00ff 0x80000 Applesoft BASIC program data 19470 belong&0x00ff00ff 0x00080000 1948# assuming that line number must be positive 1949>2 leshort >0 Applesoft BASIC program data, first line number %d 1950#>2 leshort x \b, first line number %d 1951 1952# ORCA/EZ assembler: 1953# 1954# This will not identify ORCA/M source files, since those have 1955# some sort of date code instead of the two zero bytes at 6 and 7 1956# XXX Conflicts with ELF 1957#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data 1958#>5 byte x \b, build number %d 1959 1960# Broderbund Fantavision 1961# 1962# I don't know what these values really mean, but they seem to recur. 1963# Will they cause too many conflicts? 1964 1965# Probably :-) 1966#2 belong&0xFF00FF 0x040008 Fantavision movie data 1967 1968# Some attempts at images. 1969# 1970# These are actually just bit-for-bit dumps of the frame buffer, so 1971# there's really no reasonably way to distinguish them except for their 1972# address (if preserved) -- 8192 or 16384 -- and their length -- 8192 1973# or, occasionally, 8184. 1974# 1975# Nevertheless this will manage to catch a lot of images that happen 1976# to have a solid-colored line at the bottom of the screen. 1977 1978# GRR: Magic too weak 1979#8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background 1980#8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background 1981#8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background 1982#8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background 1983#8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background 1984 1985# Beagle Bros. Apple Mechanic fonts 1986 19870 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font 1988 1989# Apple Universal Disk Image Format (UDIF) - dmg files. 1990# From Johan Gade. 1991# These entries are disabled for now until we fix the following issues. 1992# 1993# Note there might be some problems with the "VAX COFF executable" 1994# entry. Note this entry should be placed before the mac filesystem section, 1995# particularly the "Apple Partition data" entry. 1996# 1997# The intended meaning of these tests is, that the file is only of the 1998# specified type if both of the lines are correct - i.e. if the first 1999# line matches and the second doesn't then it is not of that type. 2000# 2001#0 long 0x7801730d 2002#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) 2003# 2004# Note that this entry is recognized correctly by the "Apple Partition 2005# data" entry - however since this entry is more specific - this 2006# information seems to be more useful. 2007#0 long 0x45520200 2008#>0x410 string disk\ image UDIF read/write image (UDRW) 2009 2010# From: Toby Peterson <toby@apple.com> 20110 string bplist00 Apple binary property list 2012 2013# Apple binary property list (bplist) 2014# Assumes version bytes are hex. 2015# Provides content hints for version 0 files. Assumes that the root 2016# object is the first object (true for CoreFoundation implementation). 2017# From: David Remahl <dremahl@apple.com> 20180 string bplist 2019>6 byte x \bCoreFoundation binary property list data, version 0x%c 2020>>7 byte x \b%c 2021>6 string 00 \b 2022>>8 byte&0xF0 0x00 \b 2023>>>8 byte&0x0F 0x00 \b, root type: null 2024>>>8 byte&0x0F 0x08 \b, root type: false boolean 2025>>>8 byte&0x0F 0x09 \b, root type: true boolean 2026>>8 byte&0xF0 0x10 \b, root type: integer 2027>>8 byte&0xF0 0x20 \b, root type: real 2028>>8 byte&0xF0 0x30 \b, root type: date 2029>>8 byte&0xF0 0x40 \b, root type: data 2030>>8 byte&0xF0 0x50 \b, root type: ascii string 2031>>8 byte&0xF0 0x60 \b, root type: unicode string 2032>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) 2033>>8 byte&0xF0 0xa0 \b, root type: array 2034>>8 byte&0xF0 0xd0 \b, root type: dictionary 2035 2036# Apple/NeXT typedstream data 2037# Serialization format used by NeXT and Apple for various 2038# purposes in YellowStep/Cocoa, including some nib files. 2039# From: David Remahl <dremahl@apple.com> 20402 string typedstream NeXT/Apple typedstream data, big endian 2041>0 byte x \b, version %d 2042>0 byte <5 \b 2043>>13 byte 0x81 \b 2044>>>14 ubeshort x \b, system %d 20452 string streamtyped NeXT/Apple typedstream data, little endian 2046>0 byte x \b, version %d 2047>0 byte <5 \b 2048>>13 byte 0x81 \b 2049>>>14 uleshort x \b, system %d 2050 2051#------------------------------------------------------------------------------ 2052# CAF: Apple CoreAudio File Format 2053# 2054# Container format for high-end audio purposes. 2055# From: David Remahl <dremahl@apple.com> 2056# 20570 string caff CoreAudio Format audio file 2058>4 beshort <10 version %d 2059>6 beshort x 2060 2061 2062#------------------------------------------------------------------------------ 2063# Keychain database files 20640 string kych Mac OS X Keychain File 2065 2066#------------------------------------------------------------------------------ 2067# Code Signing related file types 20680 belong 0xfade0c00 Mac OS X Code Requirement 2069>8 belong 1 (opExpr) 2070>4 belong x - %d bytes 2071 20720 belong 0xfade0c01 Mac OS X Code Requirement Set 2073>8 belong >1 containing %d items 2074>4 belong x - %d bytes 2075 20760 belong 0xfade0c02 Mac OS X Code Directory 2077>8 belong x version %x 2078>12 belong >0 flags 0x%x 2079>4 belong x - %d bytes 2080 20810 belong 0xfade0cc0 Mac OS X Detached Code Signature (non-executable) 2082>4 belong x - %d bytes 2083 20840 belong 0xfade0cc1 Mac OS X Detached Code Signature 2085>8 belong >1 (%d elements) 2086>4 belong x - %d bytes 2087 2088# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 2089# .vdi 20904 string innotek\ VirtualBox\ Disk\ Image %s 2091 2092# Apple disk partition stuff 2093# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2094# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h 2095# Update: Joerg Jenderek 2096# "ER" is APPLE_DRVR_MAP_MAGIC signature 20970 beshort 0x4552 2098# display Apple Driver Map (strength=50) after Syslinux bootloader (71) 2099#!:strength +0 2100# strengthen the magic by looking for used blocksizes 512 2048 2101>2 ubeshort&0xf1FF 0 Apple Driver Map 2102# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid 2103#>>504 ubequad&0x0000FFffFFff0000 0 2104!:mime application/x-apple-diskimage 2105!:apple ????devr 2106# https://en.wikipedia.org/wiki/Apple_Disk_Image 2107!:ext dmg/iso 2108# sbBlkSize for driver descriptor map 512 2048 2109>>2 beshort x \b, blocksize %d 2110# sbBlkCount sometimes garbish like 2111# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg 2112# 0xf2720100 for bunziped Firefox 48.0-2.dmg 2113# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso 2114# 0x00009090 by syslinux-6.03/utils/isohybrid.c 2115>>4 ubelong x \b, blockcount %u 2116# following device/driver information not very useful 2117# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2118>>8 ubeshort x \b, devtype %u 2119# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2120>>10 ubeshort x \b, devid %u 2121# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2122>>12 ubelong >0 2123>>>12 ubelong x \b, driver data %u 2124# number of driver descriptors sbDrvrCount <= 61 2125# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso) 2126>>16 ubeshort x \b, driver count %u 2127# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map 2128# >>18 use apple-driver-map 2129# >>26 use apple-driver-map 2130# # ... 2131# >>500 use apple-driver-map 2132# number of partitions is always same in every partition (map block count) 2133#>>0x0204 ubelong x \b, %u partitions 2134>>0x0204 ubelong >0 \b, contains[@0x200]: 2135>>>0x0200 use apple-apm 2136>>0x0204 ubelong >1 \b, contains[@0x400]: 2137>>>0x0400 use apple-apm 2138>>0x0204 ubelong >2 \b, contains[@0x600]: 2139>>>0x0600 use apple-apm 2140>>0x0204 ubelong >3 \b, contains[@0x800]: 2141>>>0x0800 use apple-apm 2142>>0x0204 ubelong >4 \b, contains[@0xA00]: 2143>>>0x0A00 use apple-apm 2144>>0x0204 ubelong >5 \b, contains[@0xC00]: 2145>>>0x0C00 use apple-apm 2146>>0x0204 ubelong >6 \b, contains[@0xE00]: 2147>>>0x0E00 use apple-apm 2148>>0x0204 ubelong >7 \b, contains[@0x1000]: 2149>>>0x1000 use apple-apm 2150# display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type) 21510 name apple-driver-map 2152>0 ubequad !0 2153# descBlock first block of driver 2154>>0 ubelong x \b, driver start block %u 2155# descSize driver size in blocks 2156>>4 ubeshort x \b, size %u 2157# descType driver system type 1 701h F8FFh FFFFh 2158>>6 ubeshort x \b, type 0x%x 2159 2160# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map 2161# Reference: https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h 2162# Update: Joerg Jenderek 2163# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the 2164# magic stronger. 2165# for apple partition map stored as a single file 21660 belong 0x504d0000 2167# to display Apple Partition Map (strength=70) after Syslinux bootloader (71) 2168#!:strength +0 2169>0 use apple-apm 2170# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type 2171# file: could not find any valid magic files! 2172#!:ext bin 2173# display apple partition map. Normally called after Apple driver map 21740 name apple-apm 2175>0 belong 0x504d0000 Apple Partition Map 2176# number of partitions 2177>>4 ubelong x \b, map block count %u 2178# logical block (512 bytes) start of partition 2179>>8 ubelong x \b, start block %u 2180>>12 ubelong x \b, block count %u 2181>>16 string >0 \b, name %s 2182>>48 string >0 \b, type %s 2183# processor type dpme_process_id[16] e.g. "68000" "68020" 2184>>120 string >0 \b, processor %s 2185# A/UX boot arguments BootArgs[128] 2186>>136 string >0 \b, boot arguments %s 2187# status of partition dpme_flags 2188>>88 belong & 1 \b, valid 2189>>88 belong & 2 \b, allocated 2190>>88 belong & 4 \b, in use 2191>>88 belong & 8 \b, has boot info 2192>>88 belong & 16 \b, readable 2193>>88 belong & 32 \b, writable 2194>>88 belong & 64 \b, pic boot code 2195>>88 belong & 128 \b, chain compatible driver 2196>>88 belong & 256 \b, real driver 2197>>88 belong & 512 \b, chain driver 2198# mount automatically at startup APPLE_PS_AUTO_MOUNT 2199>>88 ubelong &0x40000000 \b, mount at startup 2200# is the startup partition APPLE_PS_STARTUP 2201>>88 ubelong &0x80000000 \b, is the startup partition 2202 2203#https://wiki.mozilla.org/DS_Store_File_Format 2204#https://en.wikipedia.org/wiki/.DS_Store 22050 string \0\0\0\1Bud1\0 Apple Desktop Services Store 2206 2207# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015) 2208# Usually not in separate files, but have either filename rsrc with 2209# no extension, or a filename corresponding to another file, with 2210# extensions rsr/rsrc 22110 string \000\000\001\000 2212>4 leshort 0 2213>>16 lelong 0 Apple HFS/HFS+ resource fork 2214 2215#https://en.wikipedia.org/wiki/AppleScript 22160 string FasdUAS AppleScript compiled 2217 2218# AppleWorks/ClarisWorks 2219# https://github.com/joshenders/appleworks_format 2220# http://fileformats.archiveteam.org/wiki/AppleWorks 22210 name appleworks 2222>0 belong&0x00ffffff 0x07e100 AppleWorks CWK Document 2223>0 belong&0x00ffffff 0x008803 ClarisWorks CWK Document 2224>0 default x 2225>>0 belong x AppleWorks/ClarisWorks CWK Document 2226>0 byte x \b, version %d 2227>30 beshort x \b, %d 2228>32 beshort x \bx%d 2229!:ext cwk 2230 22314 string BOBO 2232>0 byte >4 2233>>12 belong 0 2234>>>26 belong 0 2235>>>>0 use appleworks 2236>0 belong 0x0481ad00 2237>>0 use appleworks 2238 2239# magic for Apple File System (APFS) 2240# from Alex Myczko <alex@aiei.ch> 224132 string NXSB Apple File System (APFS) 2242>36 ulelong x \b, blocksize %u 2243 2244# iTunes cover art (versions 1 and 2) 22454 string itch 2246>24 string artw 2247>>0x1e8 string data iTunes cover art 2248>>>0x1ed string PNG (PNG) 2249>>>0x1ec beshort 0xffd8 (JPEG) 2250 2251# MacPaint image 225265 string PNTGMPNT MacPaint image data 2253#0 belong 2 MacPaint image data 2254 2255#------------------------------------------------------------------------------ 2256# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $ 2257# application: file(1) magic for applications on small devices 2258# 2259# Pebble Application 22600 string PBLAPP\000\000 Pebble application 2261 2262#------------------------------------------------------------------------------ 2263# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $ 2264# applix: file(1) magic for Applixware 2265# From: Peter Soos <sp@osb.hu> 2266# 22670 string *BEGIN Applixware 2268>7 string WORDS Words Document 2269>7 string GRAPHICS Graphic 2270>7 string RASTER Bitmap 2271>7 string SPREADSHEETS Spreadsheet 2272>7 string MACRO Macro 2273>7 string BUILDER Builder Object 2274 2275#------------------------------------------------------------------------------ 2276# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $ 2277# apt: file(1) magic for APT Cache files 2278# <http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html> 2279# <https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292> 2280 2281# before version 10 ("old format"), data was in arch-specific long/short 2282 2283# old format 64 bit 22840 name apt-cache-64bit-be 2285>12 beshort 1 \b, dirty 2286>40 bequad x \b, %llu packages 2287>48 bequad x \b, %llu versions 2288 2289# old format 32 bit 22900 name apt-cache-32bit-be 2291>8 beshort 1 \b, dirty 2292>40 belong x \b, %u packages 2293>44 belong x \b, %u versions 2294 2295# new format 22960 name apt-cache-be 2297>6 byte 1 \b, dirty 2298>24 belong x \b, %u packages 2299>28 belong x \b, %u versions 2300 23010 bequad 0x98FE76DC 2302>8 ubeshort <10 APT cache data, version %u 2303>>10 beshort x \b.%u, 64 bit big-endian 2304>>0 use apt-cache-64bit-be 2305 23060 lequad 0x98FE76DC 2307>8 uleshort <10 APT cache data, version %u 2308>>10 leshort x \b.%u, 64 bit little-endian 2309>>0 use \^apt-cache-64bit-be 2310 23110 belong 0x98FE76DC 2312>4 ubeshort <10 APT cache data, version %u 2313>>6 ubeshort x \b.%u, 32 bit big-endian 2314>>0 use apt-cache-32bit-be 2315>4 ubyte >9 APT cache data, version %u 2316>>5 ubyte x \b.%u, big-endian 2317>>0 use apt-cache-be 2318 23190 lelong 0x98FE76DC 2320>4 uleshort <10 APT cache data, version %u 2321>>6 uleshort x \b.%u, 32 bit little-endian 2322>>0 use \^apt-cache-32bit-be 2323>4 ubyte >9 APT cache data, version %u 2324>>5 ubyte x \b.%u, little-endian 2325>>0 use \^apt-cache-be 2326#------------------------------------------------------------------------------ 2327# $File: archive,v 1.129 2019/05/09 18:58:02 christos Exp $ 2328# archive: file(1) magic for archive formats (see also "msdos" for self- 2329# extracting compressed archives) 2330# 2331# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. 2332# pre-POSIX "tar" archives are also handled in the C code ../../src/is_tar.c. 2333 2334# POSIX tar archives 2335# URL: https://en.wikipedia.org/wiki/Tar_(computing) 2336# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&sektion=5&manpath=FreeBSD+8-current 2337# header mainly padded with nul bytes 2338500 quad 0 2339!:strength /2 2340# filename or extended attribute printable strings in range space null til umlaut ue 2341>0 ubeshort >0x1F00 2342>>0 ubeshort <0xFCFD 2343# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad 2344# at https://sourceforge.net/projects/s-tar/files/testscripts/ 2345>>>508 ubelong&0x8B9E8DFF 0 2346# nul, space or ascii digit 0-7 at start of mode 2347>>>>100 ubyte&0xC8 =0 2348>>>>>101 ubyte&0xC8 =0 2349# nul, space at end of check sum 2350>>>>>>155 ubyte&0xDF =0 2351# space or ascii digit 0 at start of check sum 2352>>>>>>>148 ubyte&0xEF =0x20 2353>>>>>>>>0 use tar-file 2354# minimal check and then display tar archive information which can also be 2355# embedded inside others like Android Backup, Clam AntiVirus database 23560 name tar-file 2357>257 string !ustar 2358# header padded with nuls 2359>>257 ulong =0 2360# GNU tar version 1.29 with non pax format option without refusing 2361# creates misleading V7 header for Long path, Multi-volume, Volume type 2362>>>156 ubyte 0x4c GNU tar archive 2363!:mime application/x-gtar 2364!:ext tar/gtar 2365>>>156 ubyte 0x4d GNU tar archive 2366!:mime application/x-gtar 2367!:ext tar/gtar 2368>>>156 ubyte 0x56 GNU tar archive 2369!:mime application/x-gtar 2370!:ext tar/gtar 2371>>>156 default x tar archive (V7) 2372!:mime application/x-tar 2373!:ext tar 2374# other stuff in padding 2375# some implementations add new fields to the blank area at the end of the header record 2376# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option 2377>>257 ulong !0 tar archive (old) 2378!:mime application/x-tar 2379!:ext tar 2380# magic in newer, GNU, posix variants 2381>257 string =ustar 2382# 2 last char of magic and UStar version because string expression does not work 2383# 2 space characters followed by a null for GNU variant 2384>>261 ubelong =0x72202000 POSIX tar archive (GNU) 2385!:mime application/x-gtar 2386!:ext tar/gtar 2387# UStar version with ASCII "00" 2388>>261 ubelong 0x72003030 POSIX 2389# gLOBAL and ExTENSION type only found in POSIX.1-2001 format 2390>>>156 ubyte 0x67 \b.1-2001 2391>>>156 ubyte 0x78 \b.1-2001 2392>>>156 ubyte x tar archive 2393!:mime application/x-ustar 2394!:ext tar/ustar 2395# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab 2396>>261 ubelong 0x72000000 tar archive (ustar) 2397!:mime application/x-ustar 2398!:ext tar/ustar 2399# not seen ustar variant with garbish version 2400>>261 default x tar archive (unknown ustar) 2401!:mime application/x-ustar 2402!:ext tar/ustar 2403# type flag of 1st tar archive member 2404#>156 ubyte x \b, %c-type 2405>156 ubyte x 2406>>156 ubyte 0 \b, file 2407>>156 ubyte 0x30 \b, file 2408>>156 ubyte 0x31 \b, hard link 2409>>156 ubyte 0x32 \b, symlink 2410>>156 ubyte 0x33 \b, char device 2411>>156 ubyte 0x34 \b, block device 2412>>156 ubyte 0x35 \b, directory 2413>>156 ubyte 0x36 \b, fifo 2414>>156 ubyte 0x37 \b, reserved 2415>>156 ubyte 0x4c \b, long path 2416>>156 ubyte 0x4d \b, multi volume 2417>>156 ubyte 0x56 \b, volume 2418>>156 ubyte 0x67 \b, global 2419>>156 ubyte 0x78 \b, extension 2420>>156 default x \b, type 2421>>>156 ubyte x '%c' 2422# name[100] 2423>0 string >\0 %-.60s 2424# mode mainly stored as an octal number in ASCII null or space terminated 2425>100 string >\0 \b, mode %-.7s 2426# user id mainly as octal numbers in ASCII null or space terminated 2427>108 string >\0 \b, uid %-.7s 2428# group id mainly as octal numbers in ASCII null or space terminated 2429>116 string >\0 \b, gid %-.7s 2430# size mainly as octal number in ASCII 2431>124 ubyte <0x38 2432>>124 string >\0 \b, size %-.12s 2433# coding indicated by setting the high-order bit of the leftmost byte 2434>124 ubyte >0xEF \b, size 0x 2435>>124 ubyte !0xff \b%2.2x 2436>>125 ubyte !0xff \b%2.2x 2437>>126 ubyte !0xff \b%2.2x 2438>>127 ubyte !0xff \b%2.2x 2439>>128 ubyte !0xff \b%2.2x 2440>>129 ubyte !0xff \b%2.2x 2441>>130 ubyte !0xff \b%2.2x 2442>>131 ubyte !0xff \b%2.2x 2443>>132 ubyte !0xff \b%2.2x 2444>>133 ubyte !0xff \b%2.2x 2445>>134 ubyte !0xff \b%2.2x 2446>>135 ubyte !0xff \b%2.2x 2447# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated 2448>136 string >\0 \b, seconds %-.11s 2449# header checksum stored as an octal number in ASCII null or space terminated 2450#>148 string x \b, cksum %.7s 2451# linkname[100] 2452>157 string >\0 \b, linkname %-.40s 2453# additional fields for ustar 2454>257 string =ustar 2455# owner user name null terminated 2456>>265 string >\0 \b, user %-.32s 2457# group name null terminated 2458>>297 string >\0 \b, group %-.32s 2459# device major minor if not zero 2460>>329 ubequad&0xCFCFCFCFcFcFcFdf !0 2461>>>329 string x \b, devmaj %-.7s 2462>>337 ubequad&0xCFCFCFCFcFcFcFdf !0 2463>>>337 string x \b, devmin %-.7s 2464# prefix[155] 2465>>345 string >\0 \b, prefix %-.155s 2466# old non ustar/POSIX tar 2467>257 string !ustar 2468>>508 string =tar\0 2469# padding[255] in old star 2470>>>257 string >\0 \b, padding: %-.40s 2471>>508 default x 2472# padding[255] in old tar sometimes comment field 2473>>>257 string >\0 \b, comment: %-.40s 2474 2475# Incremental snapshot gnu-tar format from: 2476# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html 24770 string GNU\ tar- GNU tar incremental snapshot data 2478>&0 regex [0-9]\.[0-9]+-[0-9]+ version %s 2479 2480# cpio archives 2481# 2482# Yes, the top two "cpio archive" formats *are* supposed to just be "short". 2483# The idea is to indicate archives produced on machines with the same 2484# byte order as the machine running "file" with "cpio archive", and 2485# to indicate archives produced on machines with the opposite byte order 2486# from the machine running "file" with "byte-swapped cpio archive". 2487# 2488# The SVR4 "cpio(4)" hints that there are additional formats, but they 2489# are defined as "short"s; I think all the new formats are 2490# character-header formats and thus are strings, not numbers. 24910 short 070707 cpio archive 2492!:mime application/x-cpio 24930 short 0143561 byte-swapped cpio archive 2494!:mime application/x-cpio # encoding: swapped 24950 string 070707 ASCII cpio archive (pre-SVR4 or odc) 24960 string 070701 ASCII cpio archive (SVR4 with no CRC) 24970 string 070702 ASCII cpio archive (SVR4 with CRC) 2498 2499# 2500# Various archive formats used by various versions of the "ar" 2501# command. 2502# 2503 2504# 2505# Original UNIX archive formats. 2506# They were written with binary values in host byte order, and 2507# the magic number was a host "int", which might have been 16 bits 2508# or 32 bits. We don't say "PDP-11" or "VAX", as there might have 2509# been ports to little-endian 16-bit-int or 32-bit-int platforms 2510# (x86?) using some of those formats; if none existed, feel free 2511# to use "PDP-11" for little-endian 16-bit and "VAX" for little-endian 2512# 32-bit. There might have been big-endian ports of that sort as 2513# well. 2514# 25150 leshort 0177555 very old 16-bit-int little-endian archive 25160 beshort 0177555 very old 16-bit-int big-endian archive 25170 lelong 0177555 very old 32-bit-int little-endian archive 25180 belong 0177555 very old 32-bit-int big-endian archive 2519 25200 leshort 0177545 old 16-bit-int little-endian archive 2521>2 string __.SYMDEF random library 25220 beshort 0177545 old 16-bit-int big-endian archive 2523>2 string __.SYMDEF random library 25240 lelong 0177545 old 32-bit-int little-endian archive 2525>4 string __.SYMDEF random library 25260 belong 0177545 old 32-bit-int big-endian archive 2527>4 string __.SYMDEF random library 2528 2529# 2530# From "pdp" (but why a 4-byte quantity?) 2531# 25320 lelong 0x39bed PDP-11 old archive 25330 lelong 0x39bee PDP-11 4.0 archive 2534 2535# 2536# XXX - what flavor of APL used this, and was it a variant of 2537# some ar archive format? It's similar to, but not the same 2538# as, the APL workspace magic numbers in pdp. 2539# 25400 long 0100554 apl workspace 2541 2542# 2543# System V Release 1 portable(?) archive format. 2544# 25450 string =<ar> System V Release 1 ar archive 2546!:mime application/x-archive 2547 2548# 2549# Debian package; it's in the portable archive format, and needs to go 2550# before the entry for regular portable archives, as it's recognized as 2551# a portable archive whose first member has a name beginning with 2552# "debian". 2553# 2554# Update: Joerg Jenderek 2555# URL: https://en.wikipedia.org/wiki/Deb_(file_format) 25560 string =!<arch>\ndebian 2557# https://manpages.debian.org/testing/dpkg/dpkg-split.1.en.html 2558>14 string -split part of multipart Debian package 2559!:mime application/vnd.debian.binary-package 2560# udeb is used for stripped down deb file 2561!:ext deb/udeb 2562>14 string -binary Debian binary package 2563!:mime application/vnd.debian.binary-package 2564!:ext deb/udeb 2565# This should not happen 2566>14 default x Unknown Debian package 2567# NL terminated version; for most Debian cases this is 2.0 or 2.1 for splitted 2568>68 string >\0 (format %s) 2569#>68 string !2.0\n 2570#>>68 string x (format %.3s) 2571>68 string =2.0\n 2572# 2nd archive name=control archive name like control.tar.gz or control.tar.xz 2573>>72 string >\0 \b, with %.14s 2574# look for 3rd archive name=data archive name like data.tar.{gz,xz,bz2,lzma} 2575>>0 search/0x93e4f data.tar. \b, data compression 2576# the above line only works if FILE_BYTES_MAX in ../../src/file.h is raised 2577# for example like libreoffice-dev-doc_1%3a5.2.7-1+rpi1+deb9u3_all.deb 2578>>>&0 string x %.4s 2579# splitted debian package case 2580>68 string =2.1\n 2581# dpkg-1.18.25/dpkg-split/info.c 2582# NL terminated ASCII package name like ckermit 2583>>&0 string x \b, %s 2584# NL terminated package version like 302-5.3 2585>>>&1 string x %s 2586# NL terminated MD5 checksum 2587>>>>&1 string x \b, MD5 %s 2588# NL terminated original package length 2589>>>>>&1 string x \b, unsplitted size %s 2590# NL terminated part length 2591>>>>>>&1 string x \b, part lenght %s 2592# NL terminated package part like n/m 2593>>>>>>>&1 string x \b, part %s 2594# NL terminated package architecture like armhf since dpkg 1.16.1 or later 2595>>>>>>>>&1 string x \b, %s 2596 2597# 2598# MIPS archive; they're in the portable archive format, and need to go 2599# before the entry for regular portable archives, as it's recognized as 2600# a portable archive whose first member has a name beginning with 2601# "__________E". 2602# 26030 string =!<arch>\n__________E MIPS archive 2604!:mime application/x-archive 2605>20 string U with MIPS Ucode members 2606>21 string L with MIPSEL members 2607>21 string B with MIPSEB members 2608>19 string L and an EL hash table 2609>19 string B and an EB hash table 2610>22 string X -- out of date 2611 2612# 2613# BSD/SVR2-and-later portable archive formats. 2614# 2615# Update: Joerg Jenderek 2616# URL: http://fileformats.archiveteam.org/wiki/AR 2617# Reference: https://www.unix.com/man-page/opensolaris/3HEAD/ar.h/ 2618# Note: Mach-O universal binary in ./cafebabe is dependent 2619# TODO: unify current ar archive, MIPS archive, Debian package 2620# distinguish BSD, SVR; 32, 64 bit; HP from other 32-bit SVR; 2621# *.ar packages from *.a libraries. handle empty archive 26220 string =!<arch>\n current ar archive 2623# print first and possibly second ar_name[16] for debugging purpose 2624#>8 string x \b, 1st "%.16s" 2625#>68 string x \b, 2nd "%.16s" 2626!:mime application/x-archive 2627# a in most case for libraries; lib for Microsoft libraries; ar else cases 2628!:ext a/lib/ar 2629>8 string __.SYMDEF random library 2630# first member with long marked name __.SYMDEF SORTED implies BSD library 2631>68 string __.SYMDEF\ SORTED random library 2632# Reference: https://parisc.wiki.kernel.org/images-parisc/b/b2/Rad_11_0_32.pdf 2633# "archive file" entry moved from ./hp 2634# LST header system_id 0210h~PA-RISC 1.1,... identifies the target architecture 2635# LST header a_magic 0619h~relocatable library 2636>68 belong 0x020b0619 - PA-RISC1.0 relocatable library 2637>68 belong 0x02100619 - PA-RISC1.1 relocatable library 2638>68 belong 0x02110619 - PA-RISC1.2 relocatable library 2639>68 belong 0x02140619 - PA-RISC2.0 relocatable library 2640#EOF for common ar archives 2641 2642# 2643# "Thin" archive, as can be produced by GNU ar. 2644# 26450 string =!<thin>\n thin archive with 2646>68 belong 0 no symbol entries 2647>68 belong 1 %d symbol entry 2648>68 belong >1 %d symbol entries 2649 26500 search/1 -h- Software Tools format archive text 2651 2652# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com) 2653# 2654# The first byte is the magic (0x1a), byte 2 is the compression type for 2655# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS 2656# filename of the first file (null terminated). Since some types collide 2657# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), 2658# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 26590 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW 2660!:mime application/x-arc 26610 lelong&0x8080ffff 0x0000091a ARC archive data, squashed 2662!:mime application/x-arc 26630 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed 2664!:mime application/x-arc 26650 lelong&0x8080ffff 0x0000031a ARC archive data, packed 2666!:mime application/x-arc 26670 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 2668!:mime application/x-arc 26690 lelong&0x8080ffff 0x0000061a ARC archive data, crunched 2670!:mime application/x-arc 2671# [JW] stuff taken from idarc, obviously ARC successors: 26720 lelong&0x8080ffff 0x00000a1a PAK archive data 2673!:mime application/x-arc 26740 lelong&0x8080ffff 0x0000141a ARC+ archive data 2675!:mime application/x-arc 26760 lelong&0x8080ffff 0x0000481a HYP archive data 2677!:mime application/x-arc 2678 2679# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) 2680# I can't create either SPARK or ArcFS archives so I have not tested this stuff 2681# [GRR: the original entries collide with ARC, above; replaced with combined 2682# version (not tested)] 2683#0 byte 0x1a RISC OS archive (spark format) 26840 string \032archive RISC OS archive (ArcFS format) 26850 string Archive\000 RISC OS archive (ArcFS format) 2686 2687# All these were taken from idarc, many could not be verified. Unfortunately, 2688# there were many low-quality sigs, i.e. easy to trigger false positives. 2689# Please notify me of any real-world fishy/ambiguous signatures and I'll try 2690# to get my hands on the actual archiver and see if I find something better. [JW] 2691# probably many can be enhanced by finding some 0-byte or control char near the start 2692 2693# idarc calls this Crush/Uncompressed... *shrug* 26940 string CRUSH Crush archive data 2695# Squeeze It (.sqz) 26960 string HLSQZ Squeeze It archive data 2697# SQWEZ 26980 string SQWEZ SQWEZ archive data 2699# HPack (.hpk) 27000 string HPAK HPack archive data 2701# HAP 27020 string \x91\x33HF HAP archive data 2703# MD/MDCD 27040 string MDmd MDCD archive data 2705# LIM 27060 string LIM\x1a LIM archive data 2707# SAR 27083 string LH5 SAR archive data 2709# BSArc/BS2 27100 string \212\3SB\020\0 BSArc/BS2 archive data 2711# Bethesda Softworks Archive (Oblivion) 27120 string BSA\0 BSArc archive data 2713>4 lelong x version %d 2714# MAR 27152 string =-ah MAR archive data 2716# ACB 2717#0 belong&0x00f800ff 0x00800000 ACB archive data 2718# CPZ 2719# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data 2720# JRC 27210 string JRchive JRC archive data 2722# Quantum 27230 string DS\0 Quantum archive data 2724# ReSOF 27250 string PK\3\6 ReSOF archive data 2726# QuArk 27270 string 7\4 QuArk archive data 2728# YAC 272914 string YC YAC archive data 2730# X1 27310 string X1 X1 archive data 27320 string XhDr X1 archive data 2733# CDC Codec (.dqt) 27340 belong&0xffffe000 0x76ff2000 CDC Codec archive data 2735# AMGC 27360 string \xad6" AMGC archive data 2737# NuLIB 27380 string N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data 2739# PakLeo 27400 string LEOLZW PAKLeo archive data 2741# ChArc 27420 string SChF ChArc archive data 2743# PSA 27440 string PSA PSA archive data 2745# CrossePAC 27460 string DSIGDCC CrossePAC archive data 2747# Freeze 27480 string \x1f\x9f\x4a\x10\x0a Freeze archive data 2749# KBoom 27500 string \xc2\xa8MP\xc2\xa8 KBoom archive data 2751# NSQ, must go after CDC Codec 27520 string \x76\xff NSQ archive data 2753# DPA 27540 string Dirk\ Paehl DPA archive data 2755# BA 2756# TODO: idarc says "bytes 0-2 == bytes 3-5" 2757# TTComp 2758# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive 2759# Update: Joerg Jenderek 2760# GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others 27610 string \0\6 2762# look for first keyword of Panorama database *.pan 2763>12 search/261 DESIGN 2764# skip keyword with low entropy 2765>12 default x TTComp archive, binary, 4K dictionary 2766# (version 5.25) labeled the above entry as "TTComp archive data" 2767# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 27680 string ESP ESP archive data 2769# ZPack 27700 string \1ZPK\1 ZPack archive data 2771# Sky 27720 string \xbc\x40 Sky archive data 2773# UFA 27740 string UFA UFA archive data 2775# Dry 27760 string =-H2O DRY archive data 2777# FoxSQZ 27780 string FOXSQZ FoxSQZ archive data 2779# AR7 27800 string ,AR7 AR7 archive data 2781# PPMZ 27820 string PPMZ PPMZ archive data 2783# MS Compress 2784# Update: Joerg Jenderek 2785# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression 2786# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html 2787# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z 27884 string \x88\xf0\x27 2789# KWAJ variant 2790>0 string KWAJ MS Compress archive data, KWAJ variant 2791!:mime application/x-ms-compress-kwaj 2792# extension not working in version 5.32 2793# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_' has bad char '?' 2794# file: line 284: Bad magic entry ' ??_' 2795!:ext ??_ 2796# compression method (0-4) 2797>>8 uleshort x \b, %u method 2798# offset of compressed data 2799>>10 uleshort x \b, 0x%x offset 2800#>>(10.s) uleshort x 2801#>>>&-6 string x \b, TEST extension %-.3s 2802# header flags to mark header extensions 2803>>12 uleshort >0 \b, 0x%x flags 2804# 4 bytes: decompressed length of file 2805>>12 uleshort &0x01 2806>>>14 ulelong x \b, original size: %u bytes 2807# 2 bytes: unknown purpose 2808# 2 bytes: length of unknown data + mentioned bytes 2809# 1-9 bytes: null-terminated file name 2810# 1-4 bytes: null-terminated file extension 2811>>12 uleshort &0x08 2812>>>12 uleshort ^0x01 2813>>>>12 uleshort ^0x02 2814>>>>>12 uleshort ^0x04 2815>>>>>>12 uleshort ^0x10 2816>>>>>>>14 string x \b, %-.8s 2817>>>>>>12 uleshort &0x10 2818>>>>>>>14 string x \b, %-.8s 2819>>>>>>>>&1 string x \b.%-.3s 2820>>>>>12 uleshort &0x04 2821>>>>>>12 uleshort ^0x10 2822>>>>>>>(14.s) uleshort x 2823>>>>>>>>&14 string x \b, %-.8s 2824>>>>>>12 uleshort &0x10 2825>>>>>>>(14.s) uleshort x 2826>>>>>>>>&14 string x \b, %-.8s 2827>>>>>>>>>&1 string x \b.%-.3s 2828>>>>12 uleshort &0x02 2829>>>>>12 uleshort ^0x04 2830>>>>>>12 uleshort ^0x10 2831>>>>>>>16 string x \b, %-.8s 2832>>>>>>12 uleshort &0x10 2833>>>>>>>16 string x \b, %-.8s 2834>>>>>>>>&1 string x \b.%-.3s 2835>>>>>12 uleshort &0x04 2836>>>>>>12 uleshort ^0x10 2837>>>>>>>(16.s) uleshort x 2838>>>>>>>>&16 string x \b, %-.8s 2839>>>>>>12 uleshort &0x10 2840>>>>>>>(16.s) uleshort x 2841>>>>>>>&16 string x %-.8s 2842>>>>>>>>&1 string x \b.%-.3s 2843>>>12 uleshort &0x01 2844>>>>12 uleshort ^0x02 2845>>>>>12 uleshort ^0x04 2846>>>>>>12 uleshort ^0x10 2847>>>>>>>18 string x \b, %-.8s 2848>>>>>>12 uleshort &0x10 2849>>>>>>>18 string x \b, %-.8s 2850>>>>>>>>&1 string x \b.%-.3s 2851>>>>>12 uleshort &0x04 2852>>>>>>12 uleshort ^0x10 2853>>>>>>>(18.s) uleshort x 2854>>>>>>>>&18 string x \b, %-.8s 2855>>>>>>12 uleshort &0x10 2856>>>>>>>(18.s) uleshort x 2857>>>>>>>>&18 string x \b, %-.8s 2858>>>>>>>>>&1 string x \b.%-.3s 2859>>>>12 uleshort &0x02 2860>>>>>12 uleshort ^0x04 2861>>>>>>12 uleshort ^0x10 2862>>>>>>>20 string x \b, %-.8s 2863>>>>>>12 uleshort &0x10 2864>>>>>>>20 string x \b, %-.8s 2865>>>>>>>>&1 string x \b.%-.3s 2866>>>>>12 uleshort &0x04 2867>>>>>>12 uleshort ^0x10 2868>>>>>>>(20.s) uleshort x 2869>>>>>>>>&20 string x \b, %-.8s 2870>>>>>>12 uleshort &0x10 2871>>>>>>>(20.s) uleshort x 2872>>>>>>>>&20 string x \b, %-.8s 2873>>>>>>>>>&1 string x \b.%-.3s 2874# 2 bytes: length of data + mentioned bytes 2875# 2876# SZDD variant Haruhiko Okumura's LZSS or 7z type MsLZ 2877>0 string SZDD MS Compress archive data, SZDD variant 2878!:mime application/x-ms-compress-szdd 2879!:ext ??_ 2880# The character missing from the end of the filename (0=unknown) 2881>>9 string >\0 \b, %-.1s is last character of original name 2882# https://www.betaarchive.com/forum/viewtopic.php?t=26161 2883# Compression mode: "A" (0x41) found but sometimes "B" in Windows 3.1 builds 026 and 034e 2884>>8 string !A \b, %-.1s method 2885>>10 ulelong >0 \b, original size: %u bytes 2886# QBasic SZDD variant 28873 string \x88\xf0\x27 2888>0 string SZ\x20 MS Compress archive data, QBasic variant 2889!:mime application/x-ms-compress-sz 2890!:ext ??$ 2891>>8 ulelong >0 \b, original size: %u bytes 2892 2893# MP3 (archiver, not lossy audio compression) 28940 string MP3\x1a MP3-Archiver archive data 2895# ZET 28960 string OZ\xc3\x9d ZET archive data 2897# TSComp 28980 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data 2899# ARQ 29000 string gW\4\1 ARQ archive data 2901# Squash 29023 string OctSqu Squash archive data 2903# Terse 29040 string \5\1\1\0 Terse archive data 2905# PUCrunch 29060 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data 2907# UHarc 29080 string UHA UHarc archive data 2909# ABComp 29100 string \2AB ABComp archive data 29110 string \3AB2 ABComp archive data 2912# CMP 29130 string CO\0 CMP archive data 2914# Splint 29150 string \x93\xb9\x06 Splint archive data 2916# InstallShield 29170 string \x13\x5d\x65\x8c InstallShield Z archive Data 2918# Gather 29191 string GTH Gather archive data 2920# BOA 29210 string BOA BOA archive data 2922# RAX 29230 string ULEB\xa RAX archive data 2924# Xtreme 29250 string ULEB\0 Xtreme archive data 2926# Pack Magic 29270 string @\xc3\xa2\1\0 Pack Magic archive data 2928# BTS 29290 belong&0xfeffffff 0x1a034465 BTS archive data 2930# ELI 5750 29310 string Ora\ ELI 5750 archive data 2932# QFC 29330 string \x1aFC\x1a QFC archive data 29340 string \x1aQF\x1a QFC archive data 2935# PRO-PACK 29360 string RNC PRO-PACK archive data 2937# 777 29380 string 777 777 archive data 2939# LZS221 29400 string sTaC LZS221 archive data 2941# HPA 29420 string HPA HPA archive data 2943# Arhangel 29440 string LG Arhangel archive data 2945# EXP1, uses bzip2 29460 string 0123456789012345BZh EXP1 archive data 2947# IMP 29480 string IMP\xa IMP archive data 2949# NRV 29500 string \x00\x9E\x6E\x72\x76\xFF NRV archive data 2951# Squish 29520 string \x73\xb2\x90\xf4 Squish archive data 2953# Par 29540 string PHILIPP Par archive data 29550 string PAR Par archive data 2956# HIT 29570 string UB HIT archive data 2958# SBX 29590 belong&0xfffff000 0x53423000 SBX archive data 2960# NaShrink 29610 string NSK NaShrink archive data 2962# SAPCAR 29630 string #\ CAR\ archive\ header SAPCAR archive data 29640 string CAR\ 2.00RG SAPCAR archive data 2965# Disintegrator 29660 string DST Disintegrator archive data 2967# ASD 29680 string ASD ASD archive data 2969# InstallShield CAB 29700 string ISc( InstallShield CAB 2971# TOP4 29720 string T4\x1a TOP4 archive data 2973# BatComp left out: sig looks like COM executable 2974# so TODO: get real 4dos batcomp file and find sig 2975# BlakHole 29760 string BH\5\7 BlakHole archive data 2977# BIX 29780 string BIX0 BIX archive data 2979# ChiefLZA 29800 string ChfLZ ChiefLZA archive data 2981# Blink 29820 string Blink Blink archive data 2983# Logitech Compress 29840 string \xda\xfa Logitech Compress archive data 2985# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 29861 string (C)\ STEPANYUK ARS-Sfx archive data 2987# AKT/AKT32 29880 string AKT32 AKT32 archive data 29890 string AKT AKT archive data 2990# NPack 29910 string MSTSM NPack archive data 2992# PFT 29930 string \0\x50\0\x14 PFT archive data 2994# SemOne 29950 string SEM SemOne archive data 2996# PPMD 29970 string \x8f\xaf\xac\x84 PPMD archive data 2998# FIZ 29990 string FIZ FIZ archive data 3000# MSXiE 30010 belong&0xfffff0f0 0x4d530000 MSXiE archive data 3002# DeepFreezer 30030 belong&0xfffffff0 0x797a3030 DeepFreezer archive data 3004# DC 30050 string =<DC- DC archive data 3006# TPac 30070 string \4TPAC\3 TPac archive data 3008# Ai 30090 string Ai\1\1\0 Ai archive data 30100 string Ai\1\0\0 Ai archive data 3011# Ai32 30120 string Ai\2\0 Ai32 archive data 30130 string Ai\2\1 Ai32 archive data 3014# SBC 30150 string SBC SBC archive data 3016# Ybs 30170 string YBS Ybs archive data 3018# DitPack 30190 string \x9e\0\0 DitPack archive data 3020# DMS 30210 string DMS! DMS archive data 3022# EPC 30230 string \x8f\xaf\xac\x8c EPC archive data 3024# VSARC 30250 string VS\x1a VSARC archive data 3026# PDZ 30270 string PDZ PDZ archive data 3028# ReDuq 30290 string rdqx ReDuq archive data 3030# GCA 30310 string GCAX GCA archive data 3032# PPMN 30330 string pN PPMN archive data 3034# WinImage 30353 string WINIMAGE WinImage archive data 3036# Compressia 30370 string CMP0CMP Compressia archive data 3038# UHBC 30390 string UHB UHBC archive data 3040# WinHKI 30410 string \x61\x5C\x04\x05 WinHKI archive data 3042# WWPack data file 30430 string WWP WWPack archive data 3044# BSN (BSA, PTS-DOS) 30450 string \xffBSG BSN archive data 30461 string \xffBSG BSN archive data 30473 string \xffBSG BSN archive data 30481 string \0\xae\2 BSN archive data 30491 string \0\xae\3 BSN archive data 30501 string \0\xae\7 BSN archive data 3051# AIN 30520 string \x33\x18 AIN archive data 30530 string \x33\x17 AIN archive data 3054# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015 3055# SZip (TODO: doesn't catch all versions) 30560 string SZ\x0a\4 SZip archive data 3057# XPack DiskImage 3058# *.XDI updated by Joerg Jenderek Sep 2015 3059# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 3060# GRR: this test is still too general as it catches also text files starting with jm 30610 string jm 3062# only found examples with this additional characteristic 2 bytes 3063>2 string \x2\x4 Xpack DiskImage archive data 3064#!:ext xdi 3065# XPack Data 3066# *.xpa updated by Joerg Jenderek Sep 2015 3067# ftp://ftp.elf.stuba.sk/pub/pc/pack/ 30680 string xpa XPA 3069!:ext xpa 3070# XPA32 3071# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip 3072# created by XPA32.EXE version 1.0.2 for Windows 3073>0 string xpa\0\1 \b32 archive data 3074# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 3075>3 ubeshort !0x0001 \bck archive data 3076# XPack Single Data 3077# changed by Joerg Jenderek Sep 2015 back to like in version 5.12 3078# letter 'I'+ acute accent is equivalent to \xcd 30790 string \xcd\ jm Xpack single archive data 3080#!:mime application/x-xpa-compressed 3081!:ext xpa 3082 3083# TODO: missing due to unknown magic/magic at end of file: 3084#DWC 3085#ARG 3086#ZAR 3087#PC/3270 3088#InstallIt 3089#RKive 3090#RK 3091#XPack Diskimage 3092 3093# These were inspired by idarc, but actually verified 3094# Dzip archiver (.dz) 3095# Update: Joerg Jenderek 3096# URL: http://speeddemosarchive.com/dzip/ 3097# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 3098# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt 30990 string DZ 3100# latest version is 2.9 dated 7 may 2003 3101>2 byte <4 Dzip archive data 3102!:mime application/x-dzip 3103!:ext dz 3104>>2 byte x \b, version %i 3105>>3 byte x \b.%i 3106>>4 ulelong x \b, offset 0x%x 3107>>8 ulelong x \b, %u files 3108# ZZip archiver (.zz) 31090 string ZZ\ \0\0 ZZip archive data 31100 string ZZ0 ZZip archive data 3111# PAQ archiver (.paq) 31120 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 31130 string PAQ PAQ archive data 3114>3 byte&0xf0 0x30 3115>>3 byte x (v%c) 3116# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 31170xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 31180 string JARCS JAR (ARJ Software, Inc.) archive data 3119 3120# ARJ archiver (jason@jarthur.Claremont.EDU) 31210 leshort 0xea60 ARJ archive data 3122!:mime application/x-arj 3123>5 byte x \b, v%d, 3124>8 byte &0x04 multi-volume, 3125>8 byte &0x10 slash-switched, 3126>8 byte &0x20 backup, 3127>34 string x original name: %s, 3128>7 byte 0 os: MS-DOS 3129>7 byte 1 os: PRIMOS 3130>7 byte 2 os: Unix 3131>7 byte 3 os: Amiga 3132>7 byte 4 os: Macintosh 3133>7 byte 5 os: OS/2 3134>7 byte 6 os: Apple ][ GS 3135>7 byte 7 os: Atari ST 3136>7 byte 8 os: NeXT 3137>7 byte 9 os: VAX/VMS 3138>3 byte >0 %d] 3139# [JW] idarc says this is also possible 31402 leshort 0xea60 ARJ archive data 3141 3142# HA archiver (Greg Roelofs, newt@uchicago.edu) 3143# This is a really bad format. A file containing HAWAII will match this... 3144#0 string HA HA archive data, 3145#>2 leshort =1 1 file, 3146#>2 leshort >1 %hu files, 3147#>4 byte&0x0f =0 first is type CPY 3148#>4 byte&0x0f =1 first is type ASC 3149#>4 byte&0x0f =2 first is type HSC 3150#>4 byte&0x0f =0x0e first is type DIR 3151#>4 byte&0x0f =0x0f first is type SPECIAL 3152# suggestion: at least identify small archives (<1024 files) 31530 belong&0xffff00fc 0x48410000 HA archive data 3154>2 leshort =1 1 file, 3155>2 leshort >1 %u files, 3156>4 byte&0x0f =0 first is type CPY 3157>4 byte&0x0f =1 first is type ASC 3158>4 byte&0x0f =2 first is type HSC 3159>4 byte&0x0f =0x0e first is type DIR 3160>4 byte&0x0f =0x0f first is type SPECIAL 3161 3162# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 31630 string HPAK HPACK archive data 3164 3165# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net 31660 string \351,\001JAM\ JAM archive, 3167>7 string >\0 version %.4s 3168>0x26 byte =0x27 - 3169>>0x2b string >\0 label %.11s, 3170>>0x27 lelong x serial %08x, 3171>>0x36 string >\0 fstype %.8s 3172 3173# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) 3174# Update: Joerg Jenderek 3175# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3176# Reference: https://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html 3177# 3178# check and display information of lharc (LHa,PMarc) file 31790 name lharc-file 3180# check 1st character of method id like -lz4- -lh5- or -pm2- 3181>2 string - 3182# check 5th character of method id 3183>>6 string - 3184# check header level 0 1 2 3 3185>>>20 ubyte <4 3186# check 2nd, 3th and 4th character of method id 3187>>>>3 regex \^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1) \b 3188!:mime application/x-lzh-compressed 3189# creator type "LHA " 3190!:apple ????LHA 3191# display archive type name like "LHa/LZS archive data" or "LArc archive" 3192>>>>>2 string -lz \b 3193!:ext lzs 3194# already known -lzs- -lz4- -lz5- with old names 3195>>>>>>2 string -lzs LHa/LZS archive data 3196>>>>>>3 regex \^lz[45] LHarc 1.x archive data 3197# missing -lz?- with wikipedia names 3198>>>>>>3 regex \^lz[2378] LArc archive 3199# display archive type name like "LHa (2.x) archive data" 3200>>>>>2 string -lh \b 3201# already known -lh0- -lh1- -lh2- -lh3- -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names 3202>>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data 3203# LHice archiver use ".ICE" as name extension instead usual one ".lzh" 3204# FOOBAR archiver use ".foo" as name extension instead usual one 3205# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment 3206>>>>>>>2 string -lh1 \b 3207!:ext lha/lzh/ice 3208>>>>>>3 regex \^lh[23d] LHa 2.x? archive data 3209>>>>>>3 regex \^lh[7] LHa (2.x)/LHark archive data 3210>>>>>>3 regex \^lh[456] LHa (2.x) archive data 3211>>>>>>>2 string -lh5 \b 3212# https://en.wikipedia.org/wiki/BIOS 3213# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like 3214# bios.rom , kd7_v14.bin, 1010.004, ... 3215!:ext lha/lzh/rom/bin 3216# missing -lh?- variants (Joe Jared) 3217>>>>>>3 regex \^lh[89a-ce] LHa (Joe Jared) archive 3218# UNLHA32 2.67a 3219>>>>>>2 string -lhx LHa (UNLHA32) archive 3220# lha archives with standard file name extensions ".lha" ".lzh" 3221>>>>>>3 regex !\^(lh1|lh5) \b 3222!:ext lha/lzh 3223# this should not happen if all -lh variants are described 3224>>>>>>2 default x LHa (unknown) archive 3225#!:ext lha 3226# PMarc 3227>>>>>3 regex \^pm[012] PMarc archive data 3228!:ext pma 3229# append method id without leading and trailing minus character 3230>>>>>3 string x [%3.3s] 3231>>>>>>0 use lharc-header 3232# 3233# check and display information of lharc header 32340 name lharc-header 3235# header size 0x4 , 0x1b-0x61 3236>0 ubyte x 3237# compressed data size != compressed file size 3238#>7 ulelong x \b, data size %d 3239# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 3240#>19 ubyte x \b, 19_0x%x 3241# level identifier 0 1 2 3 3242#>20 ubyte x \b, level %d 3243# time stamp 3244#>15 ubelong x DATE 0x%8.8x 3245# OS ID for level 1 3246>20 ubyte 1 3247# 0x20 types find for *.rom files 3248>>(21.b+24) ubyte <0x21 \b, 0x%x OS 3249# ascii type like M for MSDOS 3250>>(21.b+24) ubyte >0x20 \b, '%c' OS 3251# OS ID for level 2 3252>20 ubyte 2 3253#>>23 ubyte x \b, OS ID 0x%x 3254>>23 ubyte <0x21 \b, 0x%x OS 3255>>23 ubyte >0x20 \b, '%c' OS 3256# filename only for level 0 and 1 3257>20 ubyte <2 3258# length of filename 3259>>21 ubyte >0 \b, with 3260# filename 3261>>>21 pstring x "%s" 3262# 3263#2 string -lh0- LHarc 1.x/ARX archive data [lh0] 3264#!:mime application/x-lharc 32652 string -lh0- 3266>0 use lharc-file 3267#2 string -lh1- LHarc 1.x/ARX archive data [lh1] 3268#!:mime application/x-lharc 32692 string -lh1- 3270>0 use lharc-file 3271# NEW -lz2- ... -lz8- 32722 string -lz2- 3273>0 use lharc-file 32742 string -lz3- 3275>0 use lharc-file 32762 string -lz4- 3277>0 use lharc-file 32782 string -lz5- 3279>0 use lharc-file 32802 string -lz7- 3281>0 use lharc-file 32822 string -lz8- 3283>0 use lharc-file 3284# [never seen any but the last; -lh4- reported in comp.compression:] 3285#2 string -lzs- LHa/LZS archive data [lzs] 32862 string -lzs- 3287>0 use lharc-file 3288# According to wikipedia and others such a version does not exist 3289#2 string -lh\40- LHa 2.x? archive data [lh ] 3290#2 string -lhd- LHa 2.x? archive data [lhd] 32912 string -lhd- 3292>0 use lharc-file 3293#2 string -lh2- LHa 2.x? archive data [lh2] 32942 string -lh2- 3295>0 use lharc-file 3296#2 string -lh3- LHa 2.x? archive data [lh3] 32972 string -lh3- 3298>0 use lharc-file 3299#2 string -lh4- LHa (2.x) archive data [lh4] 33002 string -lh4- 3301>0 use lharc-file 3302#2 string -lh5- LHa (2.x) archive data [lh5] 33032 string -lh5- 3304>0 use lharc-file 3305#2 string -lh6- LHa (2.x) archive data [lh6] 33062 string -lh6- 3307>0 use lharc-file 3308#2 string -lh7- LHa (2.x)/LHark archive data [lh7] 33092 string -lh7- 3310# !:mime application/x-lha 3311# >20 byte x - header level %d 3312>0 use lharc-file 3313# NEW -lh8- ... -lhe- , -lhx- 33142 string -lh8- 3315>0 use lharc-file 33162 string -lh9- 3317>0 use lharc-file 33182 string -lha- 3319>0 use lharc-file 33202 string -lhb- 3321>0 use lharc-file 33222 string -lhc- 3323>0 use lharc-file 33242 string -lhe- 3325>0 use lharc-file 33262 string -lhx- 3327>0 use lharc-file 3328# taken from idarc [JW] 33292 string -lZ PUT archive data 3330# already done by LHarc magics 3331# this should never happen if all sub types of LZS archive are identified 3332#2 string -lz LZS archive data 33332 string -sw1- Swag archive data 3334 33350 name rar-file-header 3336>24 byte 15 \b, v1.5 3337>24 byte 20 \b, v2.0 3338>24 byte 29 \b, v4 3339>15 byte 0 \b, os: MS-DOS 3340>15 byte 1 \b, os: OS/2 3341>15 byte 2 \b, os: Win32 3342>15 byte 3 \b, os: Unix 3343>15 byte 4 \b, os: Mac OS 3344>15 byte 5 \b, os: BeOS 3345 33460 name rar-archive-header 3347>3 leshort&0x1ff >0 \b, flags: 3348>>3 leshort &0x01 ArchiveVolume 3349>>3 leshort &0x02 Commented 3350>>3 leshort &0x04 Locked 3351>>3 leshort &0x10 NewVolumeNaming 3352>>3 leshort &0x08 Solid 3353>>3 leshort &0x20 Authenticated 3354>>3 leshort &0x40 RecoveryRecordPresent 3355>>3 leshort &0x80 EncryptedBlockHeader 3356>>3 leshort &0x100 FirstVolume 3357 3358# RAR (Roshal Archive) archive 33590 string Rar!\x1a\7\0 RAR archive data 3360!:mime application/x-rar 3361!:ext rar/cbr 3362# file header 3363>(0xc.l+9) byte 0x74 3364>>(0xc.l+7) use rar-file-header 3365# subblock seems to share information with file header 3366>(0xc.l+9) byte 0x7a 3367>>(0xc.l+7) use rar-file-header 3368>9 byte 0x73 3369>>7 use rar-archive-header 3370 33710 string Rar!\x1a\7\1\0 RAR archive data, v5 3372!:mime application/x-rar 3373!:ext rar 3374 3375# Very old RAR archive 3376# https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf 33770 string RE\x7e\x5e RAR archive data (<v1.5) 3378!:mime application/x-rar 3379!:ext rar/cbr 3380 3381# SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 33820 string SQSH squished archive data (Acorn RISCOS) 3383 3384# UC2 archiver (Greg Roelofs, newt@uchicago.edu) 3385# [JW] see exe section for self-extracting version 33860 string UC2\x1a UC2 archive data 3387 3388# PKZIP multi-volume archive 33890 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract 3390!:mime application/zip 3391!:ext zip/cbz 3392 3393# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 33940 string PK\005\006 Zip archive data (empty) 3395!:mime application/zip 3396!:ext zip/cbz 3397!:strength +1 33980 string PK\003\004 3399!:strength +1 3400 3401# Specialised zip formats which start with a member named 'mimetype' 3402# (stored uncompressed, with no 'extra field') containing the file's MIME type. 3403# Check for have 8-byte name, 0-byte extra field, name "mimetype", and 3404# contents starting with "application/": 3405>26 string \x8\0\0\0mimetypeapplication/ 3406 3407# KOffice / OpenOffice & StarOffice / OpenDocument formats 3408# From: Abel Cheung <abel@oaka.org> 3409 3410# KOffice (1.2 or above) formats 3411# (mimetype contains "application/vnd.kde.<SUBTYPE>") 3412>>50 string vnd.kde. KOffice (>=1.2) 3413>>>58 string karbon Karbon document 3414>>>58 string kchart KChart document 3415>>>58 string kformula KFormula document 3416>>>58 string kivio Kivio document 3417>>>58 string kontour Kontour document 3418>>>58 string kpresenter KPresenter document 3419>>>58 string kspread KSpread document 3420>>>58 string kword KWord document 3421 3422# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) 3423# (mimetype contains "application/vnd.sun.xml.<SUBTYPE>") 3424>>50 string vnd.sun.xml. OpenOffice.org 1.x 3425>>>62 string writer Writer 3426>>>>68 byte !0x2e document 3427>>>>68 string .template template 3428>>>>68 string .global global document 3429>>>62 string calc Calc 3430>>>>66 byte !0x2e spreadsheet 3431>>>>66 string .template template 3432>>>62 string draw Draw 3433>>>>66 byte !0x2e document 3434>>>>66 string .template template 3435>>>62 string impress Impress 3436>>>>69 byte !0x2e presentation 3437>>>>69 string .template template 3438>>>62 string math Math document 3439>>>62 string base Database file 3440 3441# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) 3442# https://lists.oasis-open.org/archives/office/200505/msg00006.html 3443# (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>") 3444>>50 string vnd.oasis.opendocument. OpenDocument 3445>>>73 string text 3446>>>>77 byte !0x2d Text 3447!:mime application/vnd.oasis.opendocument.text 3448>>>>77 string -template Text Template 3449!:mime application/vnd.oasis.opendocument.text-template 3450>>>>77 string -web HTML Document Template 3451!:mime application/vnd.oasis.opendocument.text-web 3452>>>>77 string -master Master Document 3453!:mime application/vnd.oasis.opendocument.text-master 3454>>>73 string graphics 3455>>>>81 byte !0x2d Drawing 3456!:mime application/vnd.oasis.opendocument.graphics 3457>>>>81 string -template Template 3458!:mime application/vnd.oasis.opendocument.graphics-template 3459>>>73 string presentation 3460>>>>85 byte !0x2d Presentation 3461!:mime application/vnd.oasis.opendocument.presentation 3462>>>>85 string -template Template 3463!:mime application/vnd.oasis.opendocument.presentation-template 3464>>>73 string spreadsheet 3465>>>>84 byte !0x2d Spreadsheet 3466!:mime application/vnd.oasis.opendocument.spreadsheet 3467>>>>84 string -template Template 3468!:mime application/vnd.oasis.opendocument.spreadsheet-template 3469>>>73 string chart 3470>>>>78 byte !0x2d Chart 3471!:mime application/vnd.oasis.opendocument.chart 3472>>>>78 string -template Template 3473!:mime application/vnd.oasis.opendocument.chart-template 3474>>>73 string formula 3475>>>>80 byte !0x2d Formula 3476!:mime application/vnd.oasis.opendocument.formula 3477>>>>80 string -template Template 3478!:mime application/vnd.oasis.opendocument.formula-template 3479>>>73 string database Database 3480!:mime application/vnd.oasis.opendocument.database 3481# Valid for LibreOffice Base 6.0.1.1 at least 3482>>>73 string base Database 3483!:mime application/vnd.oasis.opendocument.base 3484>>>73 string image 3485>>>>78 byte !0x2d Image 3486!:mime application/vnd.oasis.opendocument.image 3487>>>>78 string -template Template 3488!:mime application/vnd.oasis.opendocument.image-template 3489 3490# EPUB (OEBPS) books using OCF (OEBPS Container Format) 3491# https://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4. 3492# From: Ralf Brown <ralf.brown@gmail.com> 3493>>50 string epub+zip EPUB document 3494!:mime application/epub+zip 3495 3496# Catch other ZIP-with-mimetype formats 3497# In a ZIP file, the bytes immediately after a member's contents are 3498# always "PK". The 2 regex rules here print the "mimetype" member's 3499# contents up to the first 'P'. Luckily, most MIME types don't contain 3500# any capital 'P's. This is a kludge. 3501# (mimetype contains "application/<OTHER>") 3502>>50 string !epub+zip 3503>>>50 string !vnd.oasis.opendocument. 3504>>>>50 string !vnd.sun.xml. 3505>>>>>50 string !vnd.kde. 3506>>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 3507!:mime application/zip 3508# (mimetype contents other than "application/*") 3509>26 string \x8\0\0\0mimetype 3510>>38 string !application/ 3511>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?) 3512!:mime application/zip 3513 3514# Java Jar files 3515>(26.s+30) leshort 0xcafe Java archive data (JAR) 3516!:mime application/java-archive 3517 3518# iOS App 3519>(26.s+30) leshort !0xcafe 3520>>26 string !\x8\0\0\0mimetype 3521>>>30 string Payload/ 3522>>>>38 search/64 .app/ iOS App 3523!:mime application/x-ios-app 3524 3525 3526# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) 3527# Next line excludes specialized formats: 3528>(26.s+30) leshort !0xcafe 3529>>26 string !\x8\0\0\0mimetype Zip archive data 3530!:mime application/zip 3531>>>4 beshort x \b, at least 3532>>>4 use zipversion 3533>>>4 beshort x to extract 3534>>>0x161 string WINZIP \b, WinZIP self-extracting 3535 3536# StarView Metafile 3537# From Pierre Ducroquet <pinaraf@pinaraf.info> 35380 string VCLMTF StarView MetaFile 3539>6 beshort x \b, version %d 3540>8 belong x \b, size %d 3541 3542# Zoo archiver 354320 lelong 0xfdc4a7dc Zoo archive data 3544!:mime application/x-zoo 3545>4 byte >48 \b, v%c. 3546>>6 byte >47 \b%c 3547>>>7 byte >47 \b%c 3548>32 byte >0 \b, modify: v%d 3549>>33 byte x \b.%d+ 3550>42 lelong 0xfdc4a7dc \b, 3551>>70 byte >0 extract: v%d 3552>>>71 byte x \b.%d+ 3553 3554# Shell archives 355510 string #\ This\ is\ a\ shell\ archive shell archive text 3556!:mime application/octet-stream 3557 3558# 3559# LBR. NB: May conflict with the questionable 3560# "binary Computer Graphics Metafile" format. 3561# 35620 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data 3563# 3564# PMA (CP/M derivative of LHA) 3565# Update: Joerg Jenderek 3566# URL: https://en.wikipedia.org/wiki/LHA_(file_format) 3567# 3568#2 string -pm0- PMarc archive data [pm0] 35692 string -pm0- 3570>0 use lharc-file 3571#2 string -pm1- PMarc archive data [pm1] 35722 string -pm1- 3573>0 use lharc-file 3574#2 string -pm2- PMarc archive data [pm2] 35752 string -pm2- 3576>0 use lharc-file 35772 string -pms- PMarc SFX archive (CP/M, DOS) 3578#!:mime application/x-foobar-exec 3579!:ext com 35805 string -pc1- PopCom compressed executable (CP/M) 3581#!:mime application/x- 3582#!:ext com 3583 3584# From Rafael Laboissiere <rafael@laboissiere.net> 3585# The Project Revision Control System (see 3586# http://prcs.sourceforge.net) generates a packaged project 3587# file which is recognized by the following entry: 35880 leshort 0xeb81 PRCS packaged project 3589 3590# Microsoft cabinets 3591# by David Necas (Yeti) <yeti@physics.muni.cz> 3592#0 string MSCF\0\0\0\0 Microsoft cabinet file data, 3593#>25 byte x v%d 3594#>24 byte x \b.%d 3595# MPi: All CABs have version 1.3, so this is pointless. 3596# Better magic in debian-additions. 3597 3598# GTKtalog catalogs 3599# by David Necas (Yeti) <yeti@physics.muni.cz> 36004 string gtktalog\ GTKtalog catalog data, 3601>13 string 3 version 3 3602>>14 beshort 0x677a (gzipped) 3603>>14 beshort !0x677a (not gzipped) 3604>13 string >3 version %s 3605 3606############################################################################ 3607# Parity archive reconstruction file, the 'par' file format now used on Usenet. 36080 string PAR\0 PARity archive data 3609>48 leshort =0 - Index file 3610>48 leshort >0 - file number %d 3611 3612# Felix von Leitner <felix-file@fefe.de> 36130 string d8:announce BitTorrent file 3614!:mime application/x-bittorrent 3615# Durval Menezes, <jmgthbfile at durval dot com> 36160 string d13:announce-list BitTorrent file 3617!:mime application/x-bittorrent 3618 3619# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi> 36200 beshort 0x0e0f Atari MSA archive data 3621>2 beshort x \b, %d sectors per track 3622>4 beshort 0 \b, 1 sided 3623>4 beshort 1 \b, 2 sided 3624>6 beshort x \b, starting track: %d 3625>8 beshort x \b, ending track: %d 3626 3627# Alternate ZIP string (amc@arwen.cs.berkeley.edu) 36280 string PK00PK\003\004 Zip archive data 3629!:mime application/zip 3630!:ext zip/cbz 3631 3632# ACE archive (from http://www.wotsit.org/download.asp?f=ace) 3633# by Stefan `Sec` Zehl <sec@42.org> 36347 string **ACE** ACE archive data 3635>15 byte >0 version %d 3636>16 byte =0x00 \b, from MS-DOS 3637>16 byte =0x01 \b, from OS/2 3638>16 byte =0x02 \b, from Win/32 3639>16 byte =0x03 \b, from Unix 3640>16 byte =0x04 \b, from MacOS 3641>16 byte =0x05 \b, from WinNT 3642>16 byte =0x06 \b, from Primos 3643>16 byte =0x07 \b, from AppleGS 3644>16 byte =0x08 \b, from Atari 3645>16 byte =0x09 \b, from Vax/VMS 3646>16 byte =0x0A \b, from Amiga 3647>16 byte =0x0B \b, from Next 3648>14 byte x \b, version %d to extract 3649>5 leshort &0x0080 \b, multiple volumes, 3650>>17 byte x \b (part %d), 3651>5 leshort &0x0002 \b, contains comment 3652>5 leshort &0x0200 \b, sfx 3653>5 leshort &0x0400 \b, small dictionary 3654>5 leshort &0x0800 \b, multi-volume 3655>5 leshort &0x1000 \b, contains AV-String 3656>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) 3657>5 leshort &0x2000 \b, with recovery record 3658>5 leshort &0x4000 \b, locked 3659>5 leshort &0x8000 \b, solid 3660# Date in MS-DOS format (whatever that is) 3661#>18 lelong x Created on 3662 3663# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann 3664# <doj@cubic.org> 36650x1A string sfArk sfArk compressed Soundfont 3666>0x15 string 2 3667>>0x1 string >\0 Version %s 3668>>0x2A string >\0 : %s 3669 3670# DR-DOS 7.03 Packed File *.??_ 36710 string Packed\ File\ Personal NetWare Packed File 3672>12 string x \b, was "%.12s" 3673 3674# EET archive 3675# From: Tilman Sauerbeck <tilman@code-monkey.de> 36760 belong 0x1ee7ff00 EET archive 3677!:mime application/x-eet 3678 3679# rzip archives 36800 string RZIP rzip compressed data 3681>4 byte x - version %d 3682>5 byte x \b.%d 3683>6 belong x (%d bytes) 3684 3685# From: Joerg Jenderek 3686# URL: https://help.foxitsoftware.com/kb/install-fzip-file.php 3687# reference: http://mark0.net/download/triddefs_xml.7z/ 3688# defs/f/fzip.trid.xml 3689# Note: unknown compression; No "PK" zip magic; normally in directory like 3690# "%APPDATA%\Foxit Software\Addon\Foxit Reader\Install" 36910 ubequad 0x2506781901010000 Foxit add-on/update 3692!:mime application/x-fzip 3693!:ext fzip 3694 3695# From: "Robert Dale" <robdale@gmail.com> 36960 belong 123 dar archive, 3697>4 belong x label "%.8x 3698>>8 belong x %.8x 3699>>>12 beshort x %.4x" 3700>14 byte 0x54 end slice 3701>14 beshort 0x4e4e multi-part 3702>14 beshort 0x4e53 multi-part, with -S 3703 3704# Symbian installation files 3705# https://www.thouky.co.uk/software/psifs/sis.html 3706# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 37078 lelong 0x10000419 Symbian installation file 3708!:mime application/vnd.symbian.install 3709>4 lelong 0x1000006D (EPOC release 3/4/5) 3710>4 lelong 0x10003A12 (EPOC release 6) 37110 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) 3712!:mime x-epoc/x-sisx-app 3713 3714# From "Nelson A. de Oliveira" <naoliv@gmail.com> 37150 string MPQ\032 MoPaQ (MPQ) archive 3716 3717# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 3718# .kgb 37190 string KGB_arch KGB Archiver file 3720>10 string x with compression level %.1s 3721 3722# xar (eXtensible ARchiver) archive 3723# URL: https://en.wikipedia.org/wiki/Xar_(archiver) 3724# xar archive format: https://code.google.com/p/xar/ 3725# From: "David Remahl" <dremahl@apple.com> 3726# Update: Joerg Jenderek 3727# TODO: lzma compression; X509Data for pkg and xip 3728# Note: verified by `xar --dump-header -f FullBundleUpdate.xar` or 3729# 7z t -txar Xcode_10.2_beta_4.xip` 37300 string xar! xar archive 3731!:mime application/x-xar 3732# pkg for Mac OSX installer package like FullBundleUpdate.pkg 3733# xip for signed Apple software like Xcode_10.2_beta_4.xip 3734!:ext xar/pkg/xip 3735# always 28 in older archives 3736>4 ubeshort >28 \b, header size %u 3737# currently there exit only version 1 since about 2014 3738>6 ubeshort >1 version %u, 3739>8 ubequad x compressed TOC: %llu, 3740#>16 ubequad x uncompressed TOC: %llu, 3741# cksum_alg 0-2 in older and also 3-4 in newer 3742>24 belong 0 no checksum 3743>24 belong 1 SHA-1 checksum 3744>24 belong 2 MD5 checksum 3745>24 belong 3 SHA-256 checksum 3746>24 belong 4 SHA-512 checksum 3747>24 belong >4 unknown 0x%x checksum 3748#>24 belong >4 checksum 3749# For no compression jump 0 bytes 3750>24 belong 0 3751>>0 ubyte x 3752# jump more bytes forward by header size 3753>>>&(4.S) ubyte x 3754# jump more bytes forward by compressed table of contents size 3755#>>>>&(8.Q) ubequad x \b, heap data 0x%llx 3756>>>>&(8.Q) ubyte x 3757# look for data by ./compress after message with 1 space at end 3758>>>>>&-3 indirect x \b, contains 3759# For SHA-1 jump 20 minus 2 bytes 3760>24 belong 1 3761>>18 ubyte x 3762# jump more bytes forward by header size 3763>>>&(4.S) ubyte x 3764# jump more bytes forward by compressed table of contents size 3765>>>>&(8.Q) ubyte x 3766# data compressed by gzip, bzip, lzma or none 3767>>>>>&-1 indirect x \b, contains 3768# For SHA-256 jump 32 minus 2 bytes 3769>24 belong 3 3770>>30 ubyte x 3771# jump more bytes forward by header size 3772>>>&(4.S) ubyte x 3773# jump more bytes forward by compressed table of contents size 3774>>>>&(8.Q) ubyte x 3775>>>>>&-1 indirect x \b, contains 3776# For SHA-512 jump 64 minus 2 bytes 3777>24 belong 4 3778>>62 ubyte x 3779# jump more bytes forward by header size 3780>>>&(4.S) ubyte x 3781# jump more bytes forward by compressed table of contents size 3782>>>>&(8.Q) ubyte x 3783>>>>>&-1 indirect x \b, contains 3784 3785# Type: Parity Archive 3786# From: Daniel van Eeden <daniel_e@dds.nl> 37870 string PAR2 Parity Archive Volume Set 3788 3789# Bacula volume format. (Volumes always start with a block header.) 3790# URL: https://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html 3791# From: Adam Buchbinder <adam.buchbinder@gmail.com> 379212 string BB02 Bacula volume 3793>20 bedate x \b, started %s 3794 3795# ePub is XHTML + XML inside a ZIP archive. The first member of the 3796# archive must be an uncompressed file called 'mimetype' with contents 3797# 'application/epub+zip' 3798 3799 3800# From: "Michael Gorny" <mgorny@gentoo.org> 3801# ZPAQ: http://mattmahoney.net/dc/zpaq.html 38020 string zPQ ZPAQ stream 3803>3 byte x \b, level %d 3804# From: Barry Carter <carter.barry@gmail.com> 3805# https://encode.ru/threads/456-zpaq-updates/page32 38060 string 7kSt ZPAQ file 3807 3808# BBeB ebook, unencrypted (LRF format) 3809# URL: https://www.sven.de/librie/Librie/LrfFormat 3810# From: Adam Buchbinder <adam.buchbinder@gmail.com> 38110 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted 3812>8 beshort x \b, version %d 3813>36 byte 1 \b, front-to-back 3814>36 byte 16 \b, back-to-front 3815>42 beshort x \b, (%dx, 3816>44 beshort x %d) 3817 3818# Symantec GHOST image by Joerg Jenderek at May 2014 3819# https://us.norton.com/ghost/ 3820# https://www.garykessler.net/library/file_sigs.html 38210 ubelong&0xFFFFf7f0 0xFEEF0100 Norton GHost image 3822# *.GHO 3823>2 ubyte&0x08 0x00 \b, first file 3824# *.GHS or *.[0-9] with cns program option 3825>2 ubyte&0x08 0x08 \b, split file 3826# part of split index interesting for *.ghs 3827>>4 ubyte x id=0x%x 3828# compression tag minus one equals numeric compression command line switch z[1-9] 3829>3 ubyte 0 \b, no compression 3830>3 ubyte 2 \b, fast compression (Z1) 3831>3 ubyte 3 \b, medium compression (Z2) 3832>3 ubyte >3 3833>>3 ubyte <11 \b, compression (Z%d-1) 3834>2 ubyte&0x08 0x00 3835# ~ 30 byte password field only for *.gho 3836>>12 ubequad !0 \b, password protected 3837>>44 ubyte !1 3838# 1~Image All, sector-by-sector only for *.gho 3839>>>10 ubyte 1 \b, sector copy 3840# 1~Image Boot track only for *.gho 3841>>>43 ubyte 1 \b, boot track 3842# 1~Image Disc only for *.gho implies Image Boot track and sector copy 3843>>44 ubyte 1 \b, disc sector copy 3844# optional image description only *.gho 3845>>0xff string >\0 "%-.254s" 3846# look for DOS sector end sequence 3847>0xE08 search/7776 \x55\xAA 3848>>&-512 indirect x \b; contains 3849 3850# Google Chrome extensions 3851# https://developer.chrome.com/extensions/crx 3852# https://developer.chrome.com/extensions/hosting 38530 string Cr24 Google Chrome extension 3854!:mime application/x-chrome-extension 3855>4 ulong x \b, version %u 3856 3857# SeqBox - Sequenced container 3858# ext: sbx, seqbox 3859# Marco Pontello marcopon@gmail.com 3860# reference: https://github.com/MarcoPon/SeqBox 38610 string SBx SeqBox, 3862>3 byte x version %d 3863 3864# LyNX archive 386556 string USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE LyNX archive 3866 3867# From: Joerg Jenderek 3868# URL: https://www.acronis.com/ 3869# Reference: https://en.wikipedia.org/wiki/TIB_(file_format) 3870# Note: only tested with True Image 2013 Build 5962 and 2019 Build 14110 38710 ubequad 0xce24b9a220000000 Acronis True Image backup 3872!:mime application/x-acronis-tib 3873!:ext tib 3874# 01000000 3875#>20 ubelong x \b, at 20 0x%x 3876# 20000000 3877#>28 ubelong x \b, at 28 0x%x 3878# strings like "Generic- SD/MMC 1.00" "Unknown Disk" "Msft Virtual Disk 1.0" 3879# ??? 3880# strings like "\Device\0000011e" "\Device\0000015a" 3881#>0 search/0x6852300/cs \\Device\\ 3882#>>&-1 pstring x \b, %s 3883# "\Device\HarddiskVolume30" "\Device\HarddiskVolume39" 3884#>>>&1 search/180/cs \\Device\\ 3885#>>>>&-1 pstring x \b, %s 3886#>>>>>&0 search/29/cs \0\0\xc8\0 3887# disk label 3888#>>>>>>&10 lestring16 x \b, disk label %11.11s 3889#>>>>>>&9 plestring16 x \b, disk label "%11.11s" 3890#>>>>>>&10 ubequad x %16.16llx 3891 3892 3893# Gentoo XPAK binary package 3894# by Michal Gorny <mgorny@gentoo.org> 3895# https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5 3896-4 string STOP 3897>-16 string XPAKSTOP Gentoo binary package (XPAK) 3898 3899# From: Joerg Jenderek 3900# URL: https://kodi.wiki/view/TexturePacker 3901# Reference: https://mirrors.kodi.tv/releases/source/17.3-Krypton.tar.gz 3902# /xbmc-Krypton/xbmc/guilib/XBTF.h 3903# /xbmc-Krypton/xbmc/guilib/XBTF.cpp 39040 string XBTF 3905# skip ASCII text by looking for terminating \0 of path 3906>264 ubyte 0 XBMC texture package 3907!:mime application/x-xbmc-xbt 3908!:ext xbt 3909# XBTF_VERSION 2 3910>>4 string !2 \b, version %-.1s 3911# nofFiles /xbmc-Krypton/xbmc/guilib/XBTFReader.cpp 3912>>5 ulelong x \b, %u file 3913# plural s 3914>>5 ulelong >1 \bs 3915# path[CXBTFFile[MaximumPathLength=256] 3916>>9 string x \b, 1st %s 3917 3918#------------------------------------------------------------------------------ 3919# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $ 3920# make: file(1) magic for assembler source 3921# 39220 regex \^[\040\t]{0,50}\\.asciiz assembler source text 3923!:mime text/x-asm 39240 regex \^[\040\t]{0,50}\\.byte assembler source text 3925!:mime text/x-asm 39260 regex \^[\040\t]{0,50}\\.even assembler source text 3927!:mime text/x-asm 39280 regex \^[\040\t]{0,50}\\.globl assembler source text 3929!:mime text/x-asm 39300 regex \^[\040\t]{0,50}\\.text assembler source text 3931!:mime text/x-asm 39320 regex \^[\040\t]{0,50}\\.file assembler source text 3933!:mime text/x-asm 39340 regex \^[\040\t]{0,50}\\.type assembler source text 3935!:mime text/x-asm 3936 3937#------------------------------------------------------------------------------ 3938# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $ 3939# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character 3940# strings as "long" - we assume they're just strings: 3941# From: guy@netapp.com (Guy Harris) 3942# 39430 string *STA Aster*x 3944>7 string WORD Words Document 3945>7 string GRAP Graphic 3946>7 string SPRE Spreadsheet 3947>7 string MACR Macro 39480 string 2278 Aster*x Version 2 3949>29 byte 0x36 Words Document 3950>29 byte 0x35 Graphic 3951>29 byte 0x32 Spreadsheet 3952>29 byte 0x38 Macro 3953 3954 3955#------------------------------------------------------------------------------ 3956# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $ 3957# att3b: file(1) magic for AT&T 3B machines 3958# 3959# The `versions' should be un-commented if they work for you. 3960# (Was the problem just one of endianness?) 3961# 3962# 3B20 3963# 3964# The 3B20 conflicts with SCCS. 3965#0 beshort 0550 3b20 COFF executable 3966#>12 belong >0 not stripped 3967#>22 beshort >0 - version %d 3968#0 beshort 0551 3b20 COFF executable (TV) 3969#>12 belong >0 not stripped 3970#>22 beshort >0 - version %d 3971# 3972# WE32K 3973# 39740 beshort 0560 WE32000 COFF 3975>18 beshort ^00000020 object 3976>18 beshort &00000020 executable 3977>12 belong >0 not stripped 3978>18 beshort ^00010000 N/A on 3b2/300 w/paging 3979>18 beshort &00020000 32100 required 3980>18 beshort &00040000 and MAU hardware required 3981>20 beshort 0407 (impure) 3982>20 beshort 0410 (pure) 3983>20 beshort 0413 (demand paged) 3984>20 beshort 0443 (target shared library) 3985>22 beshort >0 - version %d 39860 beshort 0561 WE32000 COFF executable (TV) 3987>12 belong >0 not stripped 3988#>18 beshort &00020000 - 32100 required 3989#>18 beshort &00040000 and MAU hardware required 3990#>22 beshort >0 - version %d 3991# 3992# core file for 3b2 39930 string \000\004\036\212\200 3b2 core file 3994>364 string >\0 of '%s' 3995 3996#------------------------------------------------------------------------------ 3997# $File: audio,v 1.111 2019/05/08 18:02:45 christos Exp $ 3998# audio: file(1) magic for sound formats (see also "iff") 3999# 4000# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com), 4001# and others 4002# 4003 4004# Sun/NeXT audio data 40050 string .snd Sun/NeXT audio data: 4006>12 belong 1 8-bit ISDN mu-law, 4007!:mime audio/basic 4008>12 belong 2 8-bit linear PCM [REF-PCM], 4009!:mime audio/basic 4010>12 belong 3 16-bit linear PCM, 4011!:mime audio/basic 4012>12 belong 4 24-bit linear PCM, 4013!:mime audio/basic 4014>12 belong 5 32-bit linear PCM, 4015!:mime audio/basic 4016>12 belong 6 32-bit IEEE floating point, 4017!:mime audio/basic 4018>12 belong 7 64-bit IEEE floating point, 4019!:mime audio/basic 4020>12 belong 8 Fragmented sample data, 4021>12 belong 10 DSP program, 4022>12 belong 11 8-bit fixed point, 4023>12 belong 12 16-bit fixed point, 4024>12 belong 13 24-bit fixed point, 4025>12 belong 14 32-bit fixed point, 4026>12 belong 18 16-bit linear with emphasis, 4027>12 belong 19 16-bit linear compressed, 4028>12 belong 20 16-bit linear with emphasis and compression, 4029>12 belong 21 Music kit DSP commands, 4030>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 4031!:mime audio/x-adpcm 4032>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 4033>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 4034>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 4035>12 belong 27 8-bit A-law (CCITT G.711), 4036>20 belong 1 mono, 4037>20 belong 2 stereo, 4038>20 belong 4 quad, 4039>16 belong >0 %d Hz 4040 4041# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format 4042# that uses little-endian encoding and has a different magic number 40430 lelong 0x0064732E DEC audio data: 4044>12 lelong 1 8-bit ISDN mu-law, 4045!:mime audio/x-dec-basic 4046>12 lelong 2 8-bit linear PCM [REF-PCM], 4047!:mime audio/x-dec-basic 4048>12 lelong 3 16-bit linear PCM, 4049!:mime audio/x-dec-basic 4050>12 lelong 4 24-bit linear PCM, 4051!:mime audio/x-dec-basic 4052>12 lelong 5 32-bit linear PCM, 4053!:mime audio/x-dec-basic 4054>12 lelong 6 32-bit IEEE floating point, 4055!:mime audio/x-dec-basic 4056>12 lelong 7 64-bit IEEE floating point, 4057!:mime audio/x-dec-basic 4058>12 belong 8 Fragmented sample data, 4059>12 belong 10 DSP program, 4060>12 belong 11 8-bit fixed point, 4061>12 belong 12 16-bit fixed point, 4062>12 belong 13 24-bit fixed point, 4063>12 belong 14 32-bit fixed point, 4064>12 belong 18 16-bit linear with emphasis, 4065>12 belong 19 16-bit linear compressed, 4066>12 belong 20 16-bit linear with emphasis and compression, 4067>12 belong 21 Music kit DSP commands, 4068>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), 4069!:mime audio/x-dec-basic 4070>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) 4071>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), 4072>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), 4073>12 belong 27 8-bit A-law (CCITT G.711), 4074>20 lelong 1 mono, 4075>20 lelong 2 stereo, 4076>20 lelong 4 quad, 4077>16 lelong >0 %d Hz 4078 4079# Creative Labs AUDIO stuff 40800 string MThd Standard MIDI data 4081!:mime audio/midi 4082>8 beshort x (format %d) 4083>10 beshort x using %d track 4084>10 beshort >1 \bs 4085>12 beshort&0x7fff x at 1/%d 4086>12 beshort&0x8000 >0 SMPTE 4087 40880 string CTMF Creative Music (CMF) data 4089!:mime audio/x-unknown 40900 string SBI SoundBlaster instrument data 4091!:mime audio/x-unknown 40920 string Creative\ Voice\ File Creative Labs voice data 4093!:mime audio/x-unknown 4094# is this next line right? it came this way... 4095>19 byte 0x1A 4096>23 byte >0 - version %d 4097>22 byte >0 \b.%d 4098 4099# first entry is also the string "NTRK" 41000 belong 0x4e54524b MultiTrack sound data 4101>4 belong x - version %d 4102 4103# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED 4104# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 41050 string EMOD Extended MOD sound data, 4106>4 byte&0xf0 x version %d 4107>4 byte&0x0f x \b.%d, 4108>45 byte x %d instruments 4109>83 byte 0 (module) 4110>83 byte 1 (song) 4111 4112# Real Audio (Magic .ra\0375) 41130 belong 0x2e7261fd RealAudio sound file 4114!:mime audio/x-pn-realaudio 41150 string .RMF\0\0\0 RealMedia file 4116!:mime application/vnd.rn-realmedia 4117#video/x-pn-realvideo 4118#video/vnd.rn-realvideo 4119#application/vnd.rn-realmedia 4120# sigh, there are many mimes for that but the above are the most common. 4121 4122# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] 4123# Oct 31, 1995 4124# fixed by <doj@cubic.org> 2003-06-24 4125# Too short... 4126#0 string MTM MultiTracker Module sound file 4127#0 string if Composer 669 Module sound data 4128#0 string JN Composer 669 Module sound data (extended format) 41290 string MAS_U ULT(imate) Module sound data 4130 4131#0 string FAR Module sound data 4132#>4 string >\15 Title: "%s" 4133 41340x2c string SCRM ScreamTracker III Module sound data 4135>0 string >\0 Title: "%s" 4136 4137# Gravis UltraSound patches 4138# From <ache@nagual.ru> 4139 41400 string GF1PATCH110\0ID#000002\0 GUS patch 41410 string GF1PATCH100\0ID#000002\0 Old GUS patch 4142 4143# mime types according to http://www.geocities.com/nevilo/mod.htm: 4144# audio/it .it 4145# audio/x-zipped-it .itz 4146# audio/xm fasttracker modules 4147# audio/x-s3m screamtracker modules 4148# audio/s3m screamtracker modules 4149# audio/x-zipped-mod mdz 4150# audio/mod mod 4151# audio/x-mod All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z) 4152 4153# 4154# Taken from loader code from mikmod version 2.14 4155# by Steve McIntyre (stevem@chiark.greenend.org.uk) 4156# <doj@cubic.org> added title printing on 2003-06-24 41570 string MAS_UTrack_V00 4158>14 string >/0 ultratracker V1.%.1s module sound data 4159!:mime audio/x-mod 4160#audio/x-tracker-module 4161 41620 string UN05 MikMod UNI format module sound data 4163 41640 string Extended\ Module: Fasttracker II module sound data 4165!:mime audio/x-mod 4166#audio/x-tracker-module 4167>17 string >\0 Title: "%s" 4168 416921 string/c =!SCREAM! Screamtracker 2 module sound data 4170!:mime audio/x-mod 4171#audio/x-screamtracker-module 417221 string BMOD2STM Screamtracker 2 module sound data 4173!:mime audio/x-mod 4174#audio/x-screamtracker-module 41751080 string M.K. 4-channel Protracker module sound data 4176!:mime audio/x-mod 4177#audio/x-protracker-module 4178>0 string >\0 Title: "%s" 41791080 string M!K! 4-channel Protracker module sound data 4180!:mime audio/x-mod 4181#audio/x-protracker-module 4182>0 string >\0 Title: "%s" 41831080 string FLT4 4-channel Startracker module sound data 4184!:mime audio/x-mod 4185#audio/x-startracker-module 4186>0 string >\0 Title: "%s" 41871080 string FLT8 8-channel Startracker module sound data 4188!:mime audio/x-mod 4189#audio/x-startracker-module 4190>0 string >\0 Title: "%s" 41911080 string 4CHN 4-channel Fasttracker module sound data 4192!:mime audio/x-mod 4193#audio/x-fasttracker-module 4194>0 string >\0 Title: "%s" 41951080 string 6CHN 6-channel Fasttracker module sound data 4196!:mime audio/x-mod 4197#audio/x-fasttracker-module 4198>0 string >\0 Title: "%s" 41991080 string 8CHN 8-channel Fasttracker module sound data 4200!:mime audio/x-mod 4201#audio/x-fasttracker-module 4202>0 string >\0 Title: "%s" 42031080 string CD81 8-channel Octalyser module sound data 4204!:mime audio/x-mod 4205#audio/x-octalysertracker-module 4206>0 string >\0 Title: "%s" 42071080 string OKTA 8-channel Octalyzer module sound data 4208!:mime audio/x-mod 4209#audio/x-octalysertracker-module 4210>0 string >\0 Title: "%s" 4211# Not good enough. 4212#1082 string CH 4213#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data 42141080 string 16CN 16-channel Taketracker module sound data 4215!:mime audio/x-mod 4216#audio/x-taketracker-module 4217>0 string >\0 Title: "%s" 42181080 string 32CN 32-channel Taketracker module sound data 4219!:mime audio/x-mod 4220#audio/x-taketracker-module 4221>0 string >\0 Title: "%s" 4222 4223# TOC sound files -Trevor Johnson <trevor@jpj.net> 4224# 42250 string TOC TOC sound file 4226 4227# sidfiles <pooka@iki.fi> 4228# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 42290 string SIDPLAY\ INFOFILE Sidplay info file 4230 42310 string PSID PlaySID v2.2+ (AMIGA) sidtune 4232>4 beshort >0 w/ header v%d, 4233>14 beshort =1 single song, 4234>14 beshort >1 %d songs, 4235>16 beshort >0 default song: %d 4236>0x16 string >\0 name: "%s" 4237>0x36 string >\0 author: "%s" 4238>0x56 string >\0 copyright: "%s" 4239 42400 string RSID RSID sidtune PlaySID compatible 4241>4 beshort >0 w/ header v%d, 4242>14 beshort =1 single song, 4243>14 beshort >1 %d songs, 4244>16 beshort >0 default song: %d 4245>0x16 string >\0 name: "%s" 4246>0x36 string >\0 author: "%s" 4247>0x56 string >\0 copyright: "%s" 4248 4249# IRCAM sound files - Michael Pruett <michael@68k.org> 4250# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html 42510 belong 0x64a30100 IRCAM file (VAX little-endian) 42520 belong 0x0001a364 IRCAM file (VAX big-endian) 42530 belong 0x64a30200 IRCAM file (Sun big-endian) 42540 belong 0x0002a364 IRCAM file (Sun little-endian) 42550 belong 0x64a30300 IRCAM file (MIPS little-endian) 42560 belong 0x0003a364 IRCAM file (MIPS big-endian) 42570 belong 0x64a30400 IRCAM file (NeXT big-endian) 42580 belong 0x64a30400 IRCAM file (NeXT big-endian) 42590 belong 0x0004a364 IRCAM file (NeXT little-endian) 4260 4261# NIST SPHERE <mpruett@sgi.com> 42620 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file 4263 4264# Sample Vision <mpruett@sgi.com> 42650 string SOUND\ SAMPLE\ DATA\ Sample Vision file 4266 4267# Audio Visual Research <tonigonenstein@users.sourceforge.net> 42680 string 2BIT Audio Visual Research file, 4269>12 beshort =0 mono, 4270>12 beshort =-1 stereo, 4271>14 beshort x %d bits 4272>16 beshort =0 unsigned, 4273>16 beshort =-1 signed, 4274>22 belong&0x00ffffff x %d Hz, 4275>18 beshort =0 no loop, 4276>18 beshort =-1 loop, 4277>21 ubyte <128 note %d, 4278>22 byte =0 replay 5.485 KHz 4279>22 byte =1 replay 8.084 KHz 4280>22 byte =2 replay 10.971 KHz 4281>22 byte =3 replay 16.168 KHz 4282>22 byte =4 replay 21.942 KHz 4283>22 byte =5 replay 32.336 KHz 4284>22 byte =6 replay 43.885 KHz 4285>22 byte =7 replay 47.261 KHz 4286 4287# SGI SoundTrack <mpruett@sgi.com> 42880 string _SGI_SoundTrack SGI SoundTrack project file 4289# ID3 version 2 tags <waschk@informatik.uni-rostock.de> 42900 string ID3 Audio file with ID3 version 2 4291>3 byte x \b.%d 4292>4 byte x \b.%d 4293>>5 byte &0x80 \b, unsynchronized frames 4294>>5 byte &0x40 \b, extended header 4295>>5 byte &0x20 \b, experimental 4296>>5 byte &0x10 \b, footer present 4297>(6.I+10) indirect x \b, contains: 4298 4299# NSF (NES sound file) magic 43000 string NESM\x1a NES Sound File 4301>14 string >\0 ("%s" by 4302>46 string >\0 %s, copyright 4303>78 string >\0 %s), 4304>5 byte x version %d, 4305>6 byte x %d tracks, 4306>122 byte&0x2 =1 dual PAL/NTSC 4307>122 byte&0x1 =1 PAL 4308>122 byte&0x1 =0 NTSC 4309 4310# NSFE (Extended NES sound file) magic 4311# http://slickproductions.org/docs/NSF/nsfespec.txt 4312# From: David Pflug <david@pflug.email> 43130 string NSFE Extended NES Sound File 4314>48 search/0x1000 auth 4315>>&0 string >\0 ("%s" 4316>>>&1 string >\0 by %s 4317>>>>&1 string >\0 \b, copyright %s 4318>>>>>&1 string >\0 \b, ripped by %s 4319>20 byte x \b), %d tracks, 4320>18 byte&0x2 =1 dual PAL/NTSC 4321>18 byte&0x2 =0 4322>>18 byte&0x1 =1 PAL 4323>>18 byte&0x1 =0 NTSC 4324 4325# Type: SNES SPC700 sound files 4326# From: Josh Triplett <josh@freedesktop.org> 43270 string SNES-SPC700\ Sound\ File\ Data\ v SNES SPC700 sound file 4328>&0 string 0.30 \b, version %s 4329>>0x23 byte 0x1B \b, without ID666 tag 4330>>0x23 byte 0x1A \b, with ID666 tag 4331>>>0x2E string >\0 \b, song "%.32s" 4332>>>0x4E string >\0 \b, game "%.32s" 4333 4334# Impulse tracker module (audio/x-it) 43350 string IMPM Impulse Tracker module sound data - 4336!:mime audio/x-mod 4337>4 string >\0 "%s" 4338>40 leshort !0 compatible w/ITv%x 4339>42 leshort !0 created w/ITv%x 4340 4341# Imago Orpheus module (audio/x-imf) 434260 string IM10 Imago Orpheus module sound data - 4343>0 string >\0 "%s" 4344 4345# From <collver1@attbi.com> 4346# These are the /etc/magic entries to decode modules, instruments, and 4347# samples in Impulse Tracker's native format. 4348 43490 string IMPS Impulse Tracker Sample 4350>18 byte &2 16 bit 4351>18 byte ^2 8 bit 4352>18 byte &4 stereo 4353>18 byte ^4 mono 43540 string IMPI Impulse Tracker Instrument 4355>28 leshort !0 ITv%x 4356>30 byte !0 %d samples 4357 4358# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files 4359# From <collver1@attbi.com> 43600 string LM8953 Yamaha TX Wave 4361>22 byte 0x49 looped 4362>22 byte 0xC9 non-looped 4363>23 byte 1 33kHz 4364>23 byte 2 50kHz 4365>23 byte 3 16kHz 4366 4367# scream tracker: file(1) magic for Scream Tracker sample files 4368# 4369# From <collver1@attbi.com> 437076 string SCRS Scream Tracker Sample 4371>0 byte 1 sample 4372>0 byte 2 adlib melody 4373>0 byte >2 adlib drum 4374>31 byte &2 stereo 4375>31 byte ^2 mono 4376>31 byte &4 16bit little endian 4377>31 byte ^4 8bit 4378>30 byte 0 unpacked 4379>30 byte 1 packed 4380 4381# audio 4382# From: Cory Dikkers <cdikkers@swbell.net> 43830 string MMD0 MED music file, version 0 43840 string MMD1 OctaMED Pro music file, version 1 43850 string MMD3 OctaMED Soundstudio music file, version 3 43860 string OctaMEDCmpr OctaMED Soundstudio compressed file 43870 string MED MED_Song 43880 string SymM Symphonie SymMOD music file 4389# 4390# Track Length (TRL), Tracks (TRK), Samples (SMP), Subsongs (SS) 4391# http://lclevy.free.fr/exotica/ahx/ahxformat.txt 43920 string THX AHX version 4393>3 byte =0 1 module data 4394>3 byte =1 2 module data 4395>10 byte x TRL: %u 4396>11 byte x TRK: %u 4397>12 byte x SMP: %u 4398>13 byte x SS: %u 4399# 44000 string OKTASONG Oktalyzer module data 4401# 44020 string DIGI\ Booster\ module\0 %s 4403>20 byte >0 %c 4404>>21 byte >0 \b%c 4405>>>22 byte >0 \b%c 4406>>>>23 byte >0 \b%c 4407>610 string >\0 \b, "%s" 4408# 44090 string DBM0 DIGI Booster Pro Module 4410>4 byte >0 V%X. 4411>>5 byte x \b%02X 4412>16 string >\0 \b, "%s" 4413# 44140 string FTMN FaceTheMusic module 4415>16 string >\0d \b, "%s" 4416 4417# From: <doj@cubic.org> 2003-06-24 44180 string AMShdr\32 Velvet Studio AMS Module v2.2 44190 string Extreme Extreme Tracker AMS Module v1.3 44200 string DDMF Xtracker DMF Module 4421>4 byte x v%i 4422>0xD string >\0 Title: "%s" 4423>0x2B string >\0 Composer: "%s" 44240 string DSM\32 Dynamic Studio Module DSM 44250 string SONG DigiTrekker DTM Module 44260 string DMDL DigiTrakker MDL Module 44270 string PSM\32 Protracker Studio PSM Module 442844 string PTMF Poly Tracker PTM Module 4429>0 string >\32 Title: "%s" 44300 string MT20 MadTracker 2.0 Module MT2 44310 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD 44320 string RTMM RTM Module 44330x426 string MaDoKaN96 XMS Adlib Module 4434>0 string >\0 Composer: "%s" 44350 string AMF AMF Module 4436>4 string >\0 Title: "%s" 44370 string MODINFO1 Open Cubic Player Module Inforation MDZ 44380 string Extended\40Instrument: Fast Tracker II Instrument 4439 4440# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> 4441# NOA Nancy Codec file 44420 string \210NOA\015\012\032 NOA Nancy Codec Movie file 4443# Yamaha SMAF format 44440 string MMMD Yamaha SMAF file 4445# Sharp Jisaku Melody format for PDC 44460 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody 4447>20 string Ver01.00 Ver. 1.00 4448>>32 byte x , %d tracks 4449 4450# Free lossless audio codec <http://flac.sourceforge.net> 4451# From: Przemyslaw Augustyniak <silvathraec@rpg.pl> 44520 string fLaC FLAC audio bitstream data 4453!:mime audio/flac 4454>4 byte&0x7f >0 \b, unknown version 4455>4 byte&0x7f 0 \b 4456# some common bits/sample values 4457>>20 beshort&0x1f0 0x030 \b, 4 bit 4458>>20 beshort&0x1f0 0x050 \b, 6 bit 4459>>20 beshort&0x1f0 0x070 \b, 8 bit 4460>>20 beshort&0x1f0 0x0b0 \b, 12 bit 4461>>20 beshort&0x1f0 0x0f0 \b, 16 bit 4462>>20 beshort&0x1f0 0x170 \b, 24 bit 4463>>20 byte&0xe 0x0 \b, mono 4464>>20 byte&0xe 0x2 \b, stereo 4465>>20 byte&0xe 0x4 \b, 3 channels 4466>>20 byte&0xe 0x6 \b, 4 channels 4467>>20 byte&0xe 0x8 \b, 5 channels 4468>>20 byte&0xe 0xa \b, 6 channels 4469>>20 byte&0xe 0xc \b, 7 channels 4470>>20 byte&0xe 0xe \b, 8 channels 4471# sample rates derived from known oscillator frequencies; 4472# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and 4473# 16.384 (other/fs=32kHz). 4474>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz 4475>>17 belong&0xfffff0 0x03e800 \b, 16 kHz 4476>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz 4477>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz 4478>>17 belong&0xfffff0 0x07d000 \b, 32 kHz 4479>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz 4480>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz 4481>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz 4482>>17 belong&0xfffff0 0x158880 \b, 88.2 kHz 4483>>17 belong&0xfffff0 0x177000 \b, 96 kHz 4484>>17 belong&0xfffff0 0x1f4000 \b, 128 kHz 4485>>17 belong&0xfffff0 0x2b1100 \b, 176.4 kHz 4486>>17 belong&0xfffff0 0x2ee000 \b, 192 kHz 4487>>17 belong&0xfffff0 0x3e8000 \b, 256 kHz 4488>>17 belong&0xfffff0 0x562200 \b, 352.8 kHz 4489>>17 belong&0xfffff0 0x5dc000 \b, 384 kHz 4490>>21 byte&0xf >0 \b, >4G samples 4491>>21 byte&0xf 0 \b 4492>>>22 belong >0 \b, %u samples 4493>>>22 belong 0 \b, length unknown 4494 4495# (ISDN) VBOX voice message file (Wolfram Kleff) 44960 string VBOX VBOX voice message data 4497 4498# ReBorn Song Files (.rbs) 4499# David J. Singer <doc@deadvirgins.org.uk> 45008 string RB40 RBS Song file 4501>29 string ReBorn created by ReBorn 4502>37 string Propellerhead created by ReBirth 4503 4504# Synthesizer Generator and Kimwitu share their file format 45050 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data 4506# Kimwitu++ uses a slightly different magic 45070 string A#S#C#S#S#L#HUB Kimwitu++ data 4508 4509# From "Simon Hosie 45100 string TFMX-SONG TFMX module sound data 4511 4512# Monkey's Audio compressed audio format (.ape) 4513# From danny.milo@gmx.net (Danny Milosavljevic) 4514# New version from Abel Cheung <abel (@) oaka.org> 45150 string MAC\040 Monkey's Audio compressed format 4516!:mime audio/x-ape 4517>4 uleshort >0x0F8B version %d 4518>>(0x08.l) uleshort =1000 with fast compression 4519>>(0x08.l) uleshort =2000 with normal compression 4520>>(0x08.l) uleshort =3000 with high compression 4521>>(0x08.l) uleshort =4000 with extra high compression 4522>>(0x08.l) uleshort =5000 with insane compression 4523>>(0x08.l+18) uleshort =1 \b, mono 4524>>(0x08.l+18) uleshort =2 \b, stereo 4525>>(0x08.l+20) ulelong x \b, sample rate %d 4526>4 uleshort <0x0F8C version %d 4527>>6 uleshort =1000 with fast compression 4528>>6 uleshort =2000 with normal compression 4529>>6 uleshort =3000 with high compression 4530>>6 uleshort =4000 with extra high compression 4531>>6 uleshort =5000 with insane compression 4532>>10 uleshort =1 \b, mono 4533>>10 uleshort =2 \b, stereo 4534>>12 ulelong x \b, sample rate %d 4535 4536# adlib sound files 4537# From: Alex Myczko <alex@aiei.ch> 4538 4539# https://github.com/rerrahkr/BambooTracker 45400 string BambooTrackerMod BambooTracker module 4541>22 byte x \b, version %u 4542>21 byte x \b.%u 4543>20 byte x \b.%u 4544 45450 string BambooTrackerIst BambooTracker instrument 4546>22 byte x \b, version %u 4547>21 byte x \b.%u 4548>20 byte x \b.%u 4549 45500 string RAWADATA RdosPlay RAW 4551 45521068 string RoR AMUSIC Adlib Tracker 4553 45540 string JCH EdLib 4555 45560 string mpu401tr MPU-401 Trakker 4557 45580 string SAdT Surprise! Adlib Tracker 4559>4 byte x Version %d 4560 45610 string XAD! eXotic ADlib 4562 45630 string ofTAZ! eXtra Simple Music 4564 45650 string FMK! FM Kingtracker Song 4566 45670 string DFM DFM Song 4568 45690 string \<CUD-FM-File\> CFF Song 4570 45710 string _A2module A2M Song 4572 4573# Spectrum 128 tunes (.ay files). 4574# From: Emanuel Haupt <ehaupt@critical.ch> 45750 string ZXAYEMUL Spectrum 128 tune 4576 45770 string \0BONK BONK, 4578#>5 byte x version %d 4579>14 byte x %d channel(s), 4580>15 byte =1 lossless, 4581>15 byte =0 lossy, 4582>16 byte x mid-side 4583 4584384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) 4585 4586# format VQF (proprietary codec for sound) 4587# some infos on the header file available at : 4588# http://www.twinvq.org/english/technology_format.html 45890 string TWIN97012000 VQF data 4590>27 short 0 \b, Mono 4591>27 short 1 \b, Stereo 4592>31 short >0 \b, %d kbit/s 4593>35 short >0 \b, %d kHz 4594 4595# Nelson A. de Oliveira (naoliv@gmail.com) 4596# .eqf 45970 string Winamp\ EQ\ library\ file %s 4598# it will match only versions like v<digit>.<digit> 4599# Since I saw only eqf files with version v1.1 I think that it's OK 4600>23 string x \b%.4s 4601# .preset 46020 string [Equalizer\ preset] XMMS equalizer preset 4603# .m3u 46040 search/1 #EXTM3U M3U playlist text 4605# .pls 46060 search/1 [playlist] PLS playlist text 4607# licq.conf 46081 string [licq] LICQ configuration file 4609 4610# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> 46110 string ICE! SNDH Atari ST music 46120 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music 4613 4614# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> 46150 string MP+ Musepack audio (MP+) 4616!:mime audio/x-musepack 4617>3 byte 255 \b, SV pre8 4618>3 byte&0xF 0x6 \b, SV 6 4619>3 byte&0xF 0x8 \b, SV 8 4620>3 byte&0xF 0x7 \b, SV 7 4621>>3 byte&0xF0 0x0 \b.0 4622>>3 byte&0xF0 0x10 \b.1 4623>>3 byte&0xF0 240 \b.15 4624>>10 byte&0xF0 0x0 \b, no profile 4625>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' 4626>>10 byte&0xF0 0x50 \b, quality 0 4627>>10 byte&0xF0 0x60 \b, quality 1 4628>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) 4629>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) 4630>>10 byte&0xF0 0x90 \b, quality 4 (Radio) 4631>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) 4632>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) 4633>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) 4634>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) 4635>>10 byte&0xF0 0xE0 \b, quality 9 4636>>10 byte&0xF0 0xF0 \b, quality 10 4637>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 4638>>27 byte 102 \b, Beta 1.02 4639>>27 byte 104 \b, Beta 1.04 4640>>27 byte 105 \b, Alpha 1.05 4641>>27 byte 106 \b, Beta 1.06 4642>>27 byte 110 \b, Release 1.1 4643>>27 byte 111 \b, Alpha 1.11 4644>>27 byte 112 \b, Beta 1.12 4645>>27 byte 113 \b, Alpha 1.13 4646>>27 byte 114 \b, Beta 1.14 4647>>27 byte 115 \b, Alpha 1.15 4648 46490 string MPCK Musepack audio (MPCK) 4650!:mime audio/x-musepack 4651 4652# IMY 4653# from http://filext.com/detaillist.php?extdetail=IMY 4654# https://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm 4655# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html 4656# http://www.wx800.com/msg/download/irda/iMelody.pdf 46570 string BEGIN:IMELODY iMelody Ringtone Format 4658 4659# From: "Mateus Caruccio" <mateus@caruccio.com> 4660# guitar pro v3,4,5 from http://filext.com/file-extension/gp3 46610 string \030FICHIER\ GUITAR\ PRO\ v3. Guitar Pro Ver. 3 Tablature 4662 4663# From: "Leslie P. Polzer" <leslie.polzer@gmx.net> 466460 string SONG SoundFX Module sound file 4665 4666# Type: Adaptive Multi-Rate Codec 4667# URL: http://filext.com/detaillist.php?extdetail=AMR 4668# From: Russell Coker <russell@coker.com.au> 46690 string #!AMR Adaptive Multi-Rate Codec (GSM telephony) 4670!:mime audio/amr 4671!:ext amr 4672 4673# Type: SuperCollider 3 Synth Definition File Format 4674# From: Mario Lang <mlang@debian.org> 46750 string SCgf SuperCollider3 Synth Definition file, 4676>4 belong x version %d 4677 4678# Type: True Audio Lossless Audio 4679# URL: https://wiki.multimedia.cx/index.php?title=True_Audio 4680# From: Mike Melanson <mike@multimedia.cx> 46810 string TTA1 True Audio Lossless Audio 4682 4683# Type: WavPack Lossless Audio 4684# URL: https://wiki.multimedia.cx/index.php?title=WavPack 4685# From: Mike Melanson <mike@multimedia.cx> 46860 string wvpk WavPack Lossless Audio 4687 4688# From Fabio R. Schmidlin <frs@pop.com.br> 4689# VGM music file 46900 string Vgm\040 4691>9 ubyte >0 VGM Video Game Music dump v 4692!:mime audio/x-vgm 4693!:ext vgm 4694>>9 ubyte/16 >0 \b%d 4695>>9 ubyte&0x0F x \b%d 4696>>8 ubyte/16 x \b.%d 4697>>8 ubyte&0x0F >0 \b%d 4698#Get soundchips 4699>>8 ubyte x \b, soundchip(s)= 4700>>0x0C ulelong >0 SN76489, 4701>>0x10 ulelong >0 YM2413, 4702>>0x2C ulelong >0 YM2612, 4703>>0x30 ulelong >0 YM2151, 4704>>0x38 ulelong >0 Sega PCM, 4705>>0x34 ulelong >0xC 4706>>>0x40 ulelong >0 RF5C68, 4707>>0x34 ulelong >0x10 4708>>>0x44 ulelong >0 YM2203, 4709>>0x34 ulelong >0x14 4710>>>0x48 ulelong >0 YM2608, 4711>>0x34 ulelong >0x18 4712>>>0x4C lelong >0 YM2610, 4713>>>0x4C lelong <0 YM2610B, 4714>>0x34 ulelong >0x1C 4715>>>0x50 ulelong >0 YM3812, 4716>>0x34 ulelong >0x20 4717>>>0x54 ulelong >0 YM3526, 4718>>0x34 ulelong >0x24 4719>>>0x58 ulelong >0 Y8950, 4720>>0x34 ulelong >0x28 4721>>>0x5C ulelong >0 YMF262, 4722>>0x34 ulelong >0x2C 4723>>>0x60 ulelong >0 YMF278B, 4724>>0x34 ulelong >0x30 4725>>>0x64 ulelong >0 YMF271, 4726>>0x34 ulelong >0x34 4727>>>0x68 ulelong >0 YMZ280B, 4728>>0x34 ulelong >0x38 4729>>>0x6C ulelong >0 RF5C164, 4730>>0x34 ulelong >0x3C 4731>>>0x70 ulelong >0 PWM, 4732>>0x34 ulelong >0x40 4733>>>0x74 ulelong >0 4734>>>>0x78 ubyte 0x00 AY-3-8910, 4735>>>>0x78 ubyte 0x01 AY-3-8912, 4736>>>>0x78 ubyte 0x02 AY-3-8913, 4737>>>>0x78 ubyte 0x03 AY-3-8930, 4738>>>>0x78 ubyte 0x10 YM2149, 4739>>>>0x78 ubyte 0x11 YM3439, 4740# VGM 1.61 4741>>0x34 ulelong >0x4C 4742>>>0x80 ulelong >0 DMG, 4743>>0x34 ulelong >0x50 4744>>>0x84 lelong >0 NES APU, 4745>>>0x84 lelong <0 NES APU with FDS, 4746>>0x34 ulelong >0x54 4747>>>0x88 ulelong >0 MultiPCM, 4748>>0x34 ulelong >0x58 4749>>>0x8C ulelong >0 uPD7759, 4750>>0x34 ulelong >0x5C 4751>>>0x90 ulelong >0 OKIM6258, 4752>>0x34 ulelong >0x64 4753>>>0x98 ulelong >0 OKIM6295, 4754>>0x34 ulelong >0x68 4755>>>0x9C ulelong >0 K051649, 4756>>0x34 ulelong >0x6C 4757>>>0xA0 ulelong >0 K054539, 4758>>0x34 ulelong >0x70 4759>>>0xA4 ulelong >0 HuC6280, 4760>>0x34 ulelong >0x74 4761>>>0xA8 ulelong >0 C140, 4762>>0x34 ulelong >0x78 4763>>>0xAC ulelong >0 K053260, 4764>>0x34 ulelong >0x7C 4765>>>0xB0 ulelong >0 Pokey, 4766>>0x34 ulelong >0x80 4767>>>0xB4 ulelong >0 QSound, 4768# VGM 1.71 4769>>0x34 ulelong >0x84 4770>>>0xB8 ulelong >0 SCSP, 4771>>0x34 ulelong >0x8C 4772>>>0xC0 ulelong >0 WonderSwan, 4773>>0x34 ulelong >0x90 4774>>>0xC4 ulelong >0 VSU, 4775>>0x34 ulelong >0x94 4776>>>0xC8 ulelong >0 SAA1099, 4777>>0x34 ulelong >0x98 4778>>>0xCC ulelong >0 ES5503, 4779>>0x34 ulelong >0x9C 4780>>>0xD0 lelong >0 ES5505, 4781>>>0xD0 lelong <0 ES5506, 4782>>0x34 ulelong >0xA4 4783>>>0xD8 ulelong >0 X1-010, 4784>>0x34 ulelong >0xA8 4785>>>0xDC ulelong >0 C352, 4786>>0x34 ulelong >0xAC 4787>>>0xE0 ulelong >0 GA20, 4788 4789# GVOX Encore file format 4790# Since this is a proprietary file format and there is no publicly available 4791# format specification, this is just based on induction 4792# 47930 string SCOW 4794>4 byte 0xc4 GVOX Encore music, version 5.0 or above 4795>4 byte 0xc2 GVOX Encore music, version < 5.0 4796 47970 string ZBOT 4798>4 byte 0xc5 GVOX Encore music, version < 5.0 4799 4800# Summary: Garmin Voice Processing Module (WAVE audios) 4801# From: Joerg Jenderek 4802# URL: https://www.garmin.com/ 4803# Reference: http://www.poi-factory.com/node/19580 4804# NOTE: there exist 2 other Garmin VPM formats 48050 string AUDIMG 4806# skip text files starting with string "AUDIMG" 4807>13 ubyte <13 Garmin Voice Processing Module 4808!:mime audio/x-vpm-wav-garmin 4809!:ext vpm 4810# 3 bytes indicating the voice version (200,220) 4811>>6 string x \b, version %3.3s 4812# day of release (01-31) 4813>>12 ubyte x \b, %.2d 4814# month of release (01-12) 4815>>13 ubyte x \b.%.2d 4816# year of release (like 2006, 2007, 2008) 4817>>14 uleshort x \b.%.4d 4818# hour of release (0-23) 4819>>11 ubyte x %.2d 4820# minute of release (0-59) 4821>>10 ubyte x \b:%.2d 4822# second of release (0-59) 4823>>9 ubyte x \b:%.2d 4824# if you select a language like german on your garmin device 4825# you can only select voice modules with corresponding language byte ID like 1 4826>>18 ubyte x \b, language ID %d 4827# structure for phrases/sentences? 4828# number of voice sample in the 1st phrase? 4829#>>19 uleshort x \b, 0x%x samples 4830#>>>21 uleshort >0 \b, at 0x%4.4x 4831#>>>(21.s) ubequad x 0x%llx 4832# 2nd phrase? 4833#>>23 uleshort x \b, 0x%x samples 4834#>>>25 uleshort >0 \b, at 0x%4.4x 4835#>>>(25.s) ubequad x 0x%llx 4836# pointer to 1st audio WAV sample 4837>>16 uleshort >0 4838>>>(16.s) ulelong >0 \b, at 0x%x 4839# WAV length 4840# 1 space char after "bytes" to get phrase "bytes RIFF" 4841>>>>(16.s+4) ulelong >0 %u bytes 4842# look for magic 4843>>>>>(&-8.l) string RIFF 4844# determine type by ./riff 4845>>>>>>&-4 indirect x 4846# 2 - ~ 131 WAV samples following same way 4847# 4848# Summary: encrypted Garmin Voice Processing Module 4849# From: Joerg Jenderek 4850# URL: https://www.garmin.com/us/products/ontheroad/voicestudio 4851# NOTE: Encrypted variant used in voices like DrNightmare, Elfred, Yeti. 4852# There exist 2 other Garmin VPM formats 48530 ubequad 0xa141190fecc8ced6 Garmin Voice Processing Module (encrypted) 4854!:mime audio/x-vpm-garmin 4855!:ext vpm 4856 4857# From Martin Mueller Skarbiniks Pedersen 48580 string GDM 4859>0x3 byte 0xFE General Digital Music. 4860>0x4 string >\0 title: "%s" 4861>0x24 string >\0 musician: "%s" 4862>>0x44 beshort 0x0D0A 4863>>>0x46 byte 0x1A 4864>>>>0x47 string GMFS Version 4865>>>>0x4B byte x %d. 4866>>>>0x4C byte x \b%02d 4867>>>>0x4D beshort 0x000 (2GDM v 4868>>>>0x4F byte x \b%d. 4869>>>>>0x50 byte x \b%d) 4870 48710 string MTM Multitracker 4872>0x3 byte/16 x Version %d. 4873>0x3 byte&0x0F x \b%02d 4874>>0x4 string >\0 title: "%s" 4875 48760 string HVL 4877>3 byte <2 Hively Tracker Song 4878>3 byte 0 1 module data 4879>3 byte 1 2 module data 4880 48810 string MO3 4882>3 ubyte <6 MOdule with MP3 4883>>3 byte 0 Version 0 (With MP3 and lossless) 4884>>3 byte 1 Version 1 (With ogg and lossless) 4885>>3 byte 3 Version 2.2 4886>>3 byte 4 (With no LAME header) 4887>>3 byte 5 Version 2.4 4888 48890 string ADRVPACK AProSys module 4890 4891# ftp://ftp.modland.com/pub/documents/format_documentation/\ 4892# Art%20Of%20Noise%20(.aon).txt 48930 string AON 4894>4 string "ArtOfNoise by Bastian Spiegel(twice/lego)" 4895>0x2e string NAME Art of Noise Tracker Song 4896>3 string <9 4897>3 string 4 (4 voices) 4898>3 string 8 (8 voices) 4899>>0x36 string >\0 Title: "%s" 4900 49010 string FAR 4902>0x2c byte 0x0d 4903>0x2d byte 0x0a 4904>0x2e byte 0x1a 4905>>0x3 byte 0xFE Farandole Tracker Song 4906>>>0x31 byte/16 x Version %d. 4907>>>0x31 byte&0x0F x \b%02d 4908>>>>0x4 string >\0 \b, title: "%s" 4909 4910# magic for Klystrack, https://kometbomb.github.io/klystrack/ 4911# from Alex Myczko <alex@aiei.ch> 49120 string cyd!song Klystrack song 4913>8 byte >0 \b, version %u 4914>8 byte >26 4915#>>9 byte x \b, channels %u 4916#>>10 leshort x \b, time signature %u 4917#>>12 leshort x \b, sequence step %u 4918#>>14 byte x \b, instruments %u 4919#>>15 leshort x \b, patterns %u 4920#>>17 leshort x \b, sequences %u 4921#>>19 leshort x \b, length %u 4922#>>21 leshort x \b, loop point %u 4923#>>23 byte x \b, master volume %u 4924#>>24 byte x \b, song speed %u 4925#>>25 byte x \b, song speed2 %u 4926#>>26 byte x \b, song rate %u 4927#>>27 belong x \b, flags %#x 4928#>>31 byte x \b, multiplex period %u 4929#>>32 byte x \b, pitch inaccuracy %u 4930>>149 pstring x \b, title %s 4931 49320 string cyd!inst Klystrack instrument 4933 4934# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor 4935# see Specifications/WOPL-and-OPLI-Specification.txt 4936 49370 string WOPL3-INST\0 WOPL instrument 4938>11 leshort x \b, version %u 49390 string WOPL3-BANK\0 WOPL instrument bank 4940>11 leshort x \b, version %u 4941 4942# AdLib/OPL instrument files. Format specifications on 4943# http://www.shikadi.net/moddingwiki 49440 string Junglevision\ Patch\ File Junglevision instrument data 49450 string #OPL_II# DMX OP2 instrument data 49460 string IBK\x1a IBK instrument data 49470 string 2OP\x1a IBK instrument data, 2 operators 49480 string 4OP\x1a IBK instrument data, 4 operators 49492 string ADLIB- AdLib instrument data 4950>0 byte x \b, version %u 4951>1 byte x \b.%u 4952 4953# CRI ADX ADPCM audio 4954# Used by various Sega games. 4955# https://en.wikipedia.org/wiki/ADX_(file_format) 4956# https://wiki.multimedia.cx/index.php/CRI_ADX_file 4957# Added by David Korth <gerbilsoft@gerbilsoft.com> 49580x00 beshort 0x8000 4959>(2.S-2) string (c)CRI CRI ADX ADPCM audio 4960!:ext adx 4961!:mime audio/x-adx 4962!:strength +50 4963>>0x12 byte x v%u 4964>>0x04 byte 0x02 \b, pre-set prediction coefficients 4965>>0x04 byte 0x03 \b, standard ADX 4966>>0x04 byte 0x04 \b, exponential scale 4967>>0x04 byte 0x10 \b, AHX (Dreamcast) 4968>>0x04 byte 0x11 \b, AHX 4969>>0x08 belong x \b, %u Hz 4970>>0x12 byte 0x03 4971>>>0x02 beshort >0x2B 4972>>>>0x18 belong !0 \b, looping 4973>>0x12 byte 0x04 4974>>>0x02 beshort >0x37 4975>>>>0x24 belong !0 \b, looping 4976>>0x13 byte&0x08 0x08 \b, encrypted 4977 4978# Lossless audio (.la) (http://www.lossless-audio.com/) 49790 string LA 4980>2 string 03 Lossless audio version 0.3 4981>2 string 04 Lossless audio version 0.4 4982 4983# Sony PlayStation Audio (.xa) 49840 leshort 0x4158 Sony PlayStation Audio 4985 4986# Portable Sound Format 4987# Used for audio rips for various consoles. 4988# http://fileformats.archiveteam.org/wiki/Portable_Sound_Format 4989# Added by David Korth <gerbilsoft@gerbilsoft.com> 49900 string PSF Portable Sound Format 4991!:mime audio/x-psf 4992>3 byte 0x01 (Sony PlayStation) 4993>3 byte 0x02 (Sony PlayStation 2) 4994>3 byte 0x11 (Sega Saturn) 4995>3 byte 0x12 (Sega Dreamcast) 4996>3 byte 0x13 (Sega Mega Drive) 4997>3 byte 0x21 (Nintendo 64) 4998>3 byte 0x22 (Game Boy Advance) 4999>3 byte 0x23 (Super NES) 5000>3 byte 0x41 (Capcom QSound) 5001 5002# Atari 8-bit SAP audio format 5003# http://asap.sourceforge.net/sap-format.html 5004# Added by David Korth <gerbilsoft@gerbilsoft.com> 50050 string SAP\r\n Atari 8-bit SAP audio file 5006!:mime audio/x-sap 5007!:ext sap 5008>5 search/1024 NAME 5009>>&1 string x \b: %s 5010>>5 search/1024 AUTHOR 5011>>>&1 string x by %s 5012 5013# Nintendo Wii BRSTM audio format (fields) 5014# NOTE: Assuming HEAD starts at 0x40. 5015# FIXME: Replace 0x48 with HEAD offset plus 8. 50160 name nintendo-wii-brstm-fields 5017>(0x10.L) string HEAD \b: 5018>>(0x10.L+0x0C) belong x 5019>>>(&-4.L+0x48) belong x 5020>>>>&-4 byte 0 PCM, signed 8-bit, 5021>>>>&-4 byte 1 PCM, signed 16-bit, 5022>>>>&-4 byte 2 THP ADPCM, 5023>>>>&-3 byte !0 looping, 5024>>>>&-2 byte 1 mono 5025>>>>&-2 byte 2 stereo 5026>>>>&-2 byte 3 3 channels 5027>>>>&-2 byte 4 quad 5028>>>>&-2 byte >4 %u channels 5029>>>>&0 beshort !0 %u Hz 5030 5031# Nintendo Wii BRSTM audio format 5032# https://wiibrew.org/wiki/BRSTM_file 5033# Added by David Korth <gerbilsoft@gerbilsoft.com> 50340 string RSTM Nintendo Wii BRSTM audio file 5035!:mime audio/x-brstm 5036!:ext brstm 5037# Wii is big-endian, so default to BE. 5038>4 beshort 0xFEFF 5039>>0 use nintendo-wii-brstm-fields 5040>4 leshort 0xFEFF 5041>>0 use \^nintendo-wii-brstm-fields 5042 5043# Nintendo 3DS BCSTM audio format (fields) 50440 name nintendo-3ds-bcstm-fields 5045>(0x18.l) string INFO \b: 5046# INFO block: Stream information starts at 0x20 (minus 4 for the 'INFO' magic) 5047>>&0x1C byte 0 PCM, signed 8-bit, 5048>>&0x1C byte 1 PCM, signed 16-bit, 5049>>&0x1C byte 2 DSP ADPCM, 5050>>&0x1C byte 3 IMA ADPCM, 5051>>&0x1D byte !0 looping, 5052>>&0x1E byte 1 mono 5053>>&0x1E byte 2 stereo 5054>>&0x1E byte 3 3 channels 5055>>&0x1E byte 4 quad 5056>>&0x1E byte >4 %u channels 5057>>&0x20 lelong !0 %u Hz 5058 5059# Nintendo 3DS BCSTM audio format 5060# https://www.3dbrew.org/wiki/BCSTM 5061# Added by David Korth <gerbilsoft@gerbilsoft.com> 50620 string CSTM Nintendo 3DS BCSTM audio file 5063!:mime audio/x-bcstm 5064!:ext bcstm 5065# 3DS is little-endian, so default to LE. 5066>4 leshort 0xFEFF 5067>>0 use nintendo-3ds-bcstm-fields 5068>4 beshort 0xFEFF 5069>>0 use \^nintendo-3ds-bcstm-fields 5070 5071# Nintendo Wii U BFSTM audio format 5072# http://mk8.tockdom.com/wiki/BFSTM_(File_Format) 5073# NOTE: This format is very similar to BCSTM. 5074# Added by David Korth <gerbilsoft@gerbilsoft.com> 50750 string FSTM Nintendo Wii U BFSTM audio file 5076!:mime audio/x-bfstm 5077!:ext bfstm 5078# BFSTM is used on both Wii U (BE) and Switch (LE), 5079# so default to LE. 5080>4 leshort 0xFEFF 5081>>0 use nintendo-3ds-bcstm-fields 5082>4 beshort 0xFEFF 5083>>0 use \^nintendo-3ds-bcstm-fields 5084 5085# Nintendo 3DS BCSTM audio format (fields) 50860 name nintendo-3ds-bcwav-fields 5087>(0x18.l) string INFO \b: 5088# INFO block (minus 4 for INFO magic) 5089>>&0x4 byte 0 PCM, signed 8-bit, 5090>>&0x4 byte 1 PCM, signed 16-bit, 5091>>&0x4 byte 2 DSP ADPCM, 5092>>&0x4 byte 3 IMA ADPCM, 5093>>&0x5 byte !0 looping, 5094>>&0x8 lelong x stereo 5095>>&0x8 lelong !0 %u Hz 5096 5097# Nintendo 3DS BCWAV audio format 5098# https://www.3dbrew.org/wiki/BCWAV 5099# Added by David Korth <gerbilsoft@gerbilsoft.com> 51000 string CWAV Nintendo 3DS BCWAV audio file 5101!:mime audio/x-bcwav 5102!:ext bcwav 5103# 3DS is little-endian, so default to LE. 5104>4 leshort 0xFEFF 5105>>0 use nintendo-3ds-bcwav-fields 5106>4 beshort 0xFEFF 5107>>0 use \^nintendo-3ds-bcwav-fields 5108 5109#---------------------------------------------------------------- 5110# $File: basis,v 1.5 2019/04/19 00:42:27 christos Exp $ 5111# basis: file(1) magic for BBx/Pro5-files 5112# Oliver Dammer <dammer@olida.de> 2005/11/07 5113# https://www.basis.com business-basic-files. 5114# 51150 string \074\074bbx\076\076 BBx 5116>7 string \000 indexed file 5117>7 string \001 serial file 5118>7 string \002 keyed file 5119>>13 short 0 (sort) 5120>7 string \004 program 5121>>18 byte x (LEVEL %d) 5122>>>23 string >\000 psaved 5123>7 string \006 mkeyed file 5124>>13 short 0 (sort) 5125>>8 string \000 (mkey) 5126#------------------------------------------------------------------------------ 5127# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $ 5128# beetle: file(1) magic for Beetle VM object files 5129# https://github.com/rrthomas/beetle/ 5130 5131# Beetle object module 51320 string BEETLE\000 Beetle VM object file 5133 5134#------------------------------------------------------------------------------ 5135# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $ 5136# ber: file(1) magic for several BER formats used in the mobile 5137# telecommunications industry (Georg Sauthoff) 5138 5139# The file formats are standardized by the GSMA (GSM association). 5140# They are specified via ASN.1 schemas and some prose. Basic encoding 5141# rules (BER) is the used encoding. The formats are used for exchanging 5142# call data records (CDRs) between mobile operators and associated 5143# parties for roaming clearing purposes and fraud detection. 5144 5145# The magic file covers: 5146 5147# - TAP files (TD.57) - CDR batches and notifications 5148# - RAP files (TD.32) - return batches and acknowledgements 5149# - NRT files (TD.35) - CDR batches for 'near real time' processing 5150 5151# 5152# TAP 3 Files 5153# TAP -> Transferred Account Procedure 5154# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf 5155# TransferBatch short tag 51560 byte 0x61 5157# BatchControlInfo short tag 5158>&1 search/b5 \x64 5159# Sender long tag #TAP 3.x (BER encoded) 5160>>&1 search/b8 \x5f\x81\x44 5161# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5162>>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5163>>>>&0 byte x TAP 3.%d Batch (TD.57, Transferred Account) 5164 5165# Notification short tag 51660 byte 0x62 5167# Sender long tag 5168>2 search/b8 \x5f\x81\x44 5169# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5170>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5171>>>&0 byte x TAP 3.%d Notification (TD.57, Transferred Account) 5172 5173 5174# NRT Files 5175# NRT a.k.a. NRTRDE 51760 byte 0x61 5177# <SpecificationVersionNumber>2</><ReleaseVersionNumber> block 5178>&1 search/b8 \x5f\x29\x01\x02\x5f\x25\x01 5179>>&0 byte x NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) 5180 5181# RAP Files 5182# cf. https://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf 5183# Long ReturnBatch tag 51840 string \x7f\x84\x16 5185# Long RapBatchControlInfo tag 5186>&1 search/b8 \x7f\x84\x19 5187# <SpecificationVersionNumber>3</><ReleaseVersionNumber> block 5188>>&64 search/b64 \x5f\x81\x49\x01\x03\x5f\x81\x3d\x01 5189# <RapSpecificationVersionNumber>1</><RapReleaseVersionNumber> block 5190>>>&1 string/b \x5f\x84\x20\x01\x01\x5f\x84\x1f\x01 5191>>>>&0 byte x RAP 1.%d Batch (TD.32, Returned Account Procedure), 5192>>>&0 byte x TAP 3.%d 5193 5194# Long Acknowledgement tag 51950 string \x7f\x84\x17 5196# Long Sender tag 5197>&1 search/b5 \x5f\x81\x44 RAP Acknowledgement (TD.32, Returned Account Procedure) 5198 5199#------------------------------------------------------------------------------ 5200# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $ 5201# bFLT: file(1) magic for BFLT uclinux binary files 5202# 5203# From Philippe De Muyter <phdm@macqel.be> 5204# 52050 string bFLT BFLT executable 5206>4 belong x - version %d 5207>4 belong 4 5208>>36 belong&0x1 0x1 ram 5209>>36 belong&0x2 0x2 gotpic 5210>>36 belong&0x4 0x4 gzip 5211>>36 belong&0x8 0x8 gzdata 5212 5213#------------------------------------------------------------------------------ 5214# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $ 5215# BlockHashLoc 5216# ext: bhl 5217# Marco Pontello marcopon@gmail.com 5218# reference: https://github.com/MarcoPon/BlockHashLoc 52190 string BlockHashLoc\x1a BlockHashLoc recovery info, 5220>13 byte x version %d 5221!:ext bhl 5222 5223#------------------------------------------------------------------------------ 5224# $File: bioinformatics,v 1.5 2019/04/19 00:42:27 christos Exp $ 5225# bioinfomatics: file(1) magic for Bioinfomatics file formats 5226 5227############################################################################### 5228# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable 5229# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 5230############################################################################### 52310 string \037\213 5232>3 byte &0x04 5233>>12 string BC 5234>>>14 leshort &0x02 Blocked GNU Zip Format (BGZF; gzip compatible) 5235>>>>16 leshort x \b, block length %d 5236!:mime application/x-gzip 5237 5238 5239############################################################################### 5240# Tabix index file 5241# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml) 5242############################################################################### 52430 string TBI\1 SAMtools TBI (Tabix index format) 5244>0x04 lelong =1 \b, with %d reference sequence 5245>0x04 lelong >1 \b, with %d reference sequences 5246>0x08 lelong &0x10000 \b, using half-closed-half-open coordinates (BED style) 5247>0x08 lelong ^0x10000 5248>>0x08 lelong =0 \b, using closed and one based coordinates (GFF style) 5249>>0x08 lelong =1 \b, using SAM format 5250>>0x08 lelong =2 \b, using VCF format 5251>0x0c lelong x \b, sequence name column: %d 5252>0x10 lelong x \b, region start column: %d 5253>0x08 lelong =0 5254>>0x14 lelong x \b, region end column: %d 5255>0x18 byte x \b, comment character: %c 5256>0x1c lelong x \b, skip line count: %d 5257 5258 5259############################################################################### 5260# BAM (Binary Sequence Alignment/Map format) 5261# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5262# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5263############################################################################### 52640 string BAM\1 SAMtools BAM (Binary Sequence Alignment/Map) 5265>0x04 lelong >0 5266>>&0x00 regex =^[@]HD\t.*VN: \b, with SAM header 5267>>>&0 regex =[0-9.]+ \b version %s 5268>>&(0x04) lelong >0 \b, with %d reference sequences 5269 5270 5271############################################################################### 5272# BAI (BAM indexing format) 5273# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5274############################################################################### 52750 string BAI\1 SAMtools BAI (BAM indexing format) 5276>0x04 lelong >0 \b, with %d reference sequences 5277 5278 5279############################################################################### 5280# CRAM (Binary Sequence Alignment/Map format) 5281############################################################################### 52820 string CRAM CRAM 5283>0x04 byte >-1 version %d. 5284>0x05 byte >-1 \b%d 5285>0x06 string >\0 (identified as %s) 5286 5287 5288############################################################################### 5289# BCF (Binary Call Format), version 1 5290# used by SAMtools & VCFtools (http://vcftools.sourceforge.net/bcf.pdf) 5291# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5292############################################################################### 52930 string BCF\4 5294# length of seqnm data in bytes is positive 5295>&0x00 lelong >0 5296# length of smpl data in bytes is positive 5297>>&(&-0x04) lelong >0 SAMtools BCF (Binary Call Format) 5298# length of meta in bytes 5299>>>&(&-0x04) lelong >0 5300# have meta text string 5301>>>>&0x00 search ##samtoolsVersion= 5302>>>>>&0x00 string x \b, generated by SAMtools version %s 5303 5304 5305############################################################################### 5306# BCF (Binary Call Format), version 2.1 5307# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 5308# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5309############################################################################### 53100 string BCF\2\1 Binary Call Format (BCF) version 2.1 5311# length of header text 5312>&0x00 lelong >0 5313# have header string 5314>>&0x00 search ##samtoolsVersion= 5315>>>&0x00 string x \b, generated by SAMtools version %s 5316 5317 5318############################################################################### 5319# BCF (Binary Call Format), version 2.2 5320# used by SAMtools (https://samtools.github.io/hts-specs/BCFv2_qref.pdf) 5321# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it 5322############################################################################### 53230 string BCF\2\2 Binary Call Format (BCF) version 2.2 5324# length of header text 5325>&0x00 lelong >0 5326# have header string 5327>>&0x00 search ##samtoolsVersion= 5328>>>&0x00 string x \b, generated by SAMtools version %s 5329 5330############################################################################### 5331# VCF (Variant Call Format) 5332# used by VCFtools (http://vcftools.sourceforge.net/) 5333############################################################################### 53340 search ##fileformat=VCFv Variant Call Format (VCF) 5335>&0 string x \b version %s 5336 5337############################################################################### 5338# FASTQ 5339# used by MAQ (http://maq.sourceforge.net/fastq.shtml) 5340############################################################################### 5341# XXX Broken? 5342# @<seqname> 5343#0 regex =^@[A-Za-z0-9_.:-]+\?\n 5344# <seq> 5345#>&1 regex =^[A-Za-z\n.~]++ 5346# +[<seqname>] 5347#>>&1 regex =^[A-Za-z0-9_.:-]*\?\n 5348# <qual> 5349#>>>&1 regex =^[!-~\n]+\n FASTQ 5350 5351############################################################################### 5352# FASTA 5353# used by FASTA (https://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf) 5354############################################################################### 5355#0 byte 0x3e 5356# q>0 regex =^[>][!-~\t\ ]+$ 5357# Amino Acid codes: [A-IK-Z*-]+ 5358#>>1 regex !=[!-'Jj;:=?@^`|~\\] FASTA 5359# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+ 5360# not in IUPAC codes/gaps: [EFIJLOPQZ] 5361#>>>1 regex !=[EFIJLOPQZefijlopqz] \b, with IUPAC nucleotide codes 5362#>>>1 regex =^[EFIJLOPQZefijlopqz]+$ \b, with Amino Acid codes 5363 5364############################################################################### 5365# SAM (Sequence Alignment/Map format) 5366# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf) 5367############################################################################### 5368# Short-cut version to recognise SAM files with (optional) header at beginning 5369############################################################################### 53700 string @HD\t 5371>4 search VN: Sequence Alignment/Map (SAM), with header 5372>>&0 regex [0-9.]+ \b version %s 5373############################################################################### 5374# Longer version to recognise SAM alignment lines using (many) regexes 5375############################################################################### 5376# SAM Alignment QNAME 53770 regex =^[!-?A-~]{1,255}(\t[^\t]+){11} 5378# SAM Alignment FLAG 5379>0 regex =^([^\t]+\t){1}[0-9]{1,5}\t 5380# SAM Alignment RNAME 5381>>0 regex =^([^\t]+\t){2}\\*|[^*=]*\t 5382# SAM Alignment POS 5383>>>0 regex =^([^\t]+\t){3}[0-9]{1,9}\t 5384# SAM Alignment MAPQ 5385>>>>0 regex =^([^\t]+\t){4}[0-9]{1,3}\t 5386# SAM Alignment CIGAR 5387>>>>>0 regex =\t(\\*|([0-9]+[MIDNSHPX=])+)\t 5388# SAM Alignment RNEXT 5389>>>>>>0 regex =\t(\\*|=|[!-()+->?-~][!-~]*)\t 5390# SAM Alignment PNEXT 5391>>>>>>>0 regex =^([^\t]+\t){7}[0-9]{1,9}\t 5392# SAM Alignment TLEN 5393>>>>>>>>0 regex =\t[+-]{0,1}[0-9]{1,9}\t.*\t 5394# SAM Alignment SEQ 5395>>>>>>>>>0 regex =^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t 5396# SAM Alignment QUAL 5397>>>>>>>>>>0 regex =^([^\t]+\t){10}[!-~]+ Sequence Alignment/Map (SAM) 5398>>>>>>>>>>>0 regex =^[@]HD\t.*VN: \b, with header 5399>>>>>>>>>>>>&0 regex =[0-9.]+ \b version %s 5400 5401############################################################################## 5402# 5403# Magic ids for biomedical signal file formats 5404# Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com> 5405# 5406# The list has been derived from biosig projects 5407# http://biosig.sourceforge.net 5408# https://pub.ist.ac.at/~schloegl/matlab/eeg/ 5409# https://pub.ist.ac.at/~schloegl/biosig/TESTED 5410# 5411############################################################################## 5412# 54130 string ABF\x20 Biosig/Axon Binary format 5414!:mime biosig/abf2 54150 string ABF2\0\0 Biosig/Axon Binary format 5416!:mime biosig/abf2 5417# 54180 string ATES\x20MEDICA\x20SOFT.\x20EEG\x20for\x20Windows Biosig/ATES MEDICA SOFT. EEG for Windows 5419!:mime biosig/ates 5420# 54210 string ATF\x09 Biosig/Axon Text fomrat 5422!:mime biosig/atf 5423# 54240 string ADU1 Biosig/Axona file format 5425!:mime biosig/axona 54260 string ADU2 Biosig/Axona file format 5427!:mime biosig/axona 5428# 54290 string ALPHA-TRACE-MEDICAL Biosig/alpha trace 5430!:mime biosig/alpha 5431# 54320 string AxGr Biosig/AXG 54330 string axgx Biosig/AXG 5434!:mime biosig/axg 5435# 54360 string HeaderLen= Biosig/BCI2000 54370 string BCI2000V Biosig/BCI2000 5438!:mime biosig/bci2000 5439# 5440### Specification: https://www.biosemi.com/faq/file_format.htm 54410 string \xffBIOSEMI Biosig/Biosemi data format 5442!:mime biosig/bdf 5443# 54440 string Brain\x20Vision\x20Data\x20Exchange\x20Header\x20File Biosig/Brainvision data file 54450 string Brain\x20Vision\x20V-Amp\x20Data\x20Header\x20File\x20Version Biosig/Brainvision V-Amp file 54460 string Brain\x20Vision\x20Data\x20Exchange\x20Marker\x20File,\x20Version Biosig/Brainvision Marker file 5447!:mime biosig/brainvision 5448# 54490 string CEDFILE Biosig/CFS: Cambridge Electronic devices File format 5450!:mime biosig/ced 5451# 5452### Specification: https://www.edfplus.info/specs/index.html 54530 string 0\x20\x20\x20\x20\x20\x20\x20 Biosig/EDF: European Data format 5454!:mime biosig/edf 5455# 5456### Specifications: https://arxiv.org/abs/cs/0608052 54570 string GDF Biosig/GDF: General data format for biosignals 5458!:mime biosig/gdf 5459# 54600 string DATA\0\0\0\0 Biosig/Heka Patchmaster 54610 string DAT1\0\0\0\0 Biosig/Heka Patchmaster 54620 string DAT2\0\0\0\0 Biosig/Heka Patchmaster 5463!:mime biosig/heka 5464# 54650 string (C)\x20CED\x2087 Biosig/CED SMR 5466!:mime biosig/ced-smr 5467# 54680 string CFWB\1\0\0\0 Biosig/CFWB 5469!:mime biosig/cfwb 5470# 54710 string DEMG Biosig/DEMG 5472!:mime biosig/demg 5473# 54740 string EBS\x94\x0a\x13\x1a\x0d Biosig/EBS 5475!:mime biosig/ebs 5476# 54770 string Embla\x20data\x20file Biosig/Embla 5478!:mime biosig/embla 5479# 54800 string Header\r\nFile Version Biosig/ETG4000 5481!:mime biosig/etg4000 5482# 54830 string GALILEO\x20EEG\x20TRACE\x20FILE Biosig/Galileo 5484!:mime biosig/galileo 5485# 54860 string IGOR Biosig/IgorPro ITX file 5487!:mime biosig/igorpro 5488# 5489# Specification: http://www.ampsmedical.com/uploads/2017-12-7/The_ISHNE_Format.pdf 54900 string ISHNE1.0 Biosig/ISHNE 5491!:mime biosig/ishne 5492# 5493# CEN/ISO 11073/22077 series, http://www.mfer.org/en/document.htm 54940 string @\x20\x20MFER\x20 Biosig/MFER 54950 string @\x20MFR\x20 Biosig/MFER 5496!:mime biosig/mfer 5497# 54980 string NEURALEV Biosig/NEV 54990 string N.EV.\0 Biosig/NEV 5500!:mime biosig/nev 5501# 55020 string NEX1 Biosig/NEX 5503!:mime biosig/nex1 5504# 55050 string PLEX Biosig/Plexon v1.0 550610 string PLEXON Biosig/Plexon v2.0 5507!:mime biosig/plexon 5508# 55090 string \x02\x27\x91\xC6 Biosig/RHD2000: Intan RHD2000 format 5510# 5511# Specification: CEN 1064:2005/ISO 11073:91064 551216 string SCPECG\0\0 Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064 5513!:mime biosig/scpecg 5514# 55150 string IAvSFo Biosig/SIGIF 5516!:mime biosig/sigif 5517# 55180 string POLY\x20SAMPLE\x20FILEversion\x20 Biosig/TMS32 5519!:mime biosig/tms32 5520# 55210 string FileId=TMSi\x20PortiLab\x20sample\x20log\x20file\x0a\x0dVersion= Biosig/TMSiLOG 5522!:mime biosig/tmsilog 5523# 55244 string Synergy\0\48\49\50\46\48\48\51\46\48\48\48\46\48\48\48\0\28\0\0\0\2\0\0\0 5525>63 string CRawDataElement 5526>>85 string CRawDataBuffer Biosig/SYNERGY 5527!:mime biosig/synergy 5528# 55294 string \40\0\4\1\44\1\102\2\146\3\44\0\190\3 Biosig/UNIPRO 5530!:mime biosig/unipro 5531# 55320 string VER=9\r\nCTIME= Biosig/WCP 5533!:mime biosig/wcp 5534# 55350 string \xAF\xFE\xDA\xDA Biosig/Walter Graphtek 55360 string \xDA\xDA\xFE\xAF Biosig/Walter Graphtek 55370 string \x55\x55\xFE\xAF Biosig/Walter Graphtek 5538!:mime biosig/walter-graphtek 5539# 55400 string V3.0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20 5541>32 string [PatInfo] Biosig/Sigma 5542!:mime biosig/sigma 5543# 55440 string \067\069\078\013\010\0x1a\04\0x84 Biosig/File exchange format (FEF) 5545!:mime biosig/fef 55460 string \67\69\78\0x13\0x10\0x1a\4\0x84 Biosig/File exchange format (FEF) 5547!:mime biosig/fef 5548# 55490 string \0\0\0\x64\0\0\0\x1f\0\0\0\x14\0\0\0\0\0\1 5550>36 string \0\0\0\x65\0\0\0\3\0\0\0\4\0\0 5551>>56 string \0\0\0\x6a\0\0\0\3\0\0\0\4\0\0\0\0\xff\xff\xff\xff\0\0 Biosig/FIFF 5552!:mime biosig/fiff 5553# 5554 5555#------------------------------------------------------------------------------ 5556# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $ 5557# blackberry: file(1) magic for BlackBerry file formats 5558# 55595 belong 0 5560>8 belong 010010010 BlackBerry RIM ETP file 5561>>22 string x \b for %s 5562# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files 5563# https://ftg.lbl.gov/checkpoint 55640 string C\0\0\0R\0\0\0 BLCR 5565>16 lelong 1 x86 5566>16 lelong 3 alpha 5567>16 lelong 5 x86-64 5568>16 lelong 7 ARM 5569>8 lelong x context data (little endian, version %d) 5570# Uncomment the following only of your "file" program supports "search" 5571#>0 search/1024 VMA\06 for kernel 5572#>>&1 byte x %d. 5573#>>&2 byte x %d. 5574#>>&3 byte x %d 55750 string \0\0\0C\0\0\0R BLCR 5576>16 belong 2 SPARC 5577>16 belong 4 ppc 5578>16 belong 6 ppc64 5579>16 belong 7 ARMEB 5580>16 belong 8 SPARC64 5581>8 belong x context data (big endian, version %d) 5582# Uncomment the following only of your "file" program supports "search" 5583#>0 search/1024 VMA\06 for kernel 5584#>>&1 byte x %d. 5585#>>&2 byte x \b%d. 5586#>>&3 byte x \b%d 5587 5588#------------------------------------------------------------------------------ 5589# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $ 5590# blender: file(1) magic for Blender 3D related files 5591# 5592# Native format rule v1.2. For questions use the developers list 5593# https://lists.blender.org/mailman/listinfo/bf-committers 5594# GLOB chunk was moved near start and provides subversion info since 2.42 5595 55960 string =BLENDER Blender3D, 5597>7 string =_ saved as 32-bits 5598>>8 string =v little endian 5599>>>9 byte x with version %c. 5600>>>10 byte x \b%c 5601>>>11 byte x \b%c 5602>>>0x40 string =GLOB \b. 5603>>>>0x58 leshort x \b%.4d 5604>>8 string =V big endian 5605>>>9 byte x with version %c. 5606>>>10 byte x \b%c 5607>>>11 byte x \b%c 5608>>>0x40 string =GLOB \b. 5609>>>>0x58 beshort x \b%.4d 5610>7 string =- saved as 64-bits 5611>>8 string =v little endian 5612>>9 byte x with version %c. 5613>>10 byte x \b%c 5614>>11 byte x \b%c 5615>>0x44 string =GLOB \b. 5616>>>0x60 leshort x \b%.4d 5617>>8 string =V big endian 5618>>>9 byte x with version %c. 5619>>>10 byte x \b%c 5620>>>11 byte x \b%c 5621>>>0x44 string =GLOB \b. 5622>>>>0x60 beshort x \b%.4d 5623 5624# Scripts that run in the embedded Python interpreter 56250 string #!BPY Blender3D BPython script 5626 5627#------------------------------------------------------------------------------ 5628# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $ 5629# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine 5630# 5631# Note that this 0407 conflicts with several other a.out formats... 5632# 5633# XXX - should this be redone with "be" and "le", so that it works on 5634# little-endian machines as well? If so, what's the deal with 5635# "VAX-order" and "VAX-order2"? 5636# 5637#0 long 0407 68K Blit (standalone) executable 5638#0 short 0407 VAX-order2 68K Blit (standalone) executable 56390 short 03401 VAX-order 68K Blit (standalone) executable 56400 long 0406 68k Blit mpx/mux executable 56410 short 0406 VAX-order2 68k Blit mpx/mux executable 56420 short 03001 VAX-order 68k Blit mpx/mux executable 5643# Need more values for WE32 DMD executables. 5644# Note that 0520 is the same as COFF 5645#0 short 0520 tty630 layers executable 5646 5647#------------------------------------------------------------------------------ 5648# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $ 5649# i80960 b.out objects and archives 5650# 56510 long 0x10d i960 b.out relocatable object 5652>16 long >0 not stripped 5653# 5654# b.out archive (hp-rt on i960) 56550 string =!<bout> b.out archive 5656>8 string __.SYMDEF random library 5657 5658#------------------------------------------------------------------------------ 5659# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $ 5660# bsdi: file(1) magic for BSD/OS (from BSDI) objects 5661# Some object/executable formats use the same magic numbers as are used 5662# in other OSes; those are handled by entries in aout. 5663# 5664 56650 lelong 0314 386 compact demand paged pure executable 5666>16 lelong >0 not stripped 5667>32 byte 0x6a (uses shared libs) 5668 5669# same as in SunOS 4.x, except for static shared libraries 56700 belong&077777777 0600413 SPARC demand paged 5671>0 byte &0x80 5672>>20 belong <4096 shared library 5673>>20 belong =4096 dynamically linked executable 5674>>20 belong >4096 dynamically linked executable 5675>0 byte ^0x80 executable 5676>16 belong >0 not stripped 5677>36 belong 0xb4100001 (uses shared libs) 5678 56790 belong&077777777 0600410 SPARC pure 5680>0 byte &0x80 dynamically linked executable 5681>0 byte ^0x80 executable 5682>16 belong >0 not stripped 5683>36 belong 0xb4100001 (uses shared libs) 5684 56850 belong&077777777 0600407 SPARC 5686>0 byte &0x80 dynamically linked executable 5687>0 byte ^0x80 executable 5688>16 belong >0 not stripped 5689>36 belong 0xb4100001 (uses shared libs) 5690# Chiasmus is a encryption standard developed by the German Federal 5691# Office for Information Security (Bundesamt fuer Sicherheit in der 5692# Informationstechnik). 5693 5694# Extension: .xia 56950 string XIA1 Chiasmus encrypted data 5696 5697# Extension: .xis 56980 string XIS Chiasmus key 5699 5700#------------------------------------------------------------------------------ 5701# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $ 5702# BTSnoop: file(1) magic for BTSnoop files 5703# 5704# From <marcel@holtmann.org> 57050 string btsnoop\0 BTSnoop 5706>8 belong x version %d, 5707>12 belong 1001 Unencapsulated HCI 5708>12 belong 1002 HCI UART (H4) 5709>12 belong 1003 HCI BCSP 5710>12 belong 1004 HCI Serial (H5) 5711>>12 belong x type %d 5712 5713#------------------------------------------------------------------------------ 5714# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $ 5715# c64: file(1) magic for various commodore 64 related files 5716# 5717# From: Dirk Jagdmann <doj@cubic.org> 5718 57190x16500 belong 0x12014100 D64 Image 57200x16500 belong 0x12014180 D71 Image 57210x61800 belong 0x28034400 D81 Image 57220 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image 57230 belong 0x43154164 X64 Image 5724 57250 string GCR-1541 GCR Image 5726>8 byte x version: %i 5727>9 byte x tracks: %i 5728 57299 string PSUR ARC archive (c64) 57302 string -LH1- LHA archive (c64) 5731 57320 string C64File PC64 Emulator file 5733>8 string >\0 "%s" 57340 string C64Image PC64 Freezer Image 5735 57360 beshort 0x38CD C64 PCLink Image 57370 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 5738 57390 belong 0xFF424CFF WRAptor packer (c64) 5740 57410 string C64S\x20tape\x20file T64 tape Image 5742>32 leshort x Version:0x%x 5743>36 leshort !0 Entries:%i 5744>40 string x Name:%.24s 5745 57460 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 5747>32 leshort x Version:0x%x 5748>36 leshort !0 Entries:%i 5749>40 string x Name:%.24s 5750 57510 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image 5752>32 leshort x Version:0x%x 5753>36 leshort !0 Entries:%i 5754>40 string x Name:%.24s 5755 5756# Raw tape file format (.tap files) 5757# Esa Hyyti <esa@netlab.tkk.fi> 57580 string C64-TAPE-RAW C64 Raw Tape File (.tap), 5759>0x0c byte x Version:%u, 5760>0x10 lelong x Length:%u cycles 5761 5762# magic for Goattracker2, http://covertbitops.c64.org/ 5763# from Alex Myczko <alex@aiei.ch> 57640 string GTS5 GoatTracker 2 song 5765>4 string >\0 \b, "%s" 5766>36 string >\0 \b by %s 5767>68 string >\0 \b (C) %s 5768>100 byte >0 \b, %u subsong(s) 5769 5770 5771#------------------------------------------------------------------------------ 5772# $File: cad,v 1.19 2019/04/19 00:42:27 christos Exp $ 5773# autocad: file(1) magic for cad files 5774# 5775 5776# Microstation DGN/CIT Files (www.bentley.com) 5777# Last updated July 29, 2005 by Lester Hightower 5778# DGN is the default file extension of Microstation/Intergraph CAD files. 5779# CIT is the proprietary raster format (similar to TIFF) used to attach 5780# raster underlays to Microstation DGN (vector) drawings. 5781# 5782# http://www.wotsit.org/search.asp 5783# https://filext.com/detaillist.php?extdetail=DGN 5784# https://filext.com/detaillist.php?extdetail=CIT 5785# 5786# https://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2 5787# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 5788# https://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 5789# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F 57900 string \010\011\376 Microstation 5791>3 string \002 5792>>30 string \026\105 DGNFile 5793>>30 string \034\105 DGNFile 5794>>30 string \073\107 DGNFile 5795>>30 string \073\110 DGNFile 5796>>30 string \106\107 DGNFile 5797>>30 string \110\103 DGNFile 5798>>30 string \120\104 DGNFile 5799>>30 string \172\104 DGNFile 5800>>30 string \172\105 DGNFile 5801>>30 string \172\106 DGNFile 5802>>30 string \234\106 DGNFile 5803>>30 string \273\105 DGNFile 5804>>30 string \306\106 DGNFile 5805>>30 string \310\104 DGNFile 5806>>30 string \341\104 DGNFile 5807>>30 string \372\103 DGNFile 5808>>30 string \372\104 DGNFile 5809>>30 string \372\106 DGNFile 5810>>30 string \376\103 DGNFile 5811>4 string \030\000\000 CITFile 5812>4 string \030\000\003 CITFile 5813 5814# AutoCAD 5815# Merge of the different contributions and updates from https://en.wikipedia.org/wiki/Dwg 5816# and https://www.iana.org/assignments/media-types/image/vnd.dwg 58170 string MC0.0 DWG AutoDesk AutoCAD Release 1.0 5818!:mime image/vnd.dwg 58190 string AC1.2 DWG AutoDesk AutoCAD Release 1.2 5820!:mime image/vnd.dwg 58210 string AC1.3 DWG AutoDesk AutoCAD Release 1.3 5822!:mime image/vnd.dwg 58230 string AC1.40 DWG AutoDesk AutoCAD Release 1.40 5824!:mime image/vnd.dwg 58250 string AC1.50 DWG AutoDesk AutoCAD Release 2.05 5826!:mime image/vnd.dwg 58270 string AC2.10 DWG AutoDesk AutoCAD Release 2.10 5828!:mime image/vnd.dwg 58290 string AC2.21 DWG AutoDesk AutoCAD Release 2.21 5830!:mime image/vnd.dwg 58310 string AC2.22 DWG AutoDesk AutoCAD Release 2.22 5832!:mime image/vnd.dwg 58330 string AC1001 DWG AutoDesk AutoCAD Release 2.22 5834!:mime image/vnd.dwg 58350 string AC1002 DWG AutoDesk AutoCAD Release 2.50 5836!:mime image/vnd.dwg 58370 string AC1003 DWG AutoDesk AutoCAD Release 2.60 5838!:mime image/vnd.dwg 58390 string AC1004 DWG AutoDesk AutoCAD Release 9 5840!:mime image/vnd.dwg 58410 string AC1006 DWG AutoDesk AutoCAD Release 10 5842!:mime image/vnd.dwg 58430 string AC1009 DWG AutoDesk AutoCAD Release 11/12 5844!:mime image/vnd.dwg 5845# AutoCAD DWG versions R13/R14 (www.autodesk.com) 5846# Written December 01, 2003 by Lester Hightower 5847# Based on the DWG File Format Specifications at http://www.opendwg.org/ 5848# AutoCad, from Nahuel Greco 5849# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 58500 string AC1012 DWG AutoDesk AutoCAD Release 13 5851!:mime image/vnd.dwg 58520 string AC1014 DWG AutoDesk AutoCAD Release 14 5853!:mime image/vnd.dwg 58540 string AC1015 DWG AutoDesk AutoCAD 2000/2002 5855!:mime image/vnd.dwg 5856 5857# A new version of AutoCAD DWG 5858# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 5859# ICQ 358572321) 5860# From various sources like: 5861# https://autodesk.blogs.com/between_the_lines/autocad-release-history.html 58620 string AC1018 DWG AutoDesk AutoCAD 2004/2005/2006 5863!:mime image/vnd.dwg 58640 string AC1021 DWG AutoDesk AutoCAD 2007/2008/2009 5865!:mime image/vnd.dwg 58660 string AC1024 DWG AutoDesk AutoCAD 2010/2011/2012 5867!:mime image/vnd.dwg 58680 string AC1027 DWG AutoDesk AutoCAD 2013/2014 5869!:mime image/vnd.dwg 5870 5871# KOMPAS 2D drawing from ASCON 5872# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor 5873# gathered nor specification 5874# ASCON https://ascon.net/main/ in English, 5875# https://ascon.ru/ main site in Russian 5876# Extension is CDW for drawing and FRW for fragment of drawing 5877# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru, 5878# ICQ 358572321, https://vkontakte.ru/id16076543) 5879# From: 5880# https://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292 5881# (in russian) and my experiments 58820 string KF 5883>2 belong 0x4E00000C Kompas drawing 12.0 SP1 5884>2 belong 0x4D00000C Kompas drawing 12.0 5885>2 belong 0x3200000B Kompas drawing 11.0 SP1 5886>2 belong 0x3100000B Kompas drawing 11.0 5887>2 belong 0x2310000A Kompas drawing 10.0 SP1 5888>2 belong 0x2110000A Kompas drawing 10.0 5889>2 belong 0x08000009 Kompas drawing 9.0 SP1 5890>2 belong 0x05000009 Kompas drawing 9.0 5891>2 belong 0x33010008 Kompas drawing 8+ 5892>2 belong 0x1A000008 Kompas drawing 8.0 5893>2 belong 0x2C010107 Kompas drawing 7+ 5894>2 belong 0x05000007 Kompas drawing 7.0 5895>2 belong 0x32000006 Kompas drawing 6+ 5896>2 belong 0x09000006 Kompas drawing 6.0 5897>2 belong 0x5C009005 Kompas drawing 5.11R03 5898>2 belong 0x54009005 Kompas drawing 5.11R02 5899>2 belong 0x51009005 Kompas drawing 5.11R01 5900>2 belong 0x22009005 Kompas drawing 5.10R03 5901>2 belong 0x22009005 Kompas drawing 5.10R02 mar 5902>2 belong 0x21009005 Kompas drawing 5.10R02 febr 5903>2 belong 0x19009005 Kompas drawing 5.10R01 5904>2 belong 0xF4008005 Kompas drawing 5.9R01.003 5905>2 belong 0x1C008005 Kompas drawing 5.9R01.002 5906>2 belong 0x11008005 Kompas drawing 5.8R01.003 5907 5908# CAD: file(1) magic for computer aided design files 5909# Phillip Griffith <phillip dot griffith at gmail dot com> 5910# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. 5911# 59120 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library 59130 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD 59140 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD 59150 beshort 0x0809 Bentley/Intergraph MicroStation 5916>0x02 byte 0xfe 5917>>0x04 beshort 0x1800 CIT raster CAD 5918 5919# 3DS (3d Studio files) 59200 leshort 0x4d4d 5921>6 leshort 0x2 5922>>8 lelong 0xa 5923>>>16 leshort 0x3d3d 3D Studio model 5924!:mime image/x-3ds 5925!:ext 3ds 5926 5927# MegaCAD 2D/3D drawing (.prt) 5928# https://megacad.de/ 5929# From: Markus Heidelberg <markus.heidelberg@web.de> 59300 string MegaCad23\0 MegaCAD 2D/3D drawing 5931 5932# Hoops CAD files 5933# https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\ 5934# HSF_architecture.html 5935# Stephane Charette <stephane.charette@gmail.com> 59360 string ;;\020HSF\020V OpenHSF (Hoops Stream Format) 5937>7 regex/9 V[.0-9]{4,5}\020 %s 5938!:ext hsf 5939 5940# AutoCAD Drawing Exchange Format 59410 regex \^[\ \t]*0\r?\000$ 5942>1 regex \^[\ \t]*SECTION\r?$ 5943>>2 regex \^[\ \t]*2\r?$ 5944>>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format 5945!:mime application/x-dxf 5946!:ext dxf 5947>>>>&1 search/8192 AC1006 \b, R10 5948>>>>&1 search/8192 AC1009 \b, R11/R12 5949>>>>&1 search/8192 AC1012 \b, R13 5950>>>>&1 search/8192 AC1014 \b, R14 5951>>>>&1 search/8192 AC1015 \b, version 2000 5952>>>>&1 search/8192 AC1018 \b, version 2004 5953>>>>&1 search/8192 AC1021 \b, version 2007 5954>>>>&1 search/8192 AC1024 \b, version 2010 5955 5956# The Sketchup 3D model format https://www.sketchup.com/ 59570 string \xff\xfe\xff\x0e\x53\x00\x6b\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4d\x00\x6f\x00\x64\x00\x65\x00\x6c\x00 SketchUp Model 5958!:mime application/vnd.sketchup.skp 5959!:ext skp 5960 5961#------------------------------------------------------------------------------ 5962# $File: cafebabe,v 1.24 2018/10/01 23:33:15 christos Exp $ 5963# Cafe Babes unite! 5964# 5965# Since Java bytecode and Mach-O universal binaries have the same magic number, 5966# the test must be performed in the same "magic" sequence to get both right. 5967# The long at offset 4 in a Mach-O universal binary tells the number of 5968# architectures; the short at offset 4 in a Java bytecode file is the JVM minor 5969# version and the short at offset 6 is the JVM major version. Since there are only 5970# only 18 labeled Mach-O architectures at current, and the first released 5971# Java class format was version 43.0, we can safely choose any number 5972# between 18 and 39 to test the number of architectures against 5973# (and use as a hack). Let's not use 18, because the Mach-O people 5974# might add another one or two as time goes by... 5975# 5976### JAVA START ### 59770 belong 0xcafebabe 5978>4 belong >30 compiled Java class data, 5979!:mime application/x-java-applet 5980>>6 beshort x version %d. 5981>>4 beshort x \b%d 5982# Which is which? 5983#>>4 belong 0x032d (Java 1.0) 5984#>>4 belong 0x032d (Java 1.1) 5985>>4 belong 0x002e (Java 1.2) 5986>>4 belong 0x002f (Java 1.3) 5987>>4 belong 0x0030 (Java 1.4) 5988>>4 belong 0x0031 (Java 1.5) 5989>>4 belong 0x0032 (Java 1.6) 5990>>4 belong 0x0033 (Java 1.7) 5991>>4 belong 0x0034 (Java 1.8) 5992 59930 belong 0xcafed00d JAR compressed with pack200, 5994>5 byte x version %d. 5995>4 byte x \b%d 5996!:mime application/x-java-pack200 5997 5998 59990 belong 0xcafed00d JAR compressed with pack200, 6000>5 byte x version %d. 6001>4 byte x \b%d 6002!:mime application/x-java-pack200 6003 6004### JAVA END ### 6005### MACH-O START ### 6006 60070 name mach-o \b [ 6008>0 use mach-o-cpu \b 6009>(8.L) indirect x \b: 6010>0 belong x \b] 6011 60120 belong 0xcafebabe 6013>4 belong 1 Mach-O universal binary with 1 architecture: 6014!:mime application/x-mach-binary 6015>>8 use mach-o \b 6016>4 belong >1 6017>>4 belong <20 Mach-O universal binary with %d architectures: 6018!:mime application/x-mach-binary 6019>>>8 use mach-o \b 6020>>4 belong >1 6021>>>28 use mach-o \b 6022>>4 belong >2 6023>>>48 use mach-o \b 6024>>4 belong >3 6025>>>68 use mach-o \b 6026>>4 belong >4 6027>>>88 use mach-o \b 6028>>4 belong >5 6029>>>108 use mach-o \b 6030 6031### MACH-O END ### 6032 6033#------------------------------------------------------------------------------ 6034# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $ 6035# cbor: file(1) magic for CBOR files as defined in RFC 7049 6036 60370 string \xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container 6038!:mime application/cbor 6039>3 ubyte <0x20 (positive integer) 6040>3 ubyte <0x40 6041>>3 ubyte >0x1f (negative integer) 6042>3 ubyte <0x60 6043>>3 ubyte >0x3f (byte string) 6044>3 ubyte <0x80 6045>>3 ubyte >0x5f (text string) 6046>3 ubyte <0xa0 6047>3 ubyte >0x7f (array) 6048>3 ubyte <0xc0 6049>>3 ubyte >0x9f (map) 6050>3 ubyte <0xe0 6051>>3 ubyte >0xbf (tagged) 6052>3 ubyte >0xdf (other) 6053 6054#------------------------------------------------------------------------------ 6055# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $ 6056# CDDB: file(1) magic for CDDB(tm) format CD text data files 6057# 6058# From <steve@gracenote.com> 6059# 6060# This is the /etc/magic entry to decode datafiles as used by 6061# CDDB-enabled CD player applications. 6062# 6063 60640 search/1/w #\040xmcd CDDB(tm) format CD text data 6065 6066#------------------------------------------------------------------------------ 6067# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $ 6068# chord: file(1) magic for Chord music sheet typesetting utility input files 6069# 6070# From Philippe De Muyter <phdm@macqel.be> 6071# File format is actually free, but many distributed files begin with `{title' 6072# 60730 string {title Chord text file 6074 6075# Type: PowerTab file format 6076# URL: http://www.power-tab.net/ 6077# From: Jelmer Vernooij <jelmer@samba.org> 60780 string ptab\003\000 Power-Tab v3 Tablature File 60790 string ptab\004\000 Power-Tab v4 Tablature File 6080 6081#------------------------------------------------------------------------------ 6082# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $ 6083# cisco: file(1) magic for cisco Systems routers 6084# 6085# Most cisco file-formats are covered by the generic elf code 6086# 6087# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha. 60880 belong&0xffffff00 0x85011400 cisco IOS microcode 6089>7 string >\0 for '%s' 60900 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode 6091>7 string >\0 for '%s' 6092 6093#------------------------------------------------------------------------------ 6094# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $ 6095# citrus locale declaration 6096# 6097 60980 string RuneCT Citrus locale declaration for LC_CTYPE 6099 6100#------------------------------------------------------------------------------ 6101# $File: c-lang,v 1.27 2019/02/27 16:46:23 christos Exp $ 6102# c-lang: file(1) magic for C and related languages programs 6103# 6104# The strength is to beat standard HTML 6105 6106# BCPL 61070 search/8192 "libhdr" BCPL source text 6108!:mime text/x-bcpl 61090 search/8192 "LIBHDR" BCPL source text 6110!:mime text/x-bcpl 6111 6112# C 6113# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength 61140 search/8192 #include 6115>0 regex \^#include C 6116>>0 regex \^class[[:space:]]+ 6117>>>&0 regex \\{[\.\*]\\}(;)?$ \b++ 6118>>&0 clear x source text 6119!:strength + 13 6120!:mime text/x-c 61210 search/8192 pragma 6122>0 regex \^#[[:space:]]*pragma C source text 6123!:mime text/x-c 61240 search/8192 endif 6125>0 regex \^#[[:space:]]*(if\|ifn)def 6126>>&0 regex \^#[[:space:]]*endif$ C source text 6127!:mime text/x-c 61280 search/8192 define 6129>0 regex \^#[[:space:]]*(if\|ifn)def 6130>>&0 regex \^#[[:space:]]*define C source text 6131!:mime text/x-c 61320 search/8192 char 6133>0 regex \^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6134!:mime text/x-c 61350 search/8192 double 6136>0 regex \^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6137!:mime text/x-c 61380 search/8192 extern 6139>0 regex \^[[:space:]]*extern[[:space:]]+ C source text 6140!:mime text/x-c 61410 search/8192 float 6142>0 regex \^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$ C source text 6143!:mime text/x-c 61440 search/8192 struct 6145>0 regex \^struct[[:space:]]+ C source text 6146!:mime text/x-c 61470 search/8192 union 6148>0 regex \^union[[:space:]]+ C source text 6149!:mime text/x-c 61500 search/8192 main( 6151>&0 regex \\)[[:space:]]*\\{ C source text 6152!:mime text/x-c 6153 6154# C++ 6155# The strength of these rules is increased so they beat the C rules above 61560 search/8192 namespace 6157>0 regex \^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{ C++ source text 6158!:strength + 30 6159!:mime text/x-c++ 6160# using namespace [namespace] or using std::[lib] 61610 search/8192 using 6162>0 regex \^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*; C++ source text 6163!:strength + 30 6164!:mime text/x-c++ 61650 search/8192 template 6166>0 regex \^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$ C++ source text 6167!:strength + 30 6168!:mime text/x-c++ 61690 search/8192 virtual 6170>0 regex \^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$ C++ source text 6171!:strength + 30 6172!:mime text/x-c++ 6173# But class alone is reduced to avoid beating php (Jens Schleusener) 61740 search/8192 class 6175>0 regex \^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$ C++ source text 6176!:strength + 13 6177!:mime text/x-c++ 61780 search/8192 public 6179>0 regex \^[[:space:]]*public: C++ source text 6180!:strength + 30 6181!:mime text/x-c++ 61820 search/8192 private 6183>0 regex \^[[:space:]]*private: C++ source text 6184!:strength + 30 6185!:mime text/x-c++ 61860 search/8192 protected 6187>0 regex \^[[:space:]]*protected: C++ source text 6188!:strength + 30 6189!:mime text/x-c++ 6190 6191# Objective-C 61920 search/8192 #import 6193>0 regex \^#import Objective-C source text 6194!:strength + 25 6195!:mime text/x-objective-c 6196 6197# From: Mikhail Teterin <mi@aldan.algebra.com> 61980 string cscope cscope reference data 6199>7 string x version %.2s 6200# We skip the path here, because it is often long (so file will 6201# truncate it) and mostly redundant. 6202# The inverted index functionality was added some time between 6203# versions 11 and 15, so look for -q if version is above 14: 6204>7 string >14 6205>>10 search/100 \ -q\ with inverted index 6206>10 search/100 \ -c\ text (non-compressed) 6207 6208#------------------------------------------------------------------------------ 6209# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $ 6210# clarion: file(1) magic for # Clarion Personal/Professional Developer 6211# (v2 and above) 6212# From: Julien Blache <jb@jblache.org> 6213 6214# Database files 6215# signature 62160 leshort 0x3343 Clarion Developer (v2 and above) data file 6217# attributes 6218>2 leshort &0x0001 \b, locked 6219>2 leshort &0x0004 \b, encrypted 6220>2 leshort &0x0008 \b, memo file exists 6221>2 leshort &0x0010 \b, compressed 6222>2 leshort &0x0040 \b, read only 6223# number of records 6224>5 lelong x \b, %d records 6225 6226# Memo files 62270 leshort 0x334d Clarion Developer (v2 and above) memo data 6228 6229# Key/Index files 6230# No magic? :( 6231 6232# Help files 62330 leshort 0x49e0 Clarion Developer (v2 and above) help data 6234 6235#------------------------------------------------------------------------------ 6236# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $ 6237# claris: file(1) magic for claris 6238# "H. Nanosecond" <aldomel@ix.netcom.com> 6239# Claris Works a word processor, etc. 6240# Version 3.0 6241 6242# .pct claris works clip art files 6243#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 6244#* 6245#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 6246#null to byte 1000 octal 6247514 string \377\377\377\377\000 6248>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 6249514 string \377\377\377\377\001 6250>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 Claris clip art 6251 6252# Claris works files 6253# .cwk 6254# Moved to Apple AppleWorks document 6255#0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document 6256# .plt 62570 string \020\341\000\000\010\010 Claris Works palette files .plt 6258 6259# .msp a dictionary file I am not sure about this I have only one .msp file 62600 string \002\271\262\000\040\002\000\164 Claris works dictionary 6261 6262# .usp are user dictionary bits 6263# I am not sure about a magic header: 6264#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 6265# soh S p f 8 U D sp ^ S cr nl p o d i 6266#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 6267# a t r i s t sp ^ S cr nl d i v sp # 6268 6269# .mth Thesaurus 6270# starts with \0 but no magic header 6271 6272# .chy Hyphenation file 6273# I am not sure: 000 210 034 000 000 6274 6275# other claris files 6276#./windows/claris/useng.ndx: data 6277#./windows/claris/xtndtran.l32: data 6278#./windows/claris/xtndtran.lst: data 6279#./windows/claris/clworks.lbl: data 6280#./windows/claris/clworks.prf: data 6281#./windows/claris/userd.spl: data 6282 6283#------------------------------------------------------------------------------ 6284# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $ 6285# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper. 6286# 6287# XXX - what byte order does the Clipper use? 6288# 6289# XXX - what's the "!" stuff: 6290# 6291# >18 short !074000,000000 C1 R1 6292# >18 short !074000,004000 C2 R1 6293# >18 short !074000,010000 C3 R1 6294# >18 short !074000,074000 TEST 6295# 6296# I shall assume it's ANDing the field with the first value and 6297# comparing it with the second, and rewrite it as: 6298# 6299# >18 short&074000 000000 C1 R1 6300# >18 short&074000 004000 C2 R1 6301# >18 short&074000 010000 C3 R1 6302# >18 short&074000 074000 TEST 6303# 6304# as SVR3.1's "file" doesn't support anything of the "!074000,000000" 6305# sort, nor does SunOS 4.x, so either it's something Intergraph added 6306# in CLIX, or something AT&T added in SVR3.2 or later, or something 6307# somebody else thought was a good idea; it's not documented in the 6308# man page for this version of "magic", nor does it appear to be 6309# implemented (at least not after I blew off the bogus code to turn 6310# old-style "&"s into new-style "&"s, which just didn't work at all). 6311# 63120 short 0575 CLIPPER COFF executable (VAX #) 6313>20 short 0407 (impure) 6314>20 short 0410 (5.2 compatible) 6315>20 short 0411 (pure) 6316>20 short 0413 (demand paged) 6317>20 short 0443 (target shared library) 6318>12 long >0 not stripped 6319>22 short >0 - version %d 63200 short 0577 CLIPPER COFF executable 6321>18 short&074000 000000 C1 R1 6322>18 short&074000 004000 C2 R1 6323>18 short&074000 010000 C3 R1 6324>18 short&074000 074000 TEST 6325>20 short 0407 (impure) 6326>20 short 0410 (pure) 6327>20 short 0411 (separate I&D) 6328>20 short 0413 (paged) 6329>20 short 0443 (target shared library) 6330>12 long >0 not stripped 6331>22 short >0 - version %d 6332>48 long&01 01 alignment trap enabled 6333>52 byte 1 -Ctnc 6334>52 byte 2 -Ctsw 6335>52 byte 3 -Ctpw 6336>52 byte 4 -Ctcb 6337>53 byte 1 -Cdnc 6338>53 byte 2 -Cdsw 6339>53 byte 3 -Cdpw 6340>53 byte 4 -Cdcb 6341>54 byte 1 -Csnc 6342>54 byte 2 -Cssw 6343>54 byte 3 -Cspw 6344>54 byte 4 -Cscb 63454 string pipe CLIPPER instruction trace 63464 string prof CLIPPER instruction profile 6347#------------------------------------------------------------------------------ 6348# file: file(1) magic for Clojure 6349# URL: https://clojure.org/ 6350# From: Jason Felice <jason.m.felice@gmail.com> 6351 63520 string/w #!\ /usr/bin/clj Clojure script text executable 6353!:mime text/x-clojure 63540 string/w #!\ /usr/local/bin/clj Clojure script text executable 6355!:mime text/x-clojure 63560 string/w #!\ /usr/bin/clojure Clojure script text executable 6357!:mime text/x-clojure 63580 string/w #!\ /usr/local/bin/clojure Clojure script text executable 6359!:mime text/x-clojure 63600 string/W #!/usr/bin/env\ clj Clojure script text executable 6361!:mime text/x-clojure 63620 string/W #!/usr/bin/env\ clojure Clojure script text executable 6363!:mime text/x-clojure 63640 string/W #!\ /usr/bin/env\ clj Clojure script text executable 6365!:mime text/x-clojure 63660 string/W #!\ /usr/bin/env\ clojure Clojure script text executable 6367!:mime text/x-clojure 6368 63690 regex \^\\\(ns[[:space:]]+[a-z] Clojure module source text 6370!:mime text/x-clojure 6371 63720 regex \^\\\(ns[[:space:]]+\\\^\\{: Clojure module source text 6373!:mime text/x-clojure 6374 63750 regex \^\\\(defn-?[[:space:]] Clojure module source text 6376!:mime text/x-clojure 6377 6378#------------------------------------------------------------------------------ 6379# $File: coff,v 1.3 2018/08/01 10:34:03 christos Exp $ 6380# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures 6381# 6382# COFF 6383# 6384# by Joerg Jenderek at Oct 2015 6385# https://en.wikipedia.org/wiki/COFF 6386# https://de.wikipedia.org/wiki/Common_Object_File_Format 6387# http://www.delorie.com/djgpp/doc/coff/filhdr.html 6388 6389# display name+variables+flags of Common Object Files Format (32bit) 6390# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel, 6391# mips,motorola,msdos,osf1,sharc,varied.out,vax 63920 name display-coff 6393# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 6394>18 uleshort&0x8E80 0 6395>>0 clear x 6396# f_magic - magic number 6397# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel) 6398>>0 uleshort 0x014C Intel 80386 6399# Hitachi SH big-endian COFF (./hitachi-sh) 6400>>0 uleshort 0x0500 Hitachi SH big-endian 6401# Hitachi SH little-endian COFF (./hitachi-sh) 6402>>0 uleshort 0x0550 Hitachi SH little-endian 6403# executable (RISC System/6000 V3.1) or obj module (./ibm6000) 6404#>>0 uleshort 0x01DF 6405# MS Windows COFF Intel Itanium, AMD64 6406# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx 6407>>0 uleshort 0x0200 Intel ia64 6408>>0 uleshort 0x8664 Intel amd64 6409# TODO for other COFFs 6410#>>0 uleshort 0xABCD COFF_TEMPLATE 6411>>0 default x 6412>>>0 uleshort x type 0x%04x 6413>>0 uleshort x COFF 6414# F_EXEC flag bit 6415>>18 leshort ^0x0002 object file 6416#!:mime application/x-coff 6417#!:ext cof/o/obj/lib 6418>>18 leshort &0x0002 executable 6419#!:mime application/x-coffexec 6420# F_RELFLG flag bit,static object 6421>>18 leshort &0x0001 \b, no relocation info 6422# F_LNNO flag bit 6423>>18 leshort &0x0004 \b, no line number info 6424# F_LSYMS flag bit 6425>>18 leshort &0x0008 \b, stripped 6426>>18 leshort ^0x0008 \b, not stripped 6427# flags in other COFF versions 6428#0x0010 F_FDPR_PROF 6429#0x0020 F_FDPR_OPTI 6430#0x0040 F_DSA 6431# F_AR32WR flag bit 6432#>>>18 leshort &0x0100 \b, 32 bit little endian 6433#0x1000 F_DYNLOAD 6434#0x2000 F_SHROBJ 6435#0x4000 F_LOADONLY 6436# f_nscns - number of sections 6437>>2 uleshort <2 \b, %d section 6438>>2 uleshort >1 \b, %d sections 6439# f_timdat - file time & date stamp only for little endian 6440#>>4 date x \b, %s 6441# f_symptr - symbol table pointer, only for not stripped 6442>>8 ulelong >0 \b, symbol offset=0x%x 6443# f_nsyms - number of symbols, only for not stripped 6444>>12 ulelong >0 \b, %d symbols 6445# f_opthdr - optional header size 6446>>16 uleshort >0 \b, optional header size %d 6447# at offset 20 can be optional header, extra bytes FILHSZ-20 because 6448# do not rely on sizeof(FILHDR) to give the correct size for header. 6449# or first section header 6450# additional variables for other COFF files 6451# >20 beshort 0407 (impure) 6452# >20 beshort 0410 (pure) 6453# >20 beshort 0413 (demand paged) 6454# >20 beshort 0421 (standalone) 6455# >22 leshort >0 - version %d 6456# >168 string .lowmem Apple toolbox 6457 6458 6459#------------------------------------------------------------------------------ 6460# $File: commands,v 1.60 2019/04/19 00:42:27 christos Exp $ 6461# commands: file(1) magic for various shells and interpreters 6462# 6463#0 string/w : shell archive or script for antique kernel text 64640 string/wt #!\ /bin/sh POSIX shell script text executable 6465!:mime text/x-shellscript 64660 string/wb #!\ /bin/sh POSIX shell script executable (binary data) 6467!:mime text/x-shellscript 6468 64690 string/wt #!\ /bin/csh C shell script text executable 6470!:mime text/x-shellscript 6471 6472# korn shell magic, sent by George Wu, gwu@clyde.att.com 64730 string/wt #!\ /bin/ksh Korn shell script text executable 6474!:mime text/x-shellscript 64750 string/wb #!\ /bin/ksh Korn shell script executable (binary data) 6476!:mime text/x-shellscript 6477 64780 string/wt #!\ /bin/tcsh Tenex C shell script text executable 6479!:mime text/x-shellscript 64800 string/wt #!\ /usr/bin/tcsh Tenex C shell script text executable 6481!:mime text/x-shellscript 64820 string/wt #!\ /usr/local/tcsh Tenex C shell script text executable 6483!:mime text/x-shellscript 64840 string/wt #!\ /usr/local/bin/tcsh Tenex C shell script text executable 6485!:mime text/x-shellscript 6486 6487# 6488# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) 64890 string/wt #!\ /bin/zsh Paul Falstad's zsh script text executable 6490!:mime text/x-shellscript 64910 string/wt #!\ /usr/bin/zsh Paul Falstad's zsh script text executable 6492!:mime text/x-shellscript 64930 string/wt #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable 6494!:mime text/x-shellscript 64950 string/wt #!\ /usr/local/bin/ash Neil Brown's ash script text executable 6496!:mime text/x-shellscript 64970 string/wt #!\ /usr/local/bin/ae Neil Brown's ae script text executable 6498!:mime text/x-shellscript 64990 string/wt #!\ /bin/nawk new awk script text executable 6500!:mime text/x-nawk 65010 string/wt #!\ /usr/bin/nawk new awk script text executable 6502!:mime text/x-nawk 65030 string/wt #!\ /usr/local/bin/nawk new awk script text executable 6504!:mime text/x-nawk 65050 string/wt #!\ /bin/gawk GNU awk script text executable 6506!:mime text/x-gawk 65070 string/wt #!\ /usr/bin/gawk GNU awk script text executable 6508!:mime text/x-gawk 65090 string/wt #!\ /usr/local/bin/gawk GNU awk script text executable 6510!:mime text/x-gawk 6511# 65120 string/wt #!\ /bin/awk awk script text executable 6513!:mime text/x-awk 65140 string/wt #!\ /usr/bin/awk awk script text executable 6515!:mime text/x-awk 65160 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text 6517 6518# AT&T Bell Labs' Plan 9 shell 65190 string/wt #!\ /bin/rc Plan 9 rc shell script text executable 6520 6521# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 65220 string/wt #!\ /bin/bash Bourne-Again shell script text executable 6523!:mime text/x-shellscript 65240 string/wb #!\ /bin/bash Bourne-Again shell script executable (binary data) 6525!:mime text/x-shellscript 65260 string/wt #!\ /usr/bin/bash Bourne-Again shell script text executable 6527!:mime text/x-shellscript 65280 string/wb #!\ /usr/bin/bash Bourne-Again shell script executable (binary data) 6529!:mime text/x-shellscript 65300 string/wt #!\ /usr/local/bash Bourne-Again shell script text executable 6531!:mime text/x-shellscript 65320 string/wb #!\ /usr/local/bash Bourne-Again shell script executable (binary data) 6533!:mime text/x-shellscript 65340 string/wt #!\ /usr/local/bin/bash Bourne-Again shell script text executable 6535!:mime text/x-shellscript 65360 string/wb #!\ /usr/local/bin/bash Bourne-Again shell script executable (binary data) 6537!:mime text/x-shellscript 65380 string/wt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable 6539!:mime text/x-shellscript 6540 6541# PHP scripts 6542# Ulf Harnhammar <ulfh@update.uu.se> 65430 search/1/c =<?php PHP script text 6544!:strength + 30 6545!:mime text/x-php 65460 search/1 =<?\n PHP script text 6547!:mime text/x-php 65480 search/1 =<?\r PHP script text 6549!:mime text/x-php 65500 search/1/w #!\ /usr/local/bin/php PHP script text executable 6551!:strength + 10 6552!:mime text/x-php 65530 search/1/w #!\ /usr/bin/php PHP script text executable 6554!:strength + 10 6555!:mime text/x-php 6556# Smarty compiled template, https://www.smarty.net/ 6557# Elan Ruusamae <glen@delfi.ee> 65580 string =<?php 6559>5 regex [\ \n] 6560>>6 string /*\ Smarty\ version Smarty compiled template 6561>>>24 regex [0-9.]+ \b, version %s 6562!:mime text/x-php 6563 65640 string Zend\x00 PHP script Zend Optimizer data 6565 65660 string/t $! DCL command file 6567 6568# Type: Pdmenu 6569# URL: https://packages.debian.org/pdmenu 6570# From: Edward Betts <edward@debian.org> 65710 string #!/usr/bin/pdmenu Pdmenu configuration file text 6572 6573# From Danny Weldon 65740 string \x0b\x13\x08\x00 6575>0x04 uleshort <4 ksh byte-code version %d 6576 6577#---------------------------------------------------------------------------- 6578# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $ 6579# communication 6580 6581# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. 6582# It is used for conformance testing of communication protocols. 6583# Added by W. Borgert <debacle@debian.org>. 65840 string $Suite TTCN Abstract Test Suite 6585>&1 string $SuiteId 6586>>&1 string >\n %s 6587>&2 string $SuiteId 6588>>&1 string >\n %s 6589>&3 string $SuiteId 6590>>&1 string >\n %s 6591 6592# MSC (message sequence charts) are a formal description technique, 6593# described in ITU-T Z.120, mainly used for communication protocols. 6594# Added by W. Borgert <debacle@debian.org>. 65950 string mscdocument Message Sequence Chart (document) 65960 string msc Message Sequence Chart (chart) 65970 string submsc Message Sequence Chart (subchart) 6598#------------------------------------------------------------------------------ 6599# $File: compress,v 1.75 2019/04/19 00:42:27 christos Exp $ 6600# compress: file(1) magic for pure-compression formats (no archives) 6601# 6602# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc. 6603# 6604# Formats for various forms of compressed data 6605# Formats for "compress" proper have been moved into "compress.c", 6606# because it tries to uncompress it to figure out what's inside. 6607 6608# standard unix compress 66090 string \037\235 compress'd data 6610!:mime application/x-compress 6611!:apple LZIVZIVU 6612>2 byte&0x80 >0 block compressed 6613>2 byte&0x1f x %d bits 6614 6615# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver) 6616# URL: https://en.wikipedia.org/wiki/Gzip 6617# Reference: https://tools.ietf.org/html/rfc1952 6618# Update: Joerg Jenderek, Apr 2019 6619# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 6620# * Original filename is only at offset 10 if "extra field" absent 6621# * Produce shorter output - notably, only report compression methods 6622# other than 8 ("deflate", the only method defined in RFC 1952). 6623# Note: find defs -iname '*.trid.xml' -exec grep -q '<Bytes>1F8B08' {} \; -ls 6624# TODO: 6625# FBR Blueberry FlashBack screen Record https://www.flashbackrecorder.com/ 6626# KPR KOffice/Calligra KPresenter application/x-kpresenter 6627# KPT KOffice/Calligra KPresenter template? application/x-kpresenter 6628# SAV Diggles Saved Game File http://www.innonics.com 6629# SAV FarCry (demo) saved game http://www.farcry-thegame.com 6630# DAT ZOAGZIP game data format http://en.wikipedia.org/wiki/SD_Gundam_Capsule_Fighter 66310 string \037\213 6632# to display gzip compressed (strength=100=2*50) before other (strength=50)? 6633#!:strength * 2 6634# no FNAME and FCOMMENT bit implies no file name/comment. That means only binary 6635>3 byte&0x18 =0 6636# For binary gzipped no ASCII text should occur 6637# mcd-monu-cad.trid.xml 6638>>10 string MCD Monu-Cad Drawing, Component or Font 6639#>>36 string Created\ with\ MONU-CAD 6640#!:mime application/octet-stream 6641# http://fileformats.archiveteam.org/wiki/Monu-CAD 6642# http://www.monucad.com/downloads/FullDemo-2005.EXE 6643# /HANDS96.MCC Component 6644# /DEMO_DD01.MCD Drawing 6645# /MCALF020.FNT Font 6646!:ext mcc/mcd/fnt 6647# http://www.generalcadd.com 6648>>10 string GXD General CADD, Drawing or Component 6649#!:mime application/octet-stream 6650# /gxc/BUILDINGEDGE.gxc Component 6651# /gxd/HOCKETT-STPAUL-WRHSE.gxd Drawing 6652# /gxd/POWERLAND-MILL-ADD-11.gxd Drawing v9.1.06 6653!:ext gxc/gxd 6654#>>>13 ubyte 0 \b, version 0 6655>>>13 string 09 \b, version 9 6656# other gzipped binary like gzipped tar, VirtualBox extension package,... 6657>>10 default x gzip compressed data 6658>>>0 use gzip-info 6659# size of the original (uncompressed) input data modulo 2^32 6660>>>-4 ulelong x \b, original size modulo 2^32 %u 6661# gzipped TAR or VirtualBox extension package 6662!:mime application/gzip 6663#!:mime application/x-compressed-tar 6664#!:mime application/x-virtualbox-vbox-extpack 6665# https://www.w3.org/TR/SVG/mimereg.html 6666#!:mime image/image/svg+xml-compressed 6667# zlib.3.gz 6668# microcode-20180312.tgz 6669# tpz same as tgz 6670# lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg 6671# Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack 6672!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz 6673# FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text 6674>3 byte&0x18 >0 gzip compressed data 6675!:mime application/gzip 6676# gzipped tar, gzipped Abiword document 6677#!:mime application/x-compressed-tar 6678#!:mime application/x-abiword-compressed 6679#!:mime image/image/svg+xml-compressed 6680# kleopatra_splashscreen.svgz gzipped .svg 6681!:ext gz/tgz/tpz/zabw/svgz 6682>>0 use gzip-info 6683# size of the original (uncompressed) input data modulo 2^32 6684>>-4 ulelong x \b, original size modulo 2^32 %u 6685# display information of gzip compressed files 66860 name gzip-info 6687#>2 byte x THIS iS GZIP 6688>2 byte <8 \b, reserved method 6689>2 byte >8 \b, unknown method 6690>3 byte &0x01 \b, ASCII 6691>3 byte &0x02 \b, has CRC 6692>3 byte &0x04 \b, extra field 6693>3 byte&0xC =0x08 6694>>10 string x \b, was "%s" 6695>3 byte &0x10 \b, has comment 6696>3 byte &0x20 \b, encrypted 6697>4 ledate >0 \b, last modified: %s 6698>8 byte 2 \b, max compression 6699>8 byte 4 \b, max speed 6700>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) 6701>9 byte =0x01 \b, from Amiga 6702>9 byte =0x02 \b, from VMS 6703>9 byte =0x03 \b, from Unix 6704>9 byte =0x04 \b, from VM/CMS 6705>9 byte =0x05 \b, from Atari 6706>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) 6707>9 byte =0x07 \b, from MacOS 6708>9 byte =0x08 \b, from Z-System 6709>9 byte =0x09 \b, from CP/M 6710>9 byte =0x0A \b, from TOPS/20 6711>9 byte =0x0B \b, from NTFS filesystem (NT) 6712>9 byte =0x0C \b, from QDOS 6713>9 byte =0x0D \b, from Acorn RISCOS 6714# size of the original (uncompressed) input data modulo 2^32 6715#>-4 ulelong x \b, original size modulo 2^32 %u 6716#ERROR: line 114: non zero offset 1048572 at level 1 6717 6718# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis 67190 string \037\036 packed data 6720!:mime application/octet-stream 6721>2 belong >1 \b, %d characters originally 6722>2 belong =1 \b, %d character originally 6723# 6724# This magic number is byte-order-independent. 67250 short 0x1f1f old packed data 6726!:mime application/octet-stream 6727 6728# XXX - why *two* entries for "compacted data", one of which is 6729# byte-order independent, and one of which is byte-order dependent? 6730# 67310 short 0x1fff compacted data 6732!:mime application/octet-stream 6733# This string is valid for SunOS (BE) and a matching "short" is listed 6734# in the Ultrix (LE) magic file. 67350 string \377\037 compacted data 6736!:mime application/octet-stream 67370 short 0145405 huf output 6738!:mime application/octet-stream 6739 6740# bzip2 67410 string BZh bzip2 compressed data 6742!:mime application/x-bzip2 6743>3 byte >47 \b, block size = %c00k 6744 6745# bzip a block-sorting file compressor 6746# by Julian Seward <sewardj@cs.man.ac.uk> and others 67470 string BZ0 bzip compressed data 6748!:mime application/x-bzip 6749>3 byte >47 \b, block size = %c00k 6750 6751# lzip 67520 string LZIP lzip compressed data 6753!:mime application/x-lzip 6754>4 byte x \b, version: %d 6755 6756# squeeze and crunch 6757# Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 67580 beshort 0x76FF squeezed data, 6759>4 string x original name %s 67600 beshort 0x76FE crunched data, 6761>2 string x original name %s 67620 beshort 0x76FD LZH compressed data, 6763>2 string x original name %s 6764 6765# Freeze 67660 string \037\237 frozen file 2.1 67670 string \037\236 frozen file 1.0 (or gzip 0.5) 6768 6769# SCO compress -H (LZH) 67700 string \037\240 SCO compress -H (LZH) data 6771 6772# European GSM 06.10 is a provisional standard for full-rate speech 6773# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse 6774# excitation/long term prediction) coding at 13 kbit/s. 6775# 6776# There's only a magic nibble (4 bits); that nibble repeats every 33 6777# bytes. This isn't suited for use, but maybe we can use it someday. 6778# 6779# This will cause very short GSM files to be declared as data and 6780# mismatches to be declared as data too! 6781#0 byte&0xF0 0xd0 data 6782#>33 byte&0xF0 0xd0 6783#>66 byte&0xF0 0xd0 6784#>99 byte&0xF0 0xd0 6785#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio 6786 6787# lzop from <markus.oberhumer@jk.uni-linz.ac.at> 67880 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data 6789>9 beshort <0x0940 6790>>9 byte&0xf0 =0x00 - version 0. 6791>>9 beshort&0x0fff x \b%03x, 6792>>13 byte 1 LZO1X-1, 6793>>13 byte 2 LZO1X-1(15), 6794>>13 byte 3 LZO1X-999, 6795## >>22 bedate >0 last modified: %s, 6796>>14 byte =0x00 os: MS-DOS 6797>>14 byte =0x01 os: Amiga 6798>>14 byte =0x02 os: VMS 6799>>14 byte =0x03 os: Unix 6800>>14 byte =0x05 os: Atari 6801>>14 byte =0x06 os: OS/2 6802>>14 byte =0x07 os: MacOS 6803>>14 byte =0x0A os: Tops/20 6804>>14 byte =0x0B os: WinNT 6805>>14 byte =0x0E os: Win32 6806>9 beshort >0x0939 6807>>9 byte&0xf0 =0x00 - version 0. 6808>>9 byte&0xf0 =0x10 - version 1. 6809>>9 byte&0xf0 =0x20 - version 2. 6810>>9 beshort&0x0fff x \b%03x, 6811>>15 byte 1 LZO1X-1, 6812>>15 byte 2 LZO1X-1(15), 6813>>15 byte 3 LZO1X-999, 6814## >>25 bedate >0 last modified: %s, 6815>>17 byte =0x00 os: MS-DOS 6816>>17 byte =0x01 os: Amiga 6817>>17 byte =0x02 os: VMS 6818>>17 byte =0x03 os: Unix 6819>>17 byte =0x05 os: Atari 6820>>17 byte =0x06 os: OS/2 6821>>17 byte =0x07 os: MacOS 6822>>17 byte =0x0A os: Tops/20 6823>>17 byte =0x0B os: WinNT 6824>>17 byte =0x0E os: Win32 6825 6826# 4.3BSD-Quasijarus Strong Compression 6827# https://minnie.tuhs.org/Quasijarus/compress.html 68280 string \037\241 Quasijarus strong compressed data 6829 6830# From: Cory Dikkers <cdikkers@swbell.net> 68310 string XPKF Amiga xpkf.library compressed data 68320 string PP11 Power Packer 1.1 compressed data 68330 string PP20 Power Packer 2.0 compressed data, 6834>4 belong 0x09090909 fast compression 6835>4 belong 0x090A0A0A mediocre compression 6836>4 belong 0x090A0B0B good compression 6837>4 belong 0x090A0C0C very good compression 6838>4 belong 0x090A0C0D best compression 6839 6840# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) 6841# https://www.7-zip.org or DOC/7zFormat.txt 6842# 68430 string 7z\274\257\047\034 7-zip archive data, 6844>6 byte x version %d 6845>7 byte x \b.%d 6846!:mime application/x-7z-compressed 6847!:ext 7z/cb7 6848 6849# Type: LZMA 68500 lelong&0xffffff =0x5d 6851>12 leshort 0xff LZMA compressed data, 6852!:mime application/x-lzma 6853>>5 lequad =0xffffffffffffffff streamed 6854>>5 lequad !0xffffffffffffffff non-streamed, size %lld 6855>12 leshort 0 LZMA compressed data, 6856>>5 lequad =0xffffffffffffffff streamed 6857>>5 lequad !0xffffffffffffffff non-streamed, size %lld 6858 6859# http://tukaani.org/xz/xz-file-format.txt 68600 ustring \xFD7zXZ\x00 XZ compressed data 6861!:strength * 2 6862!:mime application/x-xz 6863 6864# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt 68650 string LRZI LRZIP compressed data 6866>4 byte x - version %d 6867>5 byte x \b.%d 6868!:mime application/x-lrzip 6869 6870# https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html 68710 lelong 0x184d2204 LZ4 compressed data (v1.4+) 6872!:mime application/x-lz4 6873# Added by osm0sis@xda-developers.com 68740 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3) 6875!:mime application/x-lz4 68760 lelong 0x184c2102 LZ4 compressed data (v0.1-v0.9) 6877!:mime application/x-lz4 6878 6879# Zstandard/LZ4 skippable frames 6880# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 68810 lelong&0xFFFFFFF0 0x184D2A50 6882>(4.l+8) indirect x 6883 6884# Zstandard Dictionary ID subroutine 68850 name zstd-dictionary-id 6886# Single Segment = True 6887>0 byte &0x20 \b, Dictionary ID: 6888>>0 byte&0x03 0 None 6889>>0 byte&0x03 1 6890>>>1 byte x %u 6891>>0 byte&0x03 2 6892>>>1 leshort x %u 6893>>0 byte&0x03 3 6894>>>1 lelong x %u 6895# Single Segment = False 6896>0 byte ^0x20 \b, Dictionary ID: 6897>>0 byte&0x03 0 None 6898>>0 byte&0x03 1 6899>>>2 byte x %u 6900>>0 byte&0x03 2 6901>>>2 leshort x %u 6902>>0 byte&0x03 3 6903>>>2 lelong x %u 6904 6905# Zstandard compressed data 6906# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 69070 lelong 0xFD2FB522 Zstandard compressed data (v0.2) 6908!:mime application/x-zstd 69090 lelong 0xFD2FB523 Zstandard compressed data (v0.3) 6910!:mime application/x-zstd 69110 lelong 0xFD2FB524 Zstandard compressed data (v0.4) 6912!:mime application/x-zstd 69130 lelong 0xFD2FB525 Zstandard compressed data (v0.5) 6914!:mime application/x-zstd 69150 lelong 0xFD2FB526 Zstandard compressed data (v0.6) 6916!:mime application/x-zstd 69170 lelong 0xFD2FB527 Zstandard compressed data (v0.7) 6918!:mime application/x-zstd 6919>4 use zstd-dictionary-id 69200 lelong 0xFD2FB528 Zstandard compressed data (v0.8+) 6921!:mime application/x-zstd 6922>4 use zstd-dictionary-id 6923 6924# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md 69250 lelong 0xEC30A437 Zstandard dictionary 6926!:mime application/x-zstd-dictionary 6927>4 lelong x (ID %u) 6928 6929# AFX compressed files (Wolfram Kleff) 69302 string -afx- AFX compressed file data 6931 6932# Supplementary magic data for the file(1) command to support 6933# rzip(1). The format is described in magic(5). 6934# 6935# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with 6936# this file. 6937# 69380 string RZIP rzip compressed data 6939>4 byte x - version %d 6940>5 byte x \b.%d 6941>6 belong x (%d bytes) 6942 69430 string ArC\x01 FreeArc archive <http://freearc.org> 6944 6945# Type: DACT compressed files 69460 long 0x444354C3 DACT compressed data 6947>4 byte >-1 (version %i. 6948>5 byte >-1 %i. 6949>6 byte >-1 %i) 6950>7 long >0 , original size: %i bytes 6951>15 long >30 , block size: %i bytes 6952 6953# Valve Pack (VPK) files 69540 lelong 0x55aa1234 Valve Pak file 6955>0x4 lelong x \b, version %u 6956>0x8 lelong x \b, %u entries 6957 6958# Snappy framing format 6959# https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt 69600 string \377\006\0\0sNaPpY snappy framed data 6961!:mime application/x-snappy-framed 6962 6963# qpress, https://www.quicklz.com/ 69640 string qpress10 qpress compressed data 6965!:mime application/x-qpress 6966 6967# Zlib https://www.ietf.org/rfc/rfc6713.txt 69680 string/b x 6969>0 beshort%31 =0 6970>>0 byte&0xf =8 6971>>>0 byte&0x80 =0 zlib compressed data 6972!:mime application/zlib 6973 6974# BWC compression 69750 string BWC 6976>3 byte 0 BWC compressed data 6977 6978# UCL compression 69790 bequad 0x00e955434cff011a UCL compressed data 6980 6981# Softlib archive 69820 string SLIB Softlib archive 6983>4 leshort x \b, version %d 6984>6 leshort x (contains %d files) 6985 6986# URL: https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276 6987# From: Eric Hall <eric.hall@darkart.com> 69880 string bvx- lzfse encoded, no compression 69890 string bvx1 lzfse compressed, uncompressed tables 69900 string bvx2 lzfse compressed, compressed tables 69910 string bvxn lzfse encoded, lzvn compressed 6992 6993#------------------------------------------------------------------------------ 6994# $File: console,v 1.45 2019/04/19 00:42:27 christos Exp $ 6995# Console game magic 6996# Toby Deshane <hac@shoelace.digivill.net> 6997 6998# ines: file(1) magic for Marat's iNES Nintendo Entertainment System ROM dump format 6999# Updated by David Korth <gerbilsoft@gerbilsoft.com> 7000# References: 7001# - https://wiki.nesdev.com/w/index.php/INES 7002# - https://wiki.nesdev.com/w/index.php/NES_2.0 7003 7004# Common header for iNES, NES 2.0, and Wii U iNES. 70050 name nes-rom-image-ines 7006>7 byte&0x0C =0x8 (NES 2.0) 7007>4 byte x \b: %ux16k PRG 7008>5 byte x \b, %ux8k CHR 7009>6 byte&0x08 =0x8 [4-Scr] 7010>6 byte&0x09 =0x0 [H-mirror] 7011>6 byte&0x09 =0x1 [V-mirror] 7012>6 byte&0x02 =0x2 [SRAM] 7013>6 byte&0x04 =0x4 [Trainer] 7014>7 byte&0x03 =0x2 [PC10] 7015>7 byte&0x03 =0x1 [VS] 7016>>7 byte&0x0C =0x8 7017# NES 2.0: VS PPU 7018>>>13 byte&0x0F =0x0 \b, RP2C03B 7019>>>13 byte&0x0F =0x1 \b, RP2C03G 7020>>>13 byte&0x0F =0x2 \b, RP2C04-0001 7021>>>13 byte&0x0F =0x3 \b, RP2C04-0002 7022>>>13 byte&0x0F =0x4 \b, RP2C04-0003 7023>>>13 byte&0x0F =0x5 \b, RP2C04-0004 7024>>>13 byte&0x0F =0x6 \b, RP2C03B 7025>>>13 byte&0x0F =0x7 \b, RP2C03C 7026>>>13 byte&0x0F =0x8 \b, RP2C05-01 7027>>>13 byte&0x0F =0x9 \b, RP2C05-02 7028>>>13 byte&0x0F =0xA \b, RP2C05-03 7029>>>13 byte&0x0F =0xB \b, RP2C05-04 7030>>>13 byte&0x0F =0xC \b, RP2C05-05 7031# TODO: VS protection hardware? 7032>>7 byte x \b] 7033# NES 2.0-specific flags. 7034>7 byte&0x0C =0x8 7035>>12 byte&0x03 =0x0 [NTSC] 7036>>12 byte&0x03 =0x1 [PAL] 7037>>12 byte&0x02 =0x2 [NTSC+PAL] 7038 7039# Standard iNES ROM header. 70400 string NES\x1A NES ROM image (iNES) 7041!:mime application/x-nes-rom 7042>0 use nes-rom-image-ines 7043 7044# Wii U Virtual Console iNES ROM header. 70450 belong 0x4E455300 NES ROM image (Wii U Virtual Console) 7046!:mime application/x-nes-rom 7047>0 use nes-rom-image-ines 7048 7049#------------------------------------------------------------------------------ 7050# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images 7051# Reference: https://wiki.nesdev.com/w/index.php/UNIF 7052# From: David Korth <gerbilsoft@gerbilsoft.com> 7053# 7054# NOTE: The UNIF format uses chunks instead of a fixed header, 7055# so most of the data isn't easily parseable. 7056# 70570 string UNIF 7058>4 lelong <16 NES ROM image (UNIF v%d format) 7059!:mime application/x-nes-rom 7060 7061#------------------------------------------------------------------------------ 7062# fds: file(1) magic for Famciom Disk System disk images 7063# Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format 7064# From: David Korth <gerbilsoft@gerbilsoft.com> 7065# TODO: Check "Disk info block" and get info from that in addition to the optional header. 7066 7067# Disk info block. (block 1) 70680 name nintendo-fds-disk-info-block 7069>23 byte !1 FMC- 7070>23 byte 1 FSC- 7071>16 string x \b%.3s 7072>15 byte x \b, mfr %02X 7073>20 byte x (Rev.%02u) 7074 7075# Headered version. 70760 string FDS\x1A 7077>0x11 string *NINTENDO-HVC* Famicom Disk System disk image: 7078!:mime application/x-fds-disk 7079>>0x10 use nintendo-fds-disk-info-block 7080>4 byte 1 (%u side) 7081>4 byte !1 (%u sides) 7082 7083# Unheadered version. 70841 string *NINTENDO-HVC* Famicom Disk System disk image: 7085!:mime application/x-fds-disk 7086>0 use nintendo-fds-disk-info-block 7087 7088#------------------------------------------------------------------------------ 7089# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images 7090# Used by Nintendo 3DS NES Virtual Console games. 7091# From: David Korth <gerbilsoft@gerbilsoft.com> 7092# 70930 string TNES NES ROM image (Nintendo 3DS Virtual Console) 7094!:mime application/x-nes-rom 7095>4 byte 100 \b: FDS, 7096>>0x2010 use nintendo-fds-disk-info-block 7097>4 byte !100 \b: TNES mapper %u 7098>>5 byte x \b, %ux8k PRG 7099>>6 byte x \b, %ux8k CHR 7100>>7 byte&0x08 =1 [WRAM] 7101>>8 byte&0x09 =1 [H-mirror] 7102>>8 byte&0x09 =2 [V-mirror] 7103>>8 byte&0x02 =3 [VRAM] 7104 7105#------------------------------------------------------------------------------ 7106# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format 7107# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header 7108# 71090x104 bequad 0xCEED6666CC0D000B Game Boy ROM image 7110# TODO: application/x-gameboy-color-rom for GBC. 7111!:mime application/x-gameboy-rom 7112>0x143 byte&0x80 0x80 7113>>0x134 string >\0 \b: "%.15s" 7114>0x143 byte&0x80 !0x80 7115>>0x134 string >\0 \b: "%.16s" 7116>0x14c byte x (Rev.%02u) 7117 7118# Machine type. (SGB, CGB, SGB+CGB) 7119>0x14b byte 0x33 7120>>0x146 byte 0x03 7121>>>0x143 byte&0x80 0x80 [SGB+CGB] 7122>>>0x143 byte&0x80 !0x80 [SGB] 7123>>0x146 byte !0x03 7124>>>0x143 byte&0xC0 0x80 [CGB] 7125>>>0x143 byte&0xC0 0xC0 [CGB ONLY] 7126>0x14b byte !0x33 7127 7128# Mapper. 7129>0x147 byte 0x00 [ROM ONLY] 7130>0x147 byte 0x01 [MBC1] 7131>0x147 byte 0x02 [MBC1+RAM] 7132>0x147 byte 0x03 [MBC1+RAM+BATT] 7133>0x147 byte 0x05 [MBC2] 7134>0x147 byte 0x06 [MBC2+BATTERY] 7135>0x147 byte 0x08 [ROM+RAM] 7136>0x147 byte 0x09 [ROM+RAM+BATTERY] 7137>0x147 byte 0x0B [MMM01] 7138>0x147 byte 0x0C [MMM01+SRAM] 7139>0x147 byte 0x0D [MMM01+SRAM+BATT] 7140>0x147 byte 0x0F [MBC3+TIMER+BATT] 7141>0x147 byte 0x10 [MBC3+TIMER+RAM+BATT] 7142>0x147 byte 0x11 [MBC3] 7143>0x147 byte 0x12 [MBC3+RAM] 7144>0x147 byte 0x13 [MBC3+RAM+BATT] 7145>0x147 byte 0x19 [MBC5] 7146>0x147 byte 0x1A [MBC5+RAM] 7147>0x147 byte 0x1B [MBC5+RAM+BATT] 7148>0x147 byte 0x1C [MBC5+RUMBLE] 7149>0x147 byte 0x1D [MBC5+RUMBLE+SRAM] 7150>0x147 byte 0x1E [MBC5+RUMBLE+SRAM+BATT] 7151>0x147 byte 0xFC [Pocket Camera] 7152>0x147 byte 0xFD [Bandai TAMA5] 7153>0x147 byte 0xFE [Hudson HuC-3] 7154>0x147 byte 0xFF [Hudson HuC-1] 7155 7156# ROM size. 7157>0x148 byte 0 \b, ROM: 256Kbit 7158>0x148 byte 1 \b, ROM: 512Kbit 7159>0x148 byte 2 \b, ROM: 1Mbit 7160>0x148 byte 3 \b, ROM: 2Mbit 7161>0x148 byte 4 \b, ROM: 4Mbit 7162>0x148 byte 5 \b, ROM: 8Mbit 7163>0x148 byte 6 \b, ROM: 16Mbit 7164>0x148 byte 7 \b, ROM: 32Mbit 7165>0x148 byte 0x52 \b, ROM: 9Mbit 7166>0x148 byte 0x53 \b, ROM: 10Mbit 7167>0x148 byte 0x54 \b, ROM: 12Mbit 7168 7169# RAM size. 7170>0x149 byte 1 \b, RAM: 16Kbit 7171>0x149 byte 2 \b, RAM: 64Kbit 7172>0x149 byte 3 \b, RAM: 128Kbit 7173>0x149 byte 4 \b, RAM: 1Mbit 7174>0x149 byte 5 \b, RAM: 512Kbit 7175 7176#------------------------------------------------------------------------------ 7177# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats 7178# Updated by David Korth <gerbilsoft@gerbilsoft.com> 7179# References: 7180# - https://www.retrodev.com/segacd.html 7181# - http://devster.monkeeh.com/sega/32xguide1.txt 7182# 7183 7184# Common Sega Mega Drive header format. 7185# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s. 71860 name sega-mega-drive-header 7187# ROM title. (Use domestic if present; if not, use international.) 7188>0x120 byte >0x20 7189>>0x120 string >\0 \b: "%.16s" 7190>0x120 byte <0x21 7191>>0x150 string >\0 \b: "%.16s" 7192# Other information. 7193>0x180 string >\0 (%.14s 7194>>0x110 string >\0 \b, %.16s 7195>0x180 byte 0 7196>>0x110 string >\0 (%.16s 7197>0 byte x \b) 7198 7199# TODO: Check for 32X CD? 7200# Sega Mega CD disc images: 2048-byte sectors. 72010 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 7202!:mime application/x-sega-cd-rom 7203>0 use sega-mega-drive-header 7204>0 byte x \b, 2048-byte sectors 72050 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 7206!:mime application/x-sega-cd-rom 7207>0 use sega-mega-drive-header 7208>0 byte x \b, 2048-byte sectors 7209# Sega Mega CD disc images: 2352-byte sectors. 72100x10 string SEGADISCSYSTEM\ \ Sega Mega CD disc image 7211!:mime application/x-sega-cd-rom 7212>0x10 use sega-mega-drive-header 7213>0 byte x \b, 2352-byte sectors 72140x10 string SEGABOOTDISC\ \ \ \ Sega Mega CD disc image 7215!:mime application/x-sega-cd-rom 7216>0x10 use sega-mega-drive-header 7217>0 byte x \b, 2352-byte sectors 7218 7219# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images. 72200x100 string SEGA 7221>0x3C0 bequad 0x4D41525320434845 Sega 32X ROM image 7222!:mime application/x-genesis-32x-rom 7223>>0 use sega-mega-drive-header 7224>0x3C0 bequad !0x4D41525320434845 7225>>0x105 belong 0x5049434F Sega Pico ROM image 7226!:mime application/x-sega-pico-rom 7227>>>0 use sega-mega-drive-header 7228>>0x105 belong !0x5049434F 7229>>>0x180 beshort 0x4252 Sega Mega CD Boot ROM image 7230!:mime application/x-genesis-rom 7231>>>0x180 beshort !0x4252 Sega Mega Drive / Genesis ROM image 7232!:mime application/x-genesis-rom 7233>>>0 use sega-mega-drive-header 7234 7235#------------------------------------------------------------------------------ 7236# genesis: file(1) magic for the Super MegaDrive ROM dump format 7237# 7238 7239# NOTE: Due to interleaving, we can't display anything 7240# other than the copier header information. 72410 name sega-genesis-smd-header 7242>0 byte x %dx16k blocks 7243>2 byte 0 \b, last in series or standalone 7244>2 byte >0 \b, split ROM 7245 7246# "Sega Genesis" header. 72470x280 string EAGN 7248>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 7249!:mime application/x-genesis-rom 7250>>0 use sega-genesis-smd-header 7251 7252# "Sega Mega Drive" header. 72530x280 string EAMG 7254>8 beshort 0xAABB Sega Mega Drive / Genesis ROM image (SMD format): 7255!:mime application/x-genesis-rom 7256>>0 use sega-genesis-smd-header 7257 7258#------------------------------------------------------------------------------ 7259# smsgg: file(1) magic for Sega Master System and Game Gear ROM images 7260# Detects all Game Gear and export Sega Master System ROM images, 7261# and some Japanese Sega Master System ROM images. 7262# From: David Korth <gerbilsoft@gerbilsoft.com> 7263# Reference: https://www.smspower.org/Development/ROMHeader 7264# 7265 7266# General SMS header rule. 7267# The SMS boot ROM checks the header at three locations. 72680 name sega-master-system-rom-header 7269# Machine type. 7270>0x0F byte&0xF0 0x30 Sega Master System 7271!:mime application/x-sms-rom 7272>0x0F byte&0xF0 0x40 Sega Master System 7273!:mime application/x-sms-rom 7274>0x0F byte&0xF0 0x50 Sega Game Gear 7275!:mime application/x-gamegear-rom 7276>0x0F byte&0xF0 0x60 Sega Game Gear 7277!:mime application/x-gamegear-rom 7278>0x0F byte&0xF0 0x70 Sega Game Gear 7279!:mime application/x-gamegear-rom 7280>0x0F default x Sega Master System / Game Gear 7281!:mime application/x-sms-rom 7282>0 byte x ROM image: 7283# Product code. 7284>0x0E byte&0xF0 0x10 1 7285>0x0E byte&0xF0 0x20 2 7286>0x0E byte&0xF0 0x30 3 7287>0x0E byte&0xF0 0x40 4 7288>0x0E byte&0xF0 0x50 5 7289>0x0E byte&0xF0 0x60 6 7290>0x0E byte&0xF0 0x70 7 7291>0x0E byte&0xF0 0x80 8 7292>0x0E byte&0xF0 0x90 9 7293>0x0E byte&0xF0 0xA0 10 7294>0x0E byte&0xF0 0xB0 11 7295>0x0E byte&0xF0 0xC0 12 7296>0x0E byte&0xF0 0xD0 13 7297>0x0E byte&0xF0 0xE0 14 7298>0x0E byte&0xF0 0xF0 15 7299# If the product code is 5 digits, we'll need to backspace here. 7300>0x0E byte&0xF0 !0 7301>>0x0C leshort x \b%04x 7302>0x0E byte&0xF0 0 7303>>0x0C leshort x %04x 7304# Revision. 7305>0x0E byte&0x0F x (Rev.%02d) 7306# ROM size. (Used for the boot ROM checksum routine.) 7307>0x0F byte&0x0F 0x0A (8 KB) 7308>0x0F byte&0x0F 0x0B (16 KB) 7309>0x0F byte&0x0F 0x0C (32 KB) 7310>0x0F byte&0x0F 0x0D (48 KB) 7311>0x0F byte&0x0F 0x0E (64 KB) 7312>0x0F byte&0x0F 0x0F (128 KB) 7313>0x0F byte&0x0F 0x00 (256 KB) 7314>0x0F byte&0x0F 0x01 (512 KB) 7315>0x0F byte&0x0F 0x02 (1 MB) 7316 7317# SMS/GG header locations. 73180x7FF0 string TMR\ SEGA 7319>0x7FF0 use sega-master-system-rom-header 73200x3FF0 string TMR\ SEGA 7321>0x3FF0 use sega-master-system-rom-header 73220x1FF0 string TMR\ SEGA 7323>0x1FF0 use sega-master-system-rom-header 7324 7325#------------------------------------------------------------------------------ 7326# saturn: file(1) magic for the Sega Saturn disc image format. 7327# From: David Korth <gerbilsoft@gerbilsoft.com> 7328# 7329 7330# Common Sega Saturn disc header format. 7331# NOTE: Title is 112 bytes, but we're only showing 32 due to space padding. 7332# TODO: Release date, device information, region code, others? 73330 name sega-saturn-disc-header 7334>0x60 string >\0 \b: "%.32s" 7335>0x20 string >\0 (%.10s 7336>>0x2A string >\0 \b, %.6s) 7337>>0x2A byte 0 \b) 7338 7339# 2048-byte sector version. 73400 string SEGA\ SEGASATURN\ Sega Saturn disc image 7341!:mime application/x-saturn-rom 7342>0 use sega-saturn-disc-header 7343>0 byte x (2048-byte sectors) 7344# 2352-byte sector version. 73450x10 string SEGA\ SEGASATURN\ Sega Saturn disc image 7346!:mime application/x-saturn-rom 7347>0x10 use sega-saturn-disc-header 7348>0 byte x (2352-byte sectors) 7349 7350#------------------------------------------------------------------------------ 7351# dreamcast: file(1) magic for the Sega Dreamcast disc image format. 7352# From: David Korth <gerbilsoft@gerbilsoft.com> 7353# Reference: https://mc.pp.se/dc/ip0000.bin.html 7354# 7355 7356# Common Sega Dreamcast disc header format. 7357# NOTE: Title is 128 bytes, but we're only showing 32 due to space padding. 7358# TODO: Release date, device information, region code, others? 73590 name sega-dreamcast-disc-header 7360>0x80 string >\0 \b: "%.32s" 7361>0x40 string >\0 (%.10s 7362>>0x4A string >\0 \b, %.6s) 7363>>0x4A byte 0 \b) 7364 7365# 2048-byte sector version. 73660 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 7367!:mime application/x-dc-rom 7368>0 use sega-dreamcast-disc-header 7369>0 byte x (2048-byte sectors) 7370# 2352-byte sector version. 73710x10 string SEGA\ SEGAKATANA\ Sega Dreamcast disc image 7372!:mime application/x-dc-rom 7373>0x10 use sega-dreamcast-disc-header 7374>0 byte x (2352-byte sectors) 7375 7376#------------------------------------------------------------------------------ 7377# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format 7378# 73790 belong 0x21068028 Sega Dreamcast VMU game image 73800 string LCDi Dream Animator file 7381 7382#------------------------------------------------------------------------------ 7383# z64: file(1) magic for the Z64 format N64 ROM dumps 7384# Reference: http://forum.pj64-emu.com/showthread.php?t=2239 7385# From: David Korth <gerbilsoft@gerbilsoft.com> 7386# 73870 bequad 0x803712400000000F Nintendo 64 ROM image 7388!:mime application/x-n64-rom 7389>0x20 string >\0 \b: "%.20s" 7390>0x3B string x (%.4s 7391>0x3F byte x \b, Rev.%02u) 7392 7393#------------------------------------------------------------------------------ 7394# v64: file(1) magic for the V64 format N64 ROM dumps 7395# Same as z64 format, but with 16-bit byteswapping. 7396# 73970 bequad 0x3780401200000F00 Nintendo 64 ROM image (V64) 7398!:mime application/x-n64-rom 7399 7400#------------------------------------------------------------------------------ 7401# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps 7402# Same as z64 format, but with swapped 16-bit words. 7403# 74040 bequad 0x12408037000F0000 Nintendo 64 ROM image (wordswapped) 7405!:mime application/x-n64-rom 7406 7407#------------------------------------------------------------------------------ 7408# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps 7409# Same as z64 format, but with 32-bit byteswapping. 7410# 74110 bequad 0x401237800F000000 Nintendo 64 ROM image (32-bit byteswapped) 7412!:mime application/x-n64-rom 7413 7414#------------------------------------------------------------------------------ 7415# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format 7416# Reference: https://problemkaputt.de/gbatek.htm#gbacartridgeheader 7417# 7418# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 7419# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 7420# 74214 bequad 0x24FFAE51699AA221 Game Boy Advance ROM image 7422!:mime application/x-gba-rom 7423>0xA0 string >\0 \b: "%.12s" 7424>0xAC string x (%.6s 7425>0xBC byte x \b, Rev.%02u) 7426 7427#------------------------------------------------------------------------------ 7428# nds: file(1) magic for the Nintendo DS(i) raw ROM format 7429# Reference: https://problemkaputt.de/gbatek.htm#dscartridgeheader 7430# 7431# Original version from: "Nelson A. de Oliveira" <naoliv@gmail.com> 7432# Updated version from: David Korth <gerbilsoft@gerbilsoft.com> 7433# 74340xC0 bequad 0x24FFAE51699AA221 Nintendo DS ROM image 7435!:mime application/x-nintendo-ds-rom 7436>0x00 string >\0 \b: "%.12s" 7437>0x0C string x (%.6s 7438>0x1E byte x \b, Rev.%02u) 7439>0x12 byte 2 (DSi enhanced) 7440>0x12 byte 3 (DSi only) 7441# Secure Area check. 7442>0x20 lelong <0x4000 (homebrew) 7443>0x20 lelong >0x3FFF 7444>>0x4000 lequad 0x0000000000000000 (multiboot) 7445>>0x4000 lequad !0x0000000000000000 7446>>>0x4000 lequad 0xE7FFDEFFE7FFDEFF (decrypted) 7447>>>0x4000 lequad !0xE7FFDEFFE7FFDEFF 7448>>>>0x1000 lequad 0x0000000000000000 (encrypted) 7449>>>>0x1000 lequad !0x0000000000000000 (mask ROM) 7450 7451#------------------------------------------------------------------------------ 7452# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot. 7453# This is also used for loading .nds files using the MSET exploit on 3DS. 7454# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp 74550xC0 bequad 0xC8604FE201708FE2 Nintendo DS Slot-2 ROM image (PassMe) 7456!:mime application/x-nintendo-ds-rom 7457 7458#------------------------------------------------------------------------------ 7459# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format. 7460# From: David Korth <gerbilsoft@gerbilsoft.com> 7461# References: 7462# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp 7463# - https://www.devrs.com/ngp/files/ngpctech.txt 7464# 74650x0A string BY\ SNK\ CORPORATION Neo Geo Pocket 7466!:mime application/x-neo-geo-pocket-rom 7467>0x23 byte 0x10 Color 7468>0 byte x ROM image 7469>0x24 string >\0 \b: "%.12s" 7470>0x1F byte 0xFF (debug mode enabled) 7471 7472#------------------------------------------------------------------------------ 7473# msx: file(1) magic for MSX game cartridge dumps 7474# Too simple - MPi 7475#0 beshort 0x4142 MSX game cartridge dump 7476 7477#------------------------------------------------------------------------------ 7478# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) : 74790 string PS-X\ EXE Sony Playstation executable 7480>16 lelong x PC=0x%08x, 7481>20 lelong !0 GP=0x%08x, 7482>24 lelong !0 .text=[0x%08x, 7483>>28 lelong x \b0x%x], 7484>32 lelong !0 .data=[0x%08x, 7485>>36 lelong x \b0x%x], 7486>40 lelong !0 .bss=[0x%08x, 7487>>44 lelong x \b0x%x], 7488>48 lelong !0 Stack=0x%08x, 7489>48 lelong =0 No Stack!, 7490>52 lelong !0 StackSize=0x%x, 7491#>76 string >\0 (%s) 7492# Area: 7493>113 string x (%s) 7494 7495# CPE executables 74960 string CPE CPE executable 7497>3 byte x (version %d) 7498 7499#------------------------------------------------------------------------------ 7500# Microsoft Xbox executables .xbe (Esa Hyytia <ehyytia@cc.hut.fi>) 75010 string XBEH Microsoft Xbox executable 7502# expect base address of 0x10000 7503>0x0104 ulelong =0x10000 7504>>(0x0118.l-0x0FFF4) lestring16 x \b: "%.40s" 7505>>(0x0118.l-0x0FFF5) byte x (%c 7506>>(0x0118.l-0x0FFF6) byte x \b%c- 7507>>(0x0118.l-0x0FFF8) uleshort x \b%03u) 7508>>(0x0118.l-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions 7509>>(0x0118.l-0x0FF60) ulelong&0x80000007 !0x80000007 7510>>>(0x0118.l-0x0FF60) ulelong >0 (regions: 7511>>>>(0x0118.l-0x0FF60) ulelong &0x00000001 NA 7512>>>>(0x0118.l-0x0FF60) ulelong &0x00000002 Japan 7513>>>>(0x0118.l-0x0FF60) ulelong &0x00000004 Rest_of_World 7514>>>>(0x0118.l-0x0FF60) ulelong &0x80000000 Manufacturer 7515>>>(0x0118.l-0x0FF60) ulelong >0 \b) 7516# probabilistic checks whether signed or not 7517>0x0004 ulelong =0x0 7518>>&2 ulelong =0x0 7519>>>&2 ulelong =0x0 \b, not signed 7520>0x0004 ulelong >0 7521>>&2 ulelong >0 7522>>>&2 ulelong >0 \b, signed 7523 7524# -------------------------------- 7525# Microsoft Xbox data file formats 75260 string XIP0 XIP, Microsoft Xbox data 75270 string XTF0 XTF, Microsoft Xbox data 7528 7529#------------------------------------------------------------------------------ 7530# Microsoft Xbox 360 executables (.xex) 7531# From: David Korth <gerbilsoft@gerbilsoft.com> 7532# References: 7533# - https://free60project.github.io/wiki/XEX.html 7534# - https://github.com/xenia-project/xenia/blob/HEAD/src/xenia/kernel/util/xex2_info.h 7535 7536# Title ID (part of Execution ID section) 75370 name xbox-360-xex-execution-id 7538>(0.L+0xC) byte x (%c 7539>(0.L+0xD) byte x \b%c 7540>(0.L+0xE) beshort x \b-%04u) 7541 75420 string XEX2 Microsoft Xbox 360 executable 7543>0x18 search/0x100 \x00\x04\x00\x06 7544>>&0 use xbox-360-xex-execution-id 7545>(0x010.L+0x178) ubelong 0xFFFFFFFF \b, all regions 7546>(0x010.L+0x178) ubelong !0xFFFFFFFF 7547>>(0x010.L+0x178) ubelong >0 (regions: 7548>>(0x010.L+0x178) ubelong&0x000000FF 0x000000FF USA 7549>>(0x010.L+0x178) ubelong&0x00000100 0x00000100 Japan 7550>>(0x010.L+0x178) ubelong&0x00000200 0x00000200 China 7551>>(0x010.L+0x178) ubelong&0x0000FC00 0x0000FC00 Asia 7552>>(0x010.L+0x178) ubelong&0x00FF0000 0x00FF0000 PAL 7553>>(0x010.L+0x178) ubelong&0x00FF0000 0x00FE0000 PAL [except AU/NZ] 7554>>(0x010.L+0x178) ubelong&0x00FF0000 0x00010000 AU/NZ 7555>>(0x010.L+0x178) ubelong&0xFF000000 0xFF000000 Other 7556>>(0x010.L+0x178) ubelong >0 \b) 7557 7558 7559 7560# Atari Lynx cartridge dump (EXE/BLL header) 7561# From: "Stefan A. Haubenthal" <polluks@web.de> 7562 7563# Double-check that the image type matches too, 0x8008 conflicts with 7564# 8 character OMF-86 object file headers. 75650 beshort 0x8008 7566>6 string BS93 Lynx homebrew cartridge 7567!:mime application/x-atari-lynx-rom 7568>>2 beshort x \b, RAM start $%04x 7569>6 string LYNX Lynx cartridge 7570!:mime application/x-atari-lynx-rom 7571>>2 beshort x \b, RAM start $%04x 7572 7573# Opera file system that is used on the 3DO console 7574# From: Serge van den Boom <svdb@stack.nl> 75750 string \x01ZZZZZ\x01 3DO "Opera" file system 7576 7577# From: Alex Myczko <alex@aiei.ch> 7578# From: David Pflug <david@pflug.email> 7579# is the offset 12 or the offset 16 correct? 7580# GBS (Game Boy Sound) magic 7581# ftp://ftp.modland.com/pub/documents/format_documentation/\ 7582# Gameboy%20Sound%20System%20(.gbs).txt 75830 string GBS Nintendo Gameboy Music/Audio Data 7584#12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module 7585>16 string >\0 ("%.32s" by 7586>48 string >\0 %.32s, copyright 7587>80 string >\0 %.32s), 7588>3 byte x version %u, 7589>4 byte x %u tracks 7590 7591# IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at> 7592# see https://zerosoft.zophar.net/ips.php 75930 string PATCH IPS patch file 7594 7595# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> 75960 string PPF30 Playstation Patch File version 3.0 7597>5 byte 0 \b, PPF 1.0 patch 7598>5 byte 1 \b, PPF 2.0 patch 7599>5 byte 2 \b, PPF 3.0 patch 7600>>56 byte 0 \b, Imagetype BIN (any) 7601>>56 byte 1 \b, Imagetype GI (PrimoDVD) 7602>>57 byte 0 \b, Blockcheck disabled 7603>>57 byte 1 \b, Blockcheck enabled 7604>>58 byte 0 \b, Undo data not available 7605>>58 byte 1 \b, Undo data available 7606>6 string x \b, description: %s 7607 76080 string PPF20 Playstation Patch File version 2.0 7609>5 byte 0 \b, PPF 1.0 patch 7610>5 byte 1 \b, PPF 2.0 patch 7611>>56 lelong >0 \b, size of file to patch %d 7612>6 string x \b, description: %s 7613 76140 string PPF10 Playstation Patch File version 1.0 7615>5 byte 0 \b, Simple Encoding 7616>6 string x \b, description: %s 7617 7618# From: Daniel Dawson <ddawson@icehouse.net> 7619# SNES9x .smv "movie" file format. 76200 string SMV\x1A SNES9x input recording 7621>0x4 lelong x \b, version %d 7622# version 4 is latest so far 7623>0x4 lelong <5 7624>>0x8 ledate x \b, recorded at %s 7625>>0xc lelong >0 \b, rerecorded %d times 7626>>0x10 lelong x \b, %d frames long 7627>>0x14 byte >0 \b, data for controller(s): 7628>>>0x14 byte &0x1 #1 7629>>>0x14 byte &0x2 #2 7630>>>0x14 byte &0x4 #3 7631>>>0x14 byte &0x8 #4 7632>>>0x14 byte &0x10 #5 7633>>0x15 byte ^0x1 \b, begins from snapshot 7634>>0x15 byte &0x1 \b, begins from reset 7635>>0x15 byte ^0x2 \b, NTSC standard 7636>>0x15 byte &0x2 \b, PAL standard 7637>>0x17 byte &0x1 \b, settings: 7638# WIP1Timing not used as of version 4 7639>>>0x4 lelong <4 7640>>>>0x17 byte &0x2 WIP1Timing 7641>>>0x17 byte &0x4 Left+Right 7642>>>0x17 byte &0x8 VolumeEnvX 7643>>>0x17 byte &0x10 FakeMute 7644>>>0x17 byte &0x20 SyncSound 7645# New flag as of version 4 7646>>>0x4 lelong >3 7647>>>>0x17 byte &0x80 NoCPUShutdown 7648>>0x4 lelong <4 7649>>>0x18 lelong >0x23 7650>>>>0x20 leshort !0 7651>>>>>0x20 lestring16 x \b, metadata: "%s" 7652>>0x4 lelong >3 7653>>>0x24 byte >0 \b, port 1: 7654>>>>0x24 byte 1 joypad 7655>>>>0x24 byte 2 mouse 7656>>>>0x24 byte 3 SuperScope 7657>>>>0x24 byte 4 Justifier 7658>>>>0x24 byte 5 multitap 7659>>>0x24 byte >0 \b, port 2: 7660>>>>0x25 byte 1 joypad 7661>>>>0x25 byte 2 mouse 7662>>>>0x25 byte 3 SuperScope 7663>>>>0x25 byte 4 Justifier 7664>>>>0x25 byte 5 multitap 7665>>>0x18 lelong >0x43 7666>>>>0x40 leshort !0 7667>>>>>0x40 lestring16 x \b, metadata: "%s" 7668>>0x17 byte &0x40 \b, ROM: 7669>>>(0x18.l-26) lelong x CRC32 0x%08x 7670>>>(0x18.l-23) string x "%s" 7671 7672# Type: scummVM savegame files 7673# From: Sven Hartge <debian@ds9.argh.org> 76740 string SCVM ScummVM savegame 7675>12 string >\0 "%s" 7676 7677#------------------------------------------------------------------------------ 7678# Nintendo GameCube / Wii file formats. 7679# 7680 7681# Type: Nintendo GameCube/Wii common disc header data. 7682# From: David Korth <gerbilsoft@gerbilsoft.com> 7683# Reference: https://wiibrew.org/wiki/Wii_Disc 76840 name nintendo-gcn-disc-common 7685>0x20 string x "%.64s" 7686>0x00 string x (%.6s 7687>0x06 byte >0 7688>>0x06 byte 1 \b, Disc 2 7689>>0x06 byte 2 \b, Disc 3 7690>>0x06 byte 3 \b, Disc 4 7691>0x07 byte x \b, Rev.%02u) 7692>0x18 belong 0x5D1C9EA3 7693>>0x60 beshort 0x0101 \b (Unencrypted) 7694 7695# Type: Nintendo GameCube disc image 7696# From: David Korth <gerbilsoft@gerbilsoft.com> 7697# Reference: https://wiibrew.org/wiki/Wii_Disc 76980x1C belong 0xC2339F3D Nintendo GameCube disc image: 7699!:mime application/x-gamecube-rom 7700>0 use nintendo-gcn-disc-common 7701 7702# Type: Nintendo GameCube embedded disc image 7703# Commonly found on demo discs. 7704# From: David Korth <gerbilsoft@gerbilsoft.com> 7705# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8 77060 belong 0xAE0F38A2 7707>0x0C belong 0x00100000 7708>>(8.L+0x1C) belong 0xC2339F3D Nintendo GameCube embedded disc image: 7709!:mime application/x-gamecube-rom 7710>>>(8.L) use nintendo-gcn-disc-common 7711 7712# Type: Nintendo Wii disc image 7713# From: David Korth <gerbilsoft@gerbilsoft.com> 7714# Reference: https://wiibrew.org/wiki/Wii_Disc 77150x18 belong 0x5D1C9EA3 Nintendo Wii disc image: 7716>0 use nintendo-gcn-disc-common 7717 7718# Type: Nintendo Wii disc image (WBFS format) 7719# From: David Korth <gerbilsoft@gerbilsoft.com> 7720# Reference: https://wiibrew.org/wiki/Wii_Disc 77210 string WBFS 7722>0x218 belong 0x5D1C9EA3 Nintendo Wii disc image (WBFS format): 7723!:mime application/x-wii-rom 7724>>0x200 use nintendo-gcn-disc-common 7725 7726# Type: Nintendo GameCube/Wii disc image (CISO format) 7727# NOTE: This is NOT the same as Compact ISO or PSP CISO, 7728# though it has the same magic number. 77290 string CISO 7730# Other fields are used to determine what type of CISO this is: 7731# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 7732# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 7733# - None of the above: Compact ISO. 7734>4 lelong 0x200000 7735>>8 byte 1 7736>>>0x801C belong 0xC2339F3D Nintendo GameCube disc image (CISO format): 7737!:mime application/x-wii-rom 7738>>>>0x8000 use nintendo-gcn-disc-common 7739>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii disc image (CISO format): 7740!:mime application/x-wii-rom 7741>>>>0x8000 use nintendo-gcn-disc-common 7742 7743# Type: Nintendo GameCube/Wii disc image (GCZ format) 7744# Due to zlib compression, we can't get the actual disc information. 77450 lelong 0xB10BC001 7746>4 lelong 0 Nintendo GameCube disc image (GCZ format) 7747!:mime application/x-gamecube-rom 7748>4 lelong 1 Nintendo Wii disc image (GCZ format) 7749!:mime application/x-wii-rom 7750>4 default x Nintendo GameCube/Wii disc image (GCZ format) 7751 7752# Type: Nintendo GameCube/Wii disc image (WDF format) 77530 string WII\001DISC 7754>8 belong 1 7755# WDFv1 7756>>0x54 belong 0xC2339F3D Nintendo GameCube disc image (WDFv1 format): 7757!:mime application/x-gamecube-rom 7758>>>0x38 use nintendo-gcn-disc-common 7759>>0x58 belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv1 format): 7760!:mime application/x-wii-rom 7761>>>0x38 use nintendo-gcn-disc-common 7762>8 belong 2 7763# WDFv2 7764>>(12.L+0x1C) belong 0xC2339F3D Nintendo GameCube disc image (WDFv2 format): 7765!:mime application/x-gamecube-rom 7766>>>(12.L) use nintendo-gcn-disc-common 7767>>(12.L+0x18) belong 0x5D1C9EA3 Nintendo Wii disc image (WDFv2 format): 7768!:mime application/x-wii-rom 7769>>>(12.L) use nintendo-gcn-disc-common 7770 7771# Type: Nintendo GameCube/Wii disc image (WIA format) 77720 string WIA\001 Nintendo 7773>0x48 belong 1 GameCube 7774!:mime application/x-gamecube-rom 7775>0x48 belong 2 Wii 7776!:mime application/x-wii-rom 7777>0x48 default x GameCube/Wii 7778>0x48 belong x disc image (WIA format): 7779>>0x58 use nintendo-gcn-disc-common 7780 7781# Type: Nintendo GameCube/Wii disc image (with SDK header) 7782# From: David Korth <gerbilsoft@gerbilsoft.com> 7783# Reference: https://wiibrew.org/wiki/Wii_Disc 77840 belong 0xFFFF0000 7785>0x18 belong 0x00000000 7786>>0x1C belong 0x00000000 7787>>>0x8018 belong 0x5D1C9EA3 Nintendo Wii SDK disc image: 7788!:mime application/x-wii-rom 7789>>>>0x8000 use nintendo-gcn-disc-common 7790>>>0x801C belong 0xC2339F3D Nintendo GameCube SDK disc image: 7791!:mime application/x-gamecube-rom 7792>>>>0x8000 use nintendo-gcn-disc-common 7793 7794#------------------------------------------------------------------------------ 7795# Nintendo 3DS file formats. 7796# 7797 7798# Type: Nintendo 3DS "NCSD" image. (game cards and eMMC) 7799# From: David Korth <gerbilsoft@gerbilsoft.com> 7800# Reference: https://www.3dbrew.org/wiki/NCSD 78010x100 string NCSD 7802>0x118 lequad 0 Nintendo 3DS Game Card image 7803# NCCH header for partition 0. (game data) 7804>>0x1150 string >\0 \b: "%.16s" 7805>>0x312 byte x (Rev.%02u) 7806>>0x118C byte 2 (New3DS only) 7807>>0x18D byte 0 (inner device) 7808>>0x18D byte 1 (Card1) 7809>>0x18D byte 2 (Card2) 7810>>0x18D byte 3 (extended device) 7811>0x118 bequad 0x0102020202000000 Nintendo 3DS eMMC dump (Old3DS) 7812>0x118 bequad 0x0102020203000000 Nintendo 3DS eMMC dump (New3DS) 7813 7814# Nintendo 3DS version code. 7815# Reference: https://www.3dbrew.org/wiki/Titles 7816# Format: leshort containing three fields: 7817# - 6-bit: Major 7818# - 6-bit: Minor 7819# - 4-bit: Revision 7820# NOTE: Only supporting major/minor versions from 0-15 right now. 7821# NOTE: Should be prefixed with "v". 78220 name nintendo-3ds-version-code 7823# Raw version. 7824>0 leshort x \b%u, 7825# Major version. 7826>0 leshort&0xFC00 0x0000 0 7827>0 leshort&0xFC00 0x0400 1 7828>0 leshort&0xFC00 0x0800 2 7829>0 leshort&0xFC00 0x0C00 3 7830>0 leshort&0xFC00 0x1000 4 7831>0 leshort&0xFC00 0x1400 5 7832>0 leshort&0xFC00 0x1800 6 7833>0 leshort&0xFC00 0x1C00 7 7834>0 leshort&0xFC00 0x2000 8 7835>0 leshort&0xFC00 0x2400 9 7836>0 leshort&0xFC00 0x2800 10 7837>0 leshort&0xFC00 0x2C00 11 7838>0 leshort&0xFC00 0x3000 12 7839>0 leshort&0xFC00 0x3400 13 7840>0 leshort&0xFC00 0x3800 14 7841>0 leshort&0xFC00 0x3C00 15 7842# Minor version. 7843>0 leshort&0x03F0 0x0000 \b.0 7844>0 leshort&0x03F0 0x0010 \b.1 7845>0 leshort&0x03F0 0x0020 \b.2 7846>0 leshort&0x03F0 0x0030 \b.3 7847>0 leshort&0x03F0 0x0040 \b.4 7848>0 leshort&0x03F0 0x0050 \b.5 7849>0 leshort&0x03F0 0x0060 \b.6 7850>0 leshort&0x03F0 0x0070 \b.7 7851>0 leshort&0x03F0 0x0080 \b.8 7852>0 leshort&0x03F0 0x0090 \b.9 7853>0 leshort&0x03F0 0x00A0 \b.10 7854>0 leshort&0x03F0 0x00B0 \b.11 7855>0 leshort&0x03F0 0x00C0 \b.12 7856>0 leshort&0x03F0 0x00D0 \b.13 7857>0 leshort&0x03F0 0x00E0 \b.14 7858>0 leshort&0x03F0 0x00F0 \b.15 7859# Revision. 7860>0 leshort&0x000F x \b.%u 7861 7862# Type: Nintendo 3DS "NCCH" container. 7863# https://www.3dbrew.org/wiki/NCCH 78640x100 string NCCH Nintendo 3DS 7865>0x18D byte&2 0 File Archive (CFA) 7866>0x18D byte&2 2 Executable Image (CXI) 7867>0x150 string >\0 \b: "%.16s" 7868>0x18D byte 0x05 7869>>0x10E leshort x (Old3DS System Update v 7870>>0x10E use nintendo-3ds-version-code 7871>>0x10E leshort x \b) 7872>0x18D byte 0x15 7873>>0x10E leshort x (New3DS System Update v 7874>>0x10E use nintendo-3ds-version-code 7875>>0x10E leshort x \b) 7876>0x18D byte !0x05 7877>>0x18D byte !0x15 7878>>>0x112 byte x (v 7879>>>0x112 use nintendo-3ds-version-code 7880>>>0x112 byte x \b) 7881>0x18C byte 2 (New3DS only) 7882 7883# Type: Nintendo 3DS "SMDH" file. (application description) 7884# From: David Korth <gerbilsoft@gerbilsoft.com> 7885# Reference: https://3dbrew.org/wiki/SMDH 78860 string SMDH Nintendo 3DS SMDH file 7887>0x208 leshort !0 7888>>0x208 lestring16 x \b: "%.128s" 7889>>0x388 leshort !0 7890>>>0x388 lestring16 x by %.128s 7891>0x208 leshort 0 7892>>0x008 leshort !0 7893>>>0x008 lestring16 x \b: "%.128s" 7894>>>0x188 leshort !0 7895>>>>0x188 lestring16 x by %.128s 7896 7897# Type: Nintendo 3DS Homebrew Application. 7898# From: David Korth <gerbilsoft@gerbilsoft.com> 7899# Reference: https://3dbrew.org/wiki/3DSX_Format 79000 string 3DSX Nintendo 3DS Homebrew Application (3DSX) 7901 7902#------------------------------------------------------------------------------ 7903# a7800: file(1) magic for the Atari 7800 raw ROM format. 7904# From: David Korth <gerbilsoft@gerbilsoft.com> 7905# Reference: https://sites.google.com/site/atari7800wiki/a78-header 7906 79070 byte >0 7908>0 byte <3 7909>>1 string ATARI7800 Atari 7800 ROM image 7910!:mime application/x-atari-7800-rom 7911>>>0x11 string >\0 \b: "%.32s" 7912# Display type. 7913>>>0x39 byte 0 (NTSC) 7914>>>0x39 byte 1 (PAL) 7915>>>0x36 byte&1 1 (POKEY) 7916 7917#------------------------------------------------------------------------------ 7918# vectrex: file(1) magic for the GCE Vectrex raw ROM format. 7919# From: David Korth <gerbilsoft@gerbilsoft.com> 7920# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm 7921# 7922# NOTE: Title is terminated with 0x80, not 0. 7923# The header is terminated with a 0, so that will 7924# terminate the title as well. 7925# 79260 string g\ GCE Vectrex ROM image 7927>0x11 string >\0 \b: "%.16s" 7928 7929#------------------------------------------------------------------------------ 7930# amiibo: file(1) magic for Nintendo amiibo NFC dumps. 7931# From: David Korth <gerbilsoft@gerbilsoft.com> 7932# Reference: https://www.3dbrew.org/wiki/Amiibo 79330x00 byte 0x04 7934>0x0A beshort 0x0FE0 7935>>0x0C belong 0xF110FFEE 7936>>>0x208 beshort 0x0100 7937>>>>0x020A byte 0x0F 7938>>>>>0x020C bequad 0x000000045F000000 7939>>>>>>0x5B byte 0x02 7940>>>>>>>0x54 belong x Nintendo amiibo NFC dump - amiibo ID: %08X- 7941>>>>>>>0x58 belong x \b%08X 7942 7943#------------------------------------------------------------------------------ 7944# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $ 7945# convex: file(1) magic for Convex boxes 7946# 7947# Convexes are big-endian. 7948# 7949# /*\ 7950# * Below are the magic numbers and tests added for Convex. 7951# * Added at beginning, because they are expected to be used most. 7952# \*/ 79530 belong 0507 Convex old-style object 7954>16 belong >0 not stripped 79550 belong 0513 Convex old-style demand paged executable 7956>16 belong >0 not stripped 79570 belong 0515 Convex old-style pre-paged executable 7958>16 belong >0 not stripped 79590 belong 0517 Convex old-style pre-paged, non-swapped executable 7960>16 belong >0 not stripped 79610 belong 0x011257 Core file 7962# 7963# The following are a series of dump format magic numbers. Each one 7964# corresponds to a drastically different dump format. The first on is 7965# the original dump format on a 4.1 BSD or earlier file system. The 7966# second marks the change between the 4.1 file system and the 4.2 file 7967# system. The Third marks the changing of the block size from 1K 7968# to 2K to be compatible with an IDC file system. The fourth indicates 7969# a dump that is dependent on Convex Storage Manager, because data in 7970# secondary storage is not physically contained within the dump. 7971# The restore program uses these number to determine how the data is 7972# to be extracted. 7973# 797424 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible) 797524 belong =60014 dump format, Convex Storage Manager by-reference dump 7976# 7977# what follows is a bunch of bit-mask checks on the flags field of the opthdr. 7978# If there is no `=' sign, assume just checking for whether the bit is set? 7979# 79800 belong 0601 Convex SOFF 7981>88 belong&0x000f0000 =0x00000000 c1 7982>88 belong &0x00010000 c2 7983>88 belong &0x00020000 c2mp 7984>88 belong &0x00040000 parallel 7985>88 belong &0x00080000 intrinsic 7986>88 belong &0x00000001 demand paged 7987>88 belong &0x00000002 pre-paged 7988>88 belong &0x00000004 non-swapped 7989>88 belong &0x00000008 POSIX 7990# 7991>84 belong &0x80000000 executable 7992>84 belong &0x40000000 object 7993>84 belong&0x20000000 =0 not stripped 7994>84 belong&0x18000000 =0x00000000 native fpmode 7995>84 belong&0x18000000 =0x10000000 ieee fpmode 7996>84 belong&0x18000000 =0x18000000 undefined fpmode 7997# 79980 belong 0605 Convex SOFF core 7999# 80000 belong 0607 Convex SOFF checkpoint 8001>88 belong&0x000f0000 =0x00000000 c1 8002>88 belong &0x00010000 c2 8003>88 belong &0x00020000 c2mp 8004>88 belong &0x00040000 parallel 8005>88 belong &0x00080000 intrinsic 8006>88 belong &0x00000008 POSIX 8007# 8008>84 belong&0x18000000 =0x00000000 native fpmode 8009>84 belong&0x18000000 =0x10000000 ieee fpmode 8010>84 belong&0x18000000 =0x18000000 undefined fpmode 8011 8012#------------------------------------------------------------------------------ 8013# $File: coverage,v 1.2 2019/04/19 00:42:27 christos Exp $ 8014# xoverage: file(1) magic for test coverage data 8015 8016# File formats used to store test coverage data 8017# 2016-05-21, Georg Sauthoff <mail@georg.so> 8018 8019 8020# - GCC gcno - written by GCC at compile time when compiling with 8021# gcc -ftest-coverage 8022# - GCC gcda - written by a program that was compiled with 8023# gcc -fprofile-arcs 8024# - LLVM raw profiles - generated by a program compiled with 8025# clang -fprofile-instr-generate -fcoverage-mapping ... 8026# - LLVM indexed profiles - generated by 8027# llvm-profdata 8028# - GCOV reports, i.e. the annotated source code 8029# - LCOV trace files, i.e. aggregated GCC profiles 8030# 8031# GCC coverage tracefiles 8032# .gcno file are created during compile time, 8033# while data collected during runtime is stored in .gcda files 8034# cf. gcov-io.h 8035# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html 8036# Examples: 8037# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35 8038# Debian 8 PPC64/gcc-4.9.2 : 67 63 6e 6f 34 30 39 2a 80390 lelong 0x67636e6f GCC gcno coverage (-ftest-coverage), 8040>&3 byte x version %c. 8041>&1 byte x \b%c 8042 8043# big endian 80440 belong 0x67636e6f GCC gcno coverage (-ftest-coverage), 8045>&0 byte x version %c. 8046>&2 byte x \b%c (big-endian) 8047 8048# Examples: 8049# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35 8050# Debian 8 PPC64/gcc-4.9.2 : 67 63 64 61 34 30 39 2a 80510 lelong 0x67636461 GCC gcda coverage (-fprofile-arcs), 8052>&3 byte x version %c. 8053>&1 byte x \b%c 8054 8055# big endian 80560 belong 0x67636461 GCC gcda coverage (-fprofile-arcs), 8057>&0 byte x version %c. 8058>&2 byte x \b%c (big-endian) 8059 8060 8061# LCOV tracefiles 8062# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php 80630 string TN: 8064>&0 search/64 \nSF:/ LCOV coverage tracefile 8065 8066 8067# Coverage reports generated by gcov 8068# i.e. source code annoted with coverage information 80690 string \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source: 8070>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph: 8071>>&0 search/128 \x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data: GCOV coverage report 8072 8073 8074# LLVM coverage files 8075 8076# raw data after running a program compiled with: 8077# `clang -fprofile-instr-generate -fcoverage-mapping ...` 8078# default name: default.profraw 8079# magic is: \xFF lprofr \x81 8080# cf. https://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html 80810 lequad 0xff6c70726f667281 LLVM raw profile data, 8082>&0 byte x version %d 8083 8084# big endian 80850 bequad 0xff6c70726f667281 LLVM raw profile data, 8086>&7 byte x version %d (big-endian) 8087 8088 8089# LLVM indexed instruction profile (as generated by llvm-profdata) 8090# magic is: reverse(\xFF lprofi \x81) 8091# cf. https://llvm.org/docs/CoverageMappingFormat.html 8092# https://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html 8093# https://llvm.org/docs/CommandGuide/llvm-cov.html 8094# https://llvm.org/docs/CommandGuide/llvm-profdata.html 80950 lequad 0x8169666f72706cff LLVM indexed profile data, 8096>&0 byte x version %d 8097 8098# big endian 80990 bequad 0x8169666f72706cff LLVM indexed profile data, 8100>&7 byte x version %d (big-endian) 8101 8102 8103#------------------------------------------------------------------------------ 8104# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $ 8105# cracklib: file (1) magic for cracklib v2.7 8106 81070 lelong 0x70775631 Cracklib password index, little endian 8108>4 long >0 (%i words) 8109>4 long 0 ("64-bit") 8110>>8 long >-1 (%i words) 81110 belong 0x70775631 Cracklib password index, big endian 8112>4 belong >-1 (%i words) 8113# really bellong 0x0000000070775631 81140 search/1 \0\0\0\0pwV1 Cracklib password index, big endian ("64-bit") 8115>12 belong >0 (%i words) 8116 8117# ---------------------------------------------------------------------------- 8118# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $ 8119# ctags: file (1) magic for Exuberant Ctags files 8120# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> 81210 search/1 =!_TAG Exuberant Ctags tag file text 8122 8123#-------------------------------------------------------------- 8124# ctf: file(1) magic for CTF (Common Trace Format) trace files 8125# 8126# Specs. available here: <https://www.efficios.com/ctf> 8127#-------------------------------------------------------------- 8128 8129# CTF trace data 81300 lelong 0xc1fc1fc1 Common Trace Format (CTF) trace data (LE) 81310 belong 0xc1fc1fc1 Common Trace Format (CTF) trace data (BE) 8132 8133# CTF metadata (packetized) 81340 lelong 0x75d11d57 Common Trace Format (CTF) packetized metadata (LE) 8135>35 byte x \b, v%d 8136>36 byte x \b.%d 81370 belong 0x75d11d57 Common Trace Format (CTF) packetized metadata (BE) 8138>35 byte x \b, v%d 8139>36 byte x \b.%d 8140 8141# CTF metadata (plain text) 81420 string /*\x20CTF\x20 Common Trace Format (CTF) plain text metadata 8143!:strength + 5 # this is to make sure we beat C 8144>&0 regex [0-9]+\.[0-9]+ \b, v%s 8145 8146#------------------------------------------------------------------------------ 8147# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $ 8148# file(1) magic(5) data for cubemaps Martin Erik Werner <martinerikwerner@gmail.com> 8149# 81500 string ACMP Map file for the AssaultCube FPS game 81510 string CUBE Map file for cube and cube2 engine games 81520 string MAPZ) Map file for the Blood Frontier/Red Eclipse FPS games 8153 8154#------------------------------------------------------------------------------ 8155# $File: cups,v 1.6 2019/04/19 00:42:27 christos Exp $ 8156# Cups: file(1) magic for the cups raster file format 8157# From: Laurent Martelli <martellilaurent@gmail.com> 8158# https://www.cups.org/documentation.php/spec-raster.html 8159# 8160 81610 name cups-le 8162>280 lelong x \b, %d 8163>284 lelong x \bx%d dpi 8164>376 lelong x \b, %dx 8165>380 lelong x \b%d pixels 8166>388 lelong x %d bits/color 8167>392 lelong x %d bits/pixel 8168>400 lelong 0 ColorOrder=Chunky 8169>400 lelong 1 ColorOrder=Banded 8170>400 lelong 2 ColorOrder=Planar 8171>404 lelong 0 ColorSpace=gray 8172>404 lelong 1 ColorSpace=RGB 8173>404 lelong 2 ColorSpace=RGBA 8174>404 lelong 3 ColorSpace=black 8175>404 lelong 4 ColorSpace=CMY 8176>404 lelong 5 ColorSpace=YMC 8177>404 lelong 6 ColorSpace=CMYK 8178>404 lelong 7 ColorSpace=YMCK 8179>404 lelong 8 ColorSpace=KCMY 8180>404 lelong 9 ColorSpace=KCMYcm 8181>404 lelong 10 ColorSpace=GMCK 8182>404 lelong 11 ColorSpace=GMCS 8183>404 lelong 12 ColorSpace=WHITE 8184>404 lelong 13 ColorSpace=GOLD 8185>404 lelong 14 ColorSpace=SILVER 8186>404 lelong 15 ColorSpace=CIE XYZ 8187>404 lelong 16 ColorSpace=CIE Lab 8188>404 lelong 17 ColorSpace=RGBW 8189>404 lelong 18 ColorSpace=sGray 8190>404 lelong 19 ColorSpace=sRGB 8191>404 lelong 20 ColorSpace=AdobeRGB 8192 8193# Cups Raster image format, Big Endian 81940 string RaS 8195>3 string t Cups Raster version 1, Big Endian 8196>3 string 2 Cups Raster version 2, Big Endian 8197>3 string 3 Cups Raster version 3, Big Endian 8198!:mime application/vnd.cups-raster 8199>0 use \^cups-le 8200 8201 8202# Cups Raster image format, Little Endian 82031 string SaR 8204>0 string t Cups Raster version 1, Little Endian 8205>0 string 2 Cups Raster version 2, Little Endian 8206>0 string 3 Cups Raster version 3, Little Endian 8207!:mime application/vnd.cups-raster 8208>0 use cups-le 8209 8210#------------------------------------------------------------------------------ 8211# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $ 8212# dact: file(1) magic for DACT compressed files 8213# 82140 long 0x444354C3 DACT compressed data 8215>4 byte >-1 (version %i. 8216>5 byte >-1 $BS%i. 8217>6 byte >-1 $BS%i) 8218>7 long >0 $BS, original size: %i bytes 8219>15 long >30 $BS, block size: %i bytes 8220 8221#------------------------------------------------------------------------------ 8222# $File: database,v 1.55 2019/04/19 00:42:27 christos Exp $ 8223# database: file(1) magic for various databases 8224# 8225# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 8226# 8227# 8228# GDBM magic numbers 8229# Will be maintained as part of the GDBM distribution in the future. 8230# <downsj@teeny.org> 82310 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 8232!:mime application/x-gdbm 82330 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 8234!:mime application/x-gdbm 82350 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 8236!:mime application/x-gdbm 82370 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 8238!:mime application/x-gdbm 82390 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 8240!:mime application/x-gdbm 82410 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 8242!:mime application/x-gdbm 82430 string GDBM GNU dbm 2.x database 8244!:mime application/x-gdbm 8245# 8246# Berkeley DB 8247# 8248# Ian Darwin's file /etc/magic files: big/little-endian version. 8249# 8250# Hash 1.85/1.86 databases store metadata in network byte order. 8251# Btree 1.85/1.86 databases store the metadata in host byte order. 8252# Hash and Btree 2.X and later databases store the metadata in host byte order. 8253 82540 long 0x00061561 Berkeley DB 8255!:mime application/x-dbm 8256>8 belong 4321 8257>>4 belong >2 1.86 8258>>4 belong <3 1.85 8259>>4 belong >0 (Hash, version %d, native byte-order) 8260>8 belong 1234 8261>>4 belong >2 1.86 8262>>4 belong <3 1.85 8263>>4 belong >0 (Hash, version %d, little-endian) 8264 82650 belong 0x00061561 Berkeley DB 8266>8 belong 4321 8267>>4 belong >2 1.86 8268>>4 belong <3 1.85 8269>>4 belong >0 (Hash, version %d, big-endian) 8270>8 belong 1234 8271>>4 belong >2 1.86 8272>>4 belong <3 1.85 8273>>4 belong >0 (Hash, version %d, native byte-order) 8274 82750 long 0x00053162 Berkeley DB 1.85/1.86 8276>4 long >0 (Btree, version %d, native byte-order) 82770 belong 0x00053162 Berkeley DB 1.85/1.86 8278>4 belong >0 (Btree, version %d, big-endian) 82790 lelong 0x00053162 Berkeley DB 1.85/1.86 8280>4 lelong >0 (Btree, version %d, little-endian) 8281 828212 long 0x00061561 Berkeley DB 8283>16 long >0 (Hash, version %d, native byte-order) 828412 belong 0x00061561 Berkeley DB 8285>16 belong >0 (Hash, version %d, big-endian) 828612 lelong 0x00061561 Berkeley DB 8287>16 lelong >0 (Hash, version %d, little-endian) 8288 828912 long 0x00053162 Berkeley DB 8290>16 long >0 (Btree, version %d, native byte-order) 829112 belong 0x00053162 Berkeley DB 8292>16 belong >0 (Btree, version %d, big-endian) 829312 lelong 0x00053162 Berkeley DB 8294>16 lelong >0 (Btree, version %d, little-endian) 8295 829612 long 0x00042253 Berkeley DB 8297>16 long >0 (Queue, version %d, native byte-order) 829812 belong 0x00042253 Berkeley DB 8299>16 belong >0 (Queue, version %d, big-endian) 830012 lelong 0x00042253 Berkeley DB 8301>16 lelong >0 (Queue, version %d, little-endian) 8302 8303# From Max Bowsher. 830412 long 0x00040988 Berkeley DB 8305>16 long >0 (Log, version %d, native byte-order) 830612 belong 0x00040988 Berkeley DB 8307>16 belong >0 (Log, version %d, big-endian) 830812 lelong 0x00040988 Berkeley DB 8309>16 lelong >0 (Log, version %d, little-endian) 8310 8311# 8312# 8313# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 83140 string/b RRD\0 RRDTool DB 8315>4 string/b x version %s 8316 8317>>10 short !0 16bit aligned 8318>>>10 bedouble 8.642135e+130 big-endian 8319>>>>18 short x 32bit long (m68k) 8320 8321>>10 short 0 8322>>>12 long !0 32bit aligned 8323>>>>12 bedouble 8.642135e+130 big-endian 8324>>>>>20 long 0 64bit long 8325>>>>>20 long !0 32bit long 8326>>>>12 ledouble 8.642135e+130 little-endian 8327>>>>>24 long 0 64bit long 8328>>>>>24 long !0 32bit long (i386) 8329>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 8330>>>>>24 short !0 32bit long (arm) 8331 8332>>8 quad 0 64bit aligned 8333>>>16 bedouble 8.642135e+130 big-endian 8334>>>>24 long 0 64bit long (s390x) 8335>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 8336>>>16 ledouble 8.642135e+130 little-endian 8337>>>>28 long 0 64bit long (alpha/amd64/ia64) 8338>>>>28 long !0 32bit long (armel/mipsel) 8339 8340#---------------------------------------------------------------------- 8341# ROOT: file(1) magic for ROOT databases 8342# 83430 string root\0 ROOT file 8344>4 belong x Version %d 8345>33 belong x (Compression: %d) 8346 8347# XXX: Weak magic. 8348# Alex Ott <ott@jet.msk.su> 8349## Paradox file formats 8350#2 leshort 0x0800 Paradox 8351#>0x39 byte 3 v. 3.0 8352#>0x39 byte 4 v. 3.5 8353#>0x39 byte 9 v. 4.x 8354#>0x39 byte 10 v. 5.x 8355#>0x39 byte 11 v. 5.x 8356#>0x39 byte 12 v. 7.x 8357#>>0x04 byte 0 indexed .DB data file 8358#>>0x04 byte 1 primary index .PX file 8359#>>0x04 byte 2 non-indexed .DB data file 8360#>>0x04 byte 3 non-incrementing secondary index .Xnn file 8361#>>0x04 byte 4 secondary index .Ynn file 8362#>>0x04 byte 5 incrementing secondary index .Xnn file 8363#>>0x04 byte 6 non-incrementing secondary index .XGn file 8364#>>0x04 byte 7 secondary index .YGn file 8365#>>>0x04 byte 8 incrementing secondary index .XGn file 8366 8367## XBase database files 8368# updated by Joerg Jenderek at Feb 2013 8369# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 8370# https://www.clicketyclick.dk/databases/xbase/format/dbf.html 8371# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 8372# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 83730 ubelong&0x0000FFFF <0x00000C20 8374# skip Infocom game Z-machine 8375>2 ubyte >0 8376# skip Androids *.xml 8377>>3 ubyte >0 8378>>>3 ubyte <32 8379# 1 < version VV 8380>>>>0 ubyte >1 8381# skip HELP.CA3 by test for reserved byte ( NULL ) 8382>>>>>27 ubyte 0 8383# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 8384#>>>>>30 ubeshort x 30NULL?%x 8385# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 8386>>>>>>24 ubelong&0xffFFFFff >0x01302000 8387# .DBF or .MDX 8388>>>>>>24 ubelong&0xffFFFFff <0x01302001 8389# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 8390>>>>>>>24 ubelong&0xffFFFFff =0 8391# test for 2 reserved NULL bytes,transaction and encryption byte flag 8392>>>>>>>>12 ubelong&0xFFFFfEfE 0 8393# test for MDX flag 8394>>>>>>>>>28 ubyte x 8395>>>>>>>>>28 ubyte&0xf8 0 8396# header size >= 32 8397>>>>>>>>>>8 uleshort >31 8398# skip PIC15736.PCX by test for language driver name or field name 8399>>>>>>>>>>>32 ubyte >0 8400#!:mime application/x-dbf; charset=unknown-8bit ?? 8401#!:mime application/x-dbase 8402>>>>>>>>>>>>0 use xbase-type 8403# database file 8404>>>>>>>>>>>>0 ubyte x \b DBF 8405>>>>>>>>>>>>4 lelong 0 \b, no records 8406>>>>>>>>>>>>4 lelong >0 \b, %d record 8407# plural s appended 8408>>>>>>>>>>>>>4 lelong >1 \bs 8409# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 8410# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 8411>>>>>>>>>>>>10 uleshort x * %d 8412# file size = records * record size + header size 8413>>>>>>>>>>>>1 ubyte x \b, update-date 8414>>>>>>>>>>>>1 use xbase-date 8415# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 8416#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 8417# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 8418>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 8419#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 8420>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 8421>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 8422>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 8423# 1st record offset + 1 = header size 8424>>>>>>>>>>>>8 uleshort >0 8425>>>>>>>>>>>>(8.s+1) ubyte >0 8426>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 8427>>>>>>>>>>>>>(8.s+1) ubyte >0 8428>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 8429# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 8430>>>>>>>24 ubelong&0x0133f7ff >0 8431# test for reserved NULL byte 8432>>>>>>>>47 ubyte 0 8433# test for valid TAG key format (0x10 or 0) 8434>>>>>>>>>559 ubyte&0xeF 0 8435# test MM <= 12 8436>>>>>>>>>>45 ubeshort <0x0C20 8437>>>>>>>>>>>45 ubyte >0 8438>>>>>>>>>>>>46 ubyte <32 8439>>>>>>>>>>>>>46 ubyte >0 8440#!:mime application/x-mdx 8441>>>>>>>>>>>>>>0 use xbase-type 8442>>>>>>>>>>>>>>0 ubyte x \b MDX 8443>>>>>>>>>>>>>>1 ubyte x \b, creation-date 8444>>>>>>>>>>>>>>1 use xbase-date 8445>>>>>>>>>>>>>>44 ubyte x \b, update-date 8446>>>>>>>>>>>>>>44 use xbase-date 8447# No.of tags in use (1,2,5,12) 8448>>>>>>>>>>>>>>28 uleshort x \b, %d 8449# No. of entries in tag (0x30) 8450>>>>>>>>>>>>>>25 ubyte x \b/%d tags 8451# Length of tag 8452>>>>>>>>>>>>>>26 ubyte x * %d 8453# 1st tag name_ 8454>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 8455# 2nd tag name 8456#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 8457# 8458# Print the xBase names of different version variants 84590 name xbase-type 8460>0 ubyte <2 8461# 1 < version 8462>0 ubyte >1 8463>>0 ubyte 0x02 FoxBase 8464# FoxBase+/dBaseIII+, no memo 8465>>0 ubyte 0x03 FoxBase+/dBase III 8466!:mime application/x-dbf 8467# dBASE IV no memo file 8468>>0 ubyte 0x04 dBase IV 8469!:mime application/x-dbf 8470# dBASE V no memo file 8471>>0 ubyte 0x05 dBase V 8472!:mime application/x-dbf 8473>>0 ubyte 0x30 Visual FoxPro 8474!:mime application/x-dbf 8475>>0 ubyte 0x31 Visual FoxPro, autoincrement 8476!:mime application/x-dbf 8477# Visual FoxPro, with field type Varchar or Varbinary 8478>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 8479!:mime application/x-dbf 8480# dBASE IV SQL, no memo;dbv memo var size (Flagship) 8481>>0 ubyte 0x43 dBase IV, with SQL table 8482!:mime application/x-dbf 8483# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 8484#>>0 ubyte 0x62 dBase IV, with SQL table 8485#!:mime application/x-dbf 8486# dBASE IV, with memo!! 8487>>0 ubyte 0x7b dBase IV, with memo 8488!:mime application/x-dbf 8489# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 8490#>>0 ubyte 0x82 dBase IV, with SQL system 8491#!:mime application/x-dbf 8492# FoxBase+/dBaseIII+ with memo .DBT! 8493>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 8494!:mime application/x-dbf 8495# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 8496>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 8497!:mime application/x-dbf 8498# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 8499#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 8500#!:mime application/x-dbf 8501# dBASE IV with memo! 8502>>0 ubyte 0x8B dBase IV, with memo .DBT 8503!:mime application/x-dbf 8504# dBase IV with SQL Table,no memo? 8505>>0 ubyte 0x8E dBase IV, with SQL table 8506!:mime application/x-dbf 8507# .dbv and .dbt memo (Flagship)? 8508>>0 ubyte 0xB3 Flagship 8509# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 8510#>>0 ubyte 0xCA dBase IV with memo .DBT 8511#!:mime application/x-dbf 8512# dBASE IV with SQL table, with memo .DBT 8513>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 8514!:mime application/x-dbf 8515# HiPer-Six format;Clipper SIX, with SMT memo file 8516>>0 ubyte 0xE5 Clipper SIX with memo 8517!:mime application/x-dbf 8518# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 8519#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 8520#!:mime application/x-dbf 8521>>0 ubyte 0xF5 FoxPro with memo 8522!:mime application/x-dbf 8523# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 8524#>>0 ubyte 0xFA FoxPro 2.x, with memo 8525#!:mime application/x-dbf 8526# unknown version (should not happen) 8527>>0 default x xBase 8528!:mime application/x-dbf 8529>>>0 ubyte x (0x%x) 8530# flags in version byte 8531# DBT flag (with dBASE III memo .DBT)!! 8532# >>0 ubyte&0x80 >0 DBT_FLAG=%x 8533# memo flag ?? 8534# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 8535# SQL flag ?? 8536# >>0 ubyte&0x70 >0 SQL_FLAG=%x 8537# test and print the date of xBase .DBF .MDX 85380 name xbase-date 8539# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 8540>0 ubelong x 8541>1 ubyte <13 8542>>1 ubyte >0 8543>>>2 ubyte >0 8544>>>>2 ubyte <32 8545>>>>>0 ubyte x 8546# YY is interpreted as 20YY or 19YY 8547>>>>>>0 ubyte <100 \b %.2d 8548# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 8549>>>>>>0 ubyte >99 \b %d 8550>>>>>1 ubyte x \b-%d 8551>>>>>2 ubyte x \b-%d 8552 8553# dBase memo files .DBT or .FPT 8554# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 855516 ubyte <4 8556>16 ubyte !2 8557>>16 ubyte !1 8558# next free block index is positive 8559>>>0 ulelong >0 8560# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 8561>>>>17 ubelong&0xFFfdFE00 0x00000000 8562# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 8563>>>>>20 ubelong&0xFF01209B 0x00000000 8564# dBASE III 8565>>>>>>16 ubyte 3 8566# dBASE III DBT 8567>>>>>>>0 use dbase3-memo-print 8568# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 8569>>>>>>16 ubyte 0 8570# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 8571>>>>>>>20 uleshort 0 8572# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 8573>>>>>>>>8 ulong =0 8574>>>>>>>>>6 ubeshort >0 8575# skip emacs.PIF 8576>>>>>>>>>>4 ushort 0 8577>>>>>>>>>>>0 use foxpro-memo-print 8578# dBASE III DBT , garbage 8579>>>>>>>>>6 ubeshort 0 8580# skip MM*DD*.bin by test for for reserved NULL byte 8581>>>>>>>>>>510 ubeshort 0 8582# skip TK-DOS11.img image by looking for memo text 8583>>>>>>>>>>>512 ubelong <0xfeffff03 8584# skip EFI executables by looking for memo text 8585>>>>>>>>>>>>512 ubelong >0x1F202020 8586>>>>>>>>>>>>>513 ubyte >0 8587# unusual dBASE III DBT like adressen.dbt 8588>>>>>>>>>>>>>>0 use dbase3-memo-print 8589# dBASE III DBT like angest.dbt, or garbage PCX DBF 8590>>>>>>>>8 ubelong !0 8591# skip PCX and some DBF by test for for reserved NULL bytes 8592>>>>>>>>>510 ubeshort 0 8593# skip some DBF by test of invalid version 8594>>>>>>>>>>0 ubyte >5 8595>>>>>>>>>>>0 ubyte <48 8596>>>>>>>>>>>>0 use dbase3-memo-print 8597# dBASE IV DBT with positive block size 8598>>>>>>>20 uleshort >0 8599# dBASE IV DBT with valid block length like 512, 1024 8600# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero 8601>>>>>>>>20 uleshort&0x800f 0 8602>>>>>>>>>0 use dbase4-memo-print 8603 8604# Print the information of dBase III DBT memo file 86050 name dbase3-memo-print 8606>0 ubyte x dBase III DBT 8607# instead 3 as version number 0 for unusual examples like biblio.dbt 8608>16 ubyte !3 \b, version number %u 8609# Number of next available block for appending data 8610#>0 lelong =0 \b, next free block index %u 8611>0 lelong !0 \b, next free block index %u 8612# no positiv block length 8613#>20 uleshort =0 \b, block length %u 8614>20 uleshort !0 \b, block length %u 8615# dBase III memo field terminated by \032\032 8616>512 string >\0 \b, 1st item "%s" 8617# Print the information of dBase IV DBT memo file 86180 name dbase4-memo-print 8619>0 lelong x dBase IV DBT 8620!:mime application/x-dbt 8621!:ext dbt 8622# 8 character shorted main name of coresponding dBASE IV DBF file 8623>8 ubelong >0x20000000 8624# skip unusual like for angest.dbt 8625>>20 uleshort >0 8626>>>8 string >\0 \b of %-.8s.DBF 8627# value 0 implies 512 as size 8628#>4 ulelong =0 \b, blocks size %u 8629# size of blocks not reliable like 0x2020204C in angest.dbt 8630>4 ulelong !0 8631>>4 ulelong&0x0000003f 0 \b, blocks size %u 8632# dBase IV DBT with positive block length (found 512 , 1024) 8633>20 uleshort >0 \b, block length %u 8634# next available block 8635#>0 lelong =0 \b, next free block index %u 8636>0 lelong !0 \b, next free block index %u 8637>20 uleshort >0 8638>>(20.s) ubelong x 8639>>>&-4 use dbase4-memofield-print 8640# unusual dBase IV DBT without block length (implies 512 as length) 8641>20 uleshort =0 8642>>512 ubelong x 8643>>>&-4 use dbase4-memofield-print 8644# Print the information of dBase IV memo field 86450 name dbase4-memofield-print 8646# free dBase IV memo field 8647>0 ubelong !0xFFFF0800 8648>>0 lelong x \b, next free block %u 8649>>4 lelong x \b, next used block %u 8650# used dBase IV memo field 8651>0 ubelong =0xFFFF0800 8652# length of memo field 8653>>4 lelong x \b, field length %d 8654>>>8 string >\0 \b, 1st used item "%s" 8655# Print the information of FoxPro FPT memo file 86560 name foxpro-memo-print 8657>0 belong x FoxPro FPT 8658# Size of blocks for FoxPro ( 64,256 ) 8659>6 ubeshort x \b, blocks size %u 8660# next available block 8661#>0 belong =0 \b, next free block index %u 8662>0 belong !0 \b, next free block index %u 8663# field type ( 0~picture, 1~memo, 2~object ) 8664>512 ubelong <3 \b, field type %u 8665# length of memo field 8666>512 ubelong 1 8667>>516 belong >0 \b, field length %d 8668>>>520 string >\0 \b, 1st item "%s" 8669 8670# TODO: 8671# DBASE index file *.NDX 8672# DBASE Compound Index file *.CDX 8673# dBASE IV Printer Driver *.PRF 8674## End of XBase database stuff 8675 8676# MS Access database 86774 string Standard\ Jet\ DB Microsoft Access Database 8678!:mime application/x-msaccess 86794 string Standard\ ACE\ DB Microsoft Access Database 8680!:mime application/x-msaccess 8681 8682# From: Joerg Jenderek 8683# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine 8684# Reference: https://github.com/libyal/libesedb/archive/master.zip 8685# libesedb-master/documentation/ 8686# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc 8687# Note: also known as "JET Blue". Used by numerous Windows components such as 8688# Windows Search, Mail, Exchange and Active Directory. 86894 ubelong 0xefcdab89 8690# unknown1 8691>132 ubelong 0 Extensible storage engine 8692!:mime application/x-ms-ese 8693# file_type 0~database 1~stream 8694>>12 ulelong 0 DataBase 8695# Security DataBase (sdb) 8696!:ext edb/sdb 8697>>12 ulelong 1 STreaMing 8698!:ext stm 8699# format_version 620h 8700>>8 uleshort x \b, version 0x%x 8701>>10 uleshort >0 revision 0x%4.4x 8702>>0 ubelong x \b, checksum 0x%8.8x 8703# Page size 4096 8192 32768 8704>>236 ulequad x \b, page size %lld 8705# database_state 8706>>52 ulelong 1 \b, JustCreated 8707>>52 ulelong 2 \b, DirtyShutdown 8708#>>52 ulelong 3 \b, CleanShutdown 8709>>52 ulelong 4 \b, BeingConverted 8710>>52 ulelong 5 \b, ForceDetach 8711# Windows�NT major version when the databases indexes were updated. 8712>>216 ulelong x \b, Windows version %d 8713# Windows�NT minor version 8714>>220 ulelong x \b.%d 8715 8716# From: Joerg Jenderek 8717# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility 8718# Note: files contain application compatibility fixes, application compatibility modes and application help messages. 87198 string sdbf 8720>7 ubyte 0 8721# TAG_TYPE_LIST+TAG_INDEXES 8722>>12 uleshort 0x7802 Windows application compatibility Shim DataBase 8723# version? 2 3 8724#>>>0 ulelong x \b, version %d 8725!:mime application/x-ms-sdb 8726!:ext sdb 8727 8728# TDB database from Samba et al - Martin Pool <mbp@samba.org> 87290 string TDB\ file TDB database 8730>32 lelong 0x2601196D version 6, little-endian 8731>>36 lelong x hash size %d bytes 8732 8733# SE Linux policy database 87340 lelong 0xf97cff8c SE Linux policy 8735>16 lelong x v%d 8736>20 lelong 1 MLS 8737>24 lelong x %d symbols 8738>28 lelong x %d ocons 8739 8740# ICE authority file data (Wolfram Kleff) 87412 string ICE ICE authority data 8742 8743# X11 Xauthority file (Wolfram Kleff) 874410 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 874511 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 874612 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 874713 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 874814 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 874915 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 875016 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 875117 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 875218 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 8753 8754# From: Maxime Henrion <mux@FreeBSD.org> 8755# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 87560 string PGDMP PostgreSQL custom database dump 8757>5 byte x - v%d 8758>6 byte x \b.%d 8759>5 beshort <0x101 \b-0 8760>5 beshort >0x100 8761>>7 byte x \b-%d 8762 8763# Type: Advanced Data Format (ADF) database 8764# URL: https://www.grc.nasa.gov/WWW/cgns/adf/ 8765# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 87660 string @(#)ADF\ Database CGNS Advanced Data Format 8767 8768# Tokyo Cabinet magic data 8769# http://tokyocabinet.sourceforge.net/index.html 87700 string ToKyO\ CaBiNeT\n Tokyo Cabinet 8771>14 string x \b (%s) 8772>32 byte 0 \b, Hash 8773!:mime application/x-tokyocabinet-hash 8774>32 byte 1 \b, B+ tree 8775!:mime application/x-tokyocabinet-btree 8776>32 byte 2 \b, Fixed-length 8777!:mime application/x-tokyocabinet-fixed 8778>32 byte 3 \b, Table 8779!:mime application/x-tokyocabinet-table 8780>33 byte &1 \b, [open] 8781>33 byte &2 \b, [fatal] 8782>34 byte x \b, apow=%d 8783>35 byte x \b, fpow=%d 8784>36 byte &0x01 \b, [large] 8785>36 byte &0x02 \b, [deflate] 8786>36 byte &0x04 \b, [bzip] 8787>36 byte &0x08 \b, [tcbs] 8788>36 byte &0x10 \b, [excodec] 8789>40 lequad x \b, bnum=%lld 8790>48 lequad x \b, rnum=%lld 8791>56 lequad x \b, fsiz=%lld 8792 8793# Type: QDBM Quick Database Manager 8794# From: Benoit Sibaud <bsibaud@april.org> 87950 string \\[depot\\]\n\f Quick Database Manager, little endian 87960 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 8797 8798# Type: TokyoCabinet database 8799# URL: http://tokyocabinet.sourceforge.net/ 8800# From: Benoit Sibaud <bsibaud@april.org> 88010 string ToKyO\ CaBiNeT\n TokyoCabinet database 8802>14 string x (version %s) 8803 8804# From: Stephane Blondon https://www.yaal.fr 8805# Database file for Zope (done by FileStorage) 88060 string FS21 Zope Object Database File Storage v3 (data) 88070 string FS30 Zope Object Database File Storage v4 (data) 8808 8809# Cache file for the database of Zope (done by ClientStorage) 88100 string ZEC3 Zope Object Database Client Cache File (data) 8811 8812# IDA (Interactive Disassembler) database 88130 string IDA1 IDA (Interactive Disassembler) database 8814 8815# Hopper (reverse engineering tool) https://www.hopperapp.com/ 88160 string hopperdb Hopper database 8817 8818# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) 8819# Reference: http://www.provue.com/Panorama/ 8820# From: Joerg Jenderek 8821# NOTE: test only versions 4 and 6.0 with Windows 8822# length of Panorama database name 88235 ubyte >0 8824# look after database name for "some" null bits 8825>(5.B+7) ubelong&0xF3ffF000 0 8826# look for first keyword 8827>>&1 search/2 DESIGN Panorama database 8828#!:mime application/x-panorama-database 8829!:apple KASXZEPD 8830!:ext pan 8831# database name 8832>>>5 pstring x \b, "%s" 8833 8834# 8835# 8836# askSam Database by Stefan A. Haubenthal <polluks@web.de> 88370 string askw40\0 askSam DB 8838 8839# 8840# 8841# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de> 88420 string MBSTV\040 MUIbase DB 8843>6 string x version %s 8844 8845# 8846# CDB database 88470 string NBCDB\012 NetBSD Constant Database 8848>7 byte x \b, version %d 8849>8 string x \b, for '%s' 8850>24 lelong x \b, datasize %d 8851>28 lelong x \b, entries %d 8852>32 lelong x \b, index %d 8853>36 lelong x \b, seed %#x 8854 8855# 8856# Redis RDB - https://redis.io/topics/persistence 88570 string REDIS Redis RDB file, 8858>5 regex [0-9][0-9][0-9][0-9] version %s 8859 8860# Mork database. 8861# Used by older versions of Mozilla Suite and Firefox, 8862# and current versions of Thunderbird. 8863# From: David Korth <gerbilsoft@gerbilsoft.com> 88640 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database 8865>23 string x \b, version %.3s 8866 8867#------------------------------------------------------------------------------ 8868# $File: dataone,v 1.2 2019/04/19 00:42:27 christos Exp $ 8869# 8870# DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> & 8871# Pratik Shrivastava <pratikshrivastava23@gmail.com> 8872# 8873# file formats: https://cn.dataone.org/cn/v2/formats 8874#------------------------------------------------------------------------------ 8875 8876# EML (Ecological Metadata Language Format) 88770 string <?xml 8878>&0 regex (eml)-[0-9].[0-9].[0-9]+ eml://ecoinformatics.org/%s 8879 8880# onedcx (DataONE Dublin Core Extended v1.0) 8881>&0 regex (onedcx/v)[0-9].[0-9]+ https://ns.dataone.org/metadata/schema/onedcx/v1.0 8882 8883# FGDC-STD-001-1998 (Content Standard for Digital Geospatial Metadata, 8884# version 001-1998) 8885>&0 regex fgdc FGDC-STD-001-1998 8886 8887# Mercury (Oak Ridge National Lab Mercury Metadata version 1.0) 8888>&0 regex (mercury/terms/v)[0-9].[0-9] https://purl.org/ornl/schema/mercury/terms/v1.0 8889 8890# ISOTC211 (Geographic MetaData (GMD) Extensible Markup Language) 8891>&0 regex isotc211 8892>>&0 regex eng;USA https://www.isotc211.org/2005/gmd 8893 8894# ISOTC211 (NOAA Variant Geographic MetaData (GMD) Extensible Markup Language) 8895>>&0 regex gov.noaa.nodc:[0-9]+ https://www.isotc211.org/2005/gmd-noaa 8896 8897# ISOTC211 PANGAEA Variant Geographic MetaData (GMD) Extensible Markup Language 8898>>&0 regex pangaea.dataset[0-9][0-9][0-9][0-9][0-9][0-9]+ https://www.isotc211.org/2005/gmd-pangaea 8899!:mime text/xml 8900 8901 8902# Object Reuse and Exchange Vocabulary 89030 string <?xml 8904>&0 regex rdf 8905>>&0 regex openarchives https://www.openarchives.org/ore/terms 8906!:mime application/rdf+xml 8907 8908 8909# Dryad Metadata Application Profile Version 3.1 89100 string <DryadData 8911>&0 regex (dryad-bibo/v)[0-9].[0-9] https://datadryad.org/profile/v3.1 8912!:mime text/xml 8913 8914#------------------------------------------------------------------------------ 8915# $File: dbpf,v 1.3 2019/04/19 00:42:27 christos Exp $ 8916# dppf: Maxis Database Packed Files, the stored data file format used by all 8917# Maxis games after the Sims: http://wiki.niotso.org/DBPF 8918# https://www.wiki.sc4devotion.com/index.php?title=DBPF 8919# 13 Oct 2017, Kip Warner <kip at thevertigo dot com> 89200 string DBPF Maxis Database Packed File 8921>4 ulelong x \b, version: %u. 8922>>8 ulelong x \b%u 8923>>>36 ulelong x \b, files: %u 8924>>24 ledate !0 \b, created: %s 8925>>28 ledate !0 \b, modified: %s 8926!:ext dbpf/package/dat/sc4 8927!:mime application/x-maxis-dbpf 8928#------------------------------------------------------------------------------ 8929# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $ 8930# der: file(1) magic for DER encoded files 8931# 8932 8933# Certificate information piece 89340 name certinfo 8935>0 der seq 8936>>&0 der set 8937>>>&0 der seq 8938>>>>&0 der obj_id3=550406 8939>>>>&0 der prt_str=x \b, countryName=%s 8940>>&0 der set 8941>>>&0 der seq 8942>>>>&0 der obj_id3=550408 8943>>>>&0 der utf8_str=x \b, stateOrProvinceName=%s 8944>>&0 der set 8945>>>&0 der seq 8946>>>>&0 der obj_id3=55040a 8947>>>>&0 der utf8_str=x \b, organizationName=%s 8948>>&0 der set 8949>>>&0 der seq 8950>>>>&0 der obj_id3=550403 8951>>>>&0 der utf8_str=x \b, commonName=%s 8952>>&0 der seq 8953 8954# Certificate requests 89550 der seq 8956>&0 der seq 8957>>&0 der int1=00 DER Encoded Certificate request 8958>>&0 use certinfo 8959 8960# Key Pairs 89610 der seq 8962>&0 der int1=00 8963>&0 der int65=x 8964>&0 der int3=010001 DER Encoded Key Pair, 512 bits 8965 89660 der seq 8967>&0 der int1=00 8968>&0 der int129=x 8969>&0 der int3=010001 DER Encoded Key Pair, 1024 bits 8970 89710 der seq 8972>&0 der int1=00 8973>&0 der int257=x 8974>&0 der int3=010001 DER Encoded Key Pair, 2048 bits 8975 89760 der seq 8977>&0 der int1=00 8978>&0 der int513=x 8979>&0 der int3=010001 DER Encoded Key Pair, 4096 bits 8980 89810 der seq 8982>&0 der int1=00 8983>&0 der int1025=x 8984>&0 der int3=010001 DER Encoded Key Pair, 8192 bits 8985 89860 der seq 8987>&0 der int1=00 8988>&0 der int2049=x 8989>&0 der int3=010001 DER Encoded Key Pair, 16k bits 8990 89910 der seq 8992>&0 der int1=00 8993>&0 der int4097=x 8994>&0 der int3=010001 DER Encoded Key Pair, 32k bits 8995 8996# Certificates 89970 der seq 8998>&0 der seq 8999>>&0 der int2=0dfa DER Encoded Certificate, 512 bits 9000>>&0 der int2=0dfb DER Encoded Certificate, 1024 bits 9001>>&0 der int2=0dfc DER Encoded Certificate, 2048 bits 9002>>&0 der int2=0dfd DER Encoded Certificate, 4096 bits 9003>>&0 der int2=0dfe DER Encoded Certificate, 8192 bits 9004>>&0 der int2=0dff DER Encoded Certificate, 16k bits 9005>>&0 der int2=0e04 DER Encoded Certificate, 32k bits 9006>>&0 der int2=x DER Encoded Certificate, ? bits (%s) 9007>>&0 der seq 9008>>>&0 der obj_id9=2a864886f70d010105 \b, sha1WithRSAEncryption 9009>>>&0 der obj_id9=x \b, ? Encryption (%s) 9010>>>&0 der null 9011>>&0 der seq 9012>>>&0 der set 9013>>>>&0 der seq 9014>>>>>&0 der obj_id3=550406 9015>>>>>&0 der prt_str=x \b, countryName=%s 9016>>>&0 der set 9017>>>>&0 der seq 9018>>>>>&0 der obj_id3=550408 9019>>>>>&0 der prt_str=x \b, stateOrProvinceName=%s 9020>>>&0 der set 9021>>>>&0 der seq 9022>>>>>&0 der obj_id3=550407 9023>>>>>&0 der prt_str=x \b, localityName=%s 9024>>>&0 der set 9025>>>>&0 der seq 9026>>>>>&0 der obj_id3=55040a 9027>>>>>&0 der prt_str=x \b, organizationName=%s 9028>>>&0 der set 9029>>>>&0 der seq 9030>>>>>&0 der obj_id3=55040b 9031>>>>>&0 der prt_str=x \b, organizationUnitName=%s 9032>>>&0 der set 9033>>>>&0 der seq 9034>>>>>&0 der obj_id3=550403 9035>>>>>&0 der prt_str=x \b, commonName=%s 9036>>>&0 der set 9037>>>>&0 der seq 9038>>>>>&0 der obj_id9=2a864886f70d010901 9039>>>>>&0 der ia5_str=x \b, emailAddress=%s 9040>>&0 der seq 9041>>>&0 der utc_time=x \b, utcTime=%s 9042>>>&0 der utc_time=x \b, utcTime=%s 9043>>&0 use certinfo 9044 9045#------------------------------------------------------------------------------ 9046# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $ 9047# diamond: file(1) magic for Diamond system 9048# 9049# ... diamond is a multi-media mail and electronic conferencing system.... 9050# 9051# XXX - I think it was either renamed Slate, or replaced by Slate.... 9052# 9053# The full deal is too long... 9054#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document 90550 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document 9056 9057#------------------------------------------------------------------------------ 9058# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $ 9059# diff: file(1) magic for diff(1) output 9060# 90610 search/1 diff\040 diff output text 9062!:mime text/x-diff 90630 search/1 ***\040 diff output text 9064!:mime text/x-diff 90650 search/1 Only\040in\040 diff output text 9066!:mime text/x-diff 90670 search/1 Common\040subdirectories:\040 diff output text 9068!:mime text/x-diff 9069 90700 search/1 Index: RCS/CVS diff output text 9071!:mime text/x-diff 9072 9073# bsdiff: file(1) magic for bsdiff(1) output 90740 string/b BSDIFF40 bsdiff(1) patch file 9075 9076 9077# unified diff 90780 search/4096 ---\040 9079>&0 search/1024 \n 9080>>&0 search/1 +++\040 9081>>>&0 search/1024 \n 9082>>>>&0 search/1 @@ unified diff output text 9083!:mime text/x-diff 9084!:strength + 90 9085 9086# librsync -- the library for network deltas 9087# 9088# Copyright (C) 2001 by Martin Pool. You may do whatever you want with 9089# this file. 9090# 90910 belong 0x72730236 rdiff network-delta data 9092 90930 belong 0x72730136 rdiff network-delta signature data 9094>4 belong x (block length=%d, 9095>8 belong x signature strength=%d) 9096 9097#------------------------------------------------------------------------------ 9098# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $ 9099# Digital UNIX - Info 9100# 91010 string =!<arch>\n________64E Alpha archive 9102>22 string X -- out of date 9103# 9104 91050 leshort 0603 9106>24 leshort 0410 COFF format alpha pure 9107>24 leshort 0413 COFF format alpha demand paged 9108>>22 leshort&030000 !020000 executable 9109>>22 leshort&020000 !0 dynamically linked 9110>>16 lelong !0 not stripped 9111>>16 lelong 0 stripped 9112>>27 byte x - version %d 9113>>26 byte x \b.%d 9114>>28 byte x \b-%d 9115>24 leshort 0407 COFF format alpha object 9116>>22 leshort&030000 020000 shared library 9117>>27 byte x - version %d 9118>>26 byte x \b.%d 9119>>28 byte x \b-%d 9120 9121# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> 9122# 9123# The actual magic number is just "Core", followed by a 2-byte version 9124# number; however, treating any file that begins with "Core" as a Digital 9125# UNIX core dump file may produce too many false hits, so we include one 9126# byte of the version number as well; DU 5.0 appears only to be up to 9127# version 2. 9128# 91290 string Core\001 Alpha COFF format core dump (Digital UNIX) 9130>24 string >\0 \b, from '%s' 91310 string Core\002 Alpha COFF format core dump (Digital UNIX) 9132>24 string >\0 \b, from '%s' 9133# 9134# The next is incomplete, we could tell more about this format, 9135# but its not worth it. 91360 leshort 0x188 Alpha compressed COFF 91370 leshort 0x18f Alpha u-code object 9138# 9139# 9140# Some other interesting Digital formats, 91410 string \377\377\177 ddis/ddif 91420 string \377\377\174 ddis/dots archive 91430 string \377\377\176 ddis/dtif table data 91440 string \033c\033 LN03 output 91450 long 04553207 X image 9146# 91470 string =!<PDF>!\n profiling data file 9148# 9149# Locale data tables (MIPS and Alpha). 9150# 91510 short 0x0501 locale data table 9152>6 short 0x24 for MIPS 9153>6 short 0x40 for Alpha 9154 9155#------------------------------------------------------------------------------ 9156# $File: dolby,v 1.9 2019/04/19 00:42:27 christos Exp $ 9157# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at> 9158# from https://www.atsc.org/standards/a_52a.pdf 9159# corrections, additions, etc. are always welcome! 9160# 9161# syncword 91620 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream, 9163# Proposed audio/ac3 RFC/4184 9164!:mime audio/vnd.dolby.dd-raw 9165# fscod 9166>4 byte&0xc0 = 0x00 48 kHz, 9167>4 byte&0xc0 = 0x40 44.1 kHz, 9168>4 byte&0xc0 = 0x80 32 kHz, 9169# is this one used for 96 kHz? 9170>4 byte&0xc0 = 0xc0 reserved frequency, 9171# 9172>5 byte&0x07 = 0x00 \b, complete main (CM) 9173>5 byte&0x07 = 0x01 \b, music and effects (ME) 9174>5 byte&0x07 = 0x02 \b, visually impaired (VI) 9175>5 byte&0x07 = 0x03 \b, hearing impaired (HI) 9176>5 byte&0x07 = 0x04 \b, dialogue (D) 9177>5 byte&0x07 = 0x05 \b, commentary (C) 9178>5 byte&0x07 = 0x06 \b, emergency (E) 9179>5 beshort&0x07e0 0x0720 \b, voiceover (VO) 9180>5 beshort&0x07e0 >0x0720 \b, karaoke 9181# acmod 9182>6 byte&0xe0 = 0x00 1+1 front, 9183>>6 byte&0x10 = 0x10 LFE on, 9184>6 byte&0xe0 = 0x20 1 front/0 rear, 9185>>6 byte&0x10 = 0x10 LFE on, 9186>6 byte&0xe0 = 0x40 2 front/0 rear, 9187# dsurmod (for stereo only) 9188>>6 byte&0x18 = 0x00 Dolby Surround not indicated 9189>>6 byte&0x18 = 0x08 not Dolby Surround encoded 9190>>6 byte&0x18 = 0x10 Dolby Surround encoded 9191>>6 byte&0x18 = 0x18 reserved Dolby Surround mode 9192>>6 byte&0x04 = 0x04 LFE on, 9193>6 byte&0xe0 = 0x60 3 front/0 rear, 9194>>6 byte&0x04 = 0x04 LFE on, 9195>6 byte&0xe0 = 0x80 2 front/1 rear, 9196>>6 byte&0x04 = 0x04 LFE on, 9197>6 byte&0xe0 = 0xa0 3 front/1 rear, 9198>>6 byte&0x01 = 0x01 LFE on, 9199>6 byte&0xe0 = 0xc0 2 front/2 rear, 9200>>6 byte&0x04 = 0x04 LFE on, 9201>6 byte&0xe0 = 0xe0 3 front/2 rear, 9202>>6 byte&0x01 = 0x01 LFE on, 9203# 9204>4 byte&0x3e = 0x00 \b, 32 kbit/s 9205>4 byte&0x3e = 0x02 \b, 40 kbit/s 9206>4 byte&0x3e = 0x04 \b, 48 kbit/s 9207>4 byte&0x3e = 0x06 \b, 56 kbit/s 9208>4 byte&0x3e = 0x08 \b, 64 kbit/s 9209>4 byte&0x3e = 0x0a \b, 80 kbit/s 9210>4 byte&0x3e = 0x0c \b, 96 kbit/s 9211>4 byte&0x3e = 0x0e \b, 112 kbit/s 9212>4 byte&0x3e = 0x10 \b, 128 kbit/s 9213>4 byte&0x3e = 0x12 \b, 160 kbit/s 9214>4 byte&0x3e = 0x14 \b, 192 kbit/s 9215>4 byte&0x3e = 0x16 \b, 224 kbit/s 9216>4 byte&0x3e = 0x18 \b, 256 kbit/s 9217>4 byte&0x3e = 0x1a \b, 320 kbit/s 9218>4 byte&0x3e = 0x1c \b, 384 kbit/s 9219>4 byte&0x3e = 0x1e \b, 448 kbit/s 9220>4 byte&0x3e = 0x20 \b, 512 kbit/s 9221>4 byte&0x3e = 0x22 \b, 576 kbit/s 9222>4 byte&0x3e = 0x24 \b, 640 kbit/s 9223 9224#------------------------------------------------------------------------------ 9225# $File: dump,v 1.17 2018/06/26 01:07:17 christos Exp $ 9226# dump: file(1) magic for dump file format--for new and old dump filesystems 9227# 9228# We specify both byte orders in order to recognize byte-swapped dumps. 9229# 92300 name new-dump-be 9231>4 bedate x This dump %s, 9232>8 bedate x Previous dump %s, 9233>12 belong >0 Volume %d, 9234>692 belong 0 Level zero, type: 9235>692 belong >0 Level %d, type: 9236>0 belong 1 tape header, 9237>0 belong 2 beginning of file record, 9238>0 belong 3 map of inodes on tape, 9239>0 belong 4 continuation of file record, 9240>0 belong 5 end of volume, 9241>0 belong 6 map of inodes deleted, 9242>0 belong 7 end of medium (for floppy), 9243>676 string >\0 Label %s, 9244>696 string >\0 Filesystem %s, 9245>760 string >\0 Device %s, 9246>824 string >\0 Host %s, 9247>888 belong >0 Flags %x 9248 92490 name old-dump-be 9250#>4 bedate x This dump %s, 9251#>8 bedate x Previous dump %s, 9252>12 belong >0 Volume %d, 9253>692 belong 0 Level zero, type: 9254>692 belong >0 Level %d, type: 9255>0 belong 1 tape header, 9256>0 belong 2 beginning of file record, 9257>0 belong 3 map of inodes on tape, 9258>0 belong 4 continuation of file record, 9259>0 belong 5 end of volume, 9260>0 belong 6 map of inodes deleted, 9261>0 belong 7 end of medium (for floppy), 9262>676 string >\0 Label %s, 9263>696 string >\0 Filesystem %s, 9264>760 string >\0 Device %s, 9265>824 string >\0 Host %s, 9266>888 belong >0 Flags %x 9267 92680 name ufs2-dump-be 9269>896 beqdate x This dump %s, 9270>904 beqdate x Previous dump %s, 9271>12 belong >0 Volume %d, 9272>692 belong 0 Level zero, type: 9273>692 belong >0 Level %d, type: 9274>0 belong 1 tape header, 9275>0 belong 2 beginning of file record, 9276>0 belong 3 map of inodes on tape, 9277>0 belong 4 continuation of file record, 9278>0 belong 5 end of volume, 9279>0 belong 6 map of inodes deleted, 9280>0 belong 7 end of medium (for floppy), 9281>676 string >\0 Label %s, 9282>696 string >\0 Filesystem %s, 9283>760 string >\0 Device %s, 9284>824 string >\0 Host %s, 9285>888 belong >0 Flags %x 9286 928724 belong 60012 new-fs dump file (big endian), 9288>0 use new-dump-be 9289 929024 belong 60011 old-fs dump file (big endian), 9291>0 use old-dump-be 9292 929324 lelong 60012 new-fs dump file (little endian), 9294# to correctly recognize '*.mo' GNU message catalog (little endian) 9295!:strength - 15 9296>0 use \^new-dump-be 9297 929824 lelong 60011 old-fs dump file (little endian), 9299>0 use \^old-dump-be 9300 9301 930224 belong 0x19540119 new-fs dump file (ufs2, big endian), 9303>0 use ufs2-dump-be 9304 930524 lelong 0x19540119 new-fs dump file (ufs2, little endian), 9306>0 use \^ufs2-dump-be 9307 930818 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), 9309>2 medate x Previous dump %s, 9310>6 medate x This dump %s, 9311>10 leshort >0 Volume %d, 9312>0 leshort 1 tape header. 9313>0 leshort 2 beginning of file record. 9314>0 leshort 3 map of inodes on tape. 9315>0 leshort 4 continuation of file record. 9316>0 leshort 5 end of volume. 9317>0 leshort 6 map of inodes deleted. 9318>0 leshort 7 end of medium (for floppy). 9319 9320#------------------------------------------------------------------------------ 9321# $File: dyadic,v 1.9 2019/04/19 00:42:27 christos Exp $ 9322# Dyadic: file(1) magic for Dyalog APL. 9323# 9324# updated by Joerg Jenderek at Oct 2013 9325# https://en.wikipedia.org/wiki/Dyalog_APL 9326# https://www.dyalog.com/ 9327# .DXV Dyalog APL External Variable 9328# .DIN Dyalog APL Input Table 9329# .DOT Dyalog APL Output Table 9330# .DFT Dyalog APL Format File 93310 ubeshort&0xFF60 0xaa00 9332# skip biblio.dbt 9333>1 byte !4 9334# real Dyalog APL have non zero version numbers like 7.3 or 13.4 9335>>2 ubeshort >0x0000 Dyalog APL 9336>>>1 byte 0x00 aplcore 9337#>>>1 byte 0x00 incomplete workspace 9338# *.DCF Dyalog APL Component File 9339>>>1 byte 0x01 component file 32-bit non-journaled non-checksummed 9340#>>>1 byte 0x01 component file 9341>>>1 byte 0x02 external variable exclusive 9342#>>>1 byte 0x02 external variable 9343# *.DWS Dyalog APL Workspace 9344>>>1 byte 0x03 workspace 9345>>>>7 byte&0x28 0x00 32-bit 9346>>>>7 byte&0x28 0x20 64-bit 9347>>>>7 byte&0x0c 0x00 classic 9348>>>>7 byte&0x0c 0x04 unicode 9349>>>>7 byte&0x88 0x00 big-endian 9350>>>>7 byte&0x88 0x80 little-endian 9351>>>1 byte 0x06 external variable shared 9352# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File 9353>>>1 byte 0x07 session 9354>>>1 byte 0x08 mapped file 32-bit 9355>>>1 byte 0x09 component file 64-bit non-journaled non-checksummed 9356>>>1 byte 0x0a mapped file 64-bit 9357>>>1 byte 0x0b component file 32-bit level 1 journaled non-checksummed 9358>>>1 byte 0x0c component file 64-bit level 1 journaled non-checksummed 9359>>>1 byte 0x0d component file 32-bit level 1 journaled checksummed 9360>>>1 byte 0x0e component file 64-bit level 1 journaled checksummed 9361>>>1 byte 0x0f component file 32-bit level 2 journaled checksummed 9362>>>1 byte 0x10 component file 64-bit level 2 journaled checksummed 9363>>>1 byte 0x11 component file 32-bit level 3 journaled checksummed 9364>>>1 byte 0x12 component file 64-bit level 3 journaled checksummed 9365>>>1 byte 0x13 component file 32-bit non-journaled checksummed 9366>>>1 byte 0x14 component file 64-bit non-journaled checksummed 9367>>>1 byte 0x15 component file under construction 9368>>>1 byte 0x16 DFS component file 64-bit level 1 journaled checksummed 9369>>>1 byte 0x17 DFS component file 64-bit level 2 journaled checksummed 9370>>>1 byte 0x18 DFS component file 64-bit level 3 journaled checksummed 9371>>>1 byte 0x19 external workspace 9372>>>1 byte 0x80 DDB 9373>>>2 byte x version %d 9374>>>3 byte x \b.%d 9375#>>>2 byte x type %d 9376#>>>3 byte x subtype %d 9377 9378# *.DXF Dyalog APL Transfer File 93790 short 0x6060 Dyalog APL transfer 9380 9381#------------------------------------------------------------------------------ 9382# $File: ebml,v 1.2 2019/04/19 00:42:27 christos Exp $ 9383# ebml: file(1) magic for various Extensible Binary Meta Language 9384# https://www.matroska.org/technical/specs/index.html#track 93850 belong 0x1a45dfa3 EBML file 9386>4 search/b/100 \102\202 9387>>&1 string x \b, creator %.8s 9388 9389#------------------------------------------------------------------------------ 9390# $File: edid,v 1.1 2019/03/28 12:36:01 christos Exp $ 9391# edid: file(1) magic for EDID dump files 9392 93930 quad 0x00ffffffffffff00 Extended display identification data dump 9394!:mime application/x-edid-dump 9395>18 byte 0x01 Version 1 9396>>19 byte <0x04 \b.%d 9397>18 byte 0x02 Version 2 9398>>19 byte 0x00 \b.0 9399 9400#------------------------------------------------------------------------------ 9401# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $ 9402# T602 editor documents 9403# by David Necas <yeti@physics.muni.cz> 94040 string @CT\ T602 document data, 9405>4 string 0 Kamenicky 9406>4 string 1 CP 852 9407>4 string 2 KOI8-CS 9408>4 string >2 unknown encoding 9409 9410# Vi IMproved Encrypted file 9411# by David Necas <yeti@physics.muni.cz> 94120 string VimCrypt~ Vim encrypted file data 9413 94140 name vimnanoswap 9415>67 byte 0 9416>>107 byte 0 9417#>>>2 string x %s swap file 9418>>>24 ulelong x \b, pid %d 9419>>>28 string >\0 \b, user %s 9420>>>68 string >\0 \b, host %s 9421>>>108 string >\0 \b, file %s 9422>>>1007 byte 0x55 \b, modified 9423 9424# Vi IMproved Swap file 9425# by Sven Wegener <swegener@gentoo.org> 94260 string b0VIM\ Vim swap file 9427>&0 string >\0 \b, version %s 9428>0 use vimnanoswap 9429 9430 9431# Lock/swap file for several editors, at least 9432# Vi IMproved and nano 94330 string b0nano Nano swap file 9434>0 use vimnanoswap 9435 9436# kate (K Advanced Text Editor) 94370 string \x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00 Kate swap file 9438 9439#------------------------------------------------------------------------------ 9440# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $ 9441# efi: file(1) magic for Universal EFI binaries 9442 94430 lelong 0x0ef1fab9 9444>4 lelong 1 Universal EFI binary with 1 architecture 9445>>&0 lelong 7 \b, i386 9446>>&0 lelong 0x01000007 \b, x86_64 9447>4 lelong 2 Universal EFI binary with 2 architectures 9448>>&0 lelong 7 \b, i386 9449>>&0 lelong 0x01000007 \b, x86_64 9450>>&20 lelong 7 \b, i386 9451>>&20 lelong 0x01000007 \b, x86_64 9452>4 lelong >2 Universal EFI binary with %d architectures 9453 9454#------------------------------------------------------------------------------ 9455# $File: elf,v 1.77 2019/01/16 19:33:35 christos Exp $ 9456# elf: file(1) magic for ELF executables 9457# 9458# We have to check the byte order flag to see what byte order all the 9459# other stuff in the header is in. 9460# 9461# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 9462# 9463# Created by: unknown 9464# Modified by (1): Daniel Quinlan <quinlan@yggdrasil.com> 9465# Modified by (2): Peter Tobias <tobias@server.et-inf.fho-emden.de> (core support) 9466# Modified by (3): Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> (fix of core support) 9467# Modified by (4): <gerardo.cacciari@gmail.com> (VMS Itanium) 9468# Modified by (5): Matthias Urlichs <smurf@debian.org> (Listing of many architectures) 9469 94700 name elf-mips 9471>0 lelong&0xf0000000 0x00000000 MIPS-I 9472>0 lelong&0xf0000000 0x10000000 MIPS-II 9473>0 lelong&0xf0000000 0x20000000 MIPS-III 9474>0 lelong&0xf0000000 0x30000000 MIPS-IV 9475>0 lelong&0xf0000000 0x40000000 MIPS-V 9476>0 lelong&0xf0000000 0x50000000 MIPS32 9477>0 lelong&0xf0000000 0x60000000 MIPS64 9478>0 lelong&0xf0000000 0x70000000 MIPS32 rel2 9479>0 lelong&0xf0000000 0x80000000 MIPS64 rel2 9480>0 lelong&0xf0000000 0x90000000 MIPS32 rel6 9481>0 lelong&0xf0000000 0xa0000000 MIPS64 rel6 9482 94830 name elf-sparc 9484>0 lelong&0x00ffff00 0x00000100 V8+ Required, 9485>0 lelong&0x00ffff00 0x00000200 Sun UltraSPARC1 Extensions Required, 9486>0 lelong&0x00ffff00 0x00000400 HaL R1 Extensions Required, 9487>0 lelong&0x00ffff00 0x00000800 Sun UltraSPARC3 Extensions Required, 9488>0 lelong&0x3 0 total store ordering, 9489>0 lelong&0x3 1 partial store ordering, 9490>0 lelong&0x3 2 relaxed memory ordering, 9491 94920 name elf-pa-risc 9493>2 leshort 0x0208 1.0 9494>2 leshort 0x0210 1.1 9495>2 leshort 0x0214 2.0 9496>0 leshort &0x0008 (LP64) 9497 94980 name elf-le 9499>16 leshort 0 no file type, 9500!:mime application/octet-stream 9501>16 leshort 1 relocatable, 9502!:mime application/x-object 9503>16 leshort 2 executable, 9504!:mime application/x-executable 9505>16 leshort 3 ${x?pie executable:shared object}, 9506 9507!:mime application/x-${x?pie-executable:sharedlib} 9508>16 leshort 4 core file, 9509!:mime application/x-coredump 9510# OS-specific 9511>7 byte 202 9512>>16 leshort 0xFE01 executable, 9513!:mime application/x-executable 9514# Core file detection is not reliable. 9515#>>>(0x38+0xcc) string >\0 of '%s' 9516#>>>(0x38+0x10) lelong >0 (signal %d), 9517>16 leshort &0xff00 processor-specific, 9518>18 clear x 9519>18 leshort 0 no machine, 9520>18 leshort 1 AT&T WE32100, 9521>18 leshort 2 SPARC, 9522>18 leshort 3 Intel 80386, 9523>18 leshort 4 Motorola m68k, 9524>>4 byte 1 9525>>>36 lelong &0x01000000 68000, 9526>>>36 lelong &0x00810000 CPU32, 9527>>>36 lelong 0 68020, 9528>18 leshort 5 Motorola m88k, 9529>18 leshort 6 Intel 80486, 9530>18 leshort 7 Intel 80860, 9531# The official e_machine number for MIPS is now #8, regardless of endianness. 9532# The second number (#10) will be deprecated later. For now, we still 9533# say something if #10 is encountered, but only gory details for #8. 9534>18 leshort 8 MIPS, 9535>>4 byte 1 9536>>>36 lelong &0x20 N32 9537>18 leshort 10 MIPS, 9538>>4 byte 1 9539>>>36 lelong &0x20 N32 9540>18 leshort 8 9541# only for 32-bit 9542>>4 byte 1 9543>>>36 use elf-mips 9544# only for 64-bit 9545>>4 byte 2 9546>>>48 use elf-mips 9547>18 leshort 9 Amdahl, 9548>18 leshort 10 MIPS (deprecated), 9549>18 leshort 11 RS6000, 9550>18 leshort 15 PA-RISC, 9551# only for 32-bit 9552>>4 byte 1 9553>>>36 use elf-pa-risc 9554# only for 64-bit 9555>>4 byte 2 9556>>>48 use elf-pa-risc 9557>18 leshort 16 nCUBE, 9558>18 leshort 17 Fujitsu VPP500, 9559>18 leshort 18 SPARC32PLUS, 9560# only for 32-bit 9561>>4 byte 1 9562>>>36 use elf-sparc 9563>18 leshort 19 Intel 80960, 9564>18 leshort 20 PowerPC or cisco 4500, 9565>18 leshort 21 64-bit PowerPC or cisco 7500, 9566>18 leshort 22 IBM S/390, 9567>18 leshort 23 Cell SPU, 9568>18 leshort 24 cisco SVIP, 9569>18 leshort 25 cisco 7200, 9570>18 leshort 36 NEC V800 or cisco 12000, 9571>18 leshort 37 Fujitsu FR20, 9572>18 leshort 38 TRW RH-32, 9573>18 leshort 39 Motorola RCE, 9574>18 leshort 40 ARM, 9575>>4 byte 1 9576>>>36 lelong&0xff000000 0x04000000 EABI4 9577>>>36 lelong&0xff000000 0x05000000 EABI5 9578>>>36 lelong &0x00800000 BE8 9579>>>36 lelong &0x00400000 LE8 9580>18 leshort 41 Alpha, 9581>18 leshort 42 Renesas SH, 9582>18 leshort 43 SPARC V9, 9583>>4 byte 2 9584>>>48 use elf-sparc 9585>18 leshort 44 Siemens Tricore Embedded Processor, 9586>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., 9587>18 leshort 46 Renesas H8/300, 9588>18 leshort 47 Renesas H8/300H, 9589>18 leshort 48 Renesas H8S, 9590>18 leshort 49 Renesas H8/500, 9591>18 leshort 50 IA-64, 9592>18 leshort 51 Stanford MIPS-X, 9593>18 leshort 52 Motorola Coldfire, 9594>18 leshort 53 Motorola M68HC12, 9595>18 leshort 54 Fujitsu MMA, 9596>18 leshort 55 Siemens PCP, 9597>18 leshort 56 Sony nCPU, 9598>18 leshort 57 Denso NDR1, 9599>18 leshort 58 Start*Core, 9600>18 leshort 59 Toyota ME16, 9601>18 leshort 60 ST100, 9602>18 leshort 61 Tinyj emb., 9603>18 leshort 62 x86-64, 9604>18 leshort 63 Sony DSP, 9605>18 leshort 64 DEC PDP-10, 9606>18 leshort 65 DEC PDP-11, 9607>18 leshort 66 FX66, 9608>18 leshort 67 ST9+ 8/16 bit, 9609>18 leshort 68 ST7 8 bit, 9610>18 leshort 69 MC68HC16, 9611>18 leshort 70 MC68HC11, 9612>18 leshort 71 MC68HC08, 9613>18 leshort 72 MC68HC05, 9614>18 leshort 73 SGI SVx or Cray NV1, 9615>18 leshort 74 ST19 8 bit, 9616>18 leshort 75 Digital VAX, 9617>18 leshort 76 Axis cris, 9618>18 leshort 77 Infineon 32-bit embedded, 9619>18 leshort 78 Element 14 64-bit DSP, 9620>18 leshort 79 LSI Logic 16-bit DSP, 9621>18 leshort 80 MMIX, 9622>18 leshort 81 Harvard machine-independent, 9623>18 leshort 82 SiTera Prism, 9624>18 leshort 83 Atmel AVR 8-bit, 9625>18 leshort 84 Fujitsu FR30, 9626>18 leshort 85 Mitsubishi D10V, 9627>18 leshort 86 Mitsubishi D30V, 9628>18 leshort 87 NEC v850, 9629>18 leshort 88 Renesas M32R, 9630>18 leshort 89 Matsushita MN10300, 9631>18 leshort 90 Matsushita MN10200, 9632>18 leshort 91 picoJava, 9633>18 leshort 92 OpenRISC, 9634>18 leshort 93 ARC Cores Tangent-A5, 9635>18 leshort 94 Tensilica Xtensa, 9636>18 leshort 95 Alphamosaic VideoCore, 9637>18 leshort 96 Thompson Multimedia, 9638>18 leshort 97 NatSemi 32k, 9639>18 leshort 98 Tenor Network TPC, 9640>18 leshort 99 Trebia SNP 1000, 9641>18 leshort 100 STMicroelectronics ST200, 9642>18 leshort 101 Ubicom IP2022, 9643>18 leshort 102 MAX Processor, 9644>18 leshort 103 NatSemi CompactRISC, 9645>18 leshort 104 Fujitsu F2MC16, 9646>18 leshort 105 TI msp430, 9647>18 leshort 106 Analog Devices Blackfin, 9648>18 leshort 107 S1C33 Family of Seiko Epson, 9649>18 leshort 108 Sharp embedded, 9650>18 leshort 109 Arca RISC, 9651>18 leshort 110 PKU-Unity Ltd., 9652>18 leshort 111 eXcess: 16/32/64-bit, 9653>18 leshort 112 Icera Deep Execution Processor, 9654>18 leshort 113 Altera Nios II, 9655>18 leshort 114 NatSemi CRX, 9656>18 leshort 115 Motorola XGATE, 9657>18 leshort 116 Infineon C16x/XC16x, 9658>18 leshort 117 Renesas M16C series, 9659>18 leshort 118 Microchip dsPIC30F, 9660>18 leshort 119 Freescale RISC core, 9661>18 leshort 120 Renesas M32C series, 9662>18 leshort 131 Altium TSK3000 core, 9663>18 leshort 132 Freescale RS08, 9664>18 leshort 134 Cyan Technology eCOG2, 9665>18 leshort 135 Sunplus S+core7 RISC, 9666>18 leshort 136 New Japan Radio (NJR) 24-bit DSP, 9667>18 leshort 137 Broadcom VideoCore III, 9668>18 leshort 138 LatticeMico32, 9669>18 leshort 139 Seiko Epson C17 family, 9670>18 leshort 140 TI TMS320C6000 DSP family, 9671>18 leshort 141 TI TMS320C2000 DSP family, 9672>18 leshort 142 TI TMS320C55x DSP family, 9673>18 leshort 160 STMicroelectronics 64bit VLIW DSP, 9674>18 leshort 161 Cypress M8C, 9675>18 leshort 162 Renesas R32C series, 9676>18 leshort 163 NXP TriMedia family, 9677>18 leshort 164 QUALCOMM DSP6, 9678>18 leshort 165 Intel 8051 and variants, 9679>18 leshort 166 STMicroelectronics STxP7x family, 9680>18 leshort 167 Andes embedded RISC, 9681>18 leshort 168 Cyan eCOG1X family, 9682>18 leshort 169 Dallas MAXQ30, 9683>18 leshort 170 New Japan Radio (NJR) 16-bit DSP, 9684>18 leshort 171 M2000 Reconfigurable RISC, 9685>18 leshort 172 Cray NV2 vector architecture, 9686>18 leshort 173 Renesas RX family, 9687>18 leshort 174 META, 9688>18 leshort 175 MCST Elbrus, 9689>18 leshort 176 Cyan Technology eCOG16 family, 9690>18 leshort 177 NatSemi CompactRISC, 9691>18 leshort 178 Freescale Extended Time Processing Unit, 9692>18 leshort 179 Infineon SLE9X, 9693>18 leshort 180 Intel L1OM, 9694>18 leshort 181 Intel K1OM, 9695>18 leshort 183 ARM aarch64, 9696>18 leshort 185 Atmel 32-bit family, 9697>18 leshort 186 STMicroeletronics STM8 8-bit, 9698>18 leshort 187 Tilera TILE64, 9699>18 leshort 188 Tilera TILEPro, 9700>18 leshort 189 Xilinx MicroBlaze 32-bit RISC, 9701>18 leshort 190 NVIDIA CUDA architecture, 9702>18 leshort 191 Tilera TILE-Gx, 9703>18 leshort 197 Renesas RL78 family, 9704>18 leshort 199 Renesas 78K0R, 9705>18 leshort 200 Freescale 56800EX, 9706>18 leshort 201 Beyond BA1, 9707>18 leshort 202 Beyond BA2, 9708>18 leshort 203 XMOS xCORE, 9709>18 leshort 204 Microchip 8-bit PIC(r), 9710>18 leshort 210 KM211 KM32, 9711>18 leshort 211 KM211 KMX32, 9712>18 leshort 212 KM211 KMX16, 9713>18 leshort 213 KM211 KMX8, 9714>18 leshort 214 KM211 KVARC, 9715>18 leshort 215 Paneve CDP, 9716>18 leshort 216 Cognitive Smart Memory, 9717>18 leshort 217 iCelero CoolEngine, 9718>18 leshort 218 Nanoradio Optimized RISC, 9719>18 leshort 243 UCB RISC-V, 9720>18 leshort 247 eBPF, 9721>18 leshort 251 NEC VE, 9722>18 leshort 0x1057 AVR (unofficial), 9723>18 leshort 0x1059 MSP430 (unofficial), 9724>18 leshort 0x1223 Adapteva Epiphany (unofficial), 9725>18 leshort 0x2530 Morpho MT (unofficial), 9726>18 leshort 0x3330 FR30 (unofficial), 9727>18 leshort 0x3426 OpenRISC (obsolete), 9728>18 leshort 0x4688 Infineon C166 (unofficial), 9729>18 leshort 0x5441 Cygnus FRV (unofficial), 9730>18 leshort 0x5aa5 DLX (unofficial), 9731>18 leshort 0x7650 Cygnus D10V (unofficial), 9732>18 leshort 0x7676 Cygnus D30V (unofficial), 9733>18 leshort 0x8217 Ubicom IP2xxx (unofficial), 9734>18 leshort 0x8472 OpenRISC (obsolete), 9735>18 leshort 0x9025 Cygnus PowerPC (unofficial), 9736>18 leshort 0x9026 Alpha (unofficial), 9737>18 leshort 0x9041 Cygnus M32R (unofficial), 9738>18 leshort 0x9080 Cygnus V850 (unofficial), 9739>18 leshort 0xa390 IBM S/390 (obsolete), 9740>18 leshort 0xabc7 Old Xtensa (unofficial), 9741>18 leshort 0xad45 xstormy16 (unofficial), 9742>18 leshort 0xbaab Old MicroBlaze (unofficial),, 9743>18 leshort 0xbeef Cygnus MN10300 (unofficial), 9744>18 leshort 0xdead Cygnus MN10200 (unofficial), 9745>18 leshort 0xf00d Toshiba MeP (unofficial), 9746>18 leshort 0xfeb0 Renesas M32C (unofficial), 9747>18 leshort 0xfeba Vitesse IQ2000 (unofficial), 9748>18 leshort 0xfebb NIOS (unofficial), 9749>18 leshort 0xfeed Moxie (unofficial), 9750>18 default x 9751>>18 leshort x *unknown arch 0x%x* 9752>20 lelong 0 invalid version 9753>20 lelong 1 version 1 9754 97550 string \177ELF ELF 9756!:strength *2 9757>4 byte 0 invalid class 9758>4 byte 1 32-bit 9759>4 byte 2 64-bit 9760>5 byte 0 invalid byte order 9761>5 byte 1 LSB 9762>>0 use elf-le 9763>5 byte 2 MSB 9764>>0 use \^elf-le 9765>7 byte 0 (SYSV) 9766>7 byte 1 (HP-UX) 9767>7 byte 2 (NetBSD) 9768>7 byte 3 (GNU/Linux) 9769>7 byte 4 (GNU/Hurd) 9770>7 byte 5 (86Open) 9771>7 byte 6 (Solaris) 9772>7 byte 7 (Monterey) 9773>7 byte 8 (IRIX) 9774>7 byte 9 (FreeBSD) 9775>7 byte 10 (Tru64) 9776>7 byte 11 (Novell Modesto) 9777>7 byte 12 (OpenBSD) 9778>7 byte 13 (OpenVMS) 9779>7 byte 14 (HP NonStop Kernel) 9780>7 byte 15 (AROS Research Operating System) 9781>7 byte 16 (FenixOS) 9782>7 byte 17 (Nuxi CloudABI) 9783>7 byte 97 (ARM) 9784>7 byte 202 (Cafe OS) 9785>7 byte 255 (embedded) 9786 9787#------------------------------------------------------------------------------ 9788# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $ 9789# encore: file(1) magic for Encore machines 9790# 9791# XXX - needs to have the byte order specified (NS32K was little-endian, 9792# dunno whether they run the 88K in little-endian mode or not). 9793# 97940 short 0x154 Encore 9795>20 short 0x107 executable 9796>20 short 0x108 pure executable 9797>20 short 0x10b demand-paged executable 9798>20 short 0x10f unsupported executable 9799>12 long >0 not stripped 9800>22 short >0 - version %d 9801>22 short 0 - 9802#>4 date x stamp %s 98030 short 0x155 Encore unsupported executable 9804>12 long >0 not stripped 9805>22 short >0 - version %d 9806>22 short 0 - 9807#>4 date x stamp %s 9808 9809#------------------------------------------------------------------------------ 9810# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $ 9811# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] 9812# Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de> 9813# Useful information for improving this file can be found at: 9814# http://software.frodo.looijaard.name/psiconv/formats/Index.html 9815#------------------------------------------------------------------------------ 98160 lelong 0x10000037 Psion Series 5 9817>4 lelong 0x10000039 font file 9818>4 lelong 0x1000003A printer driver 9819>4 lelong 0x1000003B clipboard 9820>4 lelong 0x10000042 multi-bitmap image 9821!:mime image/x-epoc-mbm 9822>4 lelong 0x1000006A application information file 9823>4 lelong 0x1000006D 9824>>8 lelong 0x1000007D Sketch image 9825!:mime image/x-epoc-sketch 9826>>8 lelong 0x1000007E voice note 9827>>8 lelong 0x1000007F Word file 9828!:mime application/x-epoc-word 9829>>8 lelong 0x10000085 OPL program (TextEd) 9830!:mime application/x-epoc-opl 9831>>8 lelong 0x10000087 Comms settings 9832>>8 lelong 0x10000088 Sheet file 9833!:mime application/x-epoc-sheet 9834>>8 lelong 0x100001C4 EasyFax initialisation file 9835>4 lelong 0x10000073 OPO module 9836!:mime application/x-epoc-opo 9837>4 lelong 0x10000074 OPL application 9838!:mime application/x-epoc-app 9839>4 lelong 0x1000008A exported multi-bitmap image 9840>4 lelong 0x1000016D 9841>>8 lelong 0x10000087 Comms names 9842 98430 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image 9844 98450 lelong 0x10000050 Psion Series 5 9846>4 lelong 0x1000006D database 9847>>8 lelong 0x10000084 Agenda file 9848!:mime application/x-epoc-agenda 9849>>8 lelong 0x10000086 Data file 9850!:mime application/x-epoc-data 9851>>8 lelong 0x10000CEA Jotter file 9852!:mime application/x-epoc-jotter 9853>4 lelong 0x100000E4 ini file 9854 98550 lelong 0x10000079 Psion Series 5 binary: 9856>4 lelong 0x00000000 DLL 9857>4 lelong 0x10000049 comms hardware library 9858>4 lelong 0x1000004A comms protocol library 9859>4 lelong 0x1000005D OPX 9860>4 lelong 0x1000006C application 9861>4 lelong 0x1000008D DLL 9862>4 lelong 0x100000AC logical device driver 9863>4 lelong 0x100000AD physical device driver 9864>4 lelong 0x100000E5 file transfer protocol 9865>4 lelong 0x100000E5 file transfer protocol 9866>4 lelong 0x10000140 printer definition 9867>4 lelong 0x10000141 printer definition 9868 98690 lelong 0x1000007A Psion Series 5 executable 9870 9871#------------------------------------------------------------------------------ 9872# $File: erlang,v 1.7 2019/04/19 00:42:27 christos Exp $ 9873# erlang: file(1) magic for Erlang JAM and BEAM files 9874# URL: https://www.erlang.org/faq/x779.html#AEN812 9875 9876# OTP R3-R4 98770 string \0177BEAM! Old Erlang BEAM file 9878>6 short >0 - version %d 9879 9880# OTP R5 and onwards 98810 string FOR1 9882>8 string BEAM Erlang BEAM file 9883 9884# 4.2 version may have a copyright notice! 98854 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 988679 string Tue\ Jan\ 22\ 14:32:44\ MET\ 1991 Erlang JAM file - version 4.2 9887 98884 string 1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995 Erlang JAM file - version 4.3 9889 98900 bequad 0x0000000000ABCDEF Erlang DETS file 9891 9892# $File: espressif,v 1.1 2018/11/20 18:57:17 christos Exp $ 9893# configuration dump of Tasmota firmware for ESP8266 based devices by Espressif 9894# URL: https://github.com/arendst/Sonoff-Tasmota/ 9895# Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/ 9896# Sonoff-Tasmota-release-6.2.zip/Sonoff-Tasmota-release-6.2/sonoff/settings.h 9897# From: Joerg Jenderek 9898# 9899# cfg_holder=4617=0x1209 99000 uleshort 4617 9901# remainig settings normally 0x5A+offset XORed; free_1D5[20] empty since 5.12.0e 9902>0x1D5 ubequad 0x2f30313233343536 configuration of Tasmota firmware (ESP8266) 9903!:mime application/x-tasmota-dmp 9904!:ext dmp 9905# version like 6.2.1.0 ~ 0x06020100 XORed to 0x63666262 9906>>11 ubyte^0x65 x \b, version %u 9907>>10 ubyte^0x64 x \b.%u 9908>>9 ubyte^0x63 x \b.%u 9909>>8 ubyte^0x62 x \b.%u 9910#>8 ubelong x (0x%x) 9911# hostname[33] XORed 9912>>0x165 ubyte^0x1BF x \b, hostname %c 9913>>0x166 ubyte^0x1C0 >037 \b%c 9914>>0x167 ubyte^0x1C1 >037 \b%c 9915>>0x168 ubyte^0x1C2 >037 \b%c 9916>>0x169 ubyte^0x1C3 >037 \b%c 9917>>0x16A ubyte^0x1C4 >037 \b%c 9918>>0x16B ubyte^0x1C5 >037 \b%c 9919>>0x16C ubyte^0x1C6 >037 \b%c 9920>>0x16D ubyte^0x1C7 >037 \b%c 9921>>0x16E ubyte^0x1C8 >037 \b%c 9922>>0x16F ubyte^0x1C9 >037 \b%c 9923>>0x170 ubyte^0x1CA >037 \b%c 9924>>0x171 ubyte^0x1CB >037 \b%c 9925>>0x172 ubyte^0x1CC >037 \b%c 9926>>0x173 ubyte^0x1CD >037 \b%c 9927>>0x174 ubyte^0x1CE >037 \b%c 9928>>0x175 ubyte^0x1CF >037 \b%c 9929>>0x176 ubyte^0x1D0 >037 \b%c 9930>>0x177 ubyte^0x1D1 >037 \b%c 9931>>0x178 ubyte^0x1D2 >037 \b%c 9932>>0x179 ubyte^0x1D3 >037 \b%c 9933>>0x17A ubyte^0x1D4 >037 \b%c 9934>>0x17B ubyte^0x1D5 >037 \b%c 9935>>0x17C ubyte^0x1D6 >037 \b%c 9936>>0x17D ubyte^0x1D7 >037 \b%c 9937>>0x17E ubyte^0x1D8 >037 \b%c 9938>>0x17F ubyte^0x1D9 >037 \b%c 9939>>0x180 ubyte^0x1DA >037 \b%c 9940>>0x181 ubyte^0x1DB >037 \b%c 9941>>0x182 ubyte^0x1DC >037 \b%c 9942>>0x183 ubyte^0x1DD >037 \b%c 9943>>0x184 ubyte^0x1DE >037 \b%c 9944>>0x185 ubyte^0x1DF >037 \b%c 9945#>>0x165 string x (%.33s) 9946 9947 9948 9949#------------------------------------------------------------------------------ 9950# $File: esri,v 1.5 2019/04/19 00:42:27 christos Exp $ 9951# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) 9952# Based on info from 9953# <URL:https://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> 99540 belong 9994 ESRI Shapefile 9955>4 belong =0 9956>8 belong =0 9957>12 belong =0 9958>16 belong =0 9959>20 belong =0 9960>28 lelong x version %d 9961>24 belong x length %d 9962>32 lelong =0 type Null Shape 9963>32 lelong =1 type Point 9964>32 lelong =3 type PolyLine 9965>32 lelong =5 type Polygon 9966>32 lelong =8 type MultiPoint 9967>32 lelong =11 type PointZ 9968>32 lelong =13 type PolyLineZ 9969>32 lelong =15 type PolygonZ 9970>32 lelong =18 type MultiPointZ 9971>32 lelong =21 type PointM 9972>32 lelong =23 type PolyLineM 9973>32 lelong =25 type PolygonM 9974>32 lelong =28 type MultiPointM 9975>32 lelong =31 type MultiPatch 9976 9977#------------------------------------------------------------------------------ 9978# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $ 9979# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files 9980# From Roger Leigh <roger@whinlatter.uklinux.net> 99810 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0 99820 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0 99830 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0 9984 9985#------------------------------------------------------------------------------ 9986# $File: filesystems,v 1.128 2019/04/23 15:43:27 christos Exp $ 9987# filesystems: file(1) magic for different filesystems 9988# 99890 name partid 9990>0 ubyte 0x00 Unused 9991>0 ubyte 0x01 12-bit FAT 9992>0 ubyte 0x02 XENIX / 9993>0 ubyte 0x03 XENIX /usr 9994>0 ubyte 0x04 16-bit FAT, less than 32M 9995>0 ubyte 0x05 extended partition 9996>0 ubyte 0x06 16-bit FAT, more than 32M 9997>0 ubyte 0x07 OS/2 HPFS, NTFS, QNX2, Adv. UNIX 9998>0 ubyte 0x08 AIX or os, or etc. 9999>0 ubyte 0x09 AIX boot partition or Coherent 10000>0 ubyte 0x0a O/2 boot manager or Coherent swap 10001>0 ubyte 0x0b 32-bit FAT 10002>0 ubyte 0x0c 32-bit FAT, LBA-mapped 10003>0 ubyte 0x0d 7XXX, LBA-mapped 10004>0 ubyte 0x0e 16-bit FAT, LBA-mapped 10005>0 ubyte 0x0f extended partition, LBA-mapped 10006>0 ubyte 0x10 OPUS 10007>0 ubyte 0x11 OS/2 DOS 12-bit FAT 10008>0 ubyte 0x12 Compaq diagnostics 10009>0 ubyte 0x14 OS/2 DOS 16-bit FAT <32M 10010>0 ubyte 0x16 OS/2 DOS 16-bit FAT >=32M 10011>0 ubyte 0x17 OS/2 hidden IFS 10012>0 ubyte 0x18 AST Windows swapfile 10013>0 ubyte 0x19 Willowtech Photon coS 10014>0 ubyte 0x1b hidden win95 fat 32 10015>0 ubyte 0x1c hidden win95 fat 32 lba 10016>0 ubyte 0x1d hidden win95 fat 16 lba 10017>0 ubyte 0x20 Willowsoft OFS1 10018>0 ubyte 0x21 reserved 10019>0 ubyte 0x23 reserved 10020>0 ubyte 0x24 NEC DOS 10021>0 ubyte 0x26 reserved 10022>0 ubyte 0x31 reserved 10023>0 ubyte 0x32 Alien Internet Services NOS 10024>0 ubyte 0x33 reserved 10025>0 ubyte 0x34 reserved 10026>0 ubyte 0x35 JFS on OS2 10027>0 ubyte 0x36 reserved 10028>0 ubyte 0x38 Theos 10029>0 ubyte 0x39 Plan 9, or Theos spanned 10030>0 ubyte 0x3a Theos ver 4 4gb partition 10031>0 ubyte 0x3b Theos ve 4 extended partition 10032>0 ubyte 0x3c PartitionMagic recovery 10033>0 ubyte 0x3d Hidden Netware 10034>0 ubyte 0x40 VENIX 286 or LynxOS 10035>0 ubyte 0x41 PReP 10036>0 ubyte 0x42 linux swap sharing DRDOS disk 10037>0 ubyte 0x43 linux sharing DRDOS disk 10038>0 ubyte 0x44 GoBack change utility 10039>0 ubyte 0x45 Boot US Boot manager 10040>0 ubyte 0x46 EUMEL/Elan or Ergos 3 10041>0 ubyte 0x47 EUMEL/Elan or Ergos 3 10042>0 ubyte 0x48 EUMEL/Elan or Ergos 3 10043>0 ubyte 0x4a ALFX/THIN filesystem for DOS 10044>0 ubyte 0x4c Oberon partition 10045>0 ubyte 0x4d QNX4.x 10046>0 ubyte 0x4e QNX4.x 2nd part 10047>0 ubyte 0x4f QNX4.x 3rd part 10048>0 ubyte 0x50 DM (disk manager) 10049>0 ubyte 0x51 DM6 Aux1 (or Novell) 10050>0 ubyte 0x52 CP/M or Microport SysV/AT 10051>0 ubyte 0x53 DM6 Aux3 10052>0 ubyte 0x54 DM6 DDO 10053>0 ubyte 0x55 EZ-Drive (disk manager) 10054>0 ubyte 0x56 Golden Bow (disk manager) 10055>0 ubyte 0x57 Drive PRO 10056>0 ubyte 0x5c Priam Edisk (disk manager) 10057>0 ubyte 0x61 SpeedStor 10058>0 ubyte 0x63 GNU HURD or Mach or Sys V/386 10059>0 ubyte 0x64 Novell Netware 2.xx or Speedstore 10060>0 ubyte 0x65 Novell Netware 3.xx 10061>0 ubyte 0x66 Novell 386 Netware 10062>0 ubyte 0x67 Novell 10063>0 ubyte 0x68 Novell 10064>0 ubyte 0x69 Novell 10065>0 ubyte 0x70 DiskSecure Multi-Boot 10066>0 ubyte 0x71 reserved 10067>0 ubyte 0x73 reserved 10068>0 ubyte 0x74 reserved 10069>0 ubyte 0x75 PC/IX 10070>0 ubyte 0x76 reserved 10071>0 ubyte 0x77 M2FS/M2CS partition 10072>0 ubyte 0x78 XOSL boot loader filesystem 10073>0 ubyte 0x80 MINIX until 1.4a 10074>0 ubyte 0x81 MINIX since 1.4b 10075>0 ubyte 0x82 Linux swap or Solaris 10076>0 ubyte 0x83 Linux native 10077>0 ubyte 0x84 OS/2 hidden C: drive 10078>0 ubyte 0x85 Linux extended partition 10079>0 ubyte 0x86 NT FAT volume set 10080>0 ubyte 0x87 NTFS volume set or HPFS mirrored 10081>0 ubyte 0x8a Linux Kernel AiR-BOOT partition 10082>0 ubyte 0x8b Legacy Fault tolerant FAT32 10083>0 ubyte 0x8c Legacy Fault tolerant FAT32 ext 10084>0 ubyte 0x8d Hidden free FDISK FAT12 10085>0 ubyte 0x8e Linux Logical Volume Manager 10086>0 ubyte 0x90 Hidden free FDISK FAT16 10087>0 ubyte 0x91 Hidden free FDISK DOS EXT 10088>0 ubyte 0x92 Hidden free FDISK FAT16 Big 10089>0 ubyte 0x93 Amoeba filesystem 10090>0 ubyte 0x94 Amoeba bad block table 10091>0 ubyte 0x95 MIT EXOPC native partitions 10092>0 ubyte 0x97 Hidden free FDISK FAT32 10093>0 ubyte 0x98 Datalight ROM-DOS Super-Boot 10094>0 ubyte 0x99 Mylex EISA SCSI 10095>0 ubyte 0x9a Hidden free FDISK FAT16 LBA 10096>0 ubyte 0x9b Hidden free FDISK EXT LBA 10097>0 ubyte 0x9f BSDI? 10098>0 ubyte 0xa0 IBM Thinkpad hibernation 10099>0 ubyte 0xa1 HP Volume expansion (SpeedStor) 10100>0 ubyte 0xa3 HP Volume expansion (SpeedStor) 10101>0 ubyte 0xa4 HP Volume expansion (SpeedStor) 10102>0 ubyte 0xa5 386BSD partition type 10103>0 ubyte 0xa6 OpenBSD partition type 10104>0 ubyte 0xa7 NeXTSTEP 486 10105>0 ubyte 0xa8 Apple UFS 10106>0 ubyte 0xa9 NetBSD partition type 10107>0 ubyte 0xaa Olivetty Fat12 1.44MB Service part 10108>0 ubyte 0xab Apple Boot 10109>0 ubyte 0xae SHAG OS filesystem 10110>0 ubyte 0xaf Apple HFS 10111>0 ubyte 0xb0 BootStar Dummy 10112>0 ubyte 0xb1 reserved 10113>0 ubyte 0xb3 reserved 10114>0 ubyte 0xb4 reserved 10115>0 ubyte 0xb6 reserved 10116>0 ubyte 0xb7 BSDI BSD/386 filesystem 10117>0 ubyte 0xb8 BSDI BSD/386 swap 10118>0 ubyte 0xbb Boot Wizard Hidden 10119>0 ubyte 0xbe Solaris 8 partition type 10120>0 ubyte 0xbf Solaris partition type 10121>0 ubyte 0xc0 CTOS 10122>0 ubyte 0xc1 DRDOS/sec (FAT-12) 10123>0 ubyte 0xc2 Hidden Linux 10124>0 ubyte 0xc3 Hidden Linux swap 10125>0 ubyte 0xc4 DRDOS/sec (FAT-16, < 32M) 10126>0 ubyte 0xc5 DRDOS/sec (EXT) 10127>0 ubyte 0xc6 DRDOS/sec (FAT-16, >= 32M) 10128>0 ubyte 0xc7 Syrinx (Cyrnix?) or HPFS disabled 10129>0 ubyte 0xc8 Reserved for DR-DOS 8.0+ 10130>0 ubyte 0xc9 Reserved for DR-DOS 8.0+ 10131>0 ubyte 0xca Reserved for DR-DOS 8.0+ 10132>0 ubyte 0xcb DR-DOS 7.04+ Secured FAT32 CHS 10133>0 ubyte 0xcc DR-DOS 7.04+ Secured FAT32 LBA 10134>0 ubyte 0xcd CTOS Memdump 10135>0 ubyte 0xce DR-DOS 7.04+ FAT16X LBA 10136>0 ubyte 0xcf DR-DOS 7.04+ EXT LBA 10137>0 ubyte 0xd0 REAL/32 secure big partition 10138>0 ubyte 0xd1 Old Multiuser DOS FAT12 10139>0 ubyte 0xd4 Old Multiuser DOS FAT16 Small 10140>0 ubyte 0xd5 Old Multiuser DOS Extended 10141>0 ubyte 0xd6 Old Multiuser DOS FAT16 Big 10142>0 ubyte 0xd8 CP/M 86 10143>0 ubyte 0xdb CP/M or Concurrent CP/M 10144>0 ubyte 0xdd Hidden CTOS Memdump 10145>0 ubyte 0xde Dell PowerEdge Server utilities 10146>0 ubyte 0xdf DG/UX virtual disk manager 10147>0 ubyte 0xe0 STMicroelectronics ST AVFS 10148>0 ubyte 0xe1 DOS access or SpeedStor 12-bit 10149>0 ubyte 0xe3 DOS R/O or Storage Dimensions 10150>0 ubyte 0xe4 SpeedStor 16-bit FAT < 1024 cyl. 10151>0 ubyte 0xe5 reserved 10152>0 ubyte 0xe6 reserved 10153>0 ubyte 0xeb BeOS 10154>0 ubyte 0xee GPT Protective MBR 10155>0 ubyte 0xef EFI system partition 10156>0 ubyte 0xf0 Linux PA-RISC boot loader 10157>0 ubyte 0xf1 SpeedStor or Storage Dimensions 10158>0 ubyte 0xf2 DOS 3.3+ Secondary 10159>0 ubyte 0xf3 reserved 10160>0 ubyte 0xf4 SpeedStor large partition 10161>0 ubyte 0xf5 Prologue multi-volumen partition 10162>0 ubyte 0xf6 reserved 10163>0 ubyte 0xf9 pCache: ext2/ext3 persistent cache 10164>0 ubyte 0xfa Bochs x86 emulator 10165>0 ubyte 0xfb VMware File System 10166>0 ubyte 0xfc VMware Swap 10167>0 ubyte 0xfd Linux RAID partition persistent sb 10168>0 ubyte 0xfe LANstep or IBM PS/2 IML 10169>0 ubyte 0xff Xenix Bad Block Table 10170 101710 string \366\366\366\366 PC formatted floppy with no filesystem 10172# Sun disk labels 10173# From /usr/include/sun/dklabel.h: 101740774 beshort 0xdabe 10175# modified by Joerg Jenderek, because original test 10176# succeeds for Cabinet archive dao360.dl_ with negative blocks 10177>0770 long >0 Sun disk label 10178>>0 string x '%s 10179>>>31 string >\0 \b%s 10180>>>>63 string >\0 \b%s 10181>>>>>95 string >\0 \b%s 10182>>0 string x \b' 10183>>0734 short >0 %d rpm, 10184>>0736 short >0 %d phys cys, 10185>>0740 short >0 %d alts/cyl, 10186>>0746 short >0 %d interleave, 10187>>0750 short >0 %d data cyls, 10188>>0752 short >0 %d alt cyls, 10189>>0754 short >0 %d heads/partition, 10190>>0756 short >0 %d sectors/track, 10191>>0764 long >0 start cyl %d, 10192>>0770 long x %d blocks 10193# Is there a boot block written 1 sector in? 10194>512 belong&077777777 0600407 \b, boot block present 10195 10196# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk 10197# (http://btmgr.sourceforge.net/docs/user-guide-3.html) 101980 string SBMBAKUP_ Smart Boot Manager backup file 10199>9 string x \b, version %-5.5s 10200>>14 string =_ 10201>>>15 string x %-.1s 10202>>>>16 string =_ \b. 10203>>>>>17 string x \b%-.1s 10204>>>>>>18 string =_ \b. 10205>>>>>>>19 string x \b%-.1s 10206>>>22 ubyte 0 10207>>>>21 ubyte x \b, from drive 0x%x 10208>>>22 ubyte >0 10209>>>>21 string x \b, from drive %s 10210>>>535 search/17 \x55\xAA 10211>>>>&-512 indirect x \b; contains 10212 10213# updated by Joerg Jenderek at Nov 2012 10214# DOS Emulator image is 128 byte, null right padded header + harddisc image 102150 string DOSEMU\0 10216>0x27E leshort 0xAA55 10217#offset is 128 10218>>19 ubyte 128 10219>>>(19.b-1) ubyte 0x0 DOS Emulator image 10220>>>>7 ulelong >0 \b, %u heads 10221>>>>11 ulelong >0 \b, %d sectors/track 10222>>>>15 ulelong >0 \b, %d cylinders 10223>>>>128 indirect x \b; contains 10224 10225# added by Joerg Jenderek at Nov 2012 10226# http://www.thenakedpc.com/articles/v04/08/0408-05.html 10227# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data 102280 string PNCIHISK\0 Norton Utilities disc image data 10229# real x86 boot sector with jump instruction 10230>509 search/1026 \x55\xAA\xeb 10231>>&-1 indirect x \b; contains 10232# http://file-extension.net/seeker/file_extension_dat 102330 string PNCIUNDO Norton Disk Doctor UnDo file 10234# 10235 10236# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013 10237# for any allowed sector sizes 1023830 search/481 \x55\xAA 10239# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111) 10240# DOS BPB information (70) and after DOS floppy (120) like in previous file version 10241!:strength +65 10242# for sector sizes < 512 Bytes 10243>11 uleshort <512 10244>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector 10245# for sector sizes with 512 or more Bytes 10246>0x1FE leshort 0xAA55 DOS/MBR boot sector 10247 10248# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying 10249# only for sector sizes with 512 or more Bytes 102500x1FE leshort 0xAA55 DOS/MBR boot sector 10251# 10252# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version 10253!:strength +65 10254>2 string OSBS OS/BS MBR 10255# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/ 10256# and https://en.wikipedia.org/wiki/Master_Boot_Record 10257# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by 10258# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00 10259>0 search/2 \x33\xc0\x8e\xd0\xbc\x00\x7c MS-MBR 10260# Microsoft Windows 95A and early ( https://thestarman.pcministry.com/asm/mbr/STDMBR.htm ) 10261# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld 10262>>8 ubequad 0x8bf45007501ffbfc 10263# https://thestarman.pcministry.com/asm/mbr/200MBR.htm 10264>>>0x16 ubyte 0xF3 \b,DOS 2 10265>>>>219 regex Author\ -\ Author: 10266# found "David Litton" , "A Pehrsson " 10267>>>>>&0 string x "%s" 10268>>>0x16 ubyte 0xF2 10269# NEC MS-DOS 3.30 Rev. 3 . See https://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm 10270# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz 10271>>>>0x22 ubequad 0xbf7c07813d5aa575 \b,NEC 3.3 10272# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111) 10273>>>>0x22 default x \b,D0S version 3.3-7.0 10274# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...) 10275# where nn is string offset varying for different languages 10276# "Invalid partition table" nn=0x8b for english version 10277>>>>>(0x49.b) string Invalid\ partition\ table english 10278>>>>>(0x49.b) string Ung\201ltige\ Partitionstabelle german 10279>>>>>(0x49.b) string Table\ de\ partition\ invalide french 10280>>>>>(0x49.b) string Tabela\ de\ parti\207ao\ inv\240lida portuguese 10281>>>>>(0x49.b) string Tabla\ de\ partici\242n\ no\ v\240lida spanish 10282>>>>>(0x49.b) string Tavola\ delle\ partizioni\ non\ valida italian 10283>>>>>0x49 ubyte >0 at offset 0x%x 10284>>>>>>(0x49.b) string >\0 "%s" 10285# "Error loading operating system" nn=0xa3 for english version 10286# "Fehler beim Laden des Betriebssystems" nn=0xa7 for german version 10287# "Erreur en chargeant syst\212me d'exploitation" nn=0xa7 for french version 10288# "Erro na inicializa\207ao do sistema operacional" nn=0xa7 for portuguese Brazilian version 10289# "Error al cargar sistema operativo" nn=0xa8 for spanish version 10290# "Errore durante il caricamento del sistema operativo" nn=0xae for italian version 10291>>>>>0x74 ubyte >0 at offset 0x%x 10292>>>>>>(0x74.b) string >\0 "%s" 10293# "Missing operating system" nn=0xc2 for english version 10294# "Betriebssystem fehlt" nn=0xcd for german version 10295# "Syst\212me d'exploitation absent" nn=0xd2 for french version 10296# "Sistema operacional nao encontrado" nn=0xd4 for portuguese Brazilian version 10297# "Falta sistema operativo" nn=0xca for spanish version 10298# "Sistema operativo mancante" nn=0xe2 for italian version 10299>>>>>0x79 ubyte >0 at offset 0x%x 10300>>>>>>(0x79.b) string >\0 "%s" 10301# Microsoft Windows 95B to XP (https://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm) 10302# assembler instructions: push ax;pop es;push ax;pop ds;cld;mov si,7c1b 10303>>8 ubequad 0x5007501ffcbe1b7c 10304# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04 10305>>>24 ubequad 0xf3a4cbbebe07b104 9M 10306# "Invalid partition table" nn=0x10F for english version 10307# "Ung\201ltige Partitionstabelle" nn=0x10F for german version 10308# "Table de partition erron\202e" nn=0x10F for french version 10309# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x10F for russian version 10310>>>>(0x3C.b+0x0FF) string Invalid\ partition\ table english 10311>>>>(0x3C.b+0x0FF) string Ung\201ltige\ Partitionstabelle german 10312>>>>(0x3C.b+0x0FF) string Table\ de\ partition\ erron\202e french 10313>>>>(0x3C.b+0x0FF) string \215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240 russian 10314>>>>0x3C ubyte x at offset 0x%x+0xFF 10315>>>>(0x3C.b+0x0FF) string >\0 "%s" 10316# "Error loading operating system" nn=0x127 for english version 10317# "Fehler beim Laden des Betriebssystems" nn=0x12b for german version 10318# "Erreur lors du chargement du syst\212me d'exploitation" nn=0x12a for french version 10319# "\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353" nn=0x12d for russian version 10320>>>>0xBD ubyte x at offset 0x1%x 10321>>>>(0xBD.b+0x100) string >\0 "%s" 10322# "Missing operating system" nn=0x146 for english version 10323# "Betriebssystem fehlt" nn=0x151 for german version 10324# "Syst\212me d'exploitation manquant" nn=0x15e for french version 10325# "\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240" nn=0x156 for russian version 10326>>>>0xA9 ubyte x at offset 0x1%x 10327>>>>(0xA9.b+0x100) string >\0 "%s" 10328# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm 10329# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04 10330>>>24 ubequad 0xf3a4cbbdbe07b104 XP 10331# where xxyyzz are lower bits from offsets of error messages varying for different languages 10332>>>>0x1B4 ubelong&0x00FFFFFF 0x002c4463 english 10333>>>>0x1B4 ubelong&0x00FFFFFF 0x002c486e german 10334# "Invalid partition table" xx=0x12C for english version 10335# "Ung\201ltige Partitionstabelle" xx=0x12C for german version 10336>>>>0x1b5 ubyte >0 at offset 0x1%x 10337>>>>(0x1b5.b+0x100) string >\0 "%s" 10338# "Error loading operating system" yy=0x144 for english version 10339# "Fehler beim Laden des Betriebssystems" yy=0x148 for german version 10340>>>>0x1b6 ubyte >0 at offset 0x1%x 10341>>>>(0x1b6.b+0x100) string >\0 "%s" 10342# "Missing operating system" zz=0x163 for english version 10343# "Betriebssystem nicht vorhanden" zz=0x16e for german version 10344>>>>0x1b7 ubyte >0 at offset 0x1%x 10345>>>>(0x1b7.b+0x100) string >\0 "%s" 10346# Microsoft Windows Vista or 7 10347# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00 10348>>8 ubequad 0xc08ed8be007cbf00 10349# Microsoft Windows Vista (https://thestarman.pcministry.com/asm/mbr/VistaMBR.htm) 10350# assembler instructions: jnz 0729;cmp ebx,"TCPA" 10351>>>0xEC ubequad 0x753b6681fb544350 Vista 10352# where xxyyzz are lower bits from offsets of error messages varying for different languages 10353>>>>0x1B4 ubelong&0x00FFFFFF 0x00627a99 english 10354#>>>>0x1B4 ubelong&0x00FFFFFF ? german 10355# "Invalid partition table" xx=0x162 for english version 10356# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 10357>>>>0x1b5 ubyte >0 at offset 0x1%x 10358>>>>(0x1b5.b+0x100) string >\0 "%s" 10359# "Error loading operating system" yy=0x17a for english version 10360# "Fehler beim Laden des Betriebssystems" yy= 0x1?? for german version 10361>>>>0x1b6 ubyte >0 at offset 0x1%x 10362>>>>(0x1b6.b+0x100) string >\0 "%s" 10363# "Missing operating system" zz=0x199 for english version 10364# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 10365>>>>0x1b7 ubyte >0 at offset 0x1%x 10366>>>>(0x1b7.b+0x100) string >\0 "%s" 10367# Microsoft Windows 7 (https://thestarman.pcministry.com/asm/mbr/W7MBR.htm) 10368# assembler instructions: cmp ebx,"TCPA";cmp 10369>>>0xEC ubequad 0x6681fb5443504175 Windows 7 10370# where xxyyzz are lower bits from offsets of error messages varying for different languages 10371>>>>0x1B4 ubelong&0x00FFFFFF 0x00637b9a english 10372#>>>>0x1B4 ubelong&0x00FFFFFF ? german 10373# "Invalid partition table" xx=0x163 for english version 10374# "Ung\201ltige Partitionstabelle" xx=0x1?? for german version 10375>>>>0x1b5 ubyte >0 at offset 0x1%x 10376>>>>(0x1b5.b+0x100) string >\0 "%s" 10377# "Error loading operating system" yy=0x17b for english version 10378# "Fehler beim Laden des Betriebssystems" yy=0x1?? for german version 10379>>>>0x1b6 ubyte >0 at offset 0x1%x 10380>>>>(0x1b6.b+0x100) string >\0 "%s" 10381# "Missing operating system" zz=0x19a for english version 10382# "Betriebssystem nicht vorhanden" zz=0x1?? for german version 10383>>>>0x1b7 ubyte >0 at offset 0x1%x 10384>>>>(0x1b7.b+0x100) string >\0 "%s" 10385# https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs 10386# https://en.wikipedia.org/wiki/MBR_disk_signature#ID 10387>>0x1b8 ulelong >0 \b, disk signature 0x%-.4x 10388# driveID/timestamp for Win 95B,98,98SE and ME. See https://thestarman.pcministry.com/asm/mbr/mystery.htm 10389>>0xDA uleshort 0 10390>>>0xDC ulelong >0 \b, created 10391# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive 10392>>>>0xDC ubyte x with driveID 0x%x 10393# hours, minutes and seconds 10394>>>>0xDf ubyte x at %x 10395>>>>0xDe ubyte x \b:%x 10396>>>>0xDd ubyte x \b:%x 10397# special case for Microsoft MS-DOS 3.21 spanish 10398# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov 10399>0 ubequad 0xfab830008ed0bc00 10400# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov 10401>>8 ubequad 0x1fbfcb800008ed8 MS-MBR,D0S version 3.21 spanish 10402# Microsoft MBR IPL end 10403 10404# dr-dos with some upper-, lowercase variants 10405>0x9D string Invalid\ partition\ table$ 10406>>181 string No\ Operating\ System$ 10407>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 10408>0x9D string Invalid\ partition\ table$ 10409>>181 string No\ operating\ system$ 10410>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 10411>342 string Invalid\ partition\ table$ 10412>>366 string No\ operating\ system$ 10413>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 10414>295 string NEWLDR\0 10415>>302 string Bad\ PT\ $ 10416>>>310 string No\ OS\ $ 10417>>>>317 string OS\ load\ err$ 10418>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r 10419>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ 10420>>>>>>>387 string Copyright\ (c)\ 1984,1998 10421>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) 10422# 10423# tests for different MS-DOS Master Boot Records (MBR) moved and merged 10424# 10425#>0x145 string Default:\ F \b, FREE-DOS MBR 10426#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR 10427>0x145 search/7 Default:\ F \b, FREE-DOS MBR 10428#>>313 string F0\ .\ .\ . 10429#>>>322 string disk\ 1 10430#>>>>382 string FAT3 10431>64 string no\ active\ partition\ found 10432>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR 10433# Ranish Partition Manager http://www.ranish.com/part/ 10434>387 search/4 \0\ Error!\r 10435>>378 search/7 Virus! 10436>>>397 search/4 Booting\040 10437>>>>408 search/4 HD1/\0 \b, Ranish MBR ( 10438>>>>>416 string Writing\ changes... \b2.37 10439>>>>>>438 ubyte x \b,0x%x dots 10440>>>>>>440 ubyte >0 \b,virus check 10441>>>>>>441 ubyte >0 \b,partition %c 10442#2.38,2.42,2.44 10443>>>>>416 string !Writing\ changes... \b 10444>>>>>>418 ubyte 1 \bvirus check, 10445>>>>>>419 ubyte x \b0x%x seconds 10446>>>>>>420 ubyte&0x0F >0 \b,partition 10447>>>>>>>420 ubyte&0x0F <5 \b %x 10448>>>>>>>420 ubyte&0x0F 0Xf \b ask 10449>>>>>420 ubyte x \b) 10450# 10451# SYSLINUX MBR moved 10452# https://www.acronis.de/ 10453>362 string MBR\ Error\ \0\r 10454>>376 string ress\ any\ key\ to\040 10455>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR 10456# added by Joerg Jenderek 10457# https://www.visopsys.org/ 10458# https://partitionlogic.org.uk/ 10459>309 string No\ bootable\ partition\ found\r 10460>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR 10461>349 string No\ bootable\ partition\ found\r 10462>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR 10463# bootloader, bootmanager 10464>0x40 string SBML 10465# label with 11 characters of FAT 12 bit filesystem 10466>>43 string SMART\ BTMGR 10467>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager 10468# OEM-ID not always "SBM" 10469#>>>>3 strings SBM 10470>>>>6 string >\0 \b, version %s 10471>382 string XOSLLOADXCF \b, eXtended Operating System Loader 10472>6 string LILO \b, LInux i386 boot LOader 10473>>120 string LILO \b, version 22.3.4 SuSe 10474>>172 string LILO \b, version 22.5.8 Debian 10475# updated by Joerg Jenderek at Oct 2008 10476# variables according to grub-0.97/stage1/stage1.S or 10477# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 10478# usual values are marked with comments to get only informations of strange GRUB loaders 10479>342 search/60 \0Geom\0 10480#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 10481>>0x41 ubyte <2 10482>>>0x3E ubyte >2 \b; GRand Unified Bootloader 10483# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 10484>>>>0x3E ubyte x \b, stage1 version 0x%x 10485#If it is 0xFF, use a drive passed by BIOS 10486>>>>0x40 ubyte <0xFF \b, boot drive 0x%x 10487# in most case 0,1,0x2e for GRUB 0.5.95 10488>>>>0x41 ubyte >0 \b, LBA flag 0x%x 10489>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x 10490#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) 10491>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x 10492#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) 10493>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x 10494>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x 10495#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) 10496>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x 10497>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 10498>>>>>394 string stage1 \b, GRUB version 0.5.95 10499>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 10500>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 10501>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 10502>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 10503>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 10504>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 10505>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 10506>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 10507# unknown version 10508>>>343 string Geom\0Read\0\ Error\0 10509>>>>321 string Loading\ stage1.5 \b, GRUB version x.y 10510>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 10511>>>>374 string GRUB\ \0 \b, GRUB version n.m 10512# SYSLINUX bootloader moved 10513>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader 10514# http://www.bcdwb.de/bcdw/index_e.htm 10515>3 string BCDL 10516>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) 10517# mbr partition table entries updated by Joerg Jenderek at Sep 2013 10518# skip Norton Utilities disc image data 10519>3 string !IHISK 10520# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax; 10521>>0 belong !0xb8c0078e 10522# not Linux kernel 10523>>>514 string !HdrS 10524# not BeOS 10525>>>>422 string !Be\ Boot\ Loader 10526# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr 10527>>>>>0 ubelong&0xFD000000 =0xE9000000 10528# AdvanceMAME mbr 10529>>>>>>(1.b+2) ubequad 0xfa31c08ed88ec08e 10530>>>>>>>446 use partition-table 10531# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader 10532>>>>>0 ubelong&0xFD000000 !0xE9000000 10533# skip FSInfosector 10534>>>>>>0 string !RRaA 10535# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX, 10536# https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm 10537>>>>>>>0 ubequad !0xfa660fb64610668b 10538# skip 13rd sector of MS x86 bootloader 10539>>>>>>>>0 ubequad !0x660fb64610668b4e 10540# skip sector starting with DOS new line 10541>>>>>>>>>0 string !\r\n 10542# allowed active flag 0,80h-FFh 10543>>>>>>>>>>446 ubyte 0 10544>>>>>>>>>>>446 use partition-table 10545>>>>>>>>>>446 ubyte >0x7F 10546>>>>>>>>>>>446 use partition-table 10547# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries 10548# mbr partition table entries end 10549# https://www.acronis.de/ 10550#FAT label=ACRONIS\ SZ 10551#OEM-ID=BOOTWIZ0 10552>442 string Non-system\ disk,\040 10553>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader 10554# updated by Joerg Jenderek at Nov 2012, Sep 2013 10555# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes 10556# display 1 space 10557>>>447 ubyte x \b 10558>>>477 use DOS-filename 10559# 10560>185 string FDBOOT\ Version\040 10561>>204 string \rNo\ Systemdisk.\040 10562>>>220 string Booting\ from\ harddisk.\n\r 10563>>>245 string Cannot\ load\ from\ harddisk.\n\r 10564>>>>273 string Insert\ Systemdisk\040 10565>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader 10566>>>>>>200 string >\0 \b, version %-3s 10567>242 string Bootsector\ from\ C.H.\ Hochst\204 10568# http://freecode.com/projects/dosfstools dosfstools-n.m/src/mkdosfs.c 10569# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string 10570# skip name "C.H. Hochstaetter" partly because it is sometimes written without umlaut 10571>242 search/127 Bootsector\ from\ C.H.\ Hochst 10572>>278 search/127 No\ Systemdisk.\ Booting\ from\ harddisk 10573# followed by variants with point,CR-NL or NL-CR 10574>>>208 search/261 Cannot\ load\ from\ harddisk. 10575# followed by variants CR-NL or NL-CR 10576>>>>236 search/235 Insert\ Systemdisk\ and\ press\ any\ key. 10577# followed by variants with point,CR-NL or NL-CR 10578>>>>>180 search/96 Disk\ formatted\ with\ WinImage\ \b, WinImage harddisk Bootloader 10579# followed by string like "6.50 (c) 1993-2004 Gilles Vollant" 10580>>>>>>&0 string x \b, version %-4.4s 10581>(1.b+2) ubyte 0xe 10582>>(1.b+3) ubyte 0x1f 10583>>>(1.b+4) ubyte 0xbe 10584# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others 10585>>>>(1.b+5) ubyte&0xd3 0x53 10586>>>>>(1.b+6) ubyte 0x7c 10587# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah, 10588>>>>>>(1.b+7) ubyte 0xac 10589>>>>>>>(1.b+8) ubyte 0x22 10590>>>>>>>>(1.b+9) ubyte 0xc0 10591>>>>>>>>>(1.b+10) ubyte 0x74 10592>>>>>>>>>>(1.b+11) ubyte 0x0b 10593>>>>>>>>>>>(1.b+12) ubyte 0x56 10594>>>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display 10595# FAT1X version 10596>>>>>>>>>>>>>(1.b+5) ubyte 0x5b 10597>>>>>>>>>>>>>>0x5b string >\0 "%-s" 10598# FAT32 version 10599>>>>>>>>>>>>>(1.b+5) ubyte 0x77 10600>>>>>>>>>>>>>>0x77 string >\0 "%-s" 10601>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display 10602#>>244 string from\ dosemu-freedos-*-bin.tgz\r 10603#>>>170 string Sorry,\ could\ not\ load\ an\040 10604#>>>>195 string operating\ system.\r\n 10605# 10606>103 string This\ is\ not\ a\ bootable\ disk.\040 10607>>132 string Please\ insert\ a\ bootable\040 10608>>>157 string floppy\ and\r\n 10609>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display 10610# 10611>66 string Solaris\ Boot\ Sector 10612>>99 string Incomplete\ MDBoot\ load. 10613>>>89 string Version \b, Sun Solaris Bootloader 10614>>>>97 byte x version %c 10615# 10616>408 string OS/2\ !!\ SYS01475\r\0 10617>>429 string OS/2\ !!\ SYS02025\r\0 10618>>>450 string OS/2\ !!\ SYS02027\r\0 10619>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader 10620# 10621>409 string OS/2\ !!\ SYS01475\r\0 10622>>430 string OS/2\ !!\ SYS02025\r\0 10623>>>451 string OS/2\ !!\ SYS02027\r\0 10624>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader 10625>112 string This\ disk\ is\ not\ bootable\r 10626>>142 string If\ you\ wish\ to\ make\ it\ bootable 10627>>>176 string run\ the\ DOS\ program\ SYS\040 10628>>>200 string after\ the\r 10629>>>>216 string system\ has\ been\ loaded\r\n 10630>>>>>242 string Please\ insert\ a\ DOS\ diskette\040 10631>>>>>271 string into\r\n\ the\ drive\ and\040 10632>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display 10633# XP 10634>430 string NTLDR\ is\ missing\xFF\r\n 10635>>449 string Disk\ error\xFF\r\n 10636>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader 10637# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes 10638>>>>417 ubyte&0xDF >0 10639>>>>>417 string x %-.5s 10640>>>>>>422 ubyte&0xDF >0 10641>>>>>>>422 string x \b%-.3s 10642>>>>>425 ubyte&0xDF >0 10643>>>>>>425 string >\ \b.%-.3s 10644# 10645>>>>371 ubyte >0x20 10646>>>>>368 ubyte&0xDF >0 10647>>>>>>368 string x %-.5s 10648>>>>>>>373 ubyte&0xDF >0 10649>>>>>>>>373 string x \b%-.3s 10650>>>>>>376 ubyte&0xDF >0 10651>>>>>>>376 string x \b.%-.3s 10652# 10653>430 string NTLDR\ nicht\ gefunden\xFF\r\n 10654>>453 string Datentr\204gerfehler\xFF\r\n 10655>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) 10656>>>>417 ubyte&0xDF >0 10657>>>>>417 string x %-.5s 10658>>>>>>422 ubyte&0xDF >0 10659>>>>>>>422 string x \b%-.3s 10660>>>>>425 ubyte&0xDF >0 10661>>>>>>425 string >\ \b.%-.3s 10662# offset variant 10663>>>>379 string \0 10664>>>>>368 ubyte&0xDF >0 10665>>>>>>368 string x %-.5s 10666>>>>>>>373 ubyte&0xDF >0 10667>>>>>>>>373 string x \b%-.3s 10668# 10669>430 string NTLDR\ fehlt\xFF\r\n 10670>>444 string Datentr\204gerfehler\xFF\r\n 10671>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) 10672>>>>417 ubyte&0xDF >0 10673>>>>>417 string x %-.5s 10674>>>>>>422 ubyte&0xDF >0 10675>>>>>>>422 string x \b%-.3s 10676>>>>>425 ubyte&0xDF >0 10677>>>>>>425 string >\ \b.%-.3s 10678# variant 10679>>>>371 ubyte >0x20 10680>>>>>368 ubyte&0xDF >0 10681>>>>>>368 string x %-.5s 10682>>>>>>>373 ubyte&0xDF >0 10683>>>>>>>>373 string x \b%-.3s 10684>>>>>>376 ubyte&0xDF >0 10685>>>>>>>376 string x \b.%-.3s 10686# 10687>430 string NTLDR\ fehlt\xFF\r\n 10688>>444 string Medienfehler\xFF\r\n 10689>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) 10690>>>>371 ubyte >0x20 10691>>>>>368 ubyte&0xDF >0 10692>>>>>>368 string x %-.5s 10693>>>>>>>373 ubyte&0xDF >0 10694>>>>>>>>373 string x \b%-.3s 10695>>>>>>376 ubyte&0xDF >0 10696>>>>>>>376 string x \b.%-.3s 10697# variant 10698>>>>417 ubyte&0xDF >0 10699>>>>>417 string x %-.5s 10700>>>>>>422 ubyte&0xDF >0 10701>>>>>>>422 string x \b%-.3s 10702>>>>>425 ubyte&0xDF >0 10703>>>>>>425 string >\ \b.%-.3s 10704# 10705>430 string Datentr\204ger\ entfernen\xFF\r\n 10706>>454 string Medienfehler\xFF\r\n 10707>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) 10708>>>>379 string \0 10709>>>>>368 ubyte&0xDF >0 10710>>>>>>368 string x %-.5s 10711>>>>>>>373 ubyte&0xDF >0 10712>>>>>>>>373 string x \b%-.3s 10713>>>>>>376 ubyte&0xDF >0 10714>>>>>>>376 string x \b.%-.3s 10715# variant 10716>>>>417 ubyte&0xDF >0 10717>>>>>417 string x %-.5s 10718>>>>>>422 ubyte&0xDF >0 10719>>>>>>>422 string x \b%-.3s 10720>>>>>425 ubyte&0xDF >0 10721>>>>>>425 string >\ \b.%-.3s 10722# 10723 10724#>3 string NTFS\ \ \ \040 10725>389 string Fehler\ beim\ Lesen\040 10726>>407 string des\ Datentr\204gers 10727>>>426 string NTLDR\ fehlt 10728>>>>440 string NTLDR\ ist\ komprimiert 10729>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) 10730#>3 string NTFS\ \ \ \040 10731>313 string A\ disk\ read\ error\ occurred.\r 10732>>345 string A\ kernel\ file\ is\ missing\040 10733>>>370 string from\ the\ disk.\r 10734>>>>484 string NTLDR\ is\ compressed 10735>>>>>429 string Insert\ a\ system\ diskette\040 10736>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS 10737# DOS loader variants different languages,offsets 10738>472 ubyte&0xDF >0 10739>>389 string Invalid\ system\ disk\xFF\r\n 10740>>>411 string Disk\ I/O\ error 10741>>>>428 string Replace\ the\ disk,\ and\040 10742>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader 10743#IO.SYS 10744>>>>>>472 ubyte&0xDF >0 10745>>>>>>>472 string x \b %-.2s 10746>>>>>>>>474 ubyte&0xDF >0 10747>>>>>>>>>474 string x \b%-.5s 10748>>>>>>>>>>479 ubyte&0xDF >0 10749>>>>>>>>>>>479 string x \b%-.1s 10750>>>>>>>480 ubyte&0xDF >0 10751>>>>>>>>480 string x \b.%-.3s 10752#MSDOS.SYS 10753>>>>>>>483 ubyte&0xDF >0 \b+ 10754>>>>>>>>483 string x \b%-.5s 10755>>>>>>>>>488 ubyte&0xDF >0 10756>>>>>>>>>>488 string x \b%-.3s 10757>>>>>>>>491 ubyte&0xDF >0 10758>>>>>>>>>491 string x \b.%-.3s 10759# 10760>>390 string Invalid\ system\ disk\xFF\r\n 10761>>>412 string Disk\ I/O\ error\xFF\r\n 10762>>>>429 string Replace\ the\ disk,\ and\040 10763>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader 10764>>388 string Ungueltiges\ System\ \xFF\r\n 10765>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n 10766>>>>427 string Datentraeger\ wechseln\ und\040 10767>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) 10768#WINBOOT.SYS only not spaces (0xDF) 10769>>>>>>497 ubyte&0xDF >0 10770>>>>>>>497 string x %-.5s 10771>>>>>>>>502 ubyte&0xDF >0 10772>>>>>>>>>502 string x \b%-.1s 10773>>>>>>>>>>503 ubyte&0xDF >0 10774>>>>>>>>>>>503 string x \b%-.1s 10775>>>>>>>>>>>>504 ubyte&0xDF >0 10776>>>>>>>>>>>>>504 string x \b%-.1s 10777>>>>>>505 ubyte&0xDF >0 10778>>>>>>>505 string x \b.%-.3s 10779#IO.SYS 10780>>>>>>472 ubyte&0xDF >0 or 10781>>>>>>>472 string x \b %-.2s 10782>>>>>>>>474 ubyte&0xDF >0 10783>>>>>>>>>474 string x \b%-.5s 10784>>>>>>>>>>479 ubyte&0xDF >0 10785>>>>>>>>>>>479 string x \b%-.1s 10786>>>>>>>480 ubyte&0xDF >0 10787>>>>>>>>480 string x \b.%-.3s 10788#MSDOS.SYS 10789>>>>>>>483 ubyte&0xDF >0 \b+ 10790>>>>>>>>483 string x \b%-.5s 10791>>>>>>>>>488 ubyte&0xDF >0 10792>>>>>>>>>>488 string x \b%-.3s 10793>>>>>>>>491 ubyte&0xDF >0 10794>>>>>>>>>491 string x \b.%-.3s 10795# 10796>>390 string Ungueltiges\ System\ \xFF\r\n 10797>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n 10798>>>>429 string Datentraeger\ wechseln\ und\040 10799>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) 10800#WINBOOT.SYS only not spaces (0xDF) 10801>>>>>>497 ubyte&0xDF >0 10802>>>>>>>497 string x %-.7s 10803>>>>>>>>504 ubyte&0xDF >0 10804>>>>>>>>>504 string x \b%-.1s 10805>>>>>>505 ubyte&0xDF >0 10806>>>>>>>505 string x \b.%-.3s 10807#IO.SYS 10808>>>>>>472 ubyte&0xDF >0 or 10809>>>>>>>472 string x \b %-.2s 10810>>>>>>>>474 ubyte&0xDF >0 10811>>>>>>>>>474 string x \b%-.6s 10812>>>>>>>480 ubyte&0xDF >0 10813>>>>>>>>480 string x \b.%-.3s 10814#MSDOS.SYS 10815>>>>>>>483 ubyte&0xDF >0 \b+ 10816>>>>>>>>483 string x \b%-.5s 10817>>>>>>>>>488 ubyte&0xDF >0 10818>>>>>>>>>>488 string x \b%-.3s 10819>>>>>>>>491 ubyte&0xDF >0 10820>>>>>>>>>491 string x \b.%-.3s 10821# 10822>>389 string Ungueltiges\ System\ \xFF\r\n 10823>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n 10824>>>>428 string Datentraeger\ wechseln\ und\040 10825>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) 10826# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes 10827>>>>>>472 string x %-.2s 10828>>>>>>>474 ubyte&0xDF >0 10829>>>>>>>>474 string x \b%-.5s 10830>>>>>>>>479 ubyte&0xDF >0 10831>>>>>>>>>479 string x \b%-.1s 10832>>>>>>480 ubyte&0xDF >0 10833>>>>>>>480 string x \b.%-.3s 10834>>>>>>483 ubyte&0xDF >0 \b+ 10835>>>>>>>483 string x \b%-.5s 10836>>>>>>>488 ubyte&0xDF >0 10837>>>>>>>>488 string x \b%-.2s 10838>>>>>>>>490 ubyte&0xDF >0 10839>>>>>>>>>490 string x \b%-.1s 10840>>>>>>>491 ubyte&0xDF >0 10841>>>>>>>>491 string x \b.%-.3s 10842>479 ubyte&0xDF >0 10843>>416 string Kein\ System\ oder\040 10844>>>433 string Laufwerksfehler 10845>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) 10846#IO.SYS 10847>>>>>479 string x \b %-.2s 10848>>>>>>481 ubyte&0xDF >0 10849>>>>>>>481 string x \b%-.6s 10850>>>>>487 ubyte&0xDF >0 10851>>>>>>487 string x \b.%-.3s 10852#MSDOS.SYS 10853>>>>>>490 ubyte&0xDF >0 \b+ 10854>>>>>>>490 string x \b%-.5s 10855>>>>>>>>495 ubyte&0xDF >0 10856>>>>>>>>>495 string x \b%-.3s 10857>>>>>>>498 ubyte&0xDF >0 10858>>>>>>>>498 string x \b.%-.3s 10859# 10860>376 search/41 Non-System\ disk\ or\040 10861>>395 search/41 disk\ error\r 10862>>>407 search/41 Replace\ and\040 10863>>>>419 search/41 press\ \b, 10864>>>>419 search/41 strike\ \b, old 10865>>>>426 search/41 any\ key\ when\ ready\r MS or PC-DOS bootloader 10866#449 Disk\ Boot\ failure\r MS 3.21 10867#466 Boot\ Failure\r MS 3.30 10868>>>>>468 search/18 \0 10869#IO.SYS,IBMBIO.COM 10870>>>>>>&0 string x \b %-.2s 10871>>>>>>>&-20 ubyte&0xDF >0 10872>>>>>>>>&-1 string x \b%-.4s 10873>>>>>>>>>&-16 ubyte&0xDF >0 10874>>>>>>>>>>&-1 string x \b%-.2s 10875>>>>>>&8 ubyte&0xDF >0 \b. 10876>>>>>>>&-1 string x \b%-.3s 10877#MSDOS.SYS,IBMDOS.COM 10878>>>>>>&11 ubyte&0xDF >0 \b+ 10879>>>>>>>&-1 string x \b%-.5s 10880>>>>>>>>&-6 ubyte&0xDF >0 10881>>>>>>>>>&-1 string x \b%-.1s 10882>>>>>>>>>>&-5 ubyte&0xDF >0 10883>>>>>>>>>>>&-1 string x \b%-.2s 10884>>>>>>>&7 ubyte&0xDF >0 \b. 10885>>>>>>>>&-1 string x \b%-.3s 10886>441 string Cannot\ load\ from\ harddisk.\n\r 10887>>469 string Insert\ Systemdisk\040 10888>>>487 string and\ press\ any\ key.\n\r \b, MS (2.11) DOS bootloader 10889#>43 string \224R-LOADER\ \ SYS =label 10890>54 string SYS 10891>>324 string VASKK 10892>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) 10893# 10894>98 string Press\ a\ key\ to\ retry\0\r 10895>>120 string Cannot\ find\ file\ \0\r 10896>>>139 string Disk\ read\ error\0\r 10897>>>>156 string Loading\ ...\0 \b, DR-DOS (3.41) Bootloader 10898#DRBIOS.SYS 10899>>>>>44 ubyte&0xDF >0 10900>>>>>>44 string x \b %-.6s 10901>>>>>>>50 ubyte&0xDF >0 10902>>>>>>>>50 string x \b%-.2s 10903>>>>>>52 ubyte&0xDF >0 10904>>>>>>>52 string x \b.%-.3s 10905# 10906>70 string IBMBIO\ \ COM 10907>>472 string Cannot\ load\ DOS!\040 10908>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader 10909>>471 string Cannot\ load\ DOS\040 10910>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader 10911#?? 10912>444 string KERNEL\ \ SYS 10913>>314 string BOOT\ error! \b, FREE-DOS Bootloader 10914>499 string KERNEL\ \ SYS 10915>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader 10916>449 string KERNEL\ \ SYS 10917>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader 10918# 10919>449 string Loading\ FreeDOS 10920>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader 10921>>>497 ubyte&0xDF >0 10922>>>>497 string x \b %-.6s 10923>>>>>503 ubyte&0xDF >0 10924>>>>>>503 string x \b%-.1s 10925>>>>>>>504 ubyte&0xDF >0 10926>>>>>>>>504 string x \b%-.1s 10927>>>>505 ubyte&0xDF >0 10928>>>>>505 string x \b.%-.3s 10929# 10930>331 string Error!.0 \b, FREE-DOS 1.0 bootloader 10931# 10932>125 string Loading\ FreeDOS...\r 10933>>311 string BOOT\ error!\r \b, FREE-DOS bootloader 10934>>>441 ubyte&0xDF >0 10935>>>>441 string x \b %-.6s 10936>>>>>447 ubyte&0xDF >0 10937>>>>>>447 string x \b%-.1s 10938>>>>>>>448 ubyte&0xDF >0 10939>>>>>>>>448 string x \b%-.1s 10940>>>>449 ubyte&0xDF >0 10941>>>>>449 string x \b.%-.3s 10942>124 string FreeDOS\0 10943>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader 10944# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes 10945>>>497 ubyte&0xDF >0 10946>>>>497 string x \b %-.6s 10947>>>>>503 ubyte&0xDF >0 10948>>>>>>503 string x \b%-.1s 10949>>>>>>>504 ubyte&0xDF >0 10950>>>>>>>>504 string x \b%-.1s 10951>>>>505 ubyte&0xDF >0 10952>>>>>505 string x \b.%-.3s 10953>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader 10954>>>497 ubyte&0xDF >0 10955>>>>497 string x \b %-.6s 10956>>>>>503 ubyte&0xDF >0 10957>>>>>>503 string x \b%-.1s 10958>>>>>>>504 ubyte&0xDF >0 10959>>>>>>>>504 string x \b%-.1s 10960>>>>505 ubyte&0xDF >0 10961>>>>>505 string x \b.%-.3s 10962>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader 10963>>>497 ubyte&0xDF >0 10964>>>>497 string x \b %-.6s 10965>>>>>503 ubyte&0xDF >0 10966>>>>>>503 string x \b%-.1s 10967>>>>>>>504 ubyte&0xDF >0 10968>>>>>>>>504 string x \b%-.1s 10969>>>>505 ubyte&0xDF >0 10970>>>>>505 string x \b.%-.3s 10971>336 string Error!\040 10972>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader 10973>>>497 ubyte&0xDF >0 10974>>>>497 string x \b %-.6s 10975>>>>>503 ubyte&0xDF >0 10976>>>>>>503 string x \b%-.1s 10977>>>>>>>504 ubyte&0xDF >0 10978>>>>>>>>504 string x \b%-.1s 10979>>>>505 ubyte&0xDF >0 10980>>>>>505 string x \b.%-.3s 10981# added by Joerg Jenderek 10982# https://www.visopsys.org/ 10983# https://partitionlogic.org.uk/ 10984# OEM-ID=Visopsys 10985>478 ulelong 0 10986>>(1.b+326) string I/O\ Error\ reading\040 10987>>>(1.b+344) string Visopsys\ loader\r 10988>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader 10989# http://alexfru.chat.ru/epm.html#bootprog 10990>494 ubyte >0x4D 10991>>495 string >E 10992>>>495 string <S 10993#OEM-ID is not reliable 10994>>>>3 string BootProg 10995# It just looks for a program file name at the root directory 10996# and loads corresponding file with following execution. 10997# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes 10998>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader 10999>>>>>499 use DOS-filename 11000#If the boot sector fails to read any other sector, 11001#it prints a very short message ("RE") to the screen and hangs the computer. 11002#If the boot sector fails to find needed program in the root directory, 11003#it also hangs with another message ("NF"). 11004>>>>>492 string RENF \b, FAT (12 bit) 11005>>>>>495 string RENF \b, FAT (16 bit) 11006#If the boot sector fails to read any other sector, 11007#it prints a very short message ("RE") to the screen and hangs the computer. 11008# x86 bootloader end 11009 11010# added by Joerg Jenderek at Feb 2013 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 11011# and https://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector 11012>0 string RRaA 11013>>0x1E4 string rrAa \b, FSInfosector 11014#>>0x1FC uleshort =0 SHOULD BE ZERO 11015>>>0x1E8 ulelong <0xffffffff \b, %u free clusters 11016>>>0x1EC ulelong <0xffffffff \b, last allocated cluster %u 11017 11018# updated by Joerg Jenderek at Sep 2007 11019>3 ubyte 0 11020#no active flag 11021>>446 ubyte 0 11022# partition 1 not empty 11023>>>450 ubyte >0 11024# partitions 3,4 empty 11025>>>>482 ubyte 0 11026>>>>>498 ubyte 0 11027# partition 2 ID=0,5,15 11028>>>>>>466 ubyte <0x10 11029>>>>>>>466 ubyte 0x05 \b, extended partition table 11030>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA) 11031>>>>>>>466 ubyte 0x0 \b, extended partition table (last) 11032 11033# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 11034 11035>0x200 lelong 0x82564557 \b, BSD disklabel 11036 11037# by Joerg Jenderek at Apr 2013 11038# Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension 11039# like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS 110400 name DOS-filename 11041# space=0x20 (00100000b) means empty 11042>0 ubyte&0xDF >0 11043>>0 ubyte x \b%c 11044>>>1 ubyte&0xDF >0 11045>>>>1 ubyte x \b%c 11046>>>>>2 ubyte&0xDF >0 11047>>>>>>2 ubyte x \b%c 11048>>>>>>>3 ubyte&0xDF >0 11049>>>>>>>>3 ubyte x \b%c 11050>>>>>>>>>4 ubyte&0xDF >0 11051>>>>>>>>>>4 ubyte x \b%c 11052>>>>>>>>>>>5 ubyte&0xDF >0 11053>>>>>>>>>>>>5 ubyte x \b%c 11054>>>>>>>>>>>>>6 ubyte&0xDF >0 11055>>>>>>>>>>>>>>6 ubyte x \b%c 11056>>>>>>>>>>>>>>>7 ubyte&0xDF >0 11057>>>>>>>>>>>>>>>>7 ubyte x \b%c 11058# DOS filename extension 11059>>8 ubyte&0xDF >0 \b. 11060>>>8 ubyte x \b%c 11061>>>>9 ubyte&0xDF >0 11062>>>>>9 ubyte x \b%c 11063>>>>>>10 ubyte&0xDF >0 11064>>>>>>>10 ubyte x \b%c 11065# Print 2 following DOS filenames from directory entry form 11066# like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com 110670 name 2xDOS-filename 11068# display 1 space 11069>0 ubyte x \b 11070>0 use DOS-filename 11071>11 ubyte x \b+ 11072>11 use DOS-filename 11073 11074# https://en.wikipedia.org/wiki/Master_boot_record#PTE 11075# display standard partition table 110760 name partition-table 11077#>0 ubyte x PARTITION-TABLE 11078# test and display 1st til 4th partition table entry 11079>0 use partition-entry-test 11080>16 use partition-entry-test 11081>32 use partition-entry-test 11082>48 use partition-entry-test 11083# test for entry of partition table 110840 name partition-entry-test 11085# partition type ID > 0 11086>4 ubyte >0 11087# active flag 0 11088>>0 ubyte 0 11089>>>0 use partition-entry 11090# active flag 0x80, 0x81, ... 11091>>0 ubyte >0x7F 11092>>>0 use partition-entry 11093# Print entry of partition table 110940 name partition-entry 11095# partition type ID > 0 11096>4 ubyte >0 \b; partition 11097>>64 leshort 0xAA55 1 11098>>48 leshort 0xAA55 2 11099>>32 leshort 0xAA55 3 11100>>16 leshort 0xAA55 4 11101>>4 ubyte x : ID=0x%x 11102>>0 ubyte&0x80 0x80 \b, active 11103>>0 ubyte >0x80 0x%x 11104>>1 ubyte x \b, start-CHS ( 11105>>1 use partition-chs 11106>>5 ubyte x \b), end-CHS ( 11107>>5 use partition-chs 11108>>8 ulelong x \b), startsector %u 11109>>12 ulelong x \b, %u sectors 11110# Print cylinder,head,sector (CHS) of partition entry 111110 name partition-chs 11112# cylinder 11113>1 ubyte x \b0x 11114>1 ubyte&0xC0 0x40 \b1 11115>1 ubyte&0xC0 0x80 \b2 11116>1 ubyte&0xC0 0xC0 \b3 11117>2 ubyte x \b%x 11118# head 11119>0 ubyte x \b,%u 11120# sector 11121>1 ubyte&0x3F x \b,%u 11122 11123# FATX 111240 string FATX FATX filesystem data 11125 11126# romfs filesystems - Juan Cespedes <cespedes@debian.org> 111270 string -rom1fs- romfs filesystem, version 1 11128>8 belong x %d bytes, 11129>16 string x named %s. 11130 11131# netboot image - Juan Cespedes <cespedes@debian.org> 111320 lelong 0x1b031336L Netboot image, 11133>4 lelong&0xFFFFFF00 0 11134>>4 lelong&0x100 0x000 mode 2 11135>>4 lelong&0x100 0x100 mode 3 11136>4 lelong&0xFFFFFF00 !0 unknown mode 11137 111380x18b string OS/2 OS/2 Boot Manager 11139 11140# updated by Joerg Jenderek at Oct 2008 and Sep 2012 11141# https://syslinux.zytor.com/iso.php 11142# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05 11143# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop 111440 ulequad&0x909000007cc0eafa 0x909000007c40eafa 11145>631 search/689 ISOLINUX\ isolinux Loader 11146>>&0 string x (version %-4.4s) 11147# https://syslinux.zytor.com/pxe.php 11148# assembler instructions: jmp 7C05 111490 ulelong 0x007c05ea pxelinux loader (version 2.13 or older) 11150# assembler instructions: pushfd;pushad 111510 ulelong 0x60669c66 pxelinux loader 11152# assembler instructions: jmp 05 111530 ulelong 0xc00005ea pxelinux loader (version 3.70 or newer) 11154# https://syslinux.zytor.com/wiki/index.php/SYSLINUX 111550 string LDLINUX\ SYS\ SYSLINUX loader 11156>12 string x (older version %-4.4s) 111570 string \r\nSYSLINUX\ SYSLINUX loader 11158>11 string x (version %-4.4s) 11159# syslinux updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 11160# assembler instructions: jmp yy (yy=0x3c,0x58);nop;"SYSLINUX" 111610 ulelong&0x80909bEB 0x009018EB 11162# OEM-ID not always "SYSLINUX" 11163>434 search/47 Boot\ failed 11164# followed by \r\n\0 or :\ 11165>>482 search/132 \0LDLINUX\ SYS Syslinux bootloader (version 2.13 or older) 11166>>1 ubyte 0x58 Syslinux bootloader (version 3.0-3.9) 11167>459 search/30 Boot\ error\r\n\0 11168>>1 ubyte 0x58 Syslinux bootloader (version 3.10 or newer) 11169# SYSLINUX MBR updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at Sep 2012 11170# assembler instructions: mov di,0600h;mov cx,0100h 1117116 search/4 \xbf\x00\x06\xb9\x00\x01 11172# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21) 11173!:strength +36 11174>94 search/249 Missing\ operating\ system 11175# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other 11176# skip Ranish MBR 11177>>408 search/4 HD1/\0 11178>>408 default x 11179>>>250 search/118 \0Operating\ system\ load SYSLINUX MBR 11180# followed by "ing " or space 11181>>>>292 search/98 error 11182>>>>>&0 string \r (version 3.35 or older) 11183>>>>>&0 string .\r (version 3.52 or newer) 11184>>>>>&0 default x (version 3.36-3.51 ) 11185>368 search/106 \0Disk\ error\ on\ boot\r\n SYSLINUX GPT-MBR 11186>>156 search/10 \0Boot\ partition\ not\ found\r\n 11187>>>270 search/10 \0OS\ not\ bootable\r\n (version 3.86 or older) 11188>>174 search/10 \0Missing\ OS\r\n 11189>>>189 search/10 \0Multiple\ active\ partitions\r\n (version 4.00 or newer) 11190# SYSLINUX END 11191 11192# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012 11193# assembler instructions: xor ax,ax;mov ax,ss;mov sp,0x7c00;mov ax, 111940 ubequad 0x31c08ed0bc007c8e 11195# mbr_bootsel magic before partition table not reliable with small ipl fragments 11196#>444 uleshort 0xb5e1 11197>0004 uleshort x 11198# ERRorTeXT 11199>>181 search/166 Error\ \0\r\n NetBSD mbr 11200# NT Drive Serial Number https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS 11201>>>0x1B8 ubelong >0 \b,Serial 0x%-.8x 11202# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx 11203>>>0xbb search/71 \xcd\x13\x5a\x52\x52 \b,bootselector 11204# BOOT_EXTENDED definitions contains assembler instructions: 11205# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13 11206>>>0x96 search/1 \x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13 \b,boot extended 11207# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al 11208>>>0x130 search/55 \xee\x80\xc2\x05\xec\xa8\x40 \b,serial IO 11209# not TERSE_ERROR 11210>>>196 search/106 No\ active\ partition\0 11211>>>>&0 string Disk\ read\ error\0 11212>>>>>&0 string No\ operating\ system\0 \b,verbose 11213# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13 11214>>>0x7d search/7 \x5a\x52\xb4\x08\xcd\x13 \b,CHS 11215# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop dx;push dx;int 0x13 11216>>>0xa4 search/84 \xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13 \b,LBA-check 11217# assembler instructions: movw nametab,bx 11218>>>0x26 search/21 \xBB\x94\x07 11219# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf 11220>>>>&-9 ubequad&0xBE00f0E800febb94 0xBE0000E80000bb94 11221>>>>>181 search/166 Error\ \0 11222# "a: disk" , "Fn: diskn" or "NetBSD MBR boot" 11223>>>>>>&3 string x \b,"%s" 11224>>>446 use partition-table 11225# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html 11226# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4 11227# assembler instructions: jmp short 0x58;nop;ASCII 112280 ubequad&0xeb58908000000000 0xeb58900000000000 11229# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss, 11230>(1.b+2) ubequad 0xfa31c08ed88ec08e 11231# Error messages at end of code 11232>>376 string No\ operating\ system\r\n\0 11233>>>398 string Disk\ error\r\n\0FDD\0HDD\0 11234>>>>419 string \ EBIOS\r\n\0 AdvanceMAME mbr 11235 11236# Neil Turton mbr loader variant of https://www.chiark.greenend.org.uk/~neilt/mbr/ 11237# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11 11238# for 1st version assembler instructions: cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI, 11239# or cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS, 112400 ulequad&0xcE1b40D48EC031FC 0x8E0000D08EC031FC 11241# pointer to the data starting with Neil Turton signature string 11242>(0x1BC.s) string NDTmbr 11243>>&-14 string 1234F\0 Turton mbr ( 11244# parameters also viewed by install-mbr --list 11245>>>(0x1BC.s+7) ubyte x \b%u<= 11246>>>(0x1BC.s+9) ubyte x \bVersion<=%u 11247#>>>(0x1BC.s+8) ubyte x asm_flag_%x 11248>>>(0x1BC.s+8) ubyte&1 1 \b,Y2K-Fix 11249# variant used by testdisk of https://www.cgsecurity.org/wiki/Menu_MBRCode 11250>>>(0x1BC.s+8) ubyte&2 2 \b,TestDisk 11251#0x1~1,..,0x8~4,0x10~F,0x80~A enabled 11252#>>>(0x1BC.s+10) ubyte x \b,flags 0x%x 11253#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot 11254#>>>(0x1BC.s+11) ubyte x \b,cfg_def 0x%x 11255# for older versions 11256>>>(0x1BC.s+9) ubyte <2 11257#>>>>(0x1BC.s+12) ubyte 18 \b,%hhu/18 seconds 11258>>>>(0x1BC.s+12) ubyte !18 \b,%u/18 seconds 11259# floppy A: or B: 11260>>>>(0x1BC.s+13) ubyte <2 \b,floppy 0x%x 11261>>>>(0x1BC.s+13) ubyte >1 11262# 1st hard disc 11263#>>>>>(0x1BC.s+13) ubyte 0x80 \b,drive 0x%x 11264# not 1st hard disc 11265>>>>>(0x1BC.s+13) ubyte !0x80 \b,drive 0x%x 11266# for version >= 2 maximal timeout can be 65534 11267>>>(0x1BC.s+9) ubyte >1 11268#>>>>(0x1BC.s+12) uleshort 18 \b,%u/18 seconds 11269>>>>(0x1BC.s+12) uleshort !18 \b,%u/18 seconds 11270# floppy A: or B: 11271>>>>(0x1BC.s+14) ubyte <2 \b,floppy 0x%x 11272>>>>(0x1BC.s+14) ubyte >1 11273# 1st hard disc 11274#>>>>>(0x1BC.s+14) ubyte 0x80 \b,drive 0x%x 11275# not 1st hard disc 11276>>>>>(0x1BC.s+14) ubyte !0x80 \b,drive 0x%x 11277>>>0 ubyte x \b) 11278 11279# added by Joerg Jenderek 11280# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or 11281# grub-1.94/kern/i386/pc/startup.S 11282# https://www.gnu.org/software/grub/manual/grub.html#Embedded-data 11283# usual values are marked with comments to get only informations of strange GRUB loaders 112840x200 uleshort 0x70EA 11285# found only version 3.{1,2} 11286>0x206 ubeshort >0x0300 11287# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" 11288>>0x212 ubyte >0x29 11289>>>0x213 ubyte >0x29 11290# not iso9660_stage1_5 11291#>>>0 ulelong&0x00BE5652 0x00BE5652 11292>>>>0x213 ubyte >0x29 GRand Unified Bootloader 11293# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" 11294>>>>0x217 ubyte 0xFF stage1_5 11295>>>>0x217 ubyte <0xFF stage2 11296>>>>0x206 ubyte x \b version %u 11297>>>>0x207 ubyte x \b.%u 11298# module_size for 1.94 11299>>>>0x208 ulelong <0xffffff \b, installed partition %u 11300#>>>>0x208 ulelong =0xffffff \b, %lu (default) 11301>>>>0x208 ulelong >0xffffff \b, installed partition %u 11302# GRUB 0.5.95 unofficial 11303>>>>0x20C ulelong&0x2E300000 0x2E300000 11304# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 11305>>>>>0x20C ubyte x \b, identifier 0x%x 11306#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) 11307>>>>>0x20D ubyte >0 \b, LBA flag 0x%x 11308# GRUB version as string 11309>>>>>0x20E string >\0 \b, GRUB version %-s 11310# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 11311>>>>>>0x215 ulong 0xffffffff 11312>>>>>>>0x219 string >\0 \b, configuration file %-s 11313>>>>>>0x215 ulong !0xffffffff 11314>>>>>>>0x215 string >\0 \b, configuration file %-s 11315# newer GRUB versions 11316>>>>0x20C ulelong&0x2E300000 !0x2E300000 11317##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) 11318>>>>>0x20C ulelong >0 \b, saved entry %d 11319# for 1.94 contains kernel image size 11320# for 0.93,0.94,0.96,0.97 11321# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 11322>>>>>0x210 ubyte x \b, identifier 0x%x 11323# The flag for LBA forcing is in most cases 0 11324#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) 11325>>>>>0x211 ubyte >0 \b, LBA flag 0x%x 11326# GRUB version as string 11327>>>>>0x212 string >\0 \b, GRUB version %-s 11328# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default 11329>>>>>0x217 ulong 0xffffffff 11330>>>>>>0x21b string >\0 \b, configuration file %-s 11331>>>>>0x217 ulong !0xffffffff 11332>>>>>>0x217 string >\0 \b, configuration file %-s 11333 11334# DOS x86 sector updated and separated from "DOS/MBR boot sector" by Joerg Jenderek at May 2011 11335# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 11336# over BIOS parameter block (BPB) 11337# https://thestarman.pcministry.com/asm/2bytejumps.htm#FWD 11338# older drives may use Near JuMP instruction E9 xx xx 11339# minimal short forward jump found 0x29 for bootloaders or 0x0 11340# maximal short forward jump is 0x7f 11341# OEM-ID is empty or contain readable bytes 113420 ulelong&0x804000E9 0x000000E9 11343!:strength +60 11344# mtools-3.9.8/msdos.h 11345# usual values are marked with comments to get only informations of strange FAT systems 11346# valid sectorsize must be a power of 2 from 32 to 32768 11347>11 uleshort&0x001f 0 11348>>11 uleshort <32769 11349>>>11 uleshort >31 11350>>>>21 ubyte&0xf0 0xF0 11351>>>>>0 ubyte 0xEB DOS/MBR boot sector 11352>>>>>>1 ubyte x \b, code offset 0x%x+2 11353>>>>>0 ubyte 0xE9 11354>>>>>>1 uleshort x \b, code offset 0x%x+3 11355>>>>>3 string >\0 \b, OEM-ID "%-.8s" 11356#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC 11357>>>>>>8 string IHC \b cached by Windows 9M 11358>>>>>11 uleshort >512 \b, Bytes/sector %u 11359#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) 11360>>>>>11 uleshort <512 \b, Bytes/sector %u 11361>>>>>13 ubyte >1 \b, sectors/cluster %u 11362#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) 11363# for lazy FAT32 implementation like Transcend digital photo frame PF830 11364>>>>>82 string/c fat32 11365>>>>>>14 uleshort !32 \b, reserved sectors %u 11366#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) 11367>>>>>82 string/c !fat32 11368>>>>>>14 uleshort >1 \b, reserved sectors %u 11369#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) 11370#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS) 11371>>>>>16 ubyte >2 \b, FATs %u 11372#>>>>>16 ubyte =2 \b, FATs %u (usual) 11373>>>>>16 ubyte =1 \b, FAT %u 11374>>>>>16 ubyte >0 11375>>>>>17 uleshort >0 \b, root entries %u 11376#>>>>>17 uleshort =0 \b, root entries %hu=0 (usual Fat32) 11377>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) 11378#>>>>>19 uleshort =0 \b, sectors %hu=0 (usual Fat32) 11379>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x 11380#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) 11381>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x 11382>>>>>22 uleshort >0 \b, sectors/FAT %u 11383#>>>>>22 uleshort =0 \b, sectors/FAT %hu=0 (usual Fat32) 11384>>>>>24 uleshort x \b, sectors/track %u 11385>>>>>26 ubyte >2 \b, heads %u 11386#>>>>>26 ubyte =2 \b, heads %u (usual floppy) 11387>>>>>26 ubyte =1 \b, heads %u 11388# valid only for sector sizes with more then 32 Bytes 11389>>>>>11 uleshort >32 11390# https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block 11391# skip for values 2,2Ah,70h,73h,DFh 11392# and continue for extended boot signature values 0,28h,29h,80h 11393>>>>>>38 ubyte&0x56 =0 11394>>>>>>>28 ulelong >0 \b, hidden sectors %u 11395#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) 11396>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) 11397#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) 11398# FAT<32 bit specific 11399>>>>>>>82 string/c !fat32 11400#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) 11401#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) 11402>>>>>>>>36 ubyte !0x80 11403>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x 11404# VGA-copy CRC or 11405# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 11406>>>>>>>>37 ubyte >0 \b, reserved 0x%x 11407#>>>>>>>>37 ubyte =0 \b, reserved 0x%x 11408# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others 11409>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 11410>>>>>>>>38 ubyte&0xFE =0x28 11411>>>>>>>>>39 ulelong x \b, serial number 0x%x 11412>>>>>>>>38 ubyte =0x29 11413>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" 11414>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" 11415>>>>>>>>>43 string =NO\ NAME \b, unlabeled 11416# there exist some old floppies without word FAT at offset 54 11417# a word like "FATnm " is only a hint for a FAT size on nm-bits 11418# Normally the number of clusters is calculated by the values of BPP. 11419# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit, 11420# otherwise FAT is 16 bit. 11421# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html 11422>>>>>82 string/c !fat32 11423>>>>>>54 string FAT12 \b, FAT (12 bit) 11424>>>>>>54 string FAT16 \b, FAT (16 bit) 11425>>>>>>54 default x 11426# determinate FAT bit size by media descriptor 11427# small floppies implies FAT12 11428>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor) 11429# with media descriptor F0h floppy or maybe superfloppy with FAT16 11430>>>>>>>21 ubyte =0xF0 11431# superfloppy (many sectors) implies FAT16 11432>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors) 11433# no superfloppy with media descriptor F0h implies FAT12 11434>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors) 11435# with media descriptor F8h floppy or hard disc with FAT12 or FAT16 11436>>>>>>>21 ubyte =0xF8 11437# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12 11438>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry) 11439# hard disc with FAT12 or FAT16 11440>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 11441# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc 11442>>>>>>>21 ubyte =0xFA 11443# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12 11444>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry) 11445# RAM disc with FAT12 or FAT16 or Tandy hard disc 11446>>>>>>>>19 default x \b, FAT (1Y bit by descriptor) 11447# others are floppy 11448>>>>>>>21 default x \b, FAT (12 bit by descriptor) 11449# FAT32 bit specific 11450>>>>>82 string/c fat32 \b, FAT (32 bit) 11451>>>>>>36 ulelong x \b, sectors/FAT %u 11452# https://technet.microsoft.com/en-us/library/cc977221.aspx 11453>>>>>>40 uleshort >0 \b, extension flags 0x%x 11454#>>>>>>40 uleshort =0 \b, extension flags %hu 11455>>>>>>42 uleshort >0 \b, fsVersion %u 11456#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) 11457>>>>>>44 ulelong >2 \b, rootdir cluster %u 11458#>>>>>>44 ulelong =2 \b, rootdir cluster %u 11459#>>>>>>44 ulelong =1 \b, rootdir cluster %u 11460>>>>>>48 uleshort >1 \b, infoSector %u 11461#>>>>>>48 uleshort =1 \b, infoSector %u (usual) 11462>>>>>>48 uleshort <1 \b, infoSector %u 11463# 0 or 0xFFFF instead of usual 6 means no backup sector 11464>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector 11465>>>>>>50 uleshort =0 \b, no Backup boot sector 11466#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) 11467>>>>>>50 default x 11468>>>>>>>50 uleshort x \b, Backup boot sector %u 11469# corrected by Joerg Jenderek at Feb 2011 according to https://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO 11470>>>>>>52 ulelong >0 \b, reserved1 0x%x 11471>>>>>>56 ulelong >0 \b, reserved2 0x%x 11472>>>>>>60 ulelong >0 \b, reserved3 0x%x 11473# same structure as FAT1X 11474#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) 11475#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) 11476>>>>>>64 ubyte !0x80 11477>>>>>>>64 ubyte >0 \b, physical drive 0x%x 11478# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too 11479>>>>>>65 ubyte >0 \b, reserved 0x%x 11480>>>>>>66 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x) 11481>>>>>>66 ubyte =0x29 11482>>>>>>>67 ulelong x \b, serial number 0x%x 11483>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" 11484>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" 11485>>>>>>>71 string =NO\ NAME \b, unlabeled 11486# additional tests for floppy image added by Joerg Jenderek 11487# no fixed disk 11488>>>>>21 ubyte !0xF8 11489# floppy media with 12 bit FAT 11490>>>>>>54 string !FAT16 11491# test for FAT after bootsector 11492>>>>>>>(11.s) ulelong&0x00ffffF0 0x00ffffF0 \b, followed by FAT 11493# floppy image 11494!:mime application/x-ima 11495# NTFS specific added by Joerg Jenderek at Mar 2011 according to https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm 11496# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html 11497# 0 FATs 11498>>>>>16 ubyte =0 11499# 0 root entries 11500>>>>>>17 uleshort =0 11501# 0 DOS sectors 11502>>>>>>>19 uleshort =0 11503# 0 sectors/FAT 11504# dos < 4.0 BootSector value found is 0x80 11505#38 ubyte =0x80 \b, dos < 4.0 BootSector (0x%x) 11506>>>>>>>>22 uleshort =0 \b; NTFS 11507>>>>>>>>>24 uleshort >0 \b, sectors/track %u 11508>>>>>>>>>36 ulelong !0x800080 \b, physical drive 0x%x 11509>>>>>>>>>40 ulequad >0 \b, sectors %lld 11510>>>>>>>>>48 ulequad >0 \b, $MFT start cluster %lld 11511>>>>>>>>>56 ulequad >0 \b, $MFTMirror start cluster %lld 11512# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters. 11513# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes. 11514>>>>>>>>>64 lelong <256 11515>>>>>>>>>>64 lelong <128 \b, clusters/RecordSegment %d 11516>>>>>>>>>>64 ubyte >127 \b, bytes/RecordSegment 2^(-1*%i) 11517# Values 0 to 127 represent index block sizes of 0 to 127 clusters. 11518# Values 128 to 255 represent index block sizes of 2^(256-N) byte 11519>>>>>>>>>68 ulelong <256 11520>>>>>>>>>>68 ulelong <128 \b, clusters/index block %d 11521#>>>>>>>>>>68 ulelong >127 \b, bytes/index block 2^(256-%d) 11522>>>>>>>>>>68 ubyte >127 \b, bytes/index block 2^(-1*%i) 11523>>>>>>>>>72 ulequad x \b, serial number 0%llx 11524>>>>>>>>>80 ulelong >0 \b, checksum 0x%x 11525#>>>>>>>>>80 ulelong =0 \b, checksum 0x%x=0 (usual) 11526# unicode loadername size jump 11527>>>>>>>>>(0x200.s*2) ubyte x 11528# in next sector loadername terminated by unicode CTRL-D and $ 11529>>>>>>>>>>&0x1FF ulequad&0x0000FFffFFffFF00 0x0000002400040000 \b; contains 11530# if 2nd NTFS sectors is found then assume whole filesystem 11531#!:mime application/x-raw-disk-image 11532!:ext img/bin/ntfs 11533>>>>>>>>>>>0x200 use ntfs-sector2 11534 11535# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013, Mar 2019 11536# https://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm 11537# unused assembler instructions short JMP y2;NOP;NOP 115380x056 ulelong&0xFFFF0FFF 0x909002EB NTFS 11539#!:mime application/octet-stream 11540!:ext bin 11541>0 use ntfs-sector2 11542# https://memory.dataram.com/products-and-services/software/ramdisk 11543# assembler instructions JMP C000;NOP 115440x056 ulelong 0x9000c0e9 NTFS 11545#!:mime application/octet-stream 11546!:ext bin 11547>0 use ntfs-sector2 11548# check for characteristics of second NTFS sector and then display loader name 115490 name ntfs-sector2 11550# number of utf16 characters of loadername 11551>0 uleshort <8 11552# unused assembler instructions JMP y2;NOP;NOP or JMP C000;NOP 11553>>0x056 ulelong&0xFF0000FD 0x900000E9 11554# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR 11555>>>0x002 lestring16 x bootstrap %-5.5s 11556# check for 7 character length of loader name like BOOTMGR 11557>>>0 uleshort 7 11558>>>>0x0c lestring16 x \b%-2.2s 11559### DOS,NTFS boot sectors end 11560 11561# ntfsclone-image is a special save format for NTFS volumes, 11562# created and restored by the ntfsclone program 115630 string \0ntfsclone-image ntfsclone image, 11564>0x10 byte x version %d. 11565>0x11 byte x \b%d, 11566>0x12 lelong x cluster size %d, 11567>0x16 lequad x device size %lld, 11568>0x1e lequad x %lld total clusters, 11569>0x26 lequad x %lld clusters in use 11570 115719564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), 11572>8404 string x last mounted on %s, 11573#>9504 ledate x last checked at %s, 11574>8224 ledate x last written at %s, 11575>8401 byte x clean flag %d, 11576>8228 lelong x number of blocks %d, 11577>8232 lelong x number of data blocks %d, 11578>8236 lelong x number of cylinder groups %d, 11579>8240 lelong x block size %d, 11580>8244 lelong x fragment size %d, 11581>8252 lelong x minimum percentage of free blocks %d, 11582>8256 lelong x rotational delay %dms, 11583>8260 lelong x disk rotational speed %drps, 11584>8320 lelong 0 TIME optimization 11585>8320 lelong 1 SPACE optimization 11586 1158742332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 11588>&-1164 string x last mounted on %s, 11589>&-696 string >\0 volume name %s, 11590>&-304 leqldate x last written at %s, 11591>&-1167 byte x clean flag %d, 11592>&-1168 byte x readonly flag %d, 11593>&-296 lequad x number of blocks %lld, 11594>&-288 lequad x number of data blocks %lld, 11595>&-1332 lelong x number of cylinder groups %d, 11596>&-1328 lelong x block size %d, 11597>&-1324 lelong x fragment size %d, 11598>&-180 lelong x average file size %d, 11599>&-176 lelong x average number of files in dir %d, 11600>&-272 lequad x pending blocks to free %lld, 11601>&-264 lelong x pending inodes to free %d, 11602>&-664 lequad x system-wide uuid %0llx, 11603>&-1316 lelong x minimum percentage of free blocks %d, 11604>&-1248 lelong 0 TIME optimization 11605>&-1248 lelong 1 SPACE optimization 11606 1160766908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) 11608>&-1164 string x last mounted on %s, 11609>&-696 string >\0 volume name %s, 11610>&-304 leqldate x last written at %s, 11611>&-1167 byte x clean flag %d, 11612>&-1168 byte x readonly flag %d, 11613>&-296 lequad x number of blocks %lld, 11614>&-288 lequad x number of data blocks %lld, 11615>&-1332 lelong x number of cylinder groups %d, 11616>&-1328 lelong x block size %d, 11617>&-1324 lelong x fragment size %d, 11618>&-180 lelong x average file size %d, 11619>&-176 lelong x average number of files in dir %d, 11620>&-272 lequad x pending blocks to free %lld, 11621>&-264 lelong x pending inodes to free %d, 11622>&-664 lequad x system-wide uuid %0llx, 11623>&-1316 lelong x minimum percentage of free blocks %d, 11624>&-1248 lelong 0 TIME optimization 11625>&-1248 lelong 1 SPACE optimization 11626 116279564 belong 0x00011954 Unix Fast File system [v1] (big-endian), 11628>7168 belong 0x4c41424c Apple UFS Volume 11629>>7186 string x named %s, 11630>>7176 belong x volume label version %d, 11631>>7180 bedate x created on %s, 11632>8404 string x last mounted on %s, 11633#>9504 bedate x last checked at %s, 11634>8224 bedate x last written at %s, 11635>8401 byte x clean flag %d, 11636>8228 belong x number of blocks %d, 11637>8232 belong x number of data blocks %d, 11638>8236 belong x number of cylinder groups %d, 11639>8240 belong x block size %d, 11640>8244 belong x fragment size %d, 11641>8252 belong x minimum percentage of free blocks %d, 11642>8256 belong x rotational delay %dms, 11643>8260 belong x disk rotational speed %drps, 11644>8320 belong 0 TIME optimization 11645>8320 belong 1 SPACE optimization 11646 1164742332 belong 0x19540119 Unix Fast File system [v2] (big-endian) 11648>&-1164 string x last mounted on %s, 11649>&-696 string >\0 volume name %s, 11650>&-304 beqldate x last written at %s, 11651>&-1167 byte x clean flag %d, 11652>&-1168 byte x readonly flag %d, 11653>&-296 bequad x number of blocks %lld, 11654>&-288 bequad x number of data blocks %lld, 11655>&-1332 belong x number of cylinder groups %d, 11656>&-1328 belong x block size %d, 11657>&-1324 belong x fragment size %d, 11658>&-180 belong x average file size %d, 11659>&-176 belong x average number of files in dir %d, 11660>&-272 bequad x pending blocks to free %lld, 11661>&-264 belong x pending inodes to free %d, 11662>&-664 bequad x system-wide uuid %0llx, 11663>&-1316 belong x minimum percentage of free blocks %d, 11664>&-1248 belong 0 TIME optimization 11665>&-1248 belong 1 SPACE optimization 11666 1166766908 belong 0x19540119 Unix Fast File system [v2] (big-endian) 11668>&-1164 string x last mounted on %s, 11669>&-696 string >\0 volume name %s, 11670>&-304 beqldate x last written at %s, 11671>&-1167 byte x clean flag %d, 11672>&-1168 byte x readonly flag %d, 11673>&-296 bequad x number of blocks %lld, 11674>&-288 bequad x number of data blocks %lld, 11675>&-1332 belong x number of cylinder groups %d, 11676>&-1328 belong x block size %d, 11677>&-1324 belong x fragment size %d, 11678>&-180 belong x average file size %d, 11679>&-176 belong x average number of files in dir %d, 11680>&-272 bequad x pending blocks to free %lld, 11681>&-264 belong x pending inodes to free %d, 11682>&-664 bequad x system-wide uuid %0llx, 11683>&-1316 belong x minimum percentage of free blocks %d, 11684>&-1248 belong 0 TIME optimization 11685>&-1248 belong 1 SPACE optimization 11686 116870 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian), 11688>0x90 lelong+1 x volume %d 11689>0x94 lelong x (of %d), 11690>0x50 string x name %s, 11691>0x98 ulelong x version %u, 11692>0xa0 ulelong x flags 0x%x 11693 11694# ext2/ext3 filesystems - Andreas Dilger <adilger@dilger.ca> 11695# ext4 filesystem - Eric Sandeen <sandeen@sandeen.net> 11696# volume label and UUID Russell Coker 11697# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 116980x438 leshort 0xEF53 Linux 11699>0x44c lelong x rev %d 11700>0x43e leshort x \b.%d 11701# No journal? ext2 11702>0x45c lelong ^0x0000004 ext2 filesystem data 11703>>0x43a leshort ^0x0000001 (mounted or unclean) 11704# Has a journal? ext3 or ext4 11705>0x45c lelong &0x0000004 11706# and small INCOMPAT? 11707>>0x460 lelong <0x0000040 11708# and small RO_COMPAT? 11709>>>0x464 lelong <0x0000008 ext3 filesystem data 11710# else large RO_COMPAT? 11711>>>0x464 lelong >0x0000007 ext4 filesystem data 11712# else large INCOMPAT? 11713>>0x460 lelong >0x000003f ext4 filesystem data 11714>0x468 belong x \b, UUID=%08x 11715>0x46c beshort x \b-%04x 11716>0x46e beshort x \b-%04x 11717>0x470 beshort x \b-%04x 11718>0x472 belong x \b-%08x 11719>0x476 beshort x \b%04x 11720>0x478 string >0 \b, volume name "%s" 11721# General flags for any ext* fs 11722>0x460 lelong &0x0000004 (needs journal recovery) 11723>0x43a leshort &0x0000002 (errors) 11724# INCOMPAT flags 11725>0x460 lelong &0x0000001 (compressed) 11726#>0x460 lelong &0x0000002 (filetype) 11727#>0x460 lelong &0x0000010 (meta bg) 11728>0x460 lelong &0x0000040 (extents) 11729>0x460 lelong &0x0000080 (64bit) 11730#>0x460 lelong &0x0000100 (mmp) 11731#>0x460 lelong &0x0000200 (flex bg) 11732# RO_INCOMPAT flags 11733#>0x464 lelong &0x0000001 (sparse super) 11734>0x464 lelong &0x0000002 (large files) 11735>0x464 lelong &0x0000008 (huge files) 11736#>0x464 lelong &0x0000010 (gdt checksum) 11737#>0x464 lelong &0x0000020 (many subdirs) 11738#>0x463 lelong &0x0000040 (extra isize) 11739 11740# f2fs filesystem - Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> 117410x400 lelong 0xF2F52010 F2FS filesystem 11742>0x46c belong x \b, UUID=%08x 11743>0x470 beshort x \b-%04x 11744>0x472 beshort x \b-%04x 11745>0x474 beshort x \b-%04x 11746>0x476 belong x \b-%08x 11747>0x47a beshort x \b%04x 11748>0x147c lestring16 x \b, volume name "%s" 11749 11750# Minix filesystems - Juan Cespedes <cespedes@debian.org> 117510x410 leshort 0x137f 11752!:strength / 2 11753>0x402 beshort < 100 11754>0x402 beshort > -1 Minix filesystem, V1, 14 char names, %d zones 11755>0x1e string minix \b, bootable 117560x410 beshort 0x137f 11757!:strength / 2 11758>0x402 beshort < 100 11759>0x402 beshort > -1 Minix filesystem, V1 (big endian), %d zones 11760>0x1e string minix \b, bootable 117610x410 leshort 0x138f 11762!:strength / 2 11763>0x402 beshort < 100 11764>0x402 beshort > -1 Minix filesystem, V1, 30 char names, %d zones 11765>0x1e string minix \b, bootable 117660x410 beshort 0x138f 11767!:strength / 2 11768>0x402 beshort < 100 11769>0x402 beshort > -1 Minix filesystem, V1, 30 char names (big endian), %d zones 11770>0x1e string minix \b, bootable 11771# Weak Magic: this is $x 11772#0x410 leshort 0x2468 11773#>0x402 beshort < 100 11774#>>0x402 beshort > -1 Minix filesystem, V2, 14 char names 11775#>0x1e string minix \b, bootable 11776#0x410 beshort 0x2468 11777#>0x402 beshort < 100 11778#>0x402 beshort > -1 Minix filesystem, V2 (big endian) 11779#>0x1e string minix \b, bootable 11780#0x410 leshort 0x2478 11781#>0x402 beshort < 100 11782#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 11783#>0x1e string minix \b, bootable 11784#0x410 leshort 0x2478 11785#>0x402 beshort < 100 11786#>0x402 beshort > -1 Minix filesystem, V2, 30 char names 11787#>0x1e string minix \b, bootable 11788#0x410 beshort 0x2478 11789#>0x402 beshort !0 Minix filesystem, V2, 30 char names (big endian) 11790#>0x1e string minix \b, bootable 11791# Weak Magic! this is MD 11792#0x418 leshort 0x4d5a 11793#>0x402 beshort <100 11794#>>0x402 beshort > -1 Minix filesystem, V3, 60 char names 11795 11796# SGI disk labels - Nathan Scott <nathans@debian.org> 117970 belong 0x0BE5A941 SGI disk label (volume header) 11798 11799# SGI XFS filesystem - Nathan Scott <nathans@debian.org> 118000 belong 0x58465342 SGI XFS filesystem data 11801>0x4 belong x (blksz %d, 11802>0x68 beshort x inosz %d, 11803>0x64 beshort ^0x2004 v1 dirs) 11804>0x64 beshort &0x2004 v2 dirs) 11805 11806############################################################################ 11807# Minix-ST kernel floppy 118080x800 belong 0x46fc2700 Atari-ST Minix kernel image 11809# https://en.wikipedia.org/wiki/BIOS_parameter_block 11810# floppies with valid BPB and any instruction at beginning 11811>19 string \240\005\371\005\0\011\0\2\0 \b, 720k floppy 11812>19 string \320\002\370\005\0\011\0\1\0 \b, 360k floppy 11813 11814############################################################################ 11815# Hmmm, is this a better way of detecting _standard_ floppy images ? 1181619 string \320\002\360\003\0\011\0\1\0 DOS floppy 360k 11817>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1181819 string \240\005\371\003\0\011\0\2\0 DOS floppy 720k 11819>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1182019 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k 11821>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 11822 1182319 string \240\005\371\005\0\011\0\2\0 DOS floppy 720k, IBM 11824>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 1182519 string \100\013\371\005\0\011\0\2\0 DOS floppy 1440k, mkdosfs 11826>0x1FE leshort 0xAA55 \b, DOS/MBR hard disk boot sector 11827 1182819 string \320\002\370\005\0\011\0\1\0 Atari-ST floppy 360k 1182919 string \240\005\371\005\0\011\0\2\0 Atari-ST floppy 720k 11830# | | | | | 11831# | | | | heads 11832# | | | sectors/track 11833# | | sectors/FAT 11834# | media descriptor 11835# BPB: sectors 11836 11837# Valid media descriptor bytes for MS-DOS: 11838# 11839# Byte Capacity Media Size and Type 11840# ------------------------------------------------- 11841# 11842# F0 2.88 MB 3.5-inch, 2-sided, 36-sector 11843# F0 1.44 MB 3.5-inch, 2-sided, 18-sector 11844# F9 720K 3.5-inch, 2-sided, 9-sector 11845# F9 1.2 MB 5.25-inch, 2-sided, 15-sector 11846# FD 360K 5.25-inch, 2-sided, 9-sector 11847# FF 320K 5.25-inch, 2-sided, 8-sector 11848# FC 180K 5.25-inch, 1-sided, 9-sector 11849# FE 160K 5.25-inch, 1-sided, 8-sector 11850# FE 250K 8-inch, 1-sided, single-density 11851# FD 500K 8-inch, 2-sided, single-density 11852# FE 1.2 MB 8-inch, 2-sided, double-density 11853# F8 ----- Fixed disk 11854# 11855# FC xxxK Apricot 70x1x9 boot disk. 11856# 11857# Originally a bitmap: 11858# xxxxxxx0 Not two sided 11859# xxxxxxx1 Double sided 11860# xxxxxx0x Not 8 SPT 11861# xxxxxx1x 8 SPT 11862# xxxxx0xx Not Removable drive 11863# xxxxx1xx Removable drive 11864# 11111xxx Must be one. 11865# 11866# But now it's rather random: 11867# 111111xx Low density disk 11868# 00 SS, Not 8 SPT 11869# 01 DS, Not 8 SPT 11870# 10 SS, 8 SPT 11871# 11 DS, 8 SPT 11872# 11873# 11111001 Double density 3 1/2 floppy disk, high density 5 1/4 11874# 11110000 High density 3 1/2 floppy disk 11875# 11111000 Hard disk any format 11876# 11877 11878# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013 11879# https://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions 11880# Too Weak. 11881#512 ubelong&0xE0ffff00 0xE0ffff00 11882# without valid Media descriptor in place of BPB, cases with are done at other places 11883#>21 ubyte <0xE5 floppy with old FAT filesystem 11884# but valid Media descriptor at begin of FAT 11885#>>512 ubyte =0xed 720k 11886#>>512 ubyte =0xf0 1440k 11887#>>512 ubyte =0xf8 720k 11888#>>512 ubyte =0xf9 1220k 11889#>>512 ubyte =0xfa 320k 11890#>>512 ubyte =0xfb 640k 11891#>>512 ubyte =0xfc 180k 11892# look like an old DOS directory entry 11893#>>>0xA0E ubequad 0 11894#>>>>0xA00 ubequad !0 11895#!:mime application/x-ima 11896#>>512 ubyte =0xfd 11897# look for 2nd FAT at different location to distinguish between 360k and 500k 11898#>>>0x600 ubelong&0xE0ffff00 0xE0ffff00 360k 11899#>>>0x500 ubelong&0xE0ffff00 0xE0ffff00 500k 11900#>>>0xA0E ubequad 0 11901#!:mime application/x-ima 11902#>>512 ubyte =0xfe 11903#>>>0x400 ubelong&0xE0ffff00 0xE0ffff00 160k 11904#>>>>0x60E ubequad 0 11905#>>>>>0x600 ubequad !0 11906#!:mime application/x-ima 11907#>>>0xC00 ubelong&0xE0ffff00 0xE0ffff00 1200k 11908#>>512 ubyte =0xff 320k 11909#>>>0x60E ubequad 0 11910#>>>>0x600 ubequad !0 11911#!:mime application/x-ima 11912#>>512 ubyte x \b, Media descriptor 0x%x 11913# without x86 jump instruction 11914#>>0 ulelong&0x804000E9 !0x000000E9 11915# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV 11916#>>>0 ubequad 0xfabce701b8c0078e \b, MS-DOS 1.12 bootloader 11917# IOSYS.COM+MSDOS.COM 11918#>>>>0xc4 use 2xDOS-filename 11919#>>0 ulelong&0x804000E9 =0x000000E9 11920# only x86 short jump instruction found 11921#>>>0 ubyte =0xEB 11922#>>>>1 ubyte x \b, code offset 0x%x+2 11923# https://thestarman.pcministry.com/DOS/ibm100/Boot.htm 11924# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0 11925#>>>>(1.b+2) ubequad 0xfa8cc88ed8ba0000 \b, PC-DOS 1.0 bootloader 11926# ibmbio.com+ibmdos.com 11927#>>>>>0x176 use DOS-filename 11928#>>>>>0x181 ubyte x \b+ 11929#>>>>>0x182 use DOS-filename 11930# https://thestarman.pcministry.com/DOS/ibm110/Boot.htm 11931# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV 11932#>>>>(1.b+2) ubequad 0xfa8cc88ed833d28e \b, PC-DOS 1.1 bootloader 11933# ibmbio.com+ibmdos.com 11934#>>>>>0x18b use DOS-filename 11935#>>>>>0x196 ubyte x \b+ 11936#>>>>>0x197 use DOS-filename 11937# https://en.wikipedia.org/wiki/Zenith_Data_Systems 11938# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6 11939#>>>>(1.b+2) ubequad 0xbbc0078ed3bcc601 \b, Zenith Data Systems MS-DOS 1.25 bootloader 11940# IO.SYS+MSDOS.SYS 11941#>>>>>0x20 use 2xDOS-filename 11942# https://en.wikipedia.org/wiki/Corona_Data_Systems 11943# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX; 11944#>>>>(1.b+2) ubequad 0x8cc88ed8fa8ed0bc \b, MS-DOS 1.25 bootloader 11945# IO.SYS+MSDOS.SYS 11946#>>>>>0x69 use 2xDOS-filename 11947# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00; 11948#>>>>(1.b+2) ubequad 0xfa0e17bc007cb860 \b, MS-DOS 2.11 bootloader 11949# defect IO.SYS+MSDOS.SYS ? 11950#>>>>>0x162 use 2xDOS-filename 11951 119520 name cdrom 11953>38913 string !NSR0 ISO 9660 CD-ROM filesystem data 11954!:mime application/x-iso9660-image 11955!:ext iso/iso9660 11956>38913 string NSR0 UDF filesystem data 11957!:mime application/x-iso9660-image 11958!:ext iso/udf 11959>>38917 string 1 (version 1.0) 11960>>38917 string 2 (version 1.5) 11961>>38917 string 3 (version 2.0) 11962>>38917 byte >0x33 (unknown version, ID 0x%X) 11963>>38917 byte <0x31 (unknown version, ID 0x%X) 11964# The next line is not necessary because the MBR staff is done looking for boot signature 11965>0x1FE leshort 0xAA55 (DOS/MBR boot sector) 11966# "application id" which appears to be used as a volume label 11967>32808 string/T >\0 '%s' 11968>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 1196937633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 11970!:mime application/x-iso9660-image 1197132777 string CDROM High Sierra CD-ROM filesystem data 11972 11973# CDROM Filesystems 11974# https://en.wikipedia.org/wiki/ISO_9660 11975# Modified for UDF by gerardo.cacciari@gmail.com 1197632769 string CD001 11977# mime line at that position does not work 11978# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51) 11979#!:strength -11 11980# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51) 11981!:strength +34 11982>0 use cdrom 11983 11984# URL: https://en.wikipedia.org/wiki/NRG_(file_format) 11985# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/ 11986# 11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh 11987# From: Joerg Jenderek 11988# Note: Only for nero disc with once (DAO) type after 300 KB header 11989339969 string CD001 Nero CD image at 0x4B000 11990!:mime application/x-nrg 11991!:ext nrg 11992>307200 use cdrom 11993 11994# .cso files 11995# Reference: https://pismotec.com/ciso/ciso.h 11996# NOTE: There are two other formats with the same magic but 11997# completely incompatible specifications: 11998# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h 11999# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h 120000 string CISO 12001# Other fields are used to determine what type of CISO this is: 12002# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size) 12003# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size) 12004# - 0x10 == 0x00004000: For >2GB files using maxcso... 12005# https://github.com/unknownbrackets/maxcso/issues/26 12006# - None of the above: Compact ISO. 12007>4 lelong !0 12008>>4 lelong !0x200000 12009>>>16 lelong !0x800 12010>>>>16 lelong !0x4000 Compressed ISO CD image 12011 12012# cramfs filesystem - russell@coker.com.au 120130 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian 12014>4 lelong x size %u 12015>8 lelong &1 version #2 12016>8 lelong &2 sorted_dirs 12017>8 lelong &4 hole_support 12018>32 lelong x CRC 0x%x, 12019>36 lelong x edition %u, 12020>40 lelong x %u blocks, 12021>44 lelong x %u files 12022 120230 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian 12024>4 belong x size %u 12025>8 belong &1 version #2 12026>8 belong &2 sorted_dirs 12027>8 belong &4 hole_support 12028>32 belong x CRC 0x%x, 12029>36 belong x edition %u, 12030>40 belong x %u blocks, 12031>44 belong x %u files 12032 12033# reiserfs - russell@coker.com.au 120340x10034 string ReIsErFs ReiserFS V3.5 120350x10034 string ReIsEr2Fs ReiserFS V3.6 120360x10034 string ReIsEr3Fs ReiserFS V3.6.19 12037>0x1002c leshort x block size %d 12038>0x10032 leshort &2 (mounted or unclean) 12039>0x10000 lelong x num blocks %d 12040>0x10040 lelong 1 tea hash 12041>0x10040 lelong 2 yura hash 12042>0x10040 lelong 3 r5 hash 12043 12044# JFFS - russell@coker.com.au 120450 lelong 0x34383931 Linux Journalled Flash File system, little endian 120460 belong 0x34383931 Linux Journalled Flash File system, big endian 12047 12048# EST flat binary format (which isn't, but anyway) 12049# From: Mark Brown <broonie@sirena.org.uk> 120500 string ESTFBINR EST flat binary 12051 12052# Aculab VoIP firmware 12053# From: Mark Brown <broonie@sirena.org.uk> 120540 string VoIP\ Startup\ and Aculab VoIP firmware 12055>35 string x format %s 12056 12057# From: Mark Brown <broonie@sirena.org.uk> [old] 12058# From: Behan Webster <behanw@websterwood.com> 120590 belong 0x27051956 u-boot legacy uImage, 12060>32 string x %s, 12061>28 byte 0 Invalid os/ 12062>28 byte 1 OpenBSD/ 12063>28 byte 2 NetBSD/ 12064>28 byte 3 FreeBSD/ 12065>28 byte 4 4.4BSD/ 12066>28 byte 5 Linux/ 12067>28 byte 6 SVR4/ 12068>28 byte 7 Esix/ 12069>28 byte 8 Solaris/ 12070>28 byte 9 Irix/ 12071>28 byte 10 SCO/ 12072>28 byte 11 Dell/ 12073>28 byte 12 NCR/ 12074>28 byte 13 LynxOS/ 12075>28 byte 14 VxWorks/ 12076>28 byte 15 pSOS/ 12077>28 byte 16 QNX/ 12078>28 byte 17 Firmware/ 12079>28 byte 18 RTEMS/ 12080>28 byte 19 ARTOS/ 12081>28 byte 20 Unity OS/ 12082>28 byte 21 INTEGRITY/ 12083>29 byte 0 \bInvalid CPU, 12084>29 byte 1 \bAlpha, 12085>29 byte 2 \bARM, 12086>29 byte 3 \bIntel x86, 12087>29 byte 4 \bIA64, 12088>29 byte 5 \bMIPS, 12089>29 byte 6 \bMIPS 64-bit, 12090>29 byte 7 \bPowerPC, 12091>29 byte 8 \bIBM S390, 12092>29 byte 9 \bSuperH, 12093>29 byte 10 \bSparc, 12094>29 byte 11 \bSparc 64-bit, 12095>29 byte 12 \bM68K, 12096>29 byte 13 \bNios-32, 12097>29 byte 14 \bMicroBlaze, 12098>29 byte 15 \bNios-II, 12099>29 byte 16 \bBlackfin, 12100>29 byte 17 \bAVR32, 12101>29 byte 18 \bSTMicroelectronics ST200, 12102>29 byte 19 \bSandbox architecture, 12103>29 byte 20 \bANDES Technology NDS32, 12104>29 byte 21 \bOpenRISC 1000, 12105>29 byte 22 \bARM 64-bit, 12106>29 byte 23 \bDesignWare ARC, 12107>29 byte 24 \bx86_64, 12108>29 byte 25 \bXtensa, 12109>30 byte 0 Invalid Image 12110>30 byte 1 Standalone Program 12111>30 byte 2 OS Kernel Image 12112>30 byte 3 RAMDisk Image 12113>30 byte 4 Multi-File Image 12114>30 byte 5 Firmware Image 12115>30 byte 6 Script File 12116>30 byte 7 Filesystem Image (any type) 12117>30 byte 8 Binary Flat Device Tree BLOB 12118>31 byte 0 (Not compressed), 12119>31 byte 1 (gzip), 12120>31 byte 2 (bzip2), 12121>31 byte 3 (lzma), 12122>12 belong x %d bytes, 12123>8 bedate x %s, 12124>16 belong x Load Address: 0x%08X, 12125>20 belong x Entry Point: 0x%08X, 12126>4 belong x Header CRC: 0x%08X, 12127>24 belong x Data CRC: 0x%08X 12128 12129# JFFS2 file system 121300 leshort 0x1984 Linux old jffs2 filesystem data little endian 121310 leshort 0x1985 Linux jffs2 filesystem data little endian 12132 12133# Squashfs 121340 string sqsh Squashfs filesystem, big endian, 12135>28 beshort x version %d. 12136>30 beshort x \b%d, 12137>28 beshort <3 12138>>8 belong x %d bytes, 12139>28 beshort >2 12140>>28 beshort <4 12141>>>63 bequad x %lld bytes, 12142>>28 beshort >3 12143>>>40 bequad x %lld bytes, 12144#>>67 belong x %d bytes, 12145>4 belong x %d inodes, 12146>28 beshort <2 12147>>32 beshort x blocksize: %d bytes, 12148>28 beshort >1 12149>>28 beshort <4 12150>>>51 belong x blocksize: %d bytes, 12151>>28 beshort >3 12152>>>12 belong x blocksize: %d bytes, 12153>28 beshort <4 12154>>39 bedate x created: %s 12155>28 beshort >3 12156>>8 bedate x created: %s 121570 string hsqs Squashfs filesystem, little endian, 12158>28 leshort x version %d. 12159>30 leshort x \b%d, 12160>28 leshort <3 12161>>8 lelong x %d bytes, 12162>28 leshort >2 12163>>28 leshort <4 12164>>>63 lequad x %lld bytes, 12165>>28 leshort >3 12166>>>40 lequad x %lld bytes, 12167#>>63 lelong x %d bytes, 12168>4 lelong x %d inodes, 12169>28 leshort <2 12170>>32 leshort x blocksize: %d bytes, 12171>28 leshort >1 12172>>28 leshort <4 12173>>>51 lelong x blocksize: %d bytes, 12174>>28 leshort >3 12175>>>12 lelong x blocksize: %d bytes, 12176>28 leshort <4 12177>>39 ledate x created: %s 12178>28 leshort >3 12179>>8 ledate x created: %s 12180 12181# AFS Dump Magic 12182# From: Ty Sarna <tsarna@sarna.org> 121830 string \x01\xb3\xa1\x13\x22 AFS Dump 12184>&0 belong x (v%d) 12185>>&0 byte 0x76 12186>>>&0 belong x Vol %d, 12187>>>>&0 byte 0x6e 12188>>>>>&0 string x %s 12189>>>>>>&1 byte 0x74 12190>>>>>>>&0 beshort 2 12191>>>>>>>>&4 bedate x on: %s 12192>>>>>>>>&0 bedate =0 full dump 12193>>>>>>>>&0 bedate !0 incremental since: %s 12194 12195#---------------------------------------------------------- 12196#delta ISO Daniel Novotny (dnovotny@redhat.com) 121970 string DISO Delta ISO data 12198!:strength +50 12199>4 belong x version %d 12200 12201# VMS backup savesets - gerardo.cacciari@gmail.com 12202# 122034 string \x01\x00\x01\x00\x01\x00 12204>(0.s+16) string \x01\x01 12205>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data 12206>>>40 lelong x (block size %d, 12207>>>49 string >\0 original name '%s', 12208>>>2 short 1024 VAX generated) 12209>>>2 short 2048 AXP generated) 12210>>>2 short 4096 I64 generated) 12211 12212# Summary: Oracle Clustered Filesystem 12213# Created by: Aaron Botsis <redhat@digitalmafia.org> 122148 string OracleCFS Oracle Clustered Filesystem, 12215>4 long x rev %d 12216>0 long x \b.%d, 12217>560 string x label: %.64s, 12218>136 string x mountpoint: %.128s 12219 12220# Summary: Oracle ASM tagged volume 12221# Created by: Aaron Botsis <redhat@digitalmafia.org> 1222232 string ORCLDISK Oracle ASM Volume, 12223>40 string x Disk Name: %0.12s 1222432 string ORCLCLRD Oracle ASM Volume (cleared), 12225>40 string x Disk Name: %0.12s 12226 12227# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org> 122288 string OracleCFS Oracle Clustered Filesystem, 12229>4 long x rev %d 12230>0 long x \b.%d, 12231>560 string x label: %.64s, 12232>136 string x mountpoint: %.128s 12233 12234# Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org> 1223532 string ORCLDISK Oracle ASM Volume, 12236>40 string x Disk Name: %0.12s 1223732 string ORCLCLRD Oracle ASM Volume (cleared), 12238>40 string x Disk Name: %0.12s 12239 12240# Compaq/HP RILOE floppy image 12241# From: Dirk Jagdmann <doj@cubic.org> 122420 string CPQRFBLO Compaq/HP RILOE floppy image 12243 12244#------------------------------------------------------------------------------ 12245# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours). 12246# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes, 12247# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com 12248# 122491008 string DECFILE11 Files-11 On-Disk Structure 12250>525 byte x (ODS-%d); 12251>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system; 12252>1017 string B 12253>>525 byte 2 VAX/VMS or OpenVMS file system; 12254>>525 byte 5 OpenVMS Alpha or Itanium file system; 12255>984 string x volume label is '%-12.12s' 12256 12257# From: Thomas Klausner <wiz@NetBSD.org> 12258# https://filext.com/file-extension/DAA 12259# describes the daa file format. The magic would be: 122600 string DAA\x0\x0\x0\x0\x0 PowerISO Direct-Access-Archive 12261 12262# From Albert Cahalan <acahalan@gmail.com> 12263# really le32 operation,destination,payloadsize (but quite predictable) 12264# 01 00 00 00 00 00 00 c0 00 02 00 00 122650 string \1\0\0\0\0\0\0\300\0\2\0\0 Marvell Libertas firmware 12266 12267# From Eric Sandeen 12268# GFS2 122690x10000 belong 0x01161970 12270>0x10018 belong 0x0000051d GFS1 Filesystem 12271>>0x10024 belong x (blocksize %d, 12272>>0x10060 string >\0 lockproto %s) 12273>0x10018 belong 0x00000709 GFS2 Filesystem 12274>>0x10024 belong x (blocksize %d, 12275>>0x10060 string >\0 lockproto %s) 12276 12277# Russell Coker <russell@coker.com.au> 122780x10040 string _BHRfS_M BTRFS Filesystem 12279>0x1012b string >\0 label "%s", 12280>0x10090 lelong x sectorsize %d, 12281>0x10094 lelong x nodesize %d, 12282>0x10098 lelong x leafsize %d, 12283>0x10020 belong x UUID=%08x- 12284>0x10024 beshort x \b%04x- 12285>0x10026 beshort x \b%04x- 12286>0x10028 beshort x \b%04x- 12287>0x1002a beshort x \b%04x 12288>0x1002c belong x \b%08x, 12289>0x10078 lequad x %lld/ 12290>0x10070 lequad x \b%lld bytes used, 12291>0x10088 lequad x %lld devices 12292 12293# dvdisaster's .ecc 12294# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 122950 string *dvdisaster* dvdisaster error correction file 12296 12297# xfs metadump image 12298# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 12299# but can we do the << ? For now it's always 512 (0x200) anyway. 123000 string XFSM 12301>0x200 string XFSB XFS filesystem metadump image 12302 12303# Type: CROM filesystem 12304# From: Werner Fink <werner@suse.de> 123050 string CROMFS CROMFS 12306>6 string >\0 \b version %2.2s, 12307>8 ulequad >0 \b block data at %lld, 12308>16 ulequad >0 \b fblock table at %lld, 12309>24 ulequad >0 \b inode table at %lld, 12310>32 ulequad >0 \b root at %lld, 12311>40 ulelong >0 \b fblock size = %d, 12312>44 ulelong >0 \b block size = %d, 12313>48 ulequad >0 \b bytes = %lld 12314 12315# Type: xfs metadump image 12316# From: Daniel Novotny <dnovotny@redhat.com> 12317# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog 12318# but can we do the << ? For now it's always 512 (0x200) anyway. 123190 string XFSM 12320>0x200 string XFSB XFS filesystem metadump image 12321 12322# Type: delta ISO 12323# From: Daniel Novotny <dnovotny@redhat.com> 123240 string DISO Delta ISO data, 12325>4 belong x version %d 12326 12327# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.) 12328# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags. 12329# From: Adam Buchbinder <adam.buchbinder@gmail.com> 123300x8000 string JFS1 12331# Because it's text-only magic, check a binary value (version) to be sure. 12332# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be 12333# mountable. 12334>&0 lelong <3 JFS2 filesystem image 12335# Label is followed by a UUID; we have to limit string length to avoid 12336# appending the UUID in the case of a 16-byte label. 12337>>&144 regex [\x20-\x7E]{1,16} (label "%s") 12338>>&0 lequad x \b, %lld blocks 12339>>&8 lelong x \b, blocksize %d 12340>>&32 lelong&0x00000006 >0 (dirty) 12341>>&36 lelong >0 (compressed) 12342 12343# LFS 123440 lelong 0x070162 LFS filesystem image 12345>4 lelong 1 version 1, 12346>>8 lelong x \b blocks %u, 12347>>12 lelong x \b blocks per segment %u, 12348>4 lelong 2 version 2, 12349>>8 lelong x \b fragments %u, 12350>>12 lelong x \b bytes per segment %u, 12351>16 lelong x \b disk blocks %u, 12352>20 lelong x \b block size %u, 12353>24 lelong x \b fragment size %u, 12354>28 lelong x \b fragments per block %u, 12355>32 lelong x \b start for free list %u, 12356>36 lelong x \b number of free blocks %d, 12357>40 lelong x \b number of files %u, 12358>44 lelong x \b blocks available for writing %d, 12359>48 lelong x \b inodes in cache %d, 12360>52 lelong x \b inode file disk address 0x%x, 12361>56 lelong x \b inode file inode number %u, 12362>60 lelong x \b address of last segment written 0x%x, 12363>64 lelong x \b address of next segment to write 0x%x, 12364>68 lelong x \b address of current segment written 0x%x 12365 123660 string td\000 floppy image data (TeleDisk, compressed) 123670 string TD\000 floppy image data (TeleDisk) 12368 123690 string CQ\024 floppy image data (CopyQM, 12370>16 leshort x %d sectors, 12371>18 leshort x %d heads.) 12372 123730 string ACT\020Apricot\020disk\020image\032\004 floppy image data (ApriDisk) 12374 123750 beshort 0xAA58 floppy image data (IBM SaveDskF, old) 123760 beshort 0xAA59 floppy image data (IBM SaveDskF) 123770 beshort 0xAA5A floppy image data (IBM SaveDskF, compressed) 12378 123790 string \074CPM_Disk\076 disk image data (YAZE) 12380 12381# ReFS 12382# Richard W.M. Jones <rjones@redhat.com> 123830 string \0\0\0ReFS\0 ReFS filesystem image 12384 12385# EFW encase image file format: 12386# Gregoire Passault 12387# http://www.forensicswiki.org/wiki/Encase_image_file_format 123880 string EVF\x09\x0d\x0a\xff\x00 EWF/Expert Witness/EnCase image file format 12389 12390# UBIfs 12391# Linux kernel sources: fs/ubifs/ubifs-media.h 123920 lelong 0x06101831 12393>0x16 leshort 0 UBIfs image 12394>0x08 lequad x \b, sequence number %llu 12395>0x10 leshort x \b, length %u 12396>0x04 lelong x \b, CRC 0x%08x 12397 123980 lelong 0x23494255 12399>0x04 leshort <2 12400>0x05 string \0\0\0 12401>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 12402>0x04 leshort x UBI image, version %u 12403 12404# NEC PC-88 2D disk image 12405# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 124060x20 ulelong&0xFFFFFEFF 0x2A0 12407>0x10 string \0\0\0\0\0\0\0\0\0\0 12408>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 12409>>>0x1A ubyte&0xEF 0 12410>>>>0x1B ubyte&0x8F 0 12411>>>>>0x1B ubyte&70 <0x40 12412>>>>>>0x1C ulelong >0x21 12413>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 12414>>>>>>>>0x1B ubyte 0 \b, media=2D 12415>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 12416>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 12417>>>>>>>>0x1B ubyte 0x30 \b, media=1D 12418>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 12419>>>>>>>>0x1A ubyte 0x10 \b, write-protected 12420 12421# HDD Raw Copy Tool disk image, file extension: .imgc 12422# From Benjamin Vanheuverzwijn <bvanheu@gmail.com> 124230 pstring HDD\ Raw\ Copy\ Tool %s 12424>0x100 pstring x %s 12425>0x200 pstring x - HD model: %s 12426#>0x300 pstring x unknown %s 12427>0x400 pstring x serial: %s 12428#>0x500 pstring x unknown: %s 12429!:ext imgc 12430 12431#------------------------------------------------------------------------------ 12432# $File: finger,v 1.3 2019/04/19 00:42:27 christos Exp $ 12433# fingerprint: file(1) magic for fingerprint data 12434# XPM bitmaps) 12435# 12436 12437# https://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c 12438 124390 string FP1 libfprint fingerprint data V1 12440>3 beshort x \b, driver_id %x 12441>5 belong x \b, devtype %x 12442 124430 string FP2 libfprint fingerprint data V2 12444>3 beshort x \b, driver_id %x 12445>5 belong x \b, devtype %x 12446 12447#------------------------------------------------------------------------------ 12448# $File: flash,v 1.15 2019/04/19 00:42:27 christos Exp $ 12449# flash: file(1) magic for Macromedia Flash file format 12450# 12451# See 12452# 12453# https://www.macromedia.com/software/flash/open/ 12454# https://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\ 12455# en/devnet/swf/pdf/swf-file-format-spec.pdf page 27 12456# 12457 124580 name swf-details 12459 12460>0 string F 12461>>8 byte&0xfd 0x08 Macromedia Flash data 12462!:mime application/x-shockwave-flash 12463>>>3 byte x \b, version %d 12464>>8 byte&0xfe 0x10 Macromedia Flash data 12465!:mime application/x-shockwave-flash 12466>>>3 byte x \b, version %d 12467>>8 byte 0x18 Macromedia Flash data 12468!:mime application/x-shockwave-flash 12469>>>3 byte x \b, version %d 12470>>8 beshort&0xff87 0x2000 Macromedia Flash data 12471!:mime application/x-shockwave-flash 12472>>>3 byte x \b, version %d 12473>>8 beshort&0xffe0 0x3000 Macromedia Flash data 12474!:mime application/x-shockwave-flash 12475>>>3 byte x \b, version %d 12476>>8 byte&0x7 0 12477>>>8 ubyte >0x2f 12478>>>>9 ubyte <0x20 Macromedia Flash data 12479!:mime application/x-shockwave-flash 12480>>>>>3 byte x \b, version %d 12481 12482>0 string C 12483>>8 byte 0x78 Macromedia Flash data (compressed) 12484!:mime application/x-shockwave-flash 12485>>>3 byte x \b, version %d 12486 12487>0 string Z 12488>>8 byte 0x5d Macromedia Flash data (lzma compressed) 12489!:mime application/x-shockwave-flash 12490>>>3 byte x \b, version %d 12491 12492 124931 string WS 12494>4 ulelong >14 12495>>3 ubyte !0 12496>>>0 use swf-details 12497 12498# From: Cal Peake <cp@absolutedigital.net> 124990 string FLV\x01 Macromedia Flash Video 12500!:mime video/x-flv 12501 12502# 12503# Yosu Gomez 125040 string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document 125050 string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document 12506# From Dave Wilson 125070 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document 12508 12509#------------------------------------------------------------------------------ 12510# $File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $ 12511# flif: Magic data for file(1) command. 12512# FLIF (Free Lossless Image Format) 12513 125140 string FLIF FLIF 12515>4 string <H image data 12516>>6 beshort x \b, %u 12517>>8 beshort x \bx%u 12518>>5 string 1 \b, 8-bit/color, 12519>>5 string 2 \b, 16-bit/color, 12520>>4 string 1 \b, grayscale, non-interlaced 12521>>4 string 3 \b, RGB, non-interlaced 12522>>4 string 4 \b, RGBA, non-interlaced 12523>>4 string A \b, grayscale 12524>>4 string C \b, RGB, interlaced 12525>>4 string D \b, RGBA, interlaced 12526>4 string >H \b, animation data 12527>>5 ubyte <255 \b, %i frames 12528>>>7 beshort x \b, %u 12529>>>9 beshort x \bx%u 12530>>>6 string =1 \b, 8-bit/color 12531>>>6 string =2 \b, 16-bit/color 12532>>5 ubyte 0xFF 12533>>>6 beshort x \b, %i frames, 12534>>>9 beshort x \b, %u 12535>>>11 beshort x \bx%u 12536>>>8 string =1 \b, 8-bit/color 12537>>>8 string =2 \b, 16-bit/color 12538>>4 string =Q \b, grayscale, non-interlaced 12539>>4 string =S \b, RGB, non-interlaced 12540>>4 string =T \b, RGBA, non-interlaced 12541>>4 string =a \b, grayscale 12542>>4 string =c \b, RGB, interlaced 12543>>4 string =d \b, RGBA, interlaced 12544 12545#------------------------------------------------------------------------------ 12546# $File: fonts,v 1.41 2019/05/05 16:44:04 christos Exp $ 12547# fonts: file(1) magic for font data 12548# 125490 search/1 FONT ASCII vfont text 125500 short 0436 Berkeley vfont data 125510 short 017001 byte-swapped Berkeley vfont data 12552 12553# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com 125540 string %!PS-AdobeFont-1. PostScript Type 1 font text 12555>20 string >\0 (%s) 125566 string %!PS-AdobeFont-1. PostScript Type 1 font program data 125570 string %!FontType1 PostScript Type 1 font program data 125586 string %!FontType1 PostScript Type 1 font program data 125590 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text 12560 12561# Summary: PostScript Type 1 Printer Font Metrics 12562# URL: https://en.wikipedia.org/wiki/PostScript_fonts 12563# Reference: https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf 12564# Modified by: Joerg Jenderek 12565# Note: moved from ./msdos magic 12566# dfVersion 256=0100h 125670 uleshort 0x0100 12568# GRR: line above is too general as it catches also TrueType font, 12569# raw G3 data FAX, WhatsApp encrypted and Panorama database 12570# dfType 129=0081h 12571>66 uleshort 0x0081 12572# dfVertRes 300=012Ch not needed as additional test 12573#>>70 uleshort 0x012c 12574# dfHorizRes 300=012Ch 12575#>>>72 uleshort 0x012c 12576# dfDriverInfo points to postscript information section 12577>>(101.l) string/c Postscript Printer Font Metrics 12578# above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID 12579!:mime application/x-font-pfm 12580# AppleShare Print Server 12581#!:apple ASPS???? 12582!:ext pfm 12583# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking 12584#>>>6 string >\060 - %-.60s 12585# dfDriverInfo 12586>>>139 ulelong >0 12587# often abbreviated and same as filename 12588>>>>(139.l) string x %s 12589# dfSize 12590>>>2 ulelong x \b, %d bytes 12591# dfFace 210=D2h 9Eh 12592>>>105 ulelong >0 12593# Windows font name 12594>>>>(105.l) string x \b, %s 12595# dfItalic 12596>>>80 ubyte 1 italic 12597# dfUnderline 12598>>>81 ubyte 1 underline 12599# dfStrikeOut 12600>>>82 ubyte 1 strikeout 12601# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc 12602>>>83 uleshort >699 bold 12603# dfPitchAndFamily 16 17 48 49 64 65 12604>>>90 ubyte 16 serif 12605>>>90 ubyte 17 serif proportional 12606#>>>90 ubyte 48 other 12607>>>90 ubyte 49 proportional 12608>>>90 ubyte 64 script 12609>>>90 ubyte 65 script proportional 12610 12611# X11 font files in SNF (Server Natural Format) format 12612# updated by Joerg Jenderek at Feb 2013 12613# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm 126140 belong 00000004 X11 SNF font data, MSB first 12615#>104 belong 00000004 X11 SNF font data, MSB first 12616!:mime application/x-font-sfn 12617# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX 126180 lelong 00000004 12619>104 lelong 00000004 X11 SNF font data, LSB first 12620!:mime application/x-font-sfn 12621 12622# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 126230 search/1 STARTFONT\ X11 BDF font text 12624 12625# From: Joerg Jenderek 12626# URL: https://grub.gibibit.com/New_font_format 12627# Reference: util/grub-mkfont.c 12628# include/grub/fontformat.h 12629# FONT_FORMAT_SECTION_NAMES_FILE 126300 string FILE 12631# FONT_FORMAT_PFF2_MAGIC 12632>8 string PFF2 12633# leng 4 only at the moment 12634>>4 ubelong 4 12635# FONT_FORMAT_SECTION_NAMES_FONT_NAME 12636>>>12 string NAME GRUB2 font 12637!:mime application/x-font-pf2 12638!:ext pf2 12639# length of font_name 12640>>>>16 ubelong >0 12641# font_name 12642>>>>>20 string >\0 "%-s" 12643 12644# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 12645# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 126460 string \001fcp X11 Portable Compiled Font data, 12647>12 lelong ^0x08 bit: LSB, 12648>12 lelong &0x08 bit: MSB, 12649>12 lelong ^0x04 byte: LSB first 12650>12 lelong &0x04 byte: MSB first 126510 string D1.0\015 X11 Speedo font data 12652 12653#------------------------------------------------------------------------------ 12654# FIGlet fonts and controlfiles 12655# From figmagic supplied with Figlet version 2.2 12656# "David E. O'Brien" <obrien@FreeBSD.ORG> 126570 string flf FIGlet font 12658>3 string >2a version %-2.2s 126590 string flc FIGlet controlfile 12660>3 string >2a version %-2.2s 12661 12662# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) 12663# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 126640 belong 0x14025919 libGrx font data, 12665>8 leshort x %dx 12666>10 leshort x \b%d 12667>40 string x %s 12668# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) 126690 belong 0xff464f4e DOS code page font data collection 126707 belong 0x00454741 DOS code page font data 126717 belong 0x00564944 DOS code page font data (from Linux?) 126724098 string DOSFONT DOSFONT2 encrypted font data 12673 12674# From: Joerg Jenderek 12675# URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font 12676# Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt 12677# 12678# usual case with lightening mask and skewing mask 5555h~UU 1267962 ulelong 0x55555555 12680>0 use gdos-font 12681# BOX18.GFT COWBOY30.GFT ROYALK30.GFT 1268262 ulelong 0 12683# skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size 12684>2 uleshort >2 12685# skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 48 12686>>2 uleshort <49 12687# skip MS Windows ICO ./msdos by looking for valid face name 12688>>>4 ubeshort >0x1F00 12689# skip DOS executable BACKM212.COM by looking for horizontal offset table after header 12690#>>>>68 ulelong >87 OFFSET_OK 12691>>>>0 use gdos-font 126920 name gdos-font 12693>0 uleshort x GEM GDOS font 12694!:mime application/x-font-gdos 12695# also .eps found like AA070GEP.EPS AI360GEP.EPS 12696!:ext fnt/gtf 12697# font name like University Bold 12698>4 string x %.32s 12699# face size in points 3-48 12700>2 uleshort x %u 12701# face ID (must be unique) 12702>0 uleshort x \b, ID 0x%4.4x 12703# lowest character index in face (usually 32 for disk-loaded fonts). 12704#>36 uleshort x \b, low character index %u 12705# width of the widest character 12706#>50 uleshort x \b, %u char width 12707# width of the widest character cell 12708#>52 uleshort x \b, %u cell width 12709# thickening size 12710#>58 uleshort x \b, %u thick 12711# lightening mask to eliminate pixels, usually 5555h 12712>62 uleshort !0x5555 \b, lightening mask 0x%x 12713# skewing mask to determine when to perform additional rotation when skewing, usually 5555h 12714>64 uleshort !0x5555 \b, skewing mask 0x%x 12715# offset to horizontal offset table 58h~88 5eh 12716#>68 ulelong >88 \b, 0x%x horizontal table offset 12717# offset character offset table 12718#>72 ulelong x \b, 0x%x coffset 12719# offset to font data 12720#>72 ulelong x \b, 0x%x foffset 12721# form width in bytes 12722#>80 uleshort x \b, %u fwidth 12723# pointer to the next font, set by GDOS after loading 12724#>84 ulelong x \b, 0x%x noffset 12725 12726# downloadable fonts for browser (prints type) anthon@mnt.org 12727# https://tools.ietf.org/html/rfc3073 127280 string PFR1 Portable Font Resource font data (new) 12729>102 string >0 \b: %s 127300 string PFR0 Portable Font Resource font data (old) 12731>4 beshort >0 version %d 12732 12733# True Type fonts 12734# Modified by: Joerg Jenderek 12735# URL: https://en.wikipedia.org/wiki/TrueType 12736# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/ 12737# 12738# sfnt version "typ1" used by some Apple, but no example found 127390 string typ1 12740>0 use sfnt-font 12741>0 use sfnt-names 12742# sfnt version "true" used by some Apple 127430 string true 12744>0 use sfnt-font 12745>0 use sfnt-names 12746# GRR: below test is too general 12747# sfnt version often 0x00010000 127480 string \000\001\000\000 12749>0 use sfnt-font 12750>0 use sfnt-names 12751# validate and display sfnt font data like number of tables 127520 name sfnt-font 12753# file 5.30 version assumes 00FFh as maximal number of tables 12754#>4 ubeshort <0x0100 12755# maximal 27 tables found like in Skia.ttf 12756# 46 different table names mentioned on Apple specification 12757# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number 12758>4 ubeshort <47 12759# skip bad examples with garbage table names like in a5.show HYPERC MAC 12760# tag names consist of up to four characters padded with spaces at end like 12761# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ... 12762>>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ] 12763#>>>0 ubelong x \b, sfnt version 0x%x 12764>>>0 ubelong !0x4f54544f TrueType 12765!:mime font/sfnt 12766!:apple ????tfil 12767# .ttf for TrueType font 12768# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe 12769!:ext ttf/tte 12770# sfnt version 4F54544Fh~OTTO 12771>>>0 ubelong =0x4f54544f OpenType 12772!:mime font/otf 12773!:apple ????OTTO 12774!:ext otf 12775>>>0 ubelong x Font data 12776# DSIG=44454947h table name implies a digitally signed font 12777# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432 12778>>>12 search/432 DSIG \b, digitally signed 12779>>>4 ubeshort x \b, %d tables 12780# minimal 9 tables found like in NISC18030.ttf 12781#>>>4 ubeshort <10 TMIN 12782#>>>4 ubeshort >24 TBIG 12783# table directory entries 12784>>>12 string x \b, 1st "%4.4s" 12785 12786# search and display 1st name in sfnt font which is often copyright text 12787# does not work inside font collections 127880 name sfnt-names 12789# search for naming table 12790>12 search/432/s name 12791# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf 12792#>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET 12793>>&8 ubelong >0x00100000 12794# offset of name table 12795>>>&-4 ubelong x \b, name offset 0x%x 12796# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h 12797>>&8 ubelong <0x00100000 12798>>>&-16 ubelong x 12799# name table 12800>>>>(&8.L) ubequad x 12801# invalid format selector 12802#>>>>>&-8 ubeshort !0 \b, invalid selector %x 12803# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf 12804# maximal 1227 name records found like in Apple Chancery.ttf 12805#>>>>>&-6 ubeshort <0x4 mincount 12806#>>>>>&-6 ubeshort >130 maxcount 12807>>>>>&-6 ubeshort x \b, %d names 12808# offset to start of string storage from start of table 12809#>>>>>&-4 ubeshort x \b, record offset %d 12810# 1st name record 12811# string offset from start of storage area 12812#>>>>>&8 ubeshort x \b, string offset %d 12813# string length 12814#>>>>>&6 ubeshort x \b, string length %d 12815# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf 12816# also found 0 like in SWZCONLN.TTF 12817#>>>>>&6 ubeshort <8 MIN STRING 12818# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf 12819#>>>>>&6 ubeshort >805 MAX STRING 12820# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft 12821#>>>>>&-2 ubeshort >3 BAD PLATFORM 12822>>>>>&-2 ubeshort 0 \b, Unicode 12823>>>>>&-2 ubeshort 1 \b, Macintosh 12824>>>>>&-2 ubeshort 3 \b, Microsoft 12825# languageID (0~english Macintosh, 0409h~english Microsoft, ...) 12826>>>>>&2 ubeshort >0 \b, language 0x%x 12827# name identifiers 12828# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ... 12829>>>>>&4 ubeshort >0 \b, type %d string 12830# platform specific encoding: 12831# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0 12832#>>>>>&0 ubeshort x \b, %d encoding 12833>>>>>&0 ubeshort 0 12834# handle only name string offset 0 because do not know how to add 2 relative offsets 12835>>>>>>&6 ubeshort 0 12836>>>>>>>&(&-14.S-18) ubyte !0 12837# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h 12838# often copyright string that starts like \251 2006 The Monotype Corporation 12839>>>>>>>>&-1 string x \b, %-11.96s 12840# test for unicode string 12841>>>>>>>&(&-14.S-18) ubyte 0 12842>>>>>>>>&0 lestring16 x \b, %-11.96s 12843# unicode encoding 12844>>>>>&0 ubeshort >0 12845>>>>>>&6 ubeshort 0 12846>>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s 12847 128480 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 128490 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 12850 12851# TrueType/OpenType font collections (.ttc) 12852# URL: https://en.wikipedia.org/wiki/OpenType 12853# https://www.microsoft.com/typography/otspec/otff.htm 12854# Modified by: Joerg Jenderek 12855# Note: container for TrueType, OpenType font 128560 string ttcf 12857# skip ASCII text 12858>4 ubyte 0 12859# sfnt version often 0x00010000 of 1st table is TrueType 12860>>(12.L) ubelong !0x4f54544f TrueType 12861!:mime font/ttf 12862!:apple ????tfil 12863!:ext ttc 12864# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font 12865>>(12.L) ubelong =0x4f54544f OpenType 12866!:mime font/otf 12867!:apple ????OTTO 12868# no example found for otc 12869!:ext ttc/otc 12870>>4 ubyte x font collection data 12871#!:mime font/collection 12872# TCC version 12873>>4 belong 0x00010000 \b, 1.0 12874>>4 belong 0x00020000 \b, 2.0 12875>>8 ubelong >0 \b, %d fonts 12876# array offset size = fonts * offsetsize = fonts * 4 12877>>(8.L*4) ubequad x 12878# 0x44454947 = 'DSIG' 12879>>>&4 belong 0x44534947 \b, digitally signed 12880# offset to 1st font 12881>>12 ubelong x \b, at 0x%x 12882# point to 1st font that starts with sfnt version 12883>>(12.L) use sfnt-font 12884 12885# Opentype font data from Avi Bercovich 128860 string OTTO OpenType font data 12887!:mime application/vnd.ms-opentype 12888 12889# From: Alex Myczko <alex@aiei.ch> 128900 string SplineFontDB: Spline Font Database 12891!:mime application/vnd.font-fontforge-sfd 12892>14 string x version %s 12893 12894# EOT 128950x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 12896>0x22 string LP Embedded OpenType (EOT) 12897# workaround until there's lepstring16 12898# >>0x52 lepstring16/h >\0 \b, %s family 12899>>0x52 short !0 12900>>>0x54 lestring16 x \b, %s family 12901!:mime application/vnd.ms-fontobject 12902 12903# Web Open Font Format (.woff) 129040 name woff 12905>4 belong 0x00010000 \b, TrueType 12906>4 belong 0x4F54544F \b, CFF 12907>4 belong 0x74727565 \b, TrueType 12908>4 default x 12909>>4 belong x \b, flavor %d 12910>8 belong x \b, length %d 12911#>12 beshort x \b, numTables %d 12912#>14 beshort x \b, reserved %d 12913#>16 belong x \b, totalSfntSize %d 12914 12915# https://www.w3.org/TR/WOFF/ 129160 string wOFF Web Open Font Format 12917>0 use woff 12918>20 beshort x \b, version %d 12919>22 beshort x \b.%d 12920# https://www.w3.org/TR/WOFF2/ 129210 string wOF2 Web Open Font Format (Version 2) 12922>0 use woff 12923#>20 belong x \b, totalCompressedSize %d 12924>24 beshort x \b, version %d 12925>26 beshort x \b.%d 12926 12927#------------------------------------------------------------------------------ 12928# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $ 12929# FORTRAN source 12930# Check that the first 100 lines start with C or whitespace first. 129310 regex/100l !\^[^Cc\ \t].*$ 12932>0 regex/100l \^[Cc][\ \t] FORTRAN program text 12933!:mime text/x-fortran 12934!:strength - 5 12935 12936#------------------------------------------------------------------------------ 12937# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $ 12938# frame: file(1) magic for FrameMaker files 12939# 12940# This stuff came on a FrameMaker demo tape, most of which is 12941# copyright, but this file is "published" as witness the following: 12942# 12943# Note that this is the Framemaker Maker Interchange Format, not the 12944# Normal format which would be application/vnd.framemaker. 12945# 129460 string \<MakerFile FrameMaker document 12947!:mime application/x-mif 12948>11 string 5.5 (5.5 12949>11 string 5.0 (5.0 12950>11 string 4.0 (4.0 12951>11 string 3.0 (3.0 12952>11 string 2.0 (2.0 12953>11 string 1.0 (1.0 12954>14 byte x %c) 129550 string \<MIFFile FrameMaker MIF (ASCII) file 12956!:mime application/x-mif 12957>9 string 4.0 (4.0) 12958>9 string 3.0 (3.0) 12959>9 string 2.0 (2.0) 12960>9 string 1.0 (1.x) 129610 search/1 \<MakerDictionary FrameMaker Dictionary text 12962!:mime application/x-mif 12963>17 string 3.0 (3.0) 12964>17 string 2.0 (2.0) 12965>17 string 1.0 (1.x) 129660 string \<MakerScreenFont FrameMaker Font file 12967!:mime application/x-mif 12968>17 string 1.01 (%s) 129690 string \<MML FrameMaker MML file 12970!:mime application/x-mif 129710 string \<BookFile FrameMaker Book file 12972!:mime application/x-mif 12973>10 string 3.0 (3.0 12974>10 string 2.0 (2.0 12975>10 string 1.0 (1.0 12976>13 byte x %c) 12977# XXX - this book entry should be verified, if you find one, uncomment this 12978#0 string \<Book\040 FrameMaker Book (ASCII) file 12979#!:mime application/x-mif 12980#>6 string 3.0 (3.0) 12981#>6 string 2.0 (2.0) 12982#>6 string 1.0 (1.0) 129830 string \<Maker\040Intermediate\040Print\040File FrameMaker IPL file 12984!:mime application/x-mif 12985 12986#------------------------------------------------------------------------------ 12987# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 12988# freebsd: file(1) magic for FreeBSD objects 12989# 12990# All new-style FreeBSD magic numbers are in host byte order (i.e., 12991# little-endian on x86). 12992# 12993# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 12994# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 12995# schemes for distinguishing between executable images, shared libraries, 12996# and object files. 12997# 12998# FreeBSD says: 12999# 13000# Regardless of whether it's pure, demand-paged, or none of the 13001# above: 13002# 13003# if the entry point is < 4096, then it's a shared library if 13004# the "has run-time loader information" bit is set, and is 13005# position-independent if the "is position-independent" bit 13006# is set; 13007# 13008# if the entry point is >= 4096 (or >4095, same thing), then it's 13009# an executable, and is dynamically-linked if the "has run-time 13010# loader information" bit is set. 13011# 13012# On x86, NetBSD says: 13013# 13014# If it's neither pure nor demand-paged: 13015# 13016# if it has the "has run-time loader information" bit set, it's 13017# a dynamically-linked executable; 13018# 13019# if it doesn't have that bit set, then: 13020# 13021# if it has the "is position-independent" bit set, it's 13022# position-independent; 13023# 13024# if the entry point is non-zero, it's an executable, otherwise 13025# it's an object file. 13026# 13027# If it's pure: 13028# 13029# if it has the "has run-time loader information" bit set, it's 13030# a dynamically-linked executable, otherwise it's just an 13031# executable. 13032# 13033# If it's demand-paged: 13034# 13035# if it has the "has run-time loader information" bit set, 13036# then: 13037# 13038# if the entry point is < 4096, it's a shared library; 13039# 13040# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 13041# it's a dynamically-linked executable); 13042# 13043# if it doesn't have the "has run-time loader information" bit 13044# set, then it's just an executable. 13045# 13046# (On non-x86, NetBSD does much the same thing, except that it uses 13047# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 13048# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 13049# had 8K pages; dunno about MIPS.) 13050# 13051# I suspect the two will differ only in perverse and uninteresting cases 13052# ("shared" libraries that aren't demand-paged and whose pages probably 13053# won't actually be shared, executables with entry points <4096). 13054# 13055# I leave it to those more familiar with FreeBSD and NetBSD to figure out 13056# what the right answer is (although using ">4095", FreeBSD-style, is 13057# probably better than separately checking for "=4096" and ">4096", 13058# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 13059# executables using the NetBSD technique.) 13060# 130610 lelong&0377777777 041400407 FreeBSD/i386 13062>20 lelong <4096 13063>>3 byte&0xC0 &0x80 shared library 13064>>3 byte&0xC0 0x40 PIC object 13065>>3 byte&0xC0 0x00 object 13066>20 lelong >4095 13067>>3 byte&0x80 0x80 dynamically linked executable 13068>>3 byte&0x80 0x00 executable 13069>16 lelong >0 not stripped 13070 130710 lelong&0377777777 041400410 FreeBSD/i386 pure 13072>20 lelong <4096 13073>>3 byte&0xC0 &0x80 shared library 13074>>3 byte&0xC0 0x40 PIC object 13075>>3 byte&0xC0 0x00 object 13076>20 lelong >4095 13077>>3 byte&0x80 0x80 dynamically linked executable 13078>>3 byte&0x80 0x00 executable 13079>16 lelong >0 not stripped 13080 130810 lelong&0377777777 041400413 FreeBSD/i386 demand paged 13082>20 lelong <4096 13083>>3 byte&0xC0 &0x80 shared library 13084>>3 byte&0xC0 0x40 PIC object 13085>>3 byte&0xC0 0x00 object 13086>20 lelong >4095 13087>>3 byte&0x80 0x80 dynamically linked executable 13088>>3 byte&0x80 0x00 executable 13089>16 lelong >0 not stripped 13090 130910 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 13092>20 lelong <4096 13093>>3 byte&0xC0 &0x80 shared library 13094>>3 byte&0xC0 0x40 PIC object 13095>>3 byte&0xC0 0x00 object 13096>20 lelong >4095 13097>>3 byte&0x80 0x80 dynamically linked executable 13098>>3 byte&0x80 0x00 executable 13099>16 lelong >0 not stripped 13100 13101# XXX gross hack to identify core files 13102# cores start with a struct tss; we take advantage of the following: 13103# byte 7: highest byte of the kernel stack pointer, always 0xfe 13104# 8/9: kernel (ring 0) ss value, always 0x0010 13105# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 13106# 28: low order byte of the current PTD entry, always 0 since the 13107# PTD is page-aligned 13108# 131097 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 13110>1039 string >\0 from '%s' 13111 13112# /var/run/ld.so.hints 13113# What are you laughing about? 131140 lelong 011421044151 ld.so hints file (Little Endian 13115>4 lelong >0 \b, version %d) 13116>4 belong <1 \b) 131170 belong 011421044151 ld.so hints file (Big Endian 13118>4 belong >0 \b, version %d) 13119>4 belong <1 \b) 13120 13121# 13122# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 13123# 131240 string SCRSHOT_ scrshot(1) screenshot, 13125>8 byte x version %d, 13126>9 byte 2 %d bytes in header, 13127>>10 byte x %d chars wide by 13128>>11 byte x %d chars high 13129 13130#------------------------------------------------------------------------------ 13131# $File: fsav,v 1.19 2019/04/19 00:42:27 christos Exp $ 13132# fsav: file(1) magic for datafellows fsav virus definition files 13133# Anthon van der Neut (anthon@mnt.org) 13134 13135# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} 131360 beshort 0x1575 fsav macro virus signatures 13137>8 leshort >0 (%d- 13138>11 byte >0 \b%02d- 13139>10 byte >0 \b%02d) 13140# ftp://ftp.f-prot.com/pub/sign.zip 13141#10 ubyte <12 13142#>9 ubyte <32 13143#>>8 ubyte 0x0a 13144#>>>12 ubyte 0x07 13145#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- 13146#>>>>10 byte 0 \b01- 13147#>>>>10 byte 1 \b02- 13148#>>>>10 byte 2 \b03- 13149#>>>>10 byte 3 \b04- 13150#>>>>10 byte 4 \b05- 13151#>>>>10 byte 5 \b06- 13152#>>>>10 byte 6 \b07- 13153#>>>>10 byte 7 \b08- 13154#>>>>10 byte 8 \b09- 13155#>>>>10 byte 9 \b10- 13156#>>>>10 byte 10 \b11- 13157#>>>>10 byte 11 \b12- 13158#>>>>9 ubyte >0 \b%02d) 13159# ftp://ftp.f-prot.com/pub/sign2.zip 13160#0 ubyte 0x62 13161#>1 ubyte 0xF5 13162#>>2 ubyte 0x1 13163#>>>3 ubyte 0x1 13164#>>>>4 ubyte 0x0e 13165#>>>>>13 ubyte >0 fsav virus signatures 13166#>>>>>>11 ubyte x size 0x%02x 13167#>>>>>>12 ubyte x \b%02x 13168#>>>>>>13 ubyte x \b%02x bytes 13169 13170# Joerg Jenderek: joerg dot jenderek at web dot de 13171# clamav-0.100.2\docs\html\node60.html 13172# https://github.com/vrtadmin/clamav-faq/raw/master/manual/clamdoc.pdf 13173# ClamAV virus database files start with a 512 bytes colon separated header 13174# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime 13175# + gzipped (optional) tarball files 13176# output can often be verified by `sigtool --info=FILE` 131770 string ClamAV-VDB: Clam AntiVirus 13178# padding spaces implies database 13179>511 ubyte =0x20 database 13180!:mime application/x-clamav-database 13181# empty build time 13182>>10 string =:: (unsigned) 13183# sigtool(1) man page 13184!:ext cud 13185# display some text to avoid error like: 13186# Magdir/fsav, 78: Warning: Current entry does not yet have a description for adding a EXTENSION type 13187# file: could not find any valid magic files! (No error) 13188>>10 default x (with buildtime) 13189#>>10 default x 13190# clamtmp is used for temporily database like update process 13191# for pure tar database only cld extension found 13192!:ext cld/cvd/clamtmp/cud 13193>511 default x file 13194!:mime application/x-clamav 13195!:ext info 13196>11 string >\0 13197# buildDate empty or like "22 Mar 2017 12-57 -0400"; verified by `sigtool -i FILE` 13198>>11 regex \^[^:]{0,23} \b, %s 13199# version like 25170 13200>>>&1 regex \^[^:]{1,6} \b, version %s 13201# signaturesNumbers like 4566249 13202>>>>&1 regex \^[^:]{1,10} \b, %s signatures 13203# functionalityLevelRequired like 60 13204>>>>>&1 regex \^[^:]{1,4} \b, level %s 13205# X for nothing or MD5 13206#>>>>>>&1 regex \^[^:]{1,32} \b, MD5 "%s" 13207>>>>>>&1 regex \^[^:]{1,32} 13208# X for nothing or digital signature starting like AIzk/LYbX 13209#>>>>>>>&1 regex \^[^:]{1,255} \b, signature "%s" 13210>>>>>>>&1 regex \^[^:]{1,255} 13211# builder like neo 13212>>>>>>>>&1 regex \^[^:]{1,32} \b, builder %s 13213# buildTime like 1506611558 13214#>>>>>>>>>&1 regex \^[^:]{1,10} \b, %s 13215>>>>>>>>>&1 regex \^[^:]{1,10} 13216# padding with spaces 13217#>>>>>>>>>>&1 ubequad x \b, padding 0x%16.16llx 13218>510 ubyte =0x20 13219# inspect real database content 13220#>>512 ubeshort x \b, database MAGIC 0x%x 13221# ./archive handle pure tar archives 13222>>1012 quad =0 \b, with 13223>>>512 use tar-file 13224# not pure tar 13225>>1012 quad !0 13226# one space at the end of text and then handles gziped archives by ./compress 13227>>>512 string \037\213 \b, with 13228>>>>512 indirect x 13229 13230# Type: Grisoft AVG AntiVirus 13231# From: David Newgas <david@newgas.net> 132320 string AVG7_ANTIVIRUS_VAULT_FILE AVG 7 Antivirus vault file data 13233 132340 string X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR 13235>33 string -STANDARD-ANTIVIRUS-TEST-FILE!$H+H* EICAR virus test files 13236 13237# From: Joerg Jenderek 13238# URL: https://www.avira.com/ 13239# Note: found in directory %ProgramData%\Avira\Antivirus\INFECTED (Windows) 13240# tested with version 15.0.43.23 at November 2019 132410 string AntiVir\ Qua Avira AntiVir quarantined 13242!:mime application/x-avira-qua 13243#!:mime application/octet-stream 13244!:ext qua 13245>156 string SUSPICIOUS_FILE 13246# file path of suspicious file 13247>>220 lestring16 x %s 13248>156 string !SUSPICIOUS_FILE 13249# file path of virus file 13250>>228 lestring16 x %s 13251# quarantined date 13252>60 ldate x at %s 13253# virus/danger name 13254>156 string !SUSPICIOUS_FILE 13255>>156 string x \b, category "%s" 13256 13257 13258#------------------------------------------------------------------------------ 13259# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $ 13260# fusecompress: file(1) magic for fusecompress 132610 string \037\135\211 FuseCompress(ed) data 13262>3 byte 0x00 (none format) 13263>3 byte 0x01 (bz2 format) 13264>3 byte 0x02 (gz format) 13265>3 byte 0x03 (lzo format) 13266>3 byte 0x04 (xor format) 13267>3 byte >0x04 (unknown format) 13268>4 long x uncompressed size: %d 13269 13270#------------------------------------------------------------------------------ 13271# $File: games,v 1.17 2019/04/19 00:42:27 christos Exp $ 13272# games: file(1) for games 13273 13274# Fabio Bonelli <fabiobonelli@libero.it> 13275# Quake II - III data files 132760 string IDP2 Quake II 3D Model file, 13277>20 long x %u skin(s), 13278>8 long x (%u x 13279>12 long x %u), 13280>40 long x %u frame(s), 13281>16 long x Frame size %u bytes, 13282>24 long x %u vertices/frame, 13283>28 long x %u texture coordinates, 13284>32 long x %u triangles/frame 13285 132860 string IBSP Quake 13287>4 long 0x26 II Map file (BSP) 13288>4 long 0x2E III Map file (BSP) 13289 132900 string IDS2 Quake II SP2 sprite file 13291 13292#--------------------------------------------------------------------------- 13293# Doom and Quake 13294# submitted by Nicolas Patrois 13295 132960 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo 13297# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01 13298 1329924 string LxD\ 203 Linuxdoom save 13300>0 string x , name=%s 13301>44 string x , world=%s 13302 13303# Quake 13304 13305# Update: Joerg Jenderek 13306# URL: http://fileformats.archiveteam.org/wiki/PAK 13307# reference: https://quakewiki.org/wiki/.pak 13308# GRR: line below is too general as it matches also Acorn PackDir compressed Archive 13309# and Git pack ./revision 133100 string PACK 13311# real Quake examples like pak0.pak have only some hundreds like 150 files 13312# So test for few files 13313>8 ulelong <0x01000000 13314# in file version 5.32 test for null terminator is only true for 13315# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 13316# look for null terminator of 1st entry name 13317>>(4.l+55) ubyte 0 Quake I or II world or extension 13318!:mime application/x-dzip 13319!:ext pak 13320#>>>8 ulelong x \b, table size %u 13321# dividing this by entry size (64) gives number of files 13322>>>8 ulelong/64 x \b, %u files 13323# offset to the beginning of the file table 13324>>>4 ulelong x \b, offset 0x%x 13325# 1st file entry 13326>>>(4.l) use pak-entry 13327# 2nd file entry 13328#>>>4 ulelong+64 x \b, offset 0x%x 13329#>>>(4.l+64) use pak-entry 13330# 13331# display file table entry of Quake PAK archive 133320 name pak-entry 13333# normally entry start after header which implies offset 12 or higher 13334>56 ulelong >11 13335# the offset from the beginning of pak to beginning of this entry file contents 13336>>56 ulelong x at 0x%x 13337# the size of file for this entry 13338>>60 ulelong x %u bytes 13339# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp 13340>>0 string x '%-.56s' 13341# inspect entry content by jumping to entry offset 13342>>(56) indirect x \b: 13343 13344#0 string -1\x0a Quake I demo 13345#>30 string x version %.4s 13346#>61 string x level %s 13347 13348#0 string 5\x0a Quake I save 13349 13350# The levels 13351 13352# Quake 1 13353 133540 string 5\x0aIntroduction Quake I save: start Introduction 133550 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex 133560 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned 133570 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis 133580 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto 133590 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret) 133600 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep 133610 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon 133620 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon 133630 string 5\x0athe_Installation Quake I save: e2m1 The installation 133640 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel 133650 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!) 133660 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret) 133670 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress 133680 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse 133690 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette 133700 string 5\x0aTermination_Central Quake I save: e3m1 Termination central 133710 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin 133720 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror 133730 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight 133740 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret) 133750 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels 133760 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment 133770 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system 133780 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair 133790 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine 133800 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate 133810 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium 133820 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret) 133830 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze 133840 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony 133850 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit 13386 13387# Quake DeathMatch levels 13388 133890 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths 133900 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis 133910 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base 133920 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place 133930 string 5\x0aThe_Cistern Quake I save: dm5 The cistern 133940 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone 13395 13396# Scourge of Armagon 13397 133980 string 5\x0aCommand_HQ Quake I save: start Command HQ 133990 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station 134000 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility 134010 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret) 134020 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine 134030 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility 134040 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms 134050 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret) 134060 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral 134070 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs 134080 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt 134090 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep 134100 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment 134110 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium 134120 string 5\x0aLimbo Quake I save: hip3m3 Limbo 134130 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret) 134140 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet 134150 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair 13416 13417# Malice 13418 134190 string 5\x0aThe_Academy Quake I save: start The academy 134200 string 5\x0aThe_Lab Quake I save: d1 The lab 134210 string 5\x0aArea_33 Quake I save: d1b Area 33 134220 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions 134230 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret) 134240 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret) 134250 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice 134260 string 5\x0aArea44 Quake I save: d1c Area 44 134270 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers 134280 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life 134290 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood 134300 string 5\x0aThe_Flood Quake I save: d5 The flood 134310 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant 134320 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant 134330 string 5\x0aThe_Foundry Quake I save: d7b The foundry 134340 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base 134350 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base 134360 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories 134370 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive 134380 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ 134390 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown! 13440 13441# Malice DeathMatch levels 13442 134430 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct 134440 string 5\x0aSub_Station Quake I save: ddm2 Sub station 134450 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights! 134460 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa 134470 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse 134480 string 5\x0aDOMINO Quake I save: ddm6 Domino 134490 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder 13450 13451 134520 string MComprHD MAME CHD compressed hard disk image, 13453>12 belong x version %u 13454 13455# doom - submitted by Jon Dowland 13456 134570 string =IWAD doom main IWAD data 13458>4 lelong x containing %d lumps 134590 string =PWAD doom patch PWAD data 13460>4 lelong x containing %d lumps 13461 13462# Build engine group files (Duke Nukem, Shadow Warrior, ...) 13463# Extension: .grp 13464# Created by: "Ganael Laplanche" <ganael.laplanche@martymac.org> 134650 string KenSilverman Build engine group file 13466>12 lelong x containing %d files 13467 13468# Summary: Warcraft 3 save 13469# Extension: .w3g 13470# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 134710 string Warcraft\ III\ recorded\ game %s 13472 13473 13474# Summary: Warcraft 3 map 13475# Extension: .w3m 13476# Created by: "Nelson A. de Oliveira" <naoliv@gmail.com> 134770 string HM3W Warcraft III map file 13478 13479 13480# Summary: SGF Smart Game Format 13481# Extension: .sgf 13482# Reference: https://www.red-bean.com/sgf/ 13483# Created by: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 13484# Modified by (1): Abel Cheung (regex, more game format) 13485# FIXME: Some games don't have GM (game type) 134860 regex \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 13487>2 search/0x200/b GM[ 13488>>&0 string 1] (Go) 13489>>&0 string 2] (Othello) 13490>>&0 string 3] (chess) 13491>>&0 string 4] (Gomoku+Renju) 13492>>&0 string 5] (Nine Men's Morris) 13493>>&0 string 6] (Backgammon) 13494>>&0 string 7] (Chinese chess) 13495>>&0 string 8] (Shogi) 13496>>&0 string 9] (Lines of Action) 13497>>&0 string 10] (Ataxx) 13498>>&0 string 11] (Hex) 13499>>&0 string 12] (Jungle) 13500>>&0 string 13] (Neutron) 13501>>&0 string 14] (Philosopher's Football) 13502>>&0 string 15] (Quadrature) 13503>>&0 string 16] (Trax) 13504>>&0 string 17] (Tantrix) 13505>>&0 string 18] (Amazons) 13506>>&0 string 19] (Octi) 13507>>&0 string 20] (Gess) 13508>>&0 string 21] (Twixt) 13509>>&0 string 22] (Zertz) 13510>>&0 string 23] (Plateau) 13511>>&0 string 24] (Yinsh) 13512>>&0 string 25] (Punct) 13513>>&0 string 26] (Gobblet) 13514>>&0 string 27] (hive) 13515>>&0 string 28] (Exxit) 13516>>&0 string 29] (Hnefatal) 13517>>&0 string 30] (Kuba) 13518>>&0 string 31] (Tripples) 13519>>&0 string 32] (Chase) 13520>>&0 string 33] (Tumbling Down) 13521>>&0 string 34] (Sahara) 13522>>&0 string 35] (Byte) 13523>>&0 string 36] (Focus) 13524>>&0 string 37] (Dvonn) 13525>>&0 string 38] (Tamsk) 13526>>&0 string 39] (Gipf) 13527>>&0 string 40] (Kropki) 13528 13529############################################## 13530# NetImmerse/Gamebryo game engine entries 13531 13532# Summary: Gamebryo game engine file 13533# Extension: .nif, .kf 13534# Created by: Abel Cheung <abelcheung@gmail.com> 135350 string Gamebryo\ File\ Format,\ Version\ Gamebryo game engine file 13536>&0 regex [0-9a-z.]+ \b, version %s 13537 13538# Summary: Gamebryo game engine file 13539# Extension: .kfm 13540# Created by: Abel Cheung <abelcheung@gmail.com> 135410 string ;Gamebryo\ KFM\ File\ Version\ Gamebryo game engine animation File 13542>&0 regex [0-9a-z.]+ \b, version %s 13543 13544# Summary: NetImmerse game engine file 13545# Extension .nif 13546# Created by: Abel Cheung <abelcheung@gmail.com> 135470 string NetImmerse\ File\ Format,\ Versio 13548>&0 string n\ NetImmerse game engine file 13549>>&0 regex [0-9a-z.]+ \b, version %s 13550 13551# Type: SGF Smart Game Format 13552# URL: https://www.red-bean.com/sgf/ 13553# From: Eduardo Sabbatella <eduardo_sabbatella@yahoo.com.ar> 135542 regex/c \\(;.*GM\\[[0-9]{1,2}\\] Smart Game Format 13555>2 regex/c GM\\[1\\] - Go Game 13556>2 regex/c GM\\[6\\] - BackGammon Game 13557>2 regex/c GM\\[11\\] - Hex Game 13558>2 regex/c GM\\[18\\] - Amazons Game 13559>2 regex/c GM\\[19\\] - Octi Game 13560>2 regex/c GM\\[20\\] - Gess Game 13561>2 regex/c GM\\[21\\] - twix Game 13562 13563# Epic Games/Unreal Engine Package 13564# 135650 lelong 0x9E2A83C1 Unreal Engine Package, 13566>4 leshort x version: %i 13567>12 lelong !0 \b, names: %i 13568>28 lelong !0 \b, imports: %i 13569>20 lelong !0 \b, exports: %i 13570 13571#------------------------------------------------------------------------------ 13572# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $ 13573# gcc: file(1) magic for GCC special files 13574# 135750 string gpch GCC precompiled header 13576 13577# The version field is annoying. It's 3 characters, not zero-terminated. 13578>5 byte x (version %c 13579>6 byte x \b%c 13580>7 byte x \b%c) 13581 13582# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' 13583>4 byte 67 for C 13584>4 byte 111 for Objective-C 13585>4 byte 43 for C++ 13586>4 byte 79 for Objective-C++ 13587 13588#------------------------------------------------------------------------------ 13589# $File: gconv 13590# gconv: file(1) magic for iconv/gconv module configuration cache 13591# 13592# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC 13593# 13594# From: Marek Cermak <macermak@redhat.com> 13595# 135960 lelong 0x20010324 gconv module configuration cache data 13597 13598#------------------------------------------------------------------------------ 13599# $File: geo,v 1.7 2019/04/19 00:42:27 christos Exp $ 13600# Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu> 13601 13602###################################################################### 13603# 13604# Acoustic Doppler Current Profilers (ADCP) 13605# 13606###################################################################### 13607 136080 beshort 0x7f7f RDI Acoustic Doppler Current Profiler (ADCP) 13609 13610###################################################################### 13611# 13612# Metadata 13613# 13614###################################################################### 13615 136160 string Identification_Information FGDC ASCII metadata 13617 13618###################################################################### 13619# 13620# Seimsic / Subbottom 13621# 13622###################################################################### 13623 13624# Knudsen subbottom chirp profiler - Binary File Format: B9 13625# KEB D409-03167 V1.75 Huffman 136260 string KEB\ Knudsen seismic KEL binary (KEB) - 13627>4 regex [-A-Z0-9]* Software: %s 13628>>&1 regex V[0-9]*\.[0-9]* version %s 13629 13630###################################################################### 13631# 13632# LIDAR - Laser altimetry or bathy 13633# 13634###################################################################### 13635 13636 13637# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data 136380 string HCA LADS Caris Ascii Format (CAF) bathymetric lidar 13639>4 regex [0-9]*\.[0-9]* version %s 13640 136410 string HCB LADS Caris Binary Format (CBF) bathymetric lidar waveform data 13642>3 byte x version %d . 13643>4 byte x %d 13644 13645 13646###################################################################### 13647# 13648# MULTIBEAM SONARS https://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/ 13649# 13650###################################################################### 13651 13652# GeoAcoustics - GeoSwath Plus 136534 beshort 0x2002 GeoSwath RDF 136540 string Start:- GeoSwatch auf text file 13655 13656# Seabeam 2100 13657# mbsystem code mb41 136580 string SB2100 SeaBeam 2100 multibeam sonar 136590 string SB2100DR SeaBeam 2100 DR multibeam sonar 136600 string SB2100PR SeaBeam 2100 PR multibeam sonar 13661 13662# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor 13663# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR. 136640 string $HSF XSE multibeam 13665 13666# mb121 https://www.saic.com/maritime/gsf/ 136678 string GSF-v SAIC generic sensor format (GSF) sonar data, 13668>&0 regex [0-9]*\.[0-9]* version %s 13669 13670# MGD77 - https://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm 13671# mb161 136729 string MGD77 MGD77 Header, Marine Geophysical Data Exchange Format 13673 13674# MBSystem processing caches the mbinfo output 136751 string Swath\ Data\ File: mbsystem info cache 13676 13677# Caris John Hughes Clark format 136780 string HDCS Caris multibeam sonar related data 136791 string Start/Stop\ parameter\ header: Caris ASCII project summary 13680 13681###################################################################### 13682# 13683# Visualization and 3D modeling 13684# 13685###################################################################### 13686 13687# IVS - IVS3d.com Tagged Data Represetation 136880 string %%\ TDR\ 2.0 IVS Fledermaus TDR file 13689 13690# http://www.ecma-international.org/publications/standards/Ecma-363.htm 13691# 3D in PDFs 136920 string U3D ECMA-363, Universal 3D 13693 13694###################################################################### 13695# 13696# Support files 13697# 13698###################################################################### 13699 13700# https://midas.psi.ch/elog/ 137010 string $@MID@$ elog journal entry 13702 13703# Geospatial Designs https://www.geospatialdesigns.com/surfer6_format.htm 137040 string DSBB Surfer 6 binary grid file 13705>4 leshort x \b, %d 13706>6 leshort x \bx%d 13707>8 ledouble x \b, minx=%g 13708>16 ledouble x \b, maxx=%g 13709>24 ledouble x \b, miny=%g 13710>32 ledouble x \b, maxy=%g 13711>40 ledouble x \b, minz=%g 13712>48 ledouble x \b, maxz=%g 13713 13714# magic for LAS format files 13715# alex myczko <alex@aiei.ch> 13716# https://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf 137170 string LASF LIDAR point data records 13718>24 byte >0 \b, version %u 13719>25 byte >0 \b.%u 13720>26 string >\0 \b, SYSID %s 13721>58 string >\0 \b, Generating Software %s 13722 13723# magic for PCD format files 13724# alex myczko <alex@aiei.ch> 13725# http://pointclouds.org/documentation/tutorials/pcd_file_format.php 137260 string #\ .PCD Point Cloud Data 13727 13728#------------------------------------------------------------------------------ 13729# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $ 13730# GEOS files (Vidar Madsen, vidar@gimp.org) 13731# semi-commonly used in embedded and handheld systems. 137320 belong 0xc745c153 GEOS 13733>40 byte 1 executable 13734>40 byte 2 VMFile 13735>40 byte 3 binary 13736>40 byte 4 directory label 13737>40 byte <1 unknown 13738>40 byte >4 unknown 13739>4 string >\0 \b, name "%s" 13740#>44 short x \b, version %d 13741#>46 short x \b.%d 13742#>48 short x \b, rev %d 13743#>50 short x \b.%d 13744#>52 short x \b, proto %d 13745#>54 short x \br%d 13746#>168 string >\0 \b, copyright "%s" 13747 13748#------------------------------------------------------------------------------ 13749# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $ 13750# GIMP Gradient: file(1) magic for the GIMP's gradient data files (.ggr) 13751# by Federico Mena <federico@nuclecu.unam.mx> 13752 137530 string/t GIMP\ Gradient GIMP gradient data 13754 13755# GIMP palette (.gpl) 13756# From: Markus Heidelberg <markus.heidelberg@web.de> 137570 string/t GIMP\ Palette GIMP palette data 13758 13759#------------------------------------------------------------------------------ 13760# XCF: file(1) magic for the XCF image format used in the GIMP (.xcf) developed 13761# by Spencer Kimball and Peter Mattis 13762# ('Bucky' LaDieu, nega@vt.edu) 13763 137640 string gimp\ xcf GIMP XCF image data, 13765!:mime image/x-xcf 13766>9 string file version 0, 13767>9 string v version 13768>>10 string >\0 %s, 13769>14 belong x %u x 13770>18 belong x %u, 13771>22 belong 0 RGB Color 13772>22 belong 1 Greyscale 13773>22 belong 2 Indexed Color 13774>22 belong >2 Unknown Image Type. 13775 13776#------------------------------------------------------------------------------ 13777# XCF: file(1) magic for the patterns used in the GIMP (.pat), developed 13778# by Spencer Kimball and Peter Mattis 13779# ('Bucky' LaDieu, nega@vt.edu) 13780 1378120 string GPAT GIMP pattern data, 13782>24 string x %s 13783 13784#------------------------------------------------------------------------------ 13785# XCF: file(1) magic for the brushes used in the GIMP (.gbr), developed 13786# by Spencer Kimball and Peter Mattis 13787# ('Bucky' LaDieu, nega@vt.edu) 13788 1378920 string GIMP GIMP brush data 13790 13791# GIMP Curves File 13792# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 137930 string #\040GIMP\040Curves\040File GIMP curve file 13794 13795#------------------------------------------------------------------------------ 13796# $File: glibc,v 1.1 2018/10/11 15:35:43 christos Exp $ 13797# glibc locale files 13798# 13799# https://sourceware.org/git/?p=glibc.git;f=locale/localeinfo.h;h=68822a63#l32 13800 138010 belong 0x20070920 glibc locale file LC_CTYPE 138020 belong 0x14110320 glibc locale file LC_NUMERIC 138030 belong 0x17110320 glibc locale file LC_TIME 138040 belong 0x17100520 glibc locale file LC_COLLATE 138050 belong 0x11110320 glibc locale file LC_MONETARY 138060 belong 0x10110320 glibc locale file LC_MESSAGES 138070 belong 0x13110320 glibc locale file LC_ALL 138080 belong 0x12110320 glibc locale file LC_PAPER 138090 belong 0x1d110320 glibc locale file LC_NAME 138100 belong 0x1c110320 glibc locale file LC_ADDRESS 138110 belong 0x1f110320 glibc locale file LC_TELEPHONE 138120 belong 0x1e110320 glibc locale file LC_MEASUREMENT 138130 belong 0x19110320 glibc locale file LC_IDENTIFICATION 13814 13815 13816#------------------------------------------------------------------------------ 13817# $File: gnome,v 1.6 2019/04/19 00:42:27 christos Exp $ 13818# GNOME related files 13819 13820# Contributed by Josh Triplett 13821# FIXME: Could be simplified if pstring supported two-byte counts 138220 string GnomeKeyring\n\r\0\n GNOME keyring 13823>&0 ubyte 0 \b, major version 0 13824>>&0 ubyte 0 \b, minor version 0 13825>>>&0 ubyte 0 \b, crypto type 0 (AES) 13826>>>&0 ubyte >0 \b, crypto type %u (unknown) 13827>>>&1 ubyte 0 \b, hash type 0 (MD5) 13828>>>&1 ubyte >0 \b, hash type %u (unknown) 13829>>>&2 ubelong 0xFFFFFFFF \b, name NULL 13830>>>&2 ubelong !0xFFFFFFFF 13831>>>>&-4 ubelong >255 \b, name too long for file's pstring type 13832>>>>&-4 ubelong <256 13833>>>>>&-1 pstring x \b, name "%s" 13834>>>>>>&0 ubeqdate x \b, last modified %s 13835>>>>>>&8 ubeqdate x \b, created %s 13836>>>>>>&16 ubelong &1 13837>>>>>>>&0 ubelong x \b, locked if idle for %u seconds 13838>>>>>>&16 ubelong ^1 \b, not locked if idle 13839>>>>>>&24 ubelong x \b, hash iterations %u 13840>>>>>>&28 ubequad x \b, salt %llu 13841>>>>>>&52 ubelong x \b, %u item(s) 13842 13843# From: Alex Beregszaszi <alex@fsn.hu> 138444 string gtktalog GNOME Catalogue (gtktalog) 13845>13 string >\0 version %s 13846 13847# Summary: GStreamer binary registry 13848# Extension: .bin 13849# Submitted by: Josh Triplett <josh@joshtriplett.org> 138500 belong 0xc0def00d GStreamer binary registry 13851>4 string x \b, version %s 13852 13853# GVariant Database file 13854# By Elan Ruusamae <glen@delfi.ee> 13855# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h 13856# It's always "GVariant", it's byte swapped on incompatible archs 13857# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c 13858# file_builder_serialise() 13859# https://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant 138600 string GVariant GVariant Database file, 13861# version is never filled. probably future extension 13862>8 lelong x version %d 13863# not sure are these usable, so commented out 13864#>>16 lelong x start %d, 13865#>>>20 lelong x end %d 13866 13867# G-IR database made by gobject-introspect toolset, 13868# https://live.gnome.org/GObjectIntrospection 138690 string GOBJ\nMETADATA\r\n\032 G-IR binary database 13870>16 byte x \b, v%d 13871>17 byte x \b.%d 13872>20 leshort x \b, %d entries 13873>22 leshort x \b/%d local 13874 13875#------------------------------------------------------------------------------ 13876# $File: gnu,v 1.21 2019/04/19 00:42:27 christos Exp $ 13877# gnu: file(1) magic for various GNU tools 13878# 13879# GNU nlsutils message catalog file format 13880# 13881# GNU message catalog (.mo and .gmo files) 13882 13883# Update: Joerg Jenderek 13884# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html 13885# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/ 13886# gettext-0.19.8.1/gettext-runtime/intl/gmo.h 13887# Note: maybe call it like "GNU translation gettext machine object" 138880 string \336\22\4\225 GNU message catalog (little endian), 13889#0 ulelong 0x950412DE GNU-format message catalog data 13890# TODO: write lines in such a way that code can also be called for big endian variant 13891#>0 use gettext-object 13892#0 name gettext-object 13893>4 ulelong x revision 13894!:mime application/x-gettext-translation 13895# mo extension is also used for Easeus Partition Master PE32 executable module 13896# like ConvertFatToNTFS.mo 13897!:ext gmo/mo 13898# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit 13899# major revision 13900>4 ulelong/0xFFff x %u. 13901# minor revision 13902>4 ulelong&0x0000FFff x \b%u 13903>>8 ulelong x \b, %u message 13904# plural s 13905>>8 ulelong >1 \bs 13906# size of hashing table 13907#>20 ulelong x \b, %u hash 13908#>20 ulelong >1 \bes 13909#>24 ulelong x at 0x%x 13910# for revsion x.0 offset of table with originals is 1Ch if directly after header 13911>4 ulelong&0x0000FFff =0 13912>>12 ulelong !0x1C \b, at 0x%x string table 13913# but for x.1 table offset i found is 30h. That means directly after bigger header 13914>4 ulelong&0x0000FFff >0 13915>>12 ulelong !0x30 \b, at 0x%x string table 13916# The following variables are only used in .mo files with minor revision >= 1 13917# number of system dependent segments 13918#>>28 ulelong x \b, %u segment 13919#>>28 ulelong >1 \bs 13920# offset of table describing system dependent segments 13921#>>32 ulelong x at 0x%x 13922# number of system dependent strings pairs 13923>>36 ulelong x \b, %u sysdep message 13924>>36 ulelong >1 \bs 13925# offset of table with start offsets of original sysdep strings 13926#>>40 ulelong x \b, at 0x%x sysdep strings 13927# offset of table with start offsets of translated sysdep strings 13928#>>44 ulelong x \b, at 0x%x sysdep translations 13929# >>(44.l) ulelong x 0x%x chars 13930# >>>&0 ulelong x at 0x%x 13931# >>>>(&-4) string x "%s" 13932# string table after big header 13933#>>48 ubequad x \b, string table 0x%llx 13934# 13935# 0th string length seems to be always 0 13936#>(12.l) ulelong x \b, %u chars 13937#>>&0 ulelong x at 0x%x 13938# if 1st string length positiv inspect offset and string 13939#>(12.l+8) ulelong >0 \b, %u chars 13940#>>&0 ulelong x at 0x%x 13941# if 2nd string length positiv inspect offset and string 13942# >(12.l+16) ulelong >0 \b, %u chars 13943# >>&0 ulelong x at 0x%x 13944# skip newline byte 13945#>>>(&-4) ubyte =0x0A 13946#>>>>&0 string x "%s" 13947#>>>(&-4) ubyte !0x0A 13948#>>>>&-1 string x '%s' 13949# offset of table with translation strings 13950#>16 ulelong x \b, at 0x%x translation table 13951# check translation 0 length and offset 13952>(16.l) ulelong >0 13953>>&0 ulelong x 13954# translation 0 seems to be often Project-Id with name and version 13955>>>(&-4) string x \b, %s 13956# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL 13957>(16.l+8) ulelong >1 13958>>&0 ulelong x 13959>>>(&-4) ubyte !0x0A 13960>>>>&-1 string x '%s' 13961# 1 New Line like in tar-1.29\po\de.gmo 13962>>>(&-4) ubyte =0x0A 13963>>>>&0 ubyte !0x0A 13964>>>>>&-1 string x '%s' 13965# 2nd New Line like in parted-3.1\po\de.gmo 13966>>>>&0 ubyte =0x0A 13967>>>>>&0 string x '%s' 13968 139690 string \225\4\22\336 GNU message catalog (big endian), 13970#0 ubelong 0x950412DE GNU-format message catalog data 13971!:mime application/x-gettext-translation 13972!:ext gmo/mo 13973# TODO: for big endian use same code as for little endian 13974#>0 use \^gettext-object 13975# DEBUG code 13976#>16 ubelong x \b, at 0x%x translation table 13977#>(16.L) ubelong x 0x%x chars 13978#>>&0 ubelong x at 0x%x 13979# unexpected value HERE! 13980#>>>(&-4) ubequad x 0x%llx 13981# 13982>4 beshort x revision %d. 13983>6 beshort >0 \b%d, 13984>>8 belong x %d messages, 13985>>36 belong x %d sysdep messages 13986>6 beshort =0 \b%d, 13987>>8 belong x %d messages 13988 13989 13990# GnuPG 13991# The format is very similar to pgp 139920 string \001gpg GPG key trust database 13993>4 byte x version %d 13994# Note: magic.mime had 0x8501 for the next line instead of 0x8502 139950 beshort 0x8502 GPG encrypted data 13996!:mime text/PGP # encoding: data 13997 13998# Update: Joerg Jenderek 13999# Note: PGP and GPG use same data structure. 14000# So recognition is now done by ./pgp with start test for byte 0x99 14001# This magic is not particularly good, as the keyrings don't have true 14002# magic. Nevertheless, it covers many keyrings. 14003# 0 ubeshort-0x9901 <2 14004# >3 byte 4 14005# >>4 bedate x GPG key public ring, created %s 14006# !:mime application/x-gnupg-keyring 14007 14008# Symmetric encryption 140090 leshort 0x0d8c 14010>4 leshort 0x0203 14011>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher) 14012>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher) 14013>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher) 14014>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher) 14015>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher) 14016>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher) 14017>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher) 14018>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher) 14019>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher) 14020>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher) 14021 14022 14023# GnuPG Keybox file 14024# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD> 14025# From: Philipp Hahn <hahn@univention.de> 140260 belong 32 14027>4 byte 1 14028>>8 string KBXf GPG keybox database 14029>>>5 byte 1 version %d 14030>>>16 bedate x \b, created-at %s 14031>>>20 bedate x \b, last-maintained %s 14032 14033 14034# Gnumeric spreadsheet 14035# This entry is only semi-helpful, as Gnumeric compresses its files, so 14036# they will ordinarily reported as "compressed", but at least -z helps 1403739 string =<gmr:Workbook Gnumeric spreadsheet 14038 14039# From: James Youngman <jay@gnu.org> 14040# gnu find magic 140410 string \0LOCATE GNU findutils locate database data 14042>7 string >\0 \b, format %s 14043>7 string 02 \b (frcode) 14044 14045# Files produced by GNU gettext 14046 14047# gettext message catalogue 140480 search/1024 \nmsgid 14049>&0 search/1024 \nmsgstr GNU gettext message catalogue text 14050!:strength +100 14051!:mime text/x-po 14052 14053#------------------------------------------------------------------------------ 14054# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $ 14055# gnumeric: file(1) magic for Gnumeric spreadsheet 14056# This entry is only semi-helpful, as Gnumeric compresses its files, so 14057# they will ordinarily reported as "compressed", but at least -z helps 1405839 string =<gmr:Workbook Gnumeric spreadsheet 14059!:mime application/x-gnumeric 14060 14061#------------------------------------------------------------------------------ 14062# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $ 14063# 14064# GPT Partition table patterns. 14065# Author: Rogier Goossens (goossens.rogier@gmail.com) 14066# Note that a GPT-formatted disk must contain an MBR as well. 14067# 14068 14069# The initial segment (up to >>>>>>>>422) was copied from the X86 14070# partition table code (aka MBR). 14071# This is kept separate, so that MBR partitions are not reported as well. 14072# (use -k if you do want them as well) 14073 14074# First, detect the MBR partiton table 14075# If more than one GPT protective MBR partition exists, don't print anything 14076# (the other MBR detection code will then just print the MBR partition table) 140770x1FE leshort 0xAA55 14078>3 string !MS 14079>>3 string !SYSLINUX 14080>>>3 string !MTOOL 14081>>>>3 string !NEWLDR 14082>>>>>5 string !DOS 14083# not FAT (32 bit) 14084>>>>>>82 string !FAT32 14085#not Linux kernel 14086>>>>>>>514 string !HdrS 14087#not BeOS 14088>>>>>>>>422 string !Be\ Boot\ Loader 14089# GPT with protective MBR entry in partition 1 (only) 14090>>>>>>>>>450 ubyte 0xee 14091>>>>>>>>>>466 ubyte !0xee 14092>>>>>>>>>>>482 ubyte !0xee 14093>>>>>>>>>>>>498 ubyte !0xee 14094#>>>>>>>>>>>>>446 use gpt-mbr-partition 14095>>>>>>>>>>>>>(454.l*8192) string EFI\ PART GPT partition table 14096>>>>>>>>>>>>>>0 use gpt-mbr-type 14097>>>>>>>>>>>>>>&-8 use gpt-table 14098>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 14099>>>>>>>>>>>>>(454.l*8192) string !EFI\ PART 14100>>>>>>>>>>>>>>(454.l*4096) string EFI\ PART GPT partition table 14101>>>>>>>>>>>>>>>0 use gpt-mbr-type 14102>>>>>>>>>>>>>>>&-8 use gpt-table 14103>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 14104>>>>>>>>>>>>>>(454.l*4096) string !EFI\ PART 14105>>>>>>>>>>>>>>>(454.l*2048) string EFI\ PART GPT partition table 14106>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14107>>>>>>>>>>>>>>>>&-8 use gpt-table 14108>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 14109>>>>>>>>>>>>>>>(454.l*2048) string !EFI\ PART 14110>>>>>>>>>>>>>>>>(454.l*1024) string EFI\ PART GPT partition table 14111>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14112>>>>>>>>>>>>>>>>>&-8 use gpt-table 14113>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 14114>>>>>>>>>>>>>>>>(454.l*1024) string !EFI\ PART 14115>>>>>>>>>>>>>>>>>(454.l*512) string EFI\ PART GPT partition table 14116>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14117>>>>>>>>>>>>>>>>>>&-8 use gpt-table 14118>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 14119# GPT with protective MBR entry in partition 2 (only) 14120>>>>>>>>>450 ubyte !0xee 14121>>>>>>>>>>466 ubyte 0xee 14122>>>>>>>>>>>482 ubyte !0xee 14123>>>>>>>>>>>>498 ubyte !0xee 14124#>>>>>>>>>>>>>462 use gpt-mbr-partition 14125>>>>>>>>>>>>>(470.l*8192) string EFI\ PART GPT partition table 14126>>>>>>>>>>>>>>0 use gpt-mbr-type 14127>>>>>>>>>>>>>>&-8 use gpt-table 14128>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 14129>>>>>>>>>>>>>(470.l*8192) string !EFI\ PART 14130>>>>>>>>>>>>>>(470.l*4096) string EFI\ PART GPT partition table 14131>>>>>>>>>>>>>>>0 use gpt-mbr-type 14132>>>>>>>>>>>>>>>&-8 use gpt-table 14133>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 14134>>>>>>>>>>>>>>(470.l*4096) string !EFI\ PART 14135>>>>>>>>>>>>>>>(470.l*2048) string EFI\ PART GPT partition table 14136>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14137>>>>>>>>>>>>>>>>&-8 use gpt-table 14138>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 14139>>>>>>>>>>>>>>>(470.l*2048) string !EFI\ PART 14140>>>>>>>>>>>>>>>>(470.l*1024) string EFI\ PART GPT partition table 14141>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14142>>>>>>>>>>>>>>>>>&-8 use gpt-table 14143>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 14144>>>>>>>>>>>>>>>>(470.l*1024) string !EFI\ PART 14145>>>>>>>>>>>>>>>>>(470.l*512) string EFI\ PART GPT partition table 14146>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14147>>>>>>>>>>>>>>>>>>&-8 use gpt-table 14148>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 14149# GPT with protective MBR entry in partition 3 (only) 14150>>>>>>>>>450 ubyte !0xee 14151>>>>>>>>>>466 ubyte !0xee 14152>>>>>>>>>>>482 ubyte 0xee 14153>>>>>>>>>>>>498 ubyte !0xee 14154#>>>>>>>>>>>>>478 use gpt-mbr-partition 14155>>>>>>>>>>>>>(486.l*8192) string EFI\ PART GPT partition table 14156>>>>>>>>>>>>>>0 use gpt-mbr-type 14157>>>>>>>>>>>>>>&-8 use gpt-table 14158>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 14159>>>>>>>>>>>>>(486.l*8192) string !EFI\ PART 14160>>>>>>>>>>>>>>(486.l*4096) string EFI\ PART GPT partition table 14161>>>>>>>>>>>>>>>0 use gpt-mbr-type 14162>>>>>>>>>>>>>>>&-8 use gpt-table 14163>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 14164>>>>>>>>>>>>>>(486.l*4096) string !EFI\ PART 14165>>>>>>>>>>>>>>>(486.l*2048) string EFI\ PART GPT partition table 14166>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14167>>>>>>>>>>>>>>>>&-8 use gpt-table 14168>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 14169>>>>>>>>>>>>>>>(486.l*2048) string !EFI\ PART 14170>>>>>>>>>>>>>>>>(486.l*1024) string EFI\ PART GPT partition table 14171>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14172>>>>>>>>>>>>>>>>>&-8 use gpt-table 14173>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 14174>>>>>>>>>>>>>>>>(486.l*1024) string !EFI\ PART 14175>>>>>>>>>>>>>>>>>(486.l*512) string EFI\ PART GPT partition table 14176>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14177>>>>>>>>>>>>>>>>>>&-8 use gpt-table 14178>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 14179# GPT with protective MBR entry in partition 4 (only) 14180>>>>>>>>>450 ubyte !0xee 14181>>>>>>>>>>466 ubyte !0xee 14182>>>>>>>>>>>482 ubyte !0xee 14183>>>>>>>>>>>>498 ubyte 0xee 14184#>>>>>>>>>>>>>494 use gpt-mbr-partition 14185>>>>>>>>>>>>>(502.l*8192) string EFI\ PART GPT partition table 14186>>>>>>>>>>>>>>0 use gpt-mbr-type 14187>>>>>>>>>>>>>>&-8 use gpt-table 14188>>>>>>>>>>>>>>0 ubyte x of 8192 bytes 14189>>>>>>>>>>>>>(502.l*8192) string !EFI\ PART 14190>>>>>>>>>>>>>>(502.l*4096) string EFI\ PART GPT partition table 14191>>>>>>>>>>>>>>>0 use gpt-mbr-type 14192>>>>>>>>>>>>>>>&-8 use gpt-table 14193>>>>>>>>>>>>>>>0 ubyte x of 4096 bytes 14194>>>>>>>>>>>>>>(502.l*4096) string !EFI\ PART 14195>>>>>>>>>>>>>>>(502.l*2048) string EFI\ PART GPT partition table 14196>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14197>>>>>>>>>>>>>>>>&-8 use gpt-table 14198>>>>>>>>>>>>>>>>0 ubyte x of 2048 bytes 14199>>>>>>>>>>>>>>>(502.l*2048) string !EFI\ PART 14200>>>>>>>>>>>>>>>>(502.l*1024) string EFI\ PART GPT partition table 14201>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14202>>>>>>>>>>>>>>>>>&-8 use gpt-table 14203>>>>>>>>>>>>>>>>>0 ubyte x of 1024 bytes 14204>>>>>>>>>>>>>>>>(502.l*1024) string !EFI\ PART 14205>>>>>>>>>>>>>>>>>(502.l*512) string EFI\ PART GPT partition table 14206>>>>>>>>>>>>>>>>>>0 use gpt-mbr-type 14207>>>>>>>>>>>>>>>>>>&-8 use gpt-table 14208>>>>>>>>>>>>>>>>>>0 ubyte x of 512 bytes 14209 14210# The following code does GPT detection and processing, including 14211# sector size detection. 14212# It has to be duplicated above because the top-level pattern 14213# (i.e. not called using 'use') must print *something* for file 14214# to count it as a match. Text only printed in named patterns is 14215# not counted, and causes file to continue, and try and match 14216# other patterns. 14217# 14218# Unfortunately, when assuming sector sizes >=16k, if the sector size 14219# happens to be 512 instead, we may find confusing data after the GPT 14220# table... If the GPT table has less than 128 entries, this may even 14221# happen for assumed sector sizes as small as 4k 14222# This could be solved by checking for the presence of the backup GPT 14223# header as well, but that makes the logic extremely complex 14224##0 name gpt-mbr-partition 14225##>(8.l*8192) string EFI\ PART 14226##>>(8.l*8192) use gpt-mbr-type 14227##>>&-8 use gpt-table 14228##>>0 ubyte x of 8192 bytes 14229##>(8.l*8192) string !EFI\ PART 14230##>>(8.l*4096) string EFI\ PART GPT partition table 14231##>>>0 use gpt-mbr-type 14232##>>>&-8 use gpt-table 14233##>>>0 ubyte x of 4096 bytes 14234##>>(8.l*4096) string !EFI\ PART 14235##>>>(8.l*2048) string EFI\ PART GPT partition table 14236##>>>>0 use gpt-mbr-type 14237##>>>>&-8 use gpt-table 14238##>>>>0 ubyte x of 2048 bytes 14239##>>>(8.l*2048) string !EFI\ PART 14240##>>>>(8.l*1024) string EFI\ PART GPT partition table 14241##>>>>>0 use gpt-mbr-type 14242##>>>>>&-8 use gpt-table 14243##>>>>>0 ubyte x of 1024 bytes 14244##>>>>(8.l*1024) string !EFI\ PART 14245##>>>>>(8.l*512) string EFI\ PART GPT partition table 14246##>>>>>>0 use gpt-mbr-type 14247##>>>>>>&-8 use gpt-table 14248##>>>>>>0 ubyte x of 512 bytes 14249 14250# Print details of MBR type for a GPT-disk 14251# Calling code ensures that there is only one 0xee partition. 142520 name gpt-mbr-type 14253# GPT with protective MBR entry in partition 1 14254>450 ubyte 0xee 14255>>454 ulelong 1 14256>>>462 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 14257>>454 ulelong !1 \b (nonstandard: not at LBA 1) 14258# GPT with protective MBR entry in partition 2 14259>466 ubyte 0xee 14260>>470 ulelong 1 14261>>>478 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 14262>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 14263>>>478 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 14264>>470 ulelong !1 \b (nonstandard: not at LBA 1) 14265# GPT with protective MBR entry in partition 3 14266>482 ubyte 0xee 14267>>486 ulelong 1 14268>>>494 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 14269>>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 14270>>>494 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 14271>>486 ulelong !1 \b (nonstandard: not at LBA 1) 14272# GPT with protective MBR entry in partition 4 14273>498 ubyte 0xee 14274>>502 ulelong 1 14275>>>446 string !\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \b (with hybrid MBR) 14276>>502 ulelong !1 \b (nonstandard: not at LBA 1) 14277 14278# Print the information from a GPT partition table structure 142790 name gpt-table 14280>10 uleshort x \b, version %u 14281>8 uleshort x \b.%u 14282>56 ulelong x \b, GUID: %08x 14283>60 uleshort x \b-%04x 14284>62 uleshort x \b-%04x 14285>64 ubeshort x \b-%04x 14286>66 ubeshort x \b-%04x 14287>68 ubelong x \b%08x 14288#>80 uleshort x \b, %d partition entries 14289>32 ulequad+1 x \b, disk size: %lld sectors 14290 14291# In case a GPT data-structure is at LBA 0, report it as well 14292# This covers systems which are not GPT-aware, and which show 14293# and allow access to the protective partition. This code will 14294# detect the contents of such a partition. 142950 string EFI\ PART GPT data structure (nonstandard: at LBA 0) 14296>0 use gpt-table 14297>0 ubyte x (sector size unknown) 14298 14299 14300 14301#------------------------------------------------------------------------------ 14302# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $ 14303# gpu: file(1) magic for GPU input files 14304 14305# Standard Portable Intermediate Representation (SPIR) 14306# Documentation: https://www.khronos.org/spir 14307# Typical file extension: .spv 14308 143090 belong 0x07230203 Khronos SPIR-V binary, big-endian 14310>4 belong x \b, version 0x%08x 14311>8 belong x \b, generator 0x%08x 14312 143130 lelong 0x07230203 Khronos SPIR-V binary, little-endian 14314>4 lelong x \b, version 0x%08x 14315>8 lelong x \b, generator 0x%08x 14316 14317# Vulkan Trace file 14318# Documentation: 14319# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\ 14320# vktrace_trace_packet_identifiers.h 14321# Typical file extension: .vktrace 14322 143238 lequad 0xABADD068ADEAFD0C Vulkan trace file, little-endian 14324>0 leshort x \b, version %d 14325 143268 bequad 0xABADD068ADEAFD0C Vulkan trace file, big-endian 14327>0 beshort x \b, version %d 14328 14329#------------------------------------------------------------------------------ 14330# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $ 14331# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 14332# 14333# ACE/gr binary 143340 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file 14335>39 byte >0 - version %c 14336# ACE/gr ascii 143370 string #\ xvgr\ parameter\ file ACE/gr ascii file 143380 string #\ xmgr\ parameter\ file ACE/gr ascii file 143390 string #\ ACE/gr\ parameter\ file ACE/gr ascii file 14340# Grace projects 143410 string #\ Grace\ project\ file Grace project file 14342>23 string @version\ (version 14343>>32 byte >0 %c 14344>>33 string >\0 \b.%.2s 14345>>35 string >\0 \b.%.2s) 14346# ACE/gr fit description files 143470 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file 14348# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE 14349 14350#------------------------------------------------------------------------------ 14351# $File: graphviz,v 1.9 2019/04/30 04:01:40 christos Exp $ 14352# graphviz: file(1) magic for https://www.graphviz.org/ 14353 14354# FIXME: These patterns match too generally. For example, the first 14355# line matches a LaTeX file containing the word "graph" (with a { 14356# following later) and the second line matches this file. 14357#0 regex/100l [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text 14358#!:mime text/vnd.graphviz 14359#0 regex/100l [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text 14360#!:mime text/vnd.graphviz 14361 14362#------------------------------------------------------------------------------ 14363# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $ 14364# gringotts: file(1) magic for Gringotts 14365# http://devel.pluto.linux.it/projects/Gringotts/ 14366# author: Germano Rizzo <mano@pluto.linux.it> 14367#GRG3????Y 143680 string GRG Gringotts data file 14369#file format 1 14370>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9 14371#file format 2 14372>3 string 2 v.2, MCRYPT S2K, 14373>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 14374>>8 byte&0x70 0x10 SERPENT crypt, 14375>>8 byte&0x70 0x20 TWOFISH crypt, 14376>>8 byte&0x70 0x30 CAST-256 crypt, 14377>>8 byte&0x70 0x40 SAFER+ crypt, 14378>>8 byte&0x70 0x50 LOKI97 crypt, 14379>>8 byte&0x70 0x60 3DES crypt, 14380>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 14381>>8 byte&0x08 0x00 SHA1 hash, 14382>>8 byte&0x08 0x08 RIPEMD-160 hash, 14383>>8 byte&0x04 0x00 ZLib 14384>>8 byte&0x04 0x04 BZip2 14385>>8 byte&0x03 0x00 lvl.0 14386>>8 byte&0x03 0x01 lvl.3 14387>>8 byte&0x03 0x02 lvl.6 14388>>8 byte&0x03 0x03 lvl.9 14389#file format 3 14390>3 string 3 v.3, OpenPGP S2K, 14391>>8 byte&0x70 0x00 RIJNDAEL-128 crypt, 14392>>8 byte&0x70 0x10 SERPENT crypt, 14393>>8 byte&0x70 0x20 TWOFISH crypt, 14394>>8 byte&0x70 0x30 CAST-256 crypt, 14395>>8 byte&0x70 0x40 SAFER+ crypt, 14396>>8 byte&0x70 0x50 LOKI97 crypt, 14397>>8 byte&0x70 0x60 3DES crypt, 14398>>8 byte&0x70 0x70 RIJNDAEL-256 crypt, 14399>>8 byte&0x08 0x00 SHA1 hash, 14400>>8 byte&0x08 0x08 RIPEMD-160 hash, 14401>>8 byte&0x04 0x00 ZLib 14402>>8 byte&0x04 0x04 BZip2 14403>>8 byte&0x03 0x00 lvl.0 14404>>8 byte&0x03 0x01 lvl.3 14405>>8 byte&0x03 0x02 lvl.6 14406>>8 byte&0x03 0x03 lvl.9 14407#file format >3 14408>3 string >3 v.%.1s (unknown details) 14409 14410#------------------------------------------------------------------------------ 14411# $File: guile,v 1.2 2019/04/19 00:42:27 christos Exp $ 14412# Guile file magic from <dalepsmith@gmail.com> 14413# https://www.gnu.org/s/guile/ 14414# https://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250 14415 144160 string GOOF---- Guile Object 14417>8 string LE \b, little endian 14418>8 string BE \b, big endian 14419>11 string 4 \b, 32bit 14420>11 string 8 \b, 64bit 14421>13 regex .\.. \b, bytecode v%s 14422 14423#------------------------------------------------------------------------------ 14424# $File: hardware,v 1.1 2018/08/02 06:32:52 christos Exp $ 14425# hardware magic 14426 14427# EDID 14428# https://en.wikipedia.org/wiki/Extended_Display_Identification_Data 144290 string \x00\xFF\xFF\xFF\xFF\xFF\xFF\x00 14430>19 byte x 14431>>18 byte x EDID data, version %u. 14432>>19 byte x \b%u 14433#>>17 ubyte+1990 <255 \b, manufactured %u 14434 14435#------------------------------------------------------------------------------ 14436# $File: hitachi-sh,v 1.9 2018/08/21 12:48:41 christos Exp $ 14437# hitach-sh: file(1) magic for Hitachi Super-H 14438# 14439# Super-H COFF 14440# 14441# updated by Joerg Jenderek at Oct 2015 14442# https://en.wikipedia.org/wiki/COFF 14443# https://de.wikipedia.org/wiki/Common_Object_File_Format 14444# http://www.delorie.com/djgpp/doc/coff/filhdr.html 14445# below test line conflicts with 2nd NTFS filesystem sector 14446# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR 14447# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/) 144480 beshort 0x0500 14449# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags 14450>18 ubeshort&0x8E80 0 14451# use big endian variant of subroutine to display name+variables+flags 14452# for common object formated files 14453>>0 use \^display-coff 14454!:strength -10 14455 144560 leshort 0x0550 14457# test for unused flag bits in f_flags 14458>18 uleshort&0x8E80 0 14459# use little endian variant of subroutine to 14460# display name+variables+flags for common object formated files 14461>>0 use display-coff 14462!:strength -10 14463 14464 14465#------------------------------------------------------------------------------ 14466# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $ 14467# hp: file(1) magic for Hewlett Packard machines (see also "printer") 14468# 14469# XXX - somebody should figure out whether any byte order needs to be 14470# applied to the "TML" stuff; I'm assuming the Apollo stuff is 14471# big-endian as it was mostly 68K-based. 14472# 14473# I think the 500 series was the old stack-based machines, running a 14474# UNIX environment atop the "SUN kernel"; dunno whether it was 14475# big-endian or little-endian. 14476# 14477# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based; 14478# hp300 are 68020+68881 based; hp400 are also 68k. The following basic 14479# HP magic is useful for reference, but using "long" magic is a better 14480# practice in order to avoid collisions. 14481# 14482# Guy Harris (guy@netapp.com): some additions to this list came from 14483# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1, 14484# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0 14485# "/etc/magic", though, except for the "archive file relocatable library" 14486# stuff, and the 68030 and 68040 stuff isn't there at all - are they not 14487# used in executables, or have they just not yet updated "/etc/magic" 14488# completely? 14489# 14490# 0 beshort 200 hp200 (68010) BSD binary 14491# 0 beshort 300 hp300 (68020+68881) BSD binary 14492# 0 beshort 0x20c hp200/300 HP-UX binary 14493# 0 beshort 0x20d hp400 (68030) HP-UX binary 14494# 0 beshort 0x20e hp400 (68040?) HP-UX binary 14495# 0 beshort 0x20b PA-RISC1.0 HP-UX binary 14496# 0 beshort 0x210 PA-RISC1.1 HP-UX binary 14497# 0 beshort 0x211 PA-RISC1.2 HP-UX binary 14498# 0 beshort 0x214 PA-RISC2.0 HP-UX binary 14499 14500# 14501# The "misc" stuff needs a byte order; the archives look suspiciously 14502# like the old 177545 archives (0xff65 = 0177545). 14503# 14504#### Old Apollo stuff 145050 beshort 0627 Apollo m68k COFF executable 14506>18 beshort ^040000 not stripped 14507>22 beshort >0 - version %d 145080 beshort 0624 apollo a88k COFF executable 14509>18 beshort ^040000 not stripped 14510>22 beshort >0 - version %d 145110 long 01203604016 TML 0123 byte-order format 145120 long 01702407010 TML 1032 byte-order format 145130 long 01003405017 TML 2301 byte-order format 145140 long 01602007412 TML 3210 byte-order format 14515#### PA-RISC 1.1 145160 belong 0x02100106 PA-RISC1.1 relocatable object 145170 belong 0x02100107 PA-RISC1.1 executable 14518>168 belong &0x00000004 dynamically linked 14519>(144) belong 0x054ef630 dynamically linked 14520>96 belong >0 - not stripped 14521 145220 belong 0x02100108 PA-RISC1.1 shared executable 14523>168 belong&0x4 0x4 dynamically linked 14524>(144) belong 0x054ef630 dynamically linked 14525>96 belong >0 - not stripped 14526 145270 belong 0x0210010b PA-RISC1.1 demand-load executable 14528>168 belong&0x4 0x4 dynamically linked 14529>(144) belong 0x054ef630 dynamically linked 14530>96 belong >0 - not stripped 14531 145320 belong 0x0210010e PA-RISC1.1 shared library 14533>96 belong >0 - not stripped 14534 145350 belong 0x0210010d PA-RISC1.1 dynamic load library 14536>96 belong >0 - not stripped 14537 14538#### PA-RISC 2.0 145390 belong 0x02140106 PA-RISC2.0 relocatable object 14540 145410 belong 0x02140107 PA-RISC2.0 executable 14542>168 belong &0x00000004 dynamically linked 14543>(144) belong 0x054ef630 dynamically linked 14544>96 belong >0 - not stripped 14545 145460 belong 0x02140108 PA-RISC2.0 shared executable 14547>168 belong &0x00000004 dynamically linked 14548>(144) belong 0x054ef630 dynamically linked 14549>96 belong >0 - not stripped 14550 145510 belong 0x0214010b PA-RISC2.0 demand-load executable 14552>168 belong &0x00000004 dynamically linked 14553>(144) belong 0x054ef630 dynamically linked 14554>96 belong >0 - not stripped 14555 145560 belong 0x0214010e PA-RISC2.0 shared library 14557>96 belong >0 - not stripped 14558 145590 belong 0x0214010d PA-RISC2.0 dynamic load library 14560>96 belong >0 - not stripped 14561 14562#### 800 145630 belong 0x020b0106 PA-RISC1.0 relocatable object 14564 145650 belong 0x020b0107 PA-RISC1.0 executable 14566>168 belong&0x4 0x4 dynamically linked 14567>(144) belong 0x054ef630 dynamically linked 14568>96 belong >0 - not stripped 14569 145700 belong 0x020b0108 PA-RISC1.0 shared executable 14571>168 belong&0x4 0x4 dynamically linked 14572>(144) belong 0x054ef630 dynamically linked 14573>96 belong >0 - not stripped 14574 145750 belong 0x020b010b PA-RISC1.0 demand-load executable 14576>168 belong&0x4 0x4 dynamically linked 14577>(144) belong 0x054ef630 dynamically linked 14578>96 belong >0 - not stripped 14579 145800 belong 0x020b010e PA-RISC1.0 shared library 14581>96 belong >0 - not stripped 14582 145830 belong 0x020b010d PA-RISC1.0 dynamic load library 14584>96 belong >0 - not stripped 14585 14586#### 500 145870 long 0x02080106 HP s500 relocatable executable 14588>16 long >0 - version %d 14589 145900 long 0x02080107 HP s500 executable 14591>16 long >0 - version %d 14592 145930 long 0x02080108 HP s500 pure executable 14594>16 long >0 - version %d 14595 14596#### 200 145970 belong 0x020c0108 HP s200 pure executable 14598>4 beshort >0 - version %d 14599>8 belong &0x80000000 save fp regs 14600>8 belong &0x40000000 dynamically linked 14601>8 belong &0x20000000 debuggable 14602>36 belong >0 not stripped 14603 146040 belong 0x020c0107 HP s200 executable 14605>4 beshort >0 - version %d 14606>8 belong &0x80000000 save fp regs 14607>8 belong &0x40000000 dynamically linked 14608>8 belong &0x20000000 debuggable 14609>36 belong >0 not stripped 14610 146110 belong 0x020c010b HP s200 demand-load executable 14612>4 beshort >0 - version %d 14613>8 belong &0x80000000 save fp regs 14614>8 belong &0x40000000 dynamically linked 14615>8 belong &0x20000000 debuggable 14616>36 belong >0 not stripped 14617 146180 belong 0x020c0106 HP s200 relocatable executable 14619>4 beshort >0 - version %d 14620>6 beshort >0 - highwater %d 14621>8 belong &0x80000000 save fp regs 14622>8 belong &0x20000000 debuggable 14623>8 belong &0x10000000 PIC 14624 146250 belong 0x020a0108 HP s200 (2.x release) pure executable 14626>4 beshort >0 - version %d 14627>36 belong >0 not stripped 14628 146290 belong 0x020a0107 HP s200 (2.x release) executable 14630>4 beshort >0 - version %d 14631>36 belong >0 not stripped 14632 146330 belong 0x020c010e HP s200 shared library 14634>4 beshort >0 - version %d 14635>6 beshort >0 - highwater %d 14636>36 belong >0 not stripped 14637 146380 belong 0x020c010d HP s200 dynamic load library 14639>4 beshort >0 - version %d 14640>6 beshort >0 - highwater %d 14641>36 belong >0 not stripped 14642 14643#### MISC 146440 long 0x0000ff65 HP old archive 146450 long 0x020aff65 HP s200 old archive 146460 long 0x020cff65 HP s200 old archive 146470 long 0x0208ff65 HP s500 old archive 14648 146490 long 0x015821a6 HP core file 14650 146510 long 0x4da7eee8 HP-WINDOWS font 14652>8 byte >0 - version %d 146530 string Bitmapfile HP Bitmapfile 14654 146550 string IMGfile CIS compimg HP Bitmapfile 14656# XXX - see "lif" 14657#0 short 0x8000 lif file 146580 long 0x020c010c compiled Lisp 14659 146600 string msgcat01 HP NLS message catalog, 14661>8 long >0 %d messages 14662 14663# Summary: HP-48/49 calculator 14664# Created by: phk@data.fls.dk 14665# Modified by (1): AMAKAWA Shuhei <sa264@cam.ac.uk> 14666# Modified by (2): Samuel Thibault <samuel.thibault@ens-lyon.org> (HP49 support) 146670 string HPHP HP 14668>4 string 48 48 binary 14669>4 string 49 49 binary 14670>7 byte >64 - Rev %c 14671>8 leshort 0x2911 (ADR) 14672>8 leshort 0x2933 (REAL) 14673>8 leshort 0x2955 (LREAL) 14674>8 leshort 0x2977 (COMPLX) 14675>8 leshort 0x299d (LCOMPLX) 14676>8 leshort 0x29bf (CHAR) 14677>8 leshort 0x29e8 (ARRAY) 14678>8 leshort 0x2a0a (LNKARRAY) 14679>8 leshort 0x2a2c (STRING) 14680>8 leshort 0x2a4e (HXS) 14681>8 leshort 0x2a74 (LIST) 14682>8 leshort 0x2a96 (DIR) 14683>8 leshort 0x2ab8 (ALG) 14684>8 leshort 0x2ada (UNIT) 14685>8 leshort 0x2afc (TAGGED) 14686>8 leshort 0x2b1e (GROB) 14687>8 leshort 0x2b40 (LIB) 14688>8 leshort 0x2b62 (BACKUP) 14689>8 leshort 0x2b88 (LIBDATA) 14690>8 leshort 0x2d9d (PROG) 14691>8 leshort 0x2dcc (CODE) 14692>8 leshort 0x2e48 (GNAME) 14693>8 leshort 0x2e6d (LNAME) 14694>8 leshort 0x2e92 (XLIB) 14695 146960 string %%HP: HP text 14697>6 string T(0) - T(0) 14698>6 string T(1) - T(1) 14699>6 string T(2) - T(2) 14700>6 string T(3) - T(3) 14701>10 string A(D) A(D) 14702>10 string A(R) A(R) 14703>10 string A(G) A(G) 14704>14 string F(.) F(.); 14705>14 string F(,) F(,); 14706 14707 14708# Summary: HP-38/39 calculator 14709# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 147100 string HP3 14711>3 string 8 HP 38 14712>3 string 9 HP 39 14713>4 string Bin binary 14714>4 string Asc ASCII 14715>7 string A (Directory List) 14716>7 string B (Zaplet) 14717>7 string C (Note) 14718>7 string D (Program) 14719>7 string E (Variable) 14720>7 string F (List) 14721>7 string G (Matrix) 14722>7 string H (Library) 14723>7 string I (Target List) 14724>7 string J (ASCII Vector specification) 14725>7 string K (wildcard) 14726 14727# Summary: HP-38/39 calculator 14728# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org> 147290 string HP3 14730>3 string 8 HP 38 14731>3 string 9 HP 39 14732>4 string Bin binary 14733>4 string Asc ASCII 14734>7 string A (Directory List) 14735>7 string B (Zaplet) 14736>7 string C (Note) 14737>7 string D (Program) 14738>7 string E (Variable) 14739>7 string F (List) 14740>7 string G (Matrix) 14741>7 string H (Library) 14742>7 string I (Target List) 14743>7 string J (ASCII Vector specification) 14744>7 string K (wildcard) 14745 14746# hpBSD magic numbers 147470 beshort 200 hp200 (68010) BSD 14748>2 beshort 0407 impure binary 14749>2 beshort 0410 read-only binary 14750>2 beshort 0413 demand paged binary 147510 beshort 300 hp300 (68020+68881) BSD 14752>2 beshort 0407 impure binary 14753>2 beshort 0410 read-only binary 14754>2 beshort 0413 demand paged binary 14755# 14756# From David Gero <dgero@nortelnetworks.com> 14757# HP-UX 10.20 core file format from /usr/include/sys/core.h 14758# Unfortunately, HP-UX uses corehead blocks without specifying the order 14759# There are four we care about: 14760# CORE_KERNEL, which starts with the string "HP-UX" 14761# CORE_EXEC, which contains the name of the command 14762# CORE_PROC, which contains the signal number that caused the core dump 14763# CORE_FORMAT, which contains the version of the core file format (== 1) 14764# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC 14765# but we include all 6 variations of the order of the first 3, and 14766# assume that PROC will always be last 14767# Order 1: KERNEL, EXEC, FORMAT, PROC 147680x10 string HP-UX 14769>0 belong 2 14770>>0xC belong 0x3C 14771>>>0x4C belong 0x100 14772>>>>0x58 belong 0x44 14773>>>>>0xA0 belong 1 14774>>>>>>0xAC belong 4 14775>>>>>>>0xB0 belong 1 14776>>>>>>>>0xB4 belong 4 core file 14777>>>>>>>>>0x90 string >\0 from '%s' 14778>>>>>>>>>0xC4 belong 3 - received SIGQUIT 14779>>>>>>>>>0xC4 belong 4 - received SIGILL 14780>>>>>>>>>0xC4 belong 5 - received SIGTRAP 14781>>>>>>>>>0xC4 belong 6 - received SIGABRT 14782>>>>>>>>>0xC4 belong 7 - received SIGEMT 14783>>>>>>>>>0xC4 belong 8 - received SIGFPE 14784>>>>>>>>>0xC4 belong 10 - received SIGBUS 14785>>>>>>>>>0xC4 belong 11 - received SIGSEGV 14786>>>>>>>>>0xC4 belong 12 - received SIGSYS 14787>>>>>>>>>0xC4 belong 33 - received SIGXCPU 14788>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 14789# Order 2: KERNEL, FORMAT, EXEC, PROC 14790>>>0x4C belong 1 14791>>>>0x58 belong 4 14792>>>>>0x5C belong 1 14793>>>>>>0x60 belong 0x100 14794>>>>>>>0x6C belong 0x44 14795>>>>>>>>0xB4 belong 4 core file 14796>>>>>>>>>0xA4 string >\0 from '%s' 14797>>>>>>>>>0xC4 belong 3 - received SIGQUIT 14798>>>>>>>>>0xC4 belong 4 - received SIGILL 14799>>>>>>>>>0xC4 belong 5 - received SIGTRAP 14800>>>>>>>>>0xC4 belong 6 - received SIGABRT 14801>>>>>>>>>0xC4 belong 7 - received SIGEMT 14802>>>>>>>>>0xC4 belong 8 - received SIGFPE 14803>>>>>>>>>0xC4 belong 10 - received SIGBUS 14804>>>>>>>>>0xC4 belong 11 - received SIGSEGV 14805>>>>>>>>>0xC4 belong 12 - received SIGSYS 14806>>>>>>>>>0xC4 belong 33 - received SIGXCPU 14807>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 14808# Order 3: FORMAT, KERNEL, EXEC, PROC 148090x24 string HP-UX 14810>0 belong 1 14811>>0xC belong 4 14812>>>0x10 belong 1 14813>>>>0x14 belong 2 14814>>>>>0x20 belong 0x3C 14815>>>>>>0x60 belong 0x100 14816>>>>>>>0x6C belong 0x44 14817>>>>>>>>0xB4 belong 4 core file 14818>>>>>>>>>0xA4 string >\0 from '%s' 14819>>>>>>>>>0xC4 belong 3 - received SIGQUIT 14820>>>>>>>>>0xC4 belong 4 - received SIGILL 14821>>>>>>>>>0xC4 belong 5 - received SIGTRAP 14822>>>>>>>>>0xC4 belong 6 - received SIGABRT 14823>>>>>>>>>0xC4 belong 7 - received SIGEMT 14824>>>>>>>>>0xC4 belong 8 - received SIGFPE 14825>>>>>>>>>0xC4 belong 10 - received SIGBUS 14826>>>>>>>>>0xC4 belong 11 - received SIGSEGV 14827>>>>>>>>>0xC4 belong 12 - received SIGSYS 14828>>>>>>>>>0xC4 belong 33 - received SIGXCPU 14829>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 14830# Order 4: EXEC, KERNEL, FORMAT, PROC 148310x64 string HP-UX 14832>0 belong 0x100 14833>>0xC belong 0x44 14834>>>0x54 belong 2 14835>>>>0x60 belong 0x3C 14836>>>>>0xA0 belong 1 14837>>>>>>0xAC belong 4 14838>>>>>>>0xB0 belong 1 14839>>>>>>>>0xB4 belong 4 core file 14840>>>>>>>>>0x44 string >\0 from '%s' 14841>>>>>>>>>0xC4 belong 3 - received SIGQUIT 14842>>>>>>>>>0xC4 belong 4 - received SIGILL 14843>>>>>>>>>0xC4 belong 5 - received SIGTRAP 14844>>>>>>>>>0xC4 belong 6 - received SIGABRT 14845>>>>>>>>>0xC4 belong 7 - received SIGEMT 14846>>>>>>>>>0xC4 belong 8 - received SIGFPE 14847>>>>>>>>>0xC4 belong 10 - received SIGBUS 14848>>>>>>>>>0xC4 belong 11 - received SIGSEGV 14849>>>>>>>>>0xC4 belong 12 - received SIGSYS 14850>>>>>>>>>0xC4 belong 33 - received SIGXCPU 14851>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 14852# Order 5: FORMAT, EXEC, KERNEL, PROC 148530x78 string HP-UX 14854>0 belong 1 14855>>0xC belong 4 14856>>>0x10 belong 1 14857>>>>0x14 belong 0x100 14858>>>>>0x20 belong 0x44 14859>>>>>>0x68 belong 2 14860>>>>>>>0x74 belong 0x3C 14861>>>>>>>>0xB4 belong 4 core file 14862>>>>>>>>>0x58 string >\0 from '%s' 14863>>>>>>>>>0xC4 belong 3 - received SIGQUIT 14864>>>>>>>>>0xC4 belong 4 - received SIGILL 14865>>>>>>>>>0xC4 belong 5 - received SIGTRAP 14866>>>>>>>>>0xC4 belong 6 - received SIGABRT 14867>>>>>>>>>0xC4 belong 7 - received SIGEMT 14868>>>>>>>>>0xC4 belong 8 - received SIGFPE 14869>>>>>>>>>0xC4 belong 10 - received SIGBUS 14870>>>>>>>>>0xC4 belong 11 - received SIGSEGV 14871>>>>>>>>>0xC4 belong 12 - received SIGSYS 14872>>>>>>>>>0xC4 belong 33 - received SIGXCPU 14873>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 14874# Order 6: EXEC, FORMAT, KERNEL, PROC 14875>0 belong 0x100 14876>>0xC belong 0x44 14877>>>0x54 belong 1 14878>>>>0x60 belong 4 14879>>>>>0x64 belong 1 14880>>>>>>0x68 belong 2 14881>>>>>>>0x74 belong 0x2C 14882>>>>>>>>0xB4 belong 4 core file 14883>>>>>>>>>0x44 string >\0 from '%s' 14884>>>>>>>>>0xC4 belong 3 - received SIGQUIT 14885>>>>>>>>>0xC4 belong 4 - received SIGILL 14886>>>>>>>>>0xC4 belong 5 - received SIGTRAP 14887>>>>>>>>>0xC4 belong 6 - received SIGABRT 14888>>>>>>>>>0xC4 belong 7 - received SIGEMT 14889>>>>>>>>>0xC4 belong 8 - received SIGFPE 14890>>>>>>>>>0xC4 belong 10 - received SIGBUS 14891>>>>>>>>>0xC4 belong 11 - received SIGSEGV 14892>>>>>>>>>0xC4 belong 12 - received SIGSYS 14893>>>>>>>>>0xC4 belong 33 - received SIGXCPU 14894>>>>>>>>>0xC4 belong 34 - received SIGXFSZ 14895 14896 14897 14898#------------------------------------------------------------------------------ 14899# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $ 14900# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats 14901# Magic too short! 14902#0 string HU Human68k 14903#>68 string LZX LZX compressed 14904#>>72 string >\0 (version %s) 14905#>(8.L+74) string LZX LZX compressed 14906#>>(8.L+78) string >\0 (version %s) 14907#>60 belong >0 binded 14908#>(8.L+66) string #HUPAIR hupair 14909#>0 string HU X executable 14910#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 14911#>4 belong >0 - base address 0x%x 14912#>28 belong >0 not stripped 14913#>32 belong >0 with debug information 14914#0 beshort 0x601a Human68k Z executable 14915#0 beshort 0x6000 Human68k object file 14916#0 belong 0xd1000000 Human68k ar binary archive 14917#0 belong 0xd1010000 Human68k ar ascii archive 14918#0 beshort 0x0068 Human68k lib archive 14919#4 string LZX Human68k LZX compressed 14920#>8 string >\0 (version %s) 14921#>4 string LZX R executable 14922#2 string #HUPAIR Human68k hupair R executable 14923 14924#------------------------------------------------------------------------------ 14925# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $ 14926# ibm370: file(1) magic for IBM 370 and compatibles. 14927# 14928# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". 14929# What the heck *is* "USS/370"? 14930# AIX 4.1's "/etc/magic" has 14931# 14932# 0 short 0535 370 sysV executable 14933# >12 long >0 not stripped 14934# >22 short >0 - version %d 14935# >30 long >0 - 5.2 format 14936# 0 short 0530 370 sysV pure executable 14937# >12 long >0 not stripped 14938# >22 short >0 - version %d 14939# >30 long >0 - 5.2 format 14940# 14941# instead of the "USS/370" versions of the same magic numbers. 14942# 149430 beshort 0537 370 XA sysV executable 14944>12 belong >0 not stripped 14945>22 beshort >0 - version %d 14946>30 belong >0 - 5.2 format 149470 beshort 0532 370 XA sysV pure executable 14948>12 belong >0 not stripped 14949>22 beshort >0 - version %d 14950>30 belong >0 - 5.2 format 149510 beshort 054001 370 sysV pure executable 14952>12 belong >0 not stripped 149530 beshort 055001 370 XA sysV pure executable 14954>12 belong >0 not stripped 149550 beshort 056401 370 sysV executable 14956>12 belong >0 not stripped 149570 beshort 057401 370 XA sysV executable 14958>12 belong >0 not stripped 149590 beshort 0531 SVR2 executable (Amdahl-UTS) 14960>12 belong >0 not stripped 14961>24 belong >0 - version %d 149620 beshort 0534 SVR2 pure executable (Amdahl-UTS) 14963>12 belong >0 not stripped 14964>24 belong >0 - version %d 149650 beshort 0530 SVR2 pure executable (USS/370) 14966>12 belong >0 not stripped 14967>24 belong >0 - version %d 149680 beshort 0535 SVR2 executable (USS/370) 14969>12 belong >0 not stripped 14970>24 belong >0 - version %d 14971 14972#------------------------------------------------------------------------------ 14973# $File: ibm6000,v 1.14 2019/03/07 17:21:54 christos Exp $ 14974# ibm6000: file(1) magic for RS/6000 and the RT PC. 14975# 149760 beshort 0x01df executable (RISC System/6000 V3.1) or obj module 14977>12 belong >0 not stripped 14978# Breaks sun4 statically linked execs. 14979#0 beshort 0x0103 executable (RT Version 2) or obj module 14980#>2 byte 0x50 pure 14981#>28 belong >0 not stripped 14982#>6 beshort >0 - version %ld 149830 beshort 0x0104 shared library 149840 beshort 0x0105 ctab data 149850 beshort 0xfe04 structured file 149860 string 0xabcdef AIX message catalog 149870 belong 0x000001f9 AIX compiled message catalog 149880 string \<aiaff> archive 149890 string \<bigaf> archive (big format) 149900 belong 0x09006bea AIX backup/restore format file 149910 belong 0x09006fea AIX backup/restore format file 14992 149930 beshort 0x01f7 64-bit XCOFF executable or object module 14994>20 belong 0 not stripped 14995# GRR: this test is still too general as it catches also many FATs of DOS filesystems 149964 belong &0x0feeddb0 14997# real core dump could not be 32-bit and 64-bit together 14998>7 byte&0x03 !3 AIX core file 14999>>1 byte &0x01 fulldump 15000>>7 byte &0x01 32-bit 15001>>>0x6e0 string >\0 \b, %s 15002>>7 byte &0x02 64-bit 15003>>>0x524 string >\0 \b, %s 15004 15005#------------------------------------------------------------------------------ 15006# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $ 15007# icc: file(1) magic for International Color Consortium file formats 15008 15009# 15010# Color profiles as per the ICC's "Image technology colour management - 15011# Architecture, profile format, and data structure" specification. 15012# See 15013# 15014# http://www.color.org/specification/ICC1v43_2010-12.pdf 15015# 15016# for Specification ICC.1:2010 (Profile version 4.3.0.0). 15017# URL: http://fileformats.archiveteam.org/wiki/ICC_profile 15018# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf 15019# Update: Joerg Jenderek 15020# 15021# Bytes 36 to 39 contain a generic profile file signature of "acsp"; 15022# bytes 40 to 43 "may be used to identify the primary platform/operating 15023# system framework for which the profile was created". 15024# 15025# check and display ICC/ICM color profile 150260 name color-profile 15027>36 string acsp 15028# skip ASCII like Cognacspirit.txt by month <= 12 15029>>26 ubeshort <13 15030# platform/operating system. Only 5 mentioned 15031 15032# 15033# This appears to be what's used for Apple ColorSync profiles. 15034# Instead of adding that, Apple just changed the generic "acsp" entry 15035# to be for "ColorSync ICC Color Profile" rather than "Kodak Color 15036# Management System, ICC Profile". 15037# Yes, it's "APPL", not "AAPL"; see the spec. 15038>>>40 string APPL ColorSync 15039 15040# Microsoft ICM color profile 15041>>>40 string MSFT Microsoft 15042 15043# Yes, that's a blank after "SGI". 15044>>>40 string SGI\ SGI 15045 15046# XXX - is this what's used for the Sun KCMS or not? The standard file 15047# uses just "acsp" for that, but Apple's file uses it for "ColorSync", 15048# and there *is* an identified "primary platform" value of SUNW. 15049>>>40 string SUNW Sun KCMS 15050 15051# 5th platform 15052>>>40 string TGNT Taligent 15053 15054# remaining "l" "e" of "color profile" printed later to avoid error 15055>>>40 string x color profi 15056#>>>40 string x (%.4s) 15057!:mime application/vnd.iccprofile 15058# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found 15059>>>8 ubyte =2 15060# do not use empty message text to a avoid error like 15061# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type 15062# file.exe: could not find any valid magic files! 15063>>>>9 ubyte !0 \ble 15064!:ext icc/icm 15065# minor version 15066>>>>9 ubyte =0 \bl 15067# Kodak colour management system 15068>>>>>4 string =KCMS \be 15069!:ext icc/icm/cc 15070>>>>>4 string !KCMS \be 15071!:ext icc/icm 15072>>>8 ubyte !2 \ble 15073!:ext icc 15074# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h) 15075>>>8 ubyte x %u 15076>>>9 ubyte/16 x \b.%u 15077# reserved and shall be null but 205.205 in umx1220u.icm 15078>>>10 ubyte >0 \b.%u 15079>>>>11 ubyte >0 \b.%u 15080# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF " 15081# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm 15082>>>4 string >\ \b, type %.2s 15083>>>>6 string >\ \b%.1s 15084>>>>>7 string >\ \b%.1s 15085# colour space "XYZ " "Lab " "RGB " CMYK GRAY ... 15086>>>16 string x \b, %.3s 15087>>>19 string >\ \b%.1s 15088# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes 15089# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc 15090>>>20 string >\0 \b/%.3s 15091>>>>23 string >\ \b%.1s 15092# eleven device classes 15093>>>12 string x \b-%.4s device 15094# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm 15095>>>52 string >\040 15096# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm" 15097>>>>52 ubelong !0x6e6f6e65 15098# device manufacturer field like "HP " "IBM " EPSO 15099>>>>>48 string x \b, %.2s 15100>>>>>50 string >\ \b%.1s 15101>>>>>51 string >\ \b%.1s 15102# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC 15103>>>>>52 string >\ \ \b/%.3s 15104>>>>>>55 string >\ \b%.1s 15105>>>>>52 string x model 15106# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm 15107>>>80 string >\0 by %.2s 15108>>>>82 string >\ \b%.1s 15109>>>>>83 string >\ \b%.1s 15110# profile size 15111>>>0 ubelong x \b, %u bytes 15112# skip invalid date 0 like in linearSRGB.icc 15113>>>24 ubequad !0 15114# datetime dd-mm-yyyy hh:mm:ss 15115>>>>28 ubeshort x \b, %u 15116# month <= 12 15117>>>>26 ubeshort x \b-%u 15118# year 15119>>>>24 ubeshort x \b-%u 15120# do not display midnight time like in CNHP8308.ICC 15121>>>>30 ubequad&0xFFffFFffFFff0000 !0 15122# hour <= 24 15123>>>>>30 ubeshort x %u 15124# minutes <= 59 15125>>>>>32 ubeshort x \b:%.2u 15126# seconds <= 59 15127>>>>>34 ubeshort x \b:%.2u 15128# vendor specific flags like 2 in HPCLJ5.ICM 15129>>>44 ubeshort >0 \b, 0x%x vendor flags 15130# profile flags bits 0-2 of least 16 used by ICC 15131#>>>44 ubelong >0 \b, 0x%x flags 15132# icEmbeddedProfileTrue 15133>>>44 ubelong &1 \b, embedded 15134# icEmbeddedProfileFalse 15135#>>>44 ubelong ^1 \b, not embedded 15136# icUseWithEmbeddedDataOnly 15137>>>44 ubelong &2 \b, dependently 15138# icUseAnywhere 15139#>>>44 ubelong ^2 \b, independently 15140>>>44 ubelong &4 \b, MCS 15141#>>>44 ubelong ^4 \b, no MCS 15142# vendor specific device attributes 1~srgb.icc 15143# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM 15144>>>56 ubelong >0 \b, 0x%x vendor attribute 15145# ICC device attributes bits 0-7 used 15146#>>>60 ubelong x \b, 0x%x attribute 15147# http://www.color.org/icc34.h 15148>>>60 ubelong &0x01 \b, transparent 15149#>>>60 ubelong ^0x01 \b, reflective 15150>>>60 ubelong &0x02 \b, matte 15151#>>>60 ubelong ^0x02 \b, glossy 15152>>>60 ubelong &0x04 \b, negative 15153#>>>60 ubelong ^0x04 \b, positive 15154>>>60 ubelong &0x08 \b, black&white 15155#>>>60 ubelong ^0x08 \b, colour 15156>>>60 ubelong &0x10 \b, non-paper 15157#>>>60 ubelong ^0x10 \b, paper 15158>>>60 ubelong &0x20 \b, non-textured 15159#>>>60 ubelong ^0x20 \b, textured 15160>>>60 ubelong &0x40 \b, non-isotropic 15161#>>>60 ubelong ^0x40 \b, isotropic 15162>>>60 ubelong &0x80 \b, self-luminous 15163#>>>60 ubelong ^0x80 \b, non-self-luminous 15164# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM 15165>>>64 ubelong >3 \b, 0x%x rendering intent 15166#>>>64 ubelong =0 \b, perceptual 15167>>>64 ubelong =1 \b, relative colorimetric 15168>>>64 ubelong =2 \b, saturation 15169>>>64 ubelong =3 \b, absolute colorimetric 15170# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d 15171>>>71 ubequad !0xd6000100000000d3 \b, PCS 15172# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found 15173# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm 15174>>>>68 ubelong !0x0000f6d5 X=0x%x 15175# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm 15176>>>>72 ubelong !0x00010000 Y=0x%x 15177# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found 15178# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm 15179>>>>76 ubelong !0x0000d32d Z=0x%x 15180# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321. 15181>>>84 ubequad >0 \b, 0x%llx MD5 15182# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD 15183#>>100 ubequad x \b 0x%llx reserved 15184# tag table 15185# 6 <= tags count <= 43 15186#>>>128 ubelong >43 \b, %u tags 15187>>>128 ubelong x 15188# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt" 15189# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508 15190>>>>132 search/508 cprt 15191# but no copyright tag in linearSRGB.icc 15192# beneath /System/Library/Frameworks/WebKit.framework/ 15193# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources 15194>>>>132 default x \b, no copyright tag 15195# 1st tag 15196#>>>132 string x \b, 1st tag %.4s 15197#>>>136 ubelong x 0x%x offset 15198#>>>140 ubelong x 0x%x len 15199# 2nd tag,... 15200# look also for profileDescriptionTag "desc" 15201>>>132 search/508 desc 15202# look further for TextDescriptionType "desc" signature 15203>>>>(&0.L) string =desc 15204>>>>>&4 pstring/l x "%s" 15205# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc 15206>>>>(&0.L) string =mluc 15207>>>>>&(&8.L) ubequad x 15208>>>>>>&4 bestring16 x '%s' 15209 15210# Any other profile. 15211# XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles, 15212# and use "acsp" for everything else and dump the "primary platform" 15213# string in those cases? 1521436 string acsp 15215>0 use color-profile 15216 15217 15218 15219#------------------------------------------------------------------------------ 15220# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $ 15221# iff: file(1) magic for Interchange File Format (see also "audio" & "images") 15222# 15223# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic 15224# Arts for file interchange. It has also been used by Apple, SGI, and 15225# especially Commodore-Amiga. 15226# 15227# IFF files begin with an 8 byte FORM header, followed by a 4 character 15228# FORM type, which is followed by the first chunk in the FORM. 15229 152300 string FORM IFF data 15231#>4 belong x \b, FORM is %d bytes long 15232# audio formats 15233>8 string AIFF \b, AIFF audio 15234!:mime audio/x-aiff 15235>8 string AIFC \b, AIFF-C compressed audio 15236!:mime audio/x-aiff 15237>8 string 8SVX \b, 8SVX 8-bit sampled sound voice 15238!:mime audio/x-aiff 15239>8 string 16SV \b, 16SV 16-bit sampled sound voice 15240>8 string SAMP \b, SAMP sampled audio 15241>8 string MAUD \b, MAUD MacroSystem audio 15242>8 string SMUS \b, SMUS simple music 15243>8 string CMUS \b, CMUS complex music 15244# image formats 15245>8 string ILBMBMHD \b, ILBM interleaved image 15246>>20 beshort x \b, %d x 15247>>22 beshort x %d 15248>8 string RGBN \b, RGBN 12-bit RGB image 15249>8 string RGB8 \b, RGB8 24-bit RGB image 15250>8 string DEEP \b, DEEP TVPaint/XiPaint image 15251>8 string DR2D \b, DR2D 2-D object 15252>8 string TDDD \b, TDDD 3-D rendering 15253>8 string LWOB \b, LWOB 3-D object 15254>8 string LWO2 \b, LWO2 3-D object, v2 15255>8 string LWLO \b, LWLO 3-D layered object 15256>8 string REAL \b, REAL Real3D rendering 15257>8 string MC4D \b, MC4D MaxonCinema4D rendering 15258>8 string ANIM \b, ANIM animation 15259>8 string YAFA \b, YAFA animation 15260>8 string SSA\ \b, SSA super smooth animation 15261>8 string ACBM \b, ACBM continuous image 15262>8 string FAXX \b, FAXX fax image 15263# other formats 15264>8 string FTXT \b, FTXT formatted text 15265>8 string CTLG \b, CTLG message catalog 15266>8 string PREF \b, PREF preferences 15267>8 string DTYP \b, DTYP datatype description 15268>8 string PTCH \b, PTCH binary patch 15269>8 string AMFF \b, AMFF AmigaMetaFile format 15270>8 string WZRD \b, WZRD StormWIZARD resource 15271>8 string DOC\ \b, DOC desktop publishing document 15272>8 string WVQA \b, Westwood Studios VQA Multimedia, 15273>>24 leshort x %d video frames, 15274>>26 leshort x %d x 15275>>28 leshort x %d 15276>8 string MOVE \b, Wing Commander III Video 15277>>12 string _PC_ \b, PC version 15278>>12 string 3DO_ \b, 3DO version 15279 15280# These go at the end of the iff rules 15281# 15282# David Griffith <dave@661.org> 15283# I don't see why these might collide with anything else. 15284# 15285# Interactive Fiction related formats 15286# 15287>8 string IFRS \b, Blorb Interactive Fiction 15288>>24 string Exec with executable chunk 15289>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) 15290!:mime application/x-blorb 15291 15292#------------------------------------------------------------------------------ 15293# $File: images,v 1.160 2019/04/19 00:42:27 christos Exp $ 15294# images: file(1) magic for image formats (see also "iff", and "c-lang" for 15295# XPM bitmaps) 15296# 15297# originally from jef@helios.ee.lbl.gov (Jef Poskanzer), 15298# additions by janl@ifi.uio.no as well as others. Jan also suggested 15299# merging several one- and two-line files into here. 15300# 15301# little magic: PCX (first byte is 0x0a) 15302 15303# Targa - matches `povray', `ppmtotga' and `xv' outputs 15304# by Philippe De Muyter <phdm@macqel.be> 15305# URL: http://justsolve.archiveteam.org/wiki/TGA 15306# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf 15307# Update: Joerg Jenderek 15308# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11 15309# ,32 or 33 (both not observed) 15310# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise 15311# or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications 15312# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs 15313# `xv' recognizes only a subset of the following (RGB with pixelsize = 24) 15314# `tgatoppm' recognizes a superset (Index may be anything) 15315# 15316# test of Color Map Type 0~no 1~color map 15317# and Image Type 1 2 3 9 10 11 32 33 15318# and Color Map Entry Size 0 15 16 24 32 153190 ubequad&0x00FeC400000000C0 0 15320# Prevent conflicts with CRI ADX. 15321>(2.S-2) belong !0x28632943 15322# skip more garbage like *.iso by looking for positive image type 15323>2 ubyte >0 15324# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33 15325>>2 ubyte <34 15326# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32 15327>>>16 ubyte 1 15328>>>>0 use tga-image 15329>>>16 ubyte 8 15330>>>>0 use tga-image 15331>>>16 ubyte 15 15332>>>>0 use tga-image 15333>>>16 ubyte 16 15334>>>>0 use tga-image 15335>>>16 ubyte 24 15336>>>>0 use tga-image 15337>>>16 ubyte 32 15338>>>>0 use tga-image 15339# display tga bitmap image information 153400 name tga-image 15341>2 ubyte <34 Targa image data 15342!:mime image/x-tga 15343!:apple ????TPIC 15344# normal extension .tga but some Truevision products used others: 15345# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that) 15346!:ext tga/tpic/icb/vda/vst 15347# image type 1 2 3 9 10 11 32 33 15348>2 ubyte&0xF7 1 - Map 15349>2 ubyte&0xF7 2 - RGB 15350# alpha channel 15351>>17 ubyte&0x0F >0 \bA 15352>2 ubyte&0xF7 3 - Mono 15353# type not found, but by http://www.fileformat.info/format/tga/corion.htm 15354# Compressed color-mapped data, using Huffman, Delta, and runlength encoding 15355>2 ubyte 32 - Color 15356# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process 15357>2 ubyte 33 - Color 15358# Color Map Type 0~no 1~color map 15359>1 ubyte 1 ( 15360# first color map entry, 0 normal 15361>>3 uleshort >0 \b%d- 15362# color map length 0 2 1dh 3bh d9h 100h 15363>>5 uleshort x \b%d) 15364# 8~run length encoding bit 15365>2 ubyte&0x08 8 - RLE 15366# gimp can create big pictures! 15367>12 uleshort >0 %d x 15368>12 uleshort =0 65536 x 15369# image height. 0 interpreted as 65536 15370>14 uleshort >0 %d 15371>14 uleshort =0 65536 15372# Image Pixel depth 1 8 15 16 24 32 15373>16 ubyte x x %d 15374# X origin of image. 0 normal 15375>8 uleshort >0 +%d 15376# Y origin of image. 0 normal; positive for top 15377>10 uleshort >0 +%d 15378# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction 15379>17 ubyte&0x0F >0 - %d-bit alpha 15380# bits 5-4 give direction. normal bottom left 15381>17 ubyte &0x20 - top 15382#>17 ubyte ^0x20 - bottom 15383>17 ubyte &0x10 - right 15384#>17 ubyte ^0x10 - left 15385# some info say other bits 6-7 should be zero 15386# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm 15387# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved 15388#>17 ubyte&0xC0 0x00 - no interleave 15389>17 ubyte&0xC0 0x40 - interleave 15390>17 ubyte&0xC0 0x80 - four way interleave 15391>17 ubyte&0xC0 0xC0 - reserved 15392# positive length implies identification field 15393>0 ubyte >0 15394>>18 string x "%s" 15395# last 18 bytes of newer tga file footer signature 15396>18 search/4261301/s TRUEVISION-XFILE.\0 15397# extension area offset if not 0 15398>>&-8 ulelong >0 15399# length of the extension area. normal 495 for version 2.0 15400>>>(&-4.l) uleshort 0x01EF 15401# AuthorName[41] 15402>>>>&0 string >\0 - author "%-.40s" 15403# Comment[324]=4 * 80 null terminated 15404>>>>&41 string >\0 - comment "%-.80s" 15405# date 15406>>>>&365 ubequad&0xffffFFFFffff0000 !0 15407# Day 15408>>>>>&-6 uleshort x %d 15409# Month 15410>>>>>&-8 uleshort x \b-%d 15411# Year 15412>>>>>&-4 uleshort x \b-%d 15413# time 15414>>>>&371 ubequad&0xffffFFFFffff0000 !0 15415# hour 15416>>>>>&-8 uleshort x %d 15417# minutes 15418>>>>>&-6 uleshort x \b:%.2d 15419# second 15420>>>>>&-4 uleshort x \b:%.2d 15421# JobName[41] 15422>>>>&377 string >\0 - job "%-.40s" 15423# JobHour Jobminute Jobsecond 15424>>>>&418 ubequad&0xffffFFFFffff0000 !0 15425>>>>>&-8 uleshort x %d 15426>>>>>&-6 uleshort x \b:%.2d 15427>>>>>&-4 uleshort x \b:%.2d 15428# SoftwareId[41] 15429>>>>&424 string >\0 - %-.40s 15430# SoftwareVersionNumber 15431>>>>&424 ubyte >0 15432>>>>>&40 uleshort/100 x %d 15433>>>>>&40 uleshort%100 x \b.%d 15434# VersionLetter 15435>>>>>&42 ubyte >0x20 \b%c 15436# KeyColor 15437>>>>&468 ulelong >0 - keycolor 0x%8.8x 15438# Denominator of Pixel ratio. 0~no pixel aspect 15439>>>>&474 uleshort >0 15440# Numerator 15441>>>>>&-4 uleshort >0 - aspect %d 15442>>>>>&-2 uleshort x \b/%d 15443# Denominator of Gamma ratio. 0~no Gamma value 15444>>>>&478 uleshort >0 15445# Numerator 15446>>>>>&-4 uleshort >0 - gamma %d 15447>>>>>&-2 uleshort x \b/%d 15448# ColorOffset 15449#>>>>&480 ulelong x - col offset 0x%8.8x 15450# StampOffset 15451#>>>>&484 ulelong x - stamp offset 0x%8.8x 15452# ScanOffset 15453#>>>>&488 ulelong x - scan offset 0x%8.8x 15454# AttributesType 15455#>>>>&492 ubyte x - Attributes 0x%x 15456## EndOfTGA 15457 15458# PBMPLUS images 15459# The next byte following the magic is always whitespace. 15460# strength is changed to try these patterns before "x86 boot sector" 154610 name netpbm 15462>3 regex/s =[0-9]{1,50}\ [0-9]{1,50} Netpbm image data 15463>>&0 regex =[0-9]{1,50} \b, size = %s x 15464>>>&0 regex =[0-9]{1,50} \b %s 15465 154660 search/1 P1 15467>0 regex/4 P1[\040\t\f\r\n] 15468>>0 use netpbm 15469>>0 string x \b, bitmap 15470!:strength + 65 15471!:mime image/x-portable-bitmap 15472 154730 search/1 P2 15474>0 regex/4 P2[\040\t\f\r\n] 15475>>0 use netpbm 15476>>0 string x \b, greymap 15477!:strength + 65 15478!:mime image/x-portable-greymap 15479 154800 search/1 P3 15481>0 regex/4 P3[\040\t\f\r\n] 15482>>0 use netpbm 15483>>0 string x \b, pixmap 15484!:strength + 65 15485!:mime image/x-portable-pixmap 15486 154870 string P4 15488>0 regex/4 P4[\040\t\f\r\n] 15489>>0 use netpbm 15490>>0 string x \b, rawbits, bitmap 15491!:strength + 65 15492!:mime image/x-portable-bitmap 15493 154940 string P5 15495>0 regex/4 P5[\040\t\f\r\n] 15496>>0 use netpbm 15497>>0 string x \b, rawbits, greymap 15498!:strength + 65 15499!:mime image/x-portable-greymap 15500 155010 string P6 15502>0 regex/4 P6[\040\t\f\r\n] 15503>>0 use netpbm 15504>>0 string x \b, rawbits, pixmap 15505!:strength + 65 15506!:mime image/x-portable-pixmap 15507 155080 string P7 Netpbm PAM image file 15509!:mime image/x-portable-pixmap 15510 15511# From: bryanh@giraffe-data.com (Bryan Henderson) 155120 string \117\072 Solitaire Image Recorder format 15513>4 string \013 MGI Type 11 15514>4 string \021 MGI Type 17 155150 string .MDA MicroDesign data 15516>21 byte 48 version 2 15517>21 byte 51 version 3 155180 string .MDP MicroDesign page data 15519>21 byte 48 version 2 15520>21 byte 51 version 3 15521 15522# NIFF (Navy Interchange File Format, a modification of TIFF) images 15523# [GRR: this *must* go before TIFF] 155240 string IIN1 NIFF image data 15525!:mime image/x-niff 15526 15527# Canon RAW version 1 (CRW) files are a type of Canon Image File Format 15528# (CIFF) file. These are apparently all little-endian. 15529# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15530# URL: https://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html 155310 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data 15532!:mime image/x-canon-crw 15533>16 leshort x \b, version %d. 15534>14 leshort x \b%d 15535 15536# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic 15537# number. Put this above the TIFF test to make sure we detect them. 15538# These are apparently all little-endian. 15539# From: Adam Buchbinder <adam.buchbinder@gmail.com> 15540# URL: https://libopenraw.freedesktop.org/wiki/Canon_CR2 155410 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data 15542!:mime image/x-canon-cr2 15543!:strength +80 15544>10 byte x \b, version %d. 15545>11 byte x \b%d 15546 15547# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com) 15548# The second word of TIFF files is the TIFF version number, 42, which has 15549# never changed. The TIFF specification recommends testing for it. 155500 string MM\x00\x2a TIFF image data, big-endian 15551!:strength +70 15552!:mime image/tiff 15553>(4.L) use \^tiff_ifd 155540 string II\x2a\x00 TIFF image data, little-endian 15555!:mime image/tiff 15556!:strength +70 15557>(4.l) use tiff_ifd 15558 155590 name tiff_ifd 15560>0 leshort x \b, direntries=%d 15561>2 use tiff_entry 15562 155630 name tiff_entry 15564# NewSubFileType 15565>0 leshort 0xfe 15566>>12 use tiff_entry 15567>0 leshort 0x100 15568>>4 lelong 1 15569>>>12 use tiff_entry 15570>>>8 leshort x \b, width=%d 15571>0 leshort 0x101 15572>>4 lelong 1 15573>>>8 leshort x \b, height=%d 15574>>>12 use tiff_entry 15575>0 leshort 0x102 15576>>8 leshort x \b, bps=%d 15577>>12 use tiff_entry 15578>0 leshort 0x103 15579>>4 lelong 1 \b, compression= 15580>>>8 leshort 1 \bnone 15581>>>8 leshort 2 \bhuffman 15582>>>8 leshort 3 \bbi-level group 3 15583>>>8 leshort 4 \bbi-level group 4 15584>>>8 leshort 5 \bLZW 15585>>>8 leshort 6 \bJPEG (old) 15586>>>8 leshort 7 \bJPEG 15587>>>8 leshort 8 \bdeflate 15588>>>8 leshort 9 \bJBIG, ITU-T T.85 15589>>>8 leshort 0xa \bJBIG, ITU-T T.43 15590>>>8 leshort 0x7ffe \bNeXT RLE 2-bit 15591>>>8 leshort 0x8005 \bPackBits (Macintosh RLE) 15592>>>8 leshort 0x8029 \bThunderscan RLE 15593>>>8 leshort 0x807f \bRasterPadding (CT or MP) 15594>>>8 leshort 0x8080 \bRLE (Line Work) 15595>>>8 leshort 0x8081 \bRLE (High-Res Cont-Tone) 15596>>>8 leshort 0x8082 \bRLE (Binary Line Work) 15597>>>8 leshort 0x80b2 \bDeflate (PKZIP) 15598>>>8 leshort 0x80b3 \bKodak DCS 15599>>>8 leshort 0x8765 \bJBIG 15600>>>8 leshort 0x8798 \bJPEG2000 15601>>>8 leshort 0x8799 \bNikon NEF Compressed 15602>>>8 default x 15603>>>>8 leshort x \b(unknown 0x%x) 15604>>>12 use tiff_entry 15605>0 leshort 0x106 \b, PhotometricIntepretation= 15606>>8 clear x 15607>>8 leshort 0 \bWhiteIsZero 15608>>8 leshort 1 \bBlackIsZero 15609>>8 leshort 2 \bRGB 15610>>8 leshort 3 \bRGB Palette 15611>>8 leshort 4 \bTransparency Mask 15612>>8 leshort 5 \bCMYK 15613>>8 leshort 6 \bYCbCr 15614>>8 leshort 8 \bCIELab 15615>>8 default x 15616>>>8 leshort x \b(unknown=0x%x) 15617>>12 use tiff_entry 15618# FillOrder 15619>0 leshort 0x10a 15620>>4 lelong 1 15621>>>12 use tiff_entry 15622# DocumentName 15623>0 leshort 0x10d 15624>>(8.l) string x \b, name=%s 15625>>>12 use tiff_entry 15626# ImageDescription 15627>0 leshort 0x10e 15628>>(8.l) string x \b, description=%s 15629>>>12 use tiff_entry 15630# Make 15631>0 leshort 0x10f 15632>>(8.l) string x \b, manufacturer=%s 15633>>>12 use tiff_entry 15634# Model 15635>0 leshort 0x110 15636>>(8.l) string x \b, model=%s 15637>>>12 use tiff_entry 15638# StripOffsets 15639>0 leshort 0x111 15640>>12 use tiff_entry 15641# Orientation 15642>0 leshort 0x112 \b, orientation= 15643>>8 leshort 1 \bupper-left 15644>>8 leshort 3 \blower-right 15645>>8 leshort 6 \bupper-right 15646>>8 leshort 8 \blower-left 15647>>8 leshort 9 \bundefined 15648>>8 default x 15649>>>8 leshort x \b[*%d*] 15650>>12 use tiff_entry 15651# XResolution 15652>0 leshort 0x11a 15653>>8 lelong x \b, xresolution=%d 15654>>12 use tiff_entry 15655# YResolution 15656>0 leshort 0x11b 15657>>8 lelong x \b, yresolution=%d 15658>>12 use tiff_entry 15659# ResolutionUnit 15660>0 leshort 0x128 15661>>8 leshort x \b, resolutionunit=%d 15662>>12 use tiff_entry 15663# Software 15664>0 leshort 0x131 15665>>(8.l) string x \b, software=%s 15666>>12 use tiff_entry 15667# Datetime 15668>0 leshort 0x132 15669>>(8.l) string x \b, datetime=%s 15670>>12 use tiff_entry 15671# HostComputer 15672>0 leshort 0x13c 15673>>(8.l) string x \b, hostcomputer=%s 15674>>12 use tiff_entry 15675# WhitePoint 15676>0 leshort 0x13e 15677>>12 use tiff_entry 15678# PrimaryChromaticities 15679>0 leshort 0x13f 15680>>12 use tiff_entry 15681# YCbCrCoefficients 15682>0 leshort 0x211 15683>>12 use tiff_entry 15684# YCbCrPositioning 15685>0 leshort 0x213 15686>>12 use tiff_entry 15687# ReferenceBlackWhite 15688>0 leshort 0x214 15689>>12 use tiff_entry 15690# Copyright 15691>0 leshort 0x8298 15692>>(8.l) string x \b, copyright=%s 15693>>12 use tiff_entry 15694# ExifOffset 15695>0 leshort 0x8769 15696>>12 use tiff_entry 15697# GPS IFD 15698>0 leshort 0x8825 \b, GPS-Data 15699>>12 use tiff_entry 15700 15701#>0 leshort x \b, unknown=0x%x 15702#>>12 use tiff_entry 15703 157040 string MM\x00\x2b Big TIFF image data, big-endian 15705!:mime image/tiff 157060 string II\x2b\x00 Big TIFF image data, little-endian 15707!:mime image/tiff 15708 15709# PNG [Portable Network Graphics, or "PNG's Not GIF"] images 15710# (Greg Roelofs, newt@uchicago.edu) 15711# (Albert Cahalan, acahalan@cs.uml.edu) 15712# 15713# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ... 15714# 15715 15716# IHDR parser 157170 name png-ihdr 15718>0 belong x \b, %d x 15719>4 belong x %d, 15720>8 byte x %d-bit 15721>9 byte 0 grayscale, 15722>9 byte 2 \b/color RGB, 15723>9 byte 3 colormap, 15724>9 byte 4 gray+alpha, 15725>9 byte 6 \b/color RGBA, 15726#>10 byte 0 deflate/32K, 15727>12 byte 0 non-interlaced 15728>12 byte 1 interlaced 15729 15730# Standard PNG image. 157310 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR PNG image data 15732!:mime image/png 15733!:ext png 15734!:strength +10 15735>16 use png-ihdr 15736 15737# Apple CgBI PNG image. 157380 string \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI 15739>24 string \x00\x00\x00\x0DIHDR PNG image data (CgBI) 15740!:mime image/png 15741!:ext png 15742!:strength +10 15743>>32 use png-ihdr 15744 15745# possible GIF replacements; none yet released! 15746# (Greg Roelofs, newt@uchicago.edu) 15747# 15748# GRR 950115: this was mine ("Zip GIF"): 157490 string GIF94z ZIF image (GIF+deflate alpha) 15750!:mime image/x-unknown 15751# 15752# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better): 15753# 157540 string FGF95a FGF image (GIF+deflate beta) 15755!:mime image/x-unknown 15756# 15757# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal 15758# (best; not yet implemented): 15759# 157600 string PBF PBF image (deflate compression) 15761!:mime image/x-unknown 15762 15763# GIF 15764# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65) 157650 string GIF8 GIF image data 15766!:strength +80 15767!:mime image/gif 15768!:apple 8BIMGIFf 15769>4 string 7a \b, version 8%s, 15770>4 string 9a \b, version 8%s, 15771>6 leshort >0 %d x 15772>8 leshort >0 %d 15773#>10 byte &0x80 color mapped, 15774#>10 byte&0x07 =0x00 2 colors 15775#>10 byte&0x07 =0x01 4 colors 15776#>10 byte&0x07 =0x02 8 colors 15777#>10 byte&0x07 =0x03 16 colors 15778#>10 byte&0x07 =0x04 32 colors 15779#>10 byte&0x07 =0x05 64 colors 15780#>10 byte&0x07 =0x06 128 colors 15781#>10 byte&0x07 =0x07 256 colors 15782 15783# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster, 15784# 1 plane, no encoding. 157850 string \361\0\100\273 CMU window manager raster image data 15786>4 lelong >0 %d x 15787>8 lelong >0 %d, 15788>12 lelong >0 %d-bit 15789 15790# Magick Image File Format 157910 string id=ImageMagick MIFF image data 15792 15793# Artisan 157940 long 1123028772 Artisan image data 15795>4 long 1 \b, rectangular 24-bit 15796>4 long 2 \b, rectangular 8-bit with colormap 15797>4 long 3 \b, rectangular 32-bit (24-bit with matte) 15798 15799# FIG (Facility for Interactive Generation of figures), an object-based format 158000 search/1 #FIG FIG image text 15801>5 string x \b, version %.3s 15802 15803# PHIGS 158040 string ARF_BEGARF PHIGS clear text archive 158050 string @(#)SunPHIGS SunPHIGS 15806# version number follows, in the form m.n 15807>40 string SunBin binary 15808>32 string archive archive 15809 15810# GKS (Graphics Kernel System) 158110 string GKSM GKS Metafile 15812>24 string SunGKS \b, SunGKS 15813 15814# CGM image files 158150 string BEGMF clear text Computer Graphics Metafile 15816 15817# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de) 158180 string yz MGR bitmap, modern format, 8-bit aligned 158190 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned 158200 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned 158210 string yx MGR bitmap, modern format, squeezed 15822 15823# Fuzzy Bitmap (FBM) images 158240 string %bitmap\0 FBM image data 15825>30 long 0x31 \b, mono 15826>30 long 0x33 \b, color 15827 15828# facsimile data 158291 string PC\ Research,\ Inc group 3 fax data 15830>29 byte 0 \b, normal resolution (204x98 DPI) 15831>29 byte 1 \b, fine resolution (204x196 DPI) 15832# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at> 158330 string Sfff structured fax file 15834 15835# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net> 15836# most files with the extension .EPA and some with .BMP 158370 string \x11\x06 Award BIOS Logo, 136 x 84 15838!:mime image/x-award-bioslogo 158390 string \x11\x09 Award BIOS Logo, 136 x 126 15840!:mime image/x-award-bioslogo 15841#0 string \x07\x1f BIOS Logo corrupted? 15842# http://www.blackfiveservices.co.uk/awbmtools.shtml 15843# http://biosgfx.narod.ru/v3/ 15844# http://biosgfx.narod.ru/abr-2/ 158450 string AWBM 15846>4 leshort <1981 Award BIOS bitmap 15847!:mime image/x-award-bmp 15848# image width is a multiple of 4 15849>>4 leshort&0x0003 0 15850>>>4 leshort x \b, %d 15851>>>6 leshort x x %d 15852>>4 leshort&0x0003 >0 \b, 15853>>>4 leshort&0x0003 =1 15854>>>>4 leshort x %d+3 15855>>>4 leshort&0x0003 =2 15856>>>>4 leshort x %d+2 15857>>>4 leshort&0x0003 =3 15858>>>>4 leshort x %d+1 15859>>>6 leshort x x %d 15860# at offset 8 starts imagedata followed by "RGB " marker 15861 15862# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu) 15863# https://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\ 15864# 28bitmap_information_header.29 158650 string BM 15866>14 leshort 12 PC bitmap, OS/2 1.x format 15867!:mime image/x-ms-bmp 15868>>18 leshort x \b, %d x 15869>>20 leshort x %d 15870>14 leshort 64 PC bitmap, OS/2 2.x format 15871!:mime image/x-ms-bmp 15872>>18 leshort x \b, %d x 15873>>20 leshort x %d 15874>14 leshort 40 PC bitmap, Windows 3.x format 15875!:mime image/x-ms-bmp 15876>>18 lelong x \b, %d x 15877>>22 lelong x %d x 15878>>28 leshort x %d 15879>14 leshort 124 PC bitmap, Windows 98/2000 and newer format 15880!:mime image/x-ms-bmp 15881>>18 lelong x \b, %d x 15882>>22 lelong x %d x 15883>>28 leshort x %d 15884>14 leshort 108 PC bitmap, Windows 95/NT4 and newer format 15885!:mime image/x-ms-bmp 15886>>18 lelong x \b, %d x 15887>>22 lelong x %d x 15888>>28 leshort x %d 15889>14 leshort 128 PC bitmap, Windows NT/2000 format 15890!:mime image/x-ms-bmp 15891>>18 lelong x \b, %d x 15892>>22 lelong x %d x 15893>>28 leshort x %d 15894# Too simple - MPi 15895#0 string IC PC icon data 15896#0 string PI PC pointer image data 15897#0 string CI PC color icon data 15898#0 string CP PC color pointer image data 15899# Conflicts with other entries [BABYL] 15900#0 string BA PC bitmap array data 15901 15902# XPM icons (Greg Roelofs, newt@uchicago.edu) 159030 search/1 /*\ XPM\ */ X pixmap image text 15904!:mime image/x-xpmi 15905 15906# Utah Raster Toolkit RLE images (janl@ifi.uio.no) 159070 leshort 0xcc52 RLE image data, 15908>6 leshort x %d x 15909>8 leshort x %d 15910>2 leshort >0 \b, lower left corner: %d 15911>4 leshort >0 \b, lower right corner: %d 15912>10 byte&0x1 =0x1 \b, clear first 15913>10 byte&0x2 =0x2 \b, no background 15914>10 byte&0x4 =0x4 \b, alpha channel 15915>10 byte&0x8 =0x8 \b, comment 15916>11 byte >0 \b, %d color channels 15917>12 byte >0 \b, %d bits per pixel 15918>13 byte >0 \b, %d color map channels 15919 15920# image file format (Robert Potter, potter@cs.rochester.edu) 159210 string Imagefile\ version- iff image data 15922# this adds the whole header (inc. version number), informative but longish 15923>10 string >\0 %s 15924 15925# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com) 159260 belong 0x59a66a95 Sun raster image data 15927>4 belong >0 \b, %d x 15928>8 belong >0 %d, 15929>12 belong >0 %d-bit, 15930#>16 belong >0 %d bytes long, 15931>20 belong 0 old format, 15932#>20 belong 1 standard, 15933>20 belong 2 compressed, 15934>20 belong 3 RGB, 15935>20 belong 4 TIFF, 15936>20 belong 5 IFF, 15937>20 belong 0xffff reserved for testing, 15938>24 belong 0 no colormap 15939>24 belong 1 RGB colormap 15940>24 belong 2 raw colormap 15941#>28 belong >0 colormap is %d bytes long 15942 15943# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com) 15944# 15945# See 15946# http://reality.sgi.com/grafica/sgiimage.html 15947# 159480 beshort 474 SGI image data 15949#>2 byte 0 \b, verbatim 15950>2 byte 1 \b, RLE 15951#>3 byte 1 \b, normal precision 15952>3 byte 2 \b, high precision 15953>4 beshort x \b, %d-D 15954>6 beshort x \b, %d x 15955>8 beshort x %d 15956>10 beshort x \b, %d channel 15957>10 beshort !1 \bs 15958>80 string >0 \b, "%s" 15959 159600 string IT01 FIT image data 15961>4 belong x \b, %d x 15962>8 belong x %d x 15963>12 belong x %d 15964# 159650 string IT02 FIT image data 15966>4 belong x \b, %d x 15967>8 belong x %d x 15968>12 belong x %d 15969# 159702048 string PCD_IPI Kodak Photo CD image pack file 15971>0xe02 byte&0x03 0x00 , landscape mode 15972>0xe02 byte&0x03 0x01 , portrait mode 15973>0xe02 byte&0x03 0x02 , landscape mode 15974>0xe02 byte&0x03 0x03 , portrait mode 159750 string PCD_OPA Kodak Photo CD overview pack file 15976 15977# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu> 15978# FITS is the Flexible Image Transport System, the de facto standard for 15979# data and image transfer, storage, etc., for the astronomical community. 15980# (FITS floating point formats are big-endian.) 159810 string SIMPLE\ \ = FITS image data 15982!:mime image/fits 15983!:ext fits/fts 15984>109 string 8 \b, 8-bit, character or unsigned binary integer 15985>108 string 16 \b, 16-bit, two's complement binary integer 15986>107 string \ 32 \b, 32-bit, two's complement binary integer 15987>107 string -32 \b, 32-bit, floating point, single precision 15988>107 string -64 \b, 64-bit, floating point, double precision 15989 15990# other images 159910 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file 15992 15993# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image 15994# stuff. 15995# 159960 beshort 0x1010 PEX Binary Archive 15997 15998# DICOM medical imaging data 15999# URL: https://en.wikipedia.org/wiki/DICOM#Data_format 16000# Note: "dcm" is the official file name extension 16001# XnView mention also "dc3" and "acr" as file name extension 16002128 string DICM DICOM medical imaging data 16003!:mime application/dicom 16004!:ext dcm/dicom/dic 16005 16006# XWD - X Window Dump file. 16007# As described in /usr/X11R6/include/X11/XWDFile.h 16008# used by the xwd program. 16009# Bradford Castalia, idaeim, 1/01 16010# updated by Adam Buchbinder, 2/09 16011# The following assumes version 7 of the format; the first long is the length 16012# of the header, which is at least 25 4-byte longs, and the one at offset 8 16013# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth, 16014# which is a maximum of 32. 160150 belong >100 16016>8 belong <3 16017>>12 belong <33 16018>>>4 belong 7 XWD X Window Dump image data 16019!:mime image/x-xwindowdump 16020>>>>100 string >\0 \b, "%s" 16021>>>>16 belong x \b, %dx 16022>>>>20 belong x \b%dx 16023>>>>12 belong x \b%d 16024 16025# PDS - Planetary Data System 16026# These files use Parameter Value Language in the header section. 16027# Unfortunately, there is no certain magic, but the following 16028# strings have been found to be most likely. 160290 string NJPL1I00 PDS (JPL) image data 160302 string NJPL1I PDS (JPL) image data 160310 string CCSD3ZF PDS (CCSD) image data 160322 string CCSD3Z PDS (CCSD) image data 160330 string PDS_ PDS image data 160340 string LBLSIZE= PDS (VICAR) image data 16035 16036# pM8x: ATARI STAD compressed bitmap format 16037# 16038# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001 16039# p M 8 5/6 xx yy zz data... 16040# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed. 16041# bytes either run horizontally (pM85) or vertically (pM86). yy is the 16042# most frequent byte, xx and zz are runlength escape codes, where xx is 16043# used for runs of yy. 16044# 160450 string pM85 Atari ST STAD bitmap image data (hor) 16046>5 byte 0x00 (white background) 16047>5 byte 0xFF (black background) 160480 string pM86 Atari ST STAD bitmap image data (vert) 16049>5 byte 0x00 (white background) 16050>5 byte 0xFF (black background) 16051 16052# From: Alex Myczko <alex@aiei.ch> 16053# https://www.atarimax.com/jindroush.atari.org/afmtatr.html 160540 leshort 0x0296 Atari ATR image 16055 16056# XXX: 16057# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other 16058# magic. 16059# SGI RICE image file <mpruett@sgi.com> 16060#0 beshort 0x5249 RICE image 16061#>2 beshort x v%d 16062#>4 beshort x (%d x 16063#>6 beshort x %d) 16064#>8 beshort 0 8 bit 16065#>8 beshort 1 10 bit 16066#>8 beshort 2 12 bit 16067#>8 beshort 3 13 bit 16068#>10 beshort 0 4:2:2 16069#>10 beshort 1 4:2:2:4 16070#>10 beshort 2 4:4:4 16071#>10 beshort 3 4:4:4:4 16072#>12 beshort 1 RGB 16073#>12 beshort 2 CCIR601 16074#>12 beshort 3 RP175 16075#>12 beshort 4 YUV 16076 16077# PCX image files 16078# From: Dan Fandrich <dan@coneharvesters.com> 16079# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX 16080# https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt 16081# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000 16082# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT 160830 ubelong&0xffF8fe00 0x0a000000 16084# for PCX bit depth > 0 16085>3 ubyte >0 16086# test for valid versions 16087>>1 ubyte <6 16088>>>1 ubyte !1 PCX 16089!:mime image/x-pcx 16090#!:mime image/pcx 16091>>>>1 ubyte 0 ver. 2.5 image data 16092>>>>1 ubyte 2 ver. 2.8 image data, with palette 16093>>>>1 ubyte 3 ver. 2.8 image data, without palette 16094>>>>1 ubyte 4 for Windows image data 16095>>>>1 ubyte 5 ver. 3.0 image data 16096>>>>4 uleshort x bounding box [%d, 16097>>>>6 uleshort x %d] - 16098>>>>8 uleshort x [%d, 16099>>>>10 uleshort x %d], 16100>>>>65 ubyte >1 %d planes each of 16101>>>>3 ubyte x %d-bit 16102>>>>68 byte 1 colour, 16103>>>>68 byte 2 grayscale, 16104# this should not happen 16105>>>>68 default x image, 16106>>>>12 leshort >0 %d x 16107>>>>>14 uleshort x %d dpi, 16108>>>>2 byte 0 uncompressed 16109>>>>2 byte 1 RLE compressed 16110 16111# Adobe Photoshop 16112# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 161130 string 8BPS Adobe Photoshop Image 16114!:mime image/vnd.adobe.photoshop 16115>4 beshort 2 (PSB) 16116>18 belong x \b, %d x 16117>14 belong x %d, 16118>24 beshort 0 bitmap 16119>24 beshort 1 grayscale 16120>>12 beshort 2 with alpha 16121>24 beshort 2 indexed 16122>24 beshort 3 RGB 16123>>12 beshort 4 \bA 16124>24 beshort 4 CMYK 16125>>12 beshort 5 \bA 16126>24 beshort 7 multichannel 16127>24 beshort 8 duotone 16128>24 beshort 9 lab 16129>12 beshort > 1 16130>>12 beshort x \b, %dx 16131>12 beshort 1 \b, 16132>22 beshort x %d-bit channel 16133>12 beshort > 1 \bs 16134 16135# XV thumbnail indicator (ThMO) 161360 string P7\ 332 XV thumbnail image data 16137 16138# NITF is defined by United States MIL-STD-2500A 161390 string NITF National Imagery Transmission Format 16140>25 string >\0 dated %.14s 16141 16142# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) 16143# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de> 16144# Update: Joerg Jenderek 16145# See http://fileformats.archiveteam.org/wiki/GEM_Raster 16146# For variations, also see: 16147# https://www.seasip.info/Gem/ff_img.html (Ventura) 16148# http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT) 16149# http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT) 16150# http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG) 161510 beshort 0x0001 16152# header_size 16153>2 beshort 0x0008 16154>>0 use gem_info 16155>2 beshort 0x0009 16156>>0 use gem_info 16157# no example for NOSIG 16158>2 beshort 24 16159>>0 use gem_info 16160# no example for HYPERPAINT 16161>2 beshort 25 16162>>0 use gem_info 1616316 string XIMG\0 16164>0 use gem_info 16165# no example 1616616 string STTT\0\x10 16167>0 use gem_info 16168# no example or description 1616916 string TIMG\0 16170>0 use gem_info 16171 161720 name gem_info 16173# version is 2 for some XIMG and 1 for all others 16174>0 beshort <0x0003 GEM 16175# https://www.snowstone.org.uk/riscos/mimeman/mimemap.txt 16176!:mime image/x-gem 16177# header_size 24 25 27 59 779 words for colored bitmaps 16178>>2 beshort >9 16179>>>16 string STTT\0\x10 STTT 16180>>>16 string TIMG\0 TIMG 16181# HYPERPAINT or NOSIG variant 16182>>>16 string \0\x80 16183>>>>2 beshort =24 NOSIG 16184>>>>2 beshort !24 HYPERPAINT 16185# NOSIG or XIMG variant 16186>>>16 default x 16187>>>>16 string !XIMG\0 NOSIG 16188>>16 string =XIMG\0 XIMG Image data 16189!:ext img/ximg 16190# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type 16191>>16 string !XIMG\0 Image data 16192!:ext img 16193# header_size is 9 for Ventura files and 8 for other GEM Paint files 16194>>2 beshort 9 (Ventura) 16195#>>2 beshort 8 (Paint) 16196>>12 beshort x %d x 16197>>14 beshort x %d, 16198# 1 4 8 16199>>4 beshort x %d planes, 16200# in tenths of a millimetre 16201>>8 beshort x %d x 16202>>10 beshort x %d pixelsize 16203# pattern_size 1-8. 2 for GEM Paint 16204>>6 beshort !2 \b, pattern size %d 16205 16206# GEM Metafile (Wolfram Kleff) 162070 lelong 0x0018FFFF GEM Metafile data 16208>4 leshort x version %d 16209 16210# 16211# SMJPEG. A custom Motion JPEG format used by Loki Entertainment 16212# Software Torbjorn Andersson <d91tan@Update.UU.SE>. 16213# 162140 string \0\nSMJPEG SMJPEG 16215>8 belong x %d.x data 16216# According to the specification you could find any number of _TXT 16217# headers here, but I can't think of any way of handling that. None of 16218# the SMJPEG files I tried it on used this feature. Even if such a 16219# file is encountered the output should still be reasonable. 16220>16 string _SND \b, 16221>>24 beshort >0 %d Hz 16222>>26 byte 8 8-bit 16223>>26 byte 16 16-bit 16224>>28 string NONE uncompressed 16225# >>28 string APCM ADPCM compressed 16226>>27 byte 1 mono 16227>>28 byte 2 stereo 16228# Help! Isn't there any way to avoid writing this part twice? 16229>>32 string _VID \b, 16230# >>>48 string JFIF JPEG 16231>>>40 belong >0 %d frames 16232>>>44 beshort >0 (%d x 16233>>>46 beshort >0 %d) 16234>16 string _VID \b, 16235# >>32 string JFIF JPEG 16236>>24 belong >0 %d frames 16237>>28 beshort >0 (%d x 16238>>30 beshort >0 %d) 16239 162400 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File 16241 16242# "thumbnail file" (icon) 16243# descended from "xv", but in use by other applications as well (Wolfram Kleff) 162440 string P7\ 332 XV "thumbnail file" (icon) data 16245 16246# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?) 162470 string KiSS KISS/GS 16248>4 byte 16 color 16249>>5 byte x %d bit 16250>>8 leshort x %d colors 16251>>10 leshort x %d groups 16252>4 byte 32 cell 16253>>5 byte x %d bit 16254>>8 leshort x %d x 16255>>10 leshort x %d 16256>>12 leshort x +%d 16257>>14 leshort x +%d 16258 16259# Webshots (www.webshots.com), by John Harrison 162600 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file 16261 16262# Hercules DASD image files 16263# From Jan Jaeger <jj@septa.nl> 162640 string CKD_P370 Hercules CKD DASD image file 16265>8 long x \b, %d heads per cylinder 16266>12 long x \b, track size %d bytes 16267>16 byte x \b, device type 33%2.2X 16268 162690 string CKD_C370 Hercules compressed CKD DASD image file 16270>8 long x \b, %d heads per cylinder 16271>12 long x \b, track size %d bytes 16272>16 byte x \b, device type 33%2.2X 16273 162740 string CKD_S370 Hercules CKD DASD shadow file 16275>8 long x \b, %d heads per cylinder 16276>12 long x \b, track size %d bytes 16277>16 byte x \b, device type 33%2.2X 16278 16279# Squeak images and programs - etoffi@softhome.net 162800 string \146\031\0\0 Squeak image data 162810 search/1 'From\040Squeak Squeak program text 16282 16283# partimage: file(1) magic for PartImage files (experimental, incomplete) 16284# Author: Hans-Joachim Baader <hjb@pro-linux.de> 162850 string PaRtImAgE-VoLuMe PartImage 16286>0x0020 string 0.6.1 file version %s 16287>>0x0060 lelong >-1 volume %d 16288#>>0x0064 8 byte identifier 16289#>>0x007c reserved 16290>>0x0200 string >\0 type %s 16291>>0x1400 string >\0 device %s, 16292>>0x1600 string >\0 original filename %s, 16293# Some fields omitted 16294>>0x2744 lelong 0 not compressed 16295>>0x2744 lelong 1 gzip compressed 16296>>0x2744 lelong 2 bzip2 compressed 16297>>0x2744 lelong >2 compressed with unknown algorithm 16298>0x0020 string >0.6.1 file version %s 16299>0x0020 string <0.6.1 file version %s 16300 16301# DCX is multi-page PCX, using a simple header of up to 1024 16302# offsets for the respective PCX components. 16303# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de> 163040 lelong 987654321 DCX multi-page PCX image data 16305 16306# Simon Walton <simonw@matteworld.com> 16307# Kodak Cineon format for scanned negatives 16308# http://www.kodak.com/US/en/motion/support/dlad/ 163090 lelong 0xd75f2a80 Cineon image data 16310>200 belong >0 \b, %d x 16311>204 belong >0 %d 16312 16313 16314# Bio-Rad .PIC is an image format used by microscope control systems 16315# and related image processing software used by biologists. 16316# From: Vebjorn Ljosa <vebjorn@ljosa.com> 16317# BOOL values are two-byte integers; use them to rule out false positives. 16318# https://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt 16319# Samples: https://www.loci.wisc.edu/software/sample-data 1632014 leshort <2 16321>62 leshort <2 16322>>54 leshort 12345 Bio-Rad .PIC Image File 16323>>>0 leshort >0 %d x 16324>>>2 leshort >0 %d, 16325>>>4 leshort =1 1 image in file 16326>>>4 leshort >1 %d images in file 16327 16328# From Jan "Yenya" Kasprzak <kas@fi.muni.cz> 16329# The description of *.mrw format can be found at 16330# http://www.dalibor.cz/minolta/raw_file_format.htm 163310 string \000MRM Minolta Dimage camera raw image data 16332 16333# Summary: DjVu image / document 16334# Extension: .djvu 16335# Reference: http://djvu.org/docs/DjVu3Spec.djvu 16336# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr> 16337# Modified by (1): Abel Cheung <abelcheung@gmail.com> 163380 string AT&TFORM 16339>12 string DJVM DjVu multiple page document 16340!:mime image/vnd.djvu 16341>12 string DJVU DjVu image or single page document 16342!:mime image/vnd.djvu 16343>12 string DJVI DjVu shared document 16344!:mime image/vnd.djvu 16345>12 string THUM DjVu page thumbnails 16346!:mime image/vnd.djvu 16347 16348# Originally by Marc Espie 16349# Modified by Robert Minsk <robertminsk at yahoo.com> 16350# https://www.openexr.com/openexrfilelayout.pdf 163510 lelong 20000630 OpenEXR image data, 16352!:mime image/x-exr 16353>4 lelong&0x000000ff x version %d, 16354>4 lelong ^0x00000200 storage: scanline 16355>4 lelong &0x00000200 storage: tiled 16356>8 search/0x1000 compression\0 \b, compression: 16357>>&16 byte 0 none 16358>>&16 byte 1 rle 16359>>&16 byte 2 zips 16360>>&16 byte 3 zip 16361>>&16 byte 4 piz 16362>>&16 byte 5 pxr24 16363>>&16 byte 6 b44 16364>>&16 byte 7 b44a 16365>>&16 byte 8 dwaa 16366>>&16 byte 9 dwab 16367>>&16 byte >9 unknown 16368>8 search/0x1000 dataWindow\0 \b, dataWindow: 16369>>&10 lelong x (%d 16370>>&14 lelong x %d)- 16371>>&18 lelong x \b(%d 16372>>&22 lelong x %d) 16373>8 search/0x1000 displayWindow\0 \b, displayWindow: 16374>>&10 lelong x (%d 16375>>&14 lelong x %d)- 16376>>&18 lelong x \b(%d 16377>>&22 lelong x %d) 16378>8 search/0x1000 lineOrder\0 \b, lineOrder: 16379>>&14 byte 0 increasing y 16380>>&14 byte 1 decreasing y 16381>>&14 byte 2 random y 16382>>&14 byte >2 unknown 16383 16384# SMPTE Digital Picture Exchange Format, SMPTE DPX 16385# 16386# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital 16387# Moving-Picture Exchange (DPX), v1.0, 18 February 1994 16388# Robert Minsk <robertminsk at yahoo.com> 16389# Modified by Harry Mallon <hjmallon at gmail.com> 163900 string SDPX DPX image data, big-endian, 16391!:mime image/x-dpx 16392>0 use dpx_info 163930 string XPDS DPX image data, little-endian, 16394!:mime image/x-dpx 16395>0 use \^dpx_info 16396 163970 name dpx_info 16398>768 beshort <4 16399>>772 belong x %dx 16400>>776 belong x \b%d, 16401>768 beshort >3 16402>>776 belong x %dx 16403>>772 belong x \b%d, 16404>768 beshort 0 left to right/top to bottom 16405>768 beshort 1 right to left/top to bottom 16406>768 beshort 2 left to right/bottom to top 16407>768 beshort 3 right to left/bottom to top 16408>768 beshort 4 top to bottom/left to right 16409>768 beshort 5 top to bottom/right to left 16410>768 beshort 6 bottom to top/left to right 16411>768 beshort 7 bottom to top/right to left 16412 16413# From: Tom Hilinski <tom.hilinski@comcast.net> 16414# https://www.unidata.ucar.edu/packages/netcdf/ 164150 string CDF\001 NetCDF Data Format data 16416 16417#----------------------------------------------------------------------- 16418# Hierarchical Data Format, used to facilitate scientific data exchange 16419# specifications at http://hdf.ncsa.uiuc.edu/ 164200 belong 0x0e031301 Hierarchical Data Format (version 4) data 16421!:mime application/x-hdf 164220 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data 16423!:mime application/x-hdf 16424512 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 512 bytes user block 16425!:mime application/x-hdf 164261024 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 1k user block 16427!:mime application/x-hdf 164282048 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 2k user block 16429!:mime application/x-hdf 164304096 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) with 4k user block 16431!:mime application/x-hdf 16432 16433 16434# From: Tobias Burnus <burnus@net-b.de> 16435# Xara (for a while: Corel Xara) is a graphic package, see 16436# http://www.xara.com/ for Windows and as GPL application for Linux 164370 string XARA\243\243 Xara graphics file 16438 16439# https://www.cartesianinc.com/Tech/ 164400 string CPC\262 Cartesian Perceptual Compression image 16441!:mime image/x-cpi 16442 16443# From Albert Cahalan <acahalan@gmail.com> 16444# puredigital used it for the CVS disposable camcorder 16445#8 lelong 4 ZBM bitmap image data 16446#>4 leshort x %u x 16447#>6 leshort x %u 16448 16449# From Albert Cahalan <acahalan@gmail.com> 16450# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons 164510 string C565 OLPC firmware icon image data 16452>4 leshort x %u x 16453>6 leshort x %u 16454 16455# Applied Images - Image files from Cytovision 16456# Gustavo Junior Alves <gjalves@gjalves.com.br> 164570 string \xce\xda\xde\xfa Cytovision Metaphases file 164580 string \xed\xad\xef\xac Cytovision Karyotype file 164590 string \x0b\x00\x03\x00 Cytovision FISH Probe file 164600 string \xed\xfe\xda\xbe Cytovision FLEX file 164610 string \xed\xab\xed\xfe Cytovision FLEX file 164620 string \xad\xfd\xea\xad Cytovision RATS file 16463 16464# Wavelet Scalar Quantization format used in gray-scale fingerprint images 16465# From Tano M Fotang <mfotang@quanteq.com> 164660 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data 16467 16468# Type: PCO B16 image files 16469# URL: http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf 16470# From: Florian Philipp <florian.philipp@binarywings.net> 16471# Extension: .b16 16472# Description: Pixel image format produced by PCO Camware, typically used 16473# together with PCO cameras. 16474# Note: Different versions exist for e.g. 8 bit and 16 bit images. 16475# Documentation is incomplete. 164760 string/b PCO- PCO B16 image data 16477>12 lelong x \b, %dx 16478>16 lelong x \b%d 16479>20 lelong 0 \b, short header 16480>20 lelong -1 \b, extended header 16481>>24 lelong 0 \b, grayscale 16482>>>36 lelong 0 linear LUT 16483>>>36 lelong 1 logarithmic LUT 16484>>>28 lelong x [%d 16485>>>32 lelong x \b,%d] 16486>>24 lelong 1 \b, color 16487>>>64 lelong 0 linear LUT 16488>>>64 lelong 1 logarithmic LUT 16489>>>40 lelong x r[%d 16490>>>44 lelong x \b,%d] 16491>>>48 lelong x g[%d 16492>>>52 lelong x \b,%d] 16493>>>56 lelong x b[%d 16494>>>60 lelong x \b,%d] 16495 16496# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches 16497# From: Markus Heidelberg <markus.heidelberg at web.de> 164980 string/t [BitmapInfo2] Polar Monitor Bitmap text 16499!:mime image/x-polar-monitor-bitmap 16500 16501# From: Rick Richardson <rickrich@gmail.com> 16502# updated by: Joerg Jenderek 16503# URL: http://techmods.net/nuvi/ 165040 string GARMIN\ BITMAP\ 01 Garmin Bitmap file 16505# extension is also used for 16506# Sony SRF raw image (image/x-sony-srf) 16507# SRF map 16508# Terragen Surface Map (https://www.planetside.co.uk/terragen) 16509# FileLocator Pro search criteria file (https://www.mythicsoft.com/filelocatorpro) 16510!:ext srf 16511#!:mime image/x-garmin-srf 16512# version 1.00,2.00,2.10,2.40,2.50 16513>0x2f string >0 \b, version %4.4s 16514# width (2880,2881,3240) 16515>0x55 uleshort >0 \b, %dx 16516# height (80,90) 16517>>0x53 uleshort x \b%d 16518 16519# Type: Ulead Photo Explorer5 (.pe5) 16520# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese) 16521# From: Simon Horman <horms@debian.org> 165220 string IIO2H Ulead Photo Explorer5 16523 16524# Type: X11 cursor 16525# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup 16526# From: Mathias Brodala <info@noctus.net> 165270 string Xcur X11 cursor 16528 16529# Type: Olympus ORF raw images. 16530# URL: https://libopenraw.freedesktop.org/wiki/Olympus_ORF 16531# From: Adam Buchbinder <adam.buchbinder@gmail.com> 165320 string MMOR Olympus ORF raw image data, big-endian 16533!:mime image/x-olympus-orf 165340 string IIRO Olympus ORF raw image data, little-endian 16535!:mime image/x-olympus-orf 165360 string IIRS Olympus ORF raw image data, little-endian 16537!:mime image/x-olympus-orf 16538 16539# Type: files used in modern AVCHD camcoders to store clip information 16540# Extension: .cpi 16541# From: Alexander Danilov <alexander.a.danilov@gmail.com> 165420 string HDMV0100 AVCHD Clip Information 16543 16544# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16545# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/ 16546# Radiance HDR; usually has .pic or .hdr extension. 165470 string #?RADIANCE\n Radiance HDR image data 16548#!mime image/vnd.radiance 16549 16550# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16551# URL: https://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf 16552# Used by the pfstools packages. The regex matches for the image size could 16553# probably use some work. The MIME type is made up; if there's one in 16554# actual common use, it should replace the one below. 165550 string PFS1\x0a PFS HDR image data 16556#!mime image/x-pfs 16557>1 regex [0-9]*\ \b, %s 16558>>1 regex \ [0-9]{4} \bx%s 16559 16560# Type: Foveon X3F 16561# URL: https://www.photofo.com/downloads/x3f-raw-format.pdf 16562# From: Adam Buchbinder <adam.buchbinder@gmail.com> 16563# Note that the MIME type isn't defined anywhere that I can find; if 16564# there's a canonical type for this format, it should replace this one. 165650 string FOVb Foveon X3F raw image data 16566!:mime image/x-x3f 16567>6 leshort x \b, version %d. 16568>4 leshort x \b%d 16569>28 lelong x \b, %dx 16570>32 lelong x \b%d 16571 16572# Paint.NET file 16573# From Adam Buchbinder <adam.buchbinder@gmail.com> 165740 string PDN3 Paint.NET image data 16575!:mime image/x-paintnet 16576 16577# Not really an image. 16578# From: "Tano M. Fotang" <mfotang@quanteq.com> 165790 string \x46\x4d\x52\x00 ISO/IEC 19794-2 Format Minutiae Record (FMR) 16580 16581# doc: https://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip 16582# example: https://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip 1658390 bequad 0x574D50484F544F00 JPEG-XR Image 16584>98 byte&0x08 =0x08 \b, hard tiling 16585>99 byte&0x80 =0x80 \b, tiling present 16586>99 byte&0x40 =0x40 \b, codestream present 16587>99 byte&0x38 x \b, spatial xform= 16588>99 byte&0x38 0x00 \bTL 16589>99 byte&0x38 0x08 \bBL 16590>99 byte&0x38 0x10 \bTR 16591>99 byte&0x38 0x18 \bBR 16592>99 byte&0x38 0x20 \bBT 16593>99 byte&0x38 0x28 \bRB 16594>99 byte&0x38 0x30 \bLT 16595>99 byte&0x38 0x38 \bLB 16596>100 byte&0x80 =0x80 \b, short header 16597>>102 beshort+1 x \b, %d 16598>>104 beshort+1 x \bx%d 16599>100 byte&0x80 =0x00 \b, long header 16600>>102 belong+1 x \b, %x 16601>>106 belong+1 x \bx%x 16602>101 beshort&0xf x \b, bitdepth= 16603>>101 beshort&0xf 0x0 \b1-WHITE=1 16604>>101 beshort&0xf 0x1 \b8 16605>>101 beshort&0xf 0x2 \b16 16606>>101 beshort&0xf 0x3 \b16-SIGNED 16607>>101 beshort&0xf 0x4 \b16-FLOAT 16608>>101 beshort&0xf 0x5 \b(reserved 5) 16609>>101 beshort&0xf 0x6 \b32-SIGNED 16610>>101 beshort&0xf 0x7 \b32-FLOAT 16611>>101 beshort&0xf 0x8 \b5 16612>>101 beshort&0xf 0x9 \b10 16613>>101 beshort&0xf 0xa \b5-6-5 16614>>101 beshort&0xf 0xb \b(reserved %d) 16615>>101 beshort&0xf 0xc \b(reserved %d) 16616>>101 beshort&0xf 0xd \b(reserved %d) 16617>>101 beshort&0xf 0xe \b(reserved %d) 16618>>101 beshort&0xf 0xf \b1-BLACK=1 16619>101 beshort&0xf0 x \b, colorfmt= 16620>>101 beshort&0xf0 0x00 \bYONLY 16621>>101 beshort&0xf0 0x10 \bYUV240 16622>>101 beshort&0xf0 0x20 \bYWV422 16623>>101 beshort&0xf0 0x30 \bYWV444 16624>>101 beshort&0xf0 0x40 \bCMYK 16625>>101 beshort&0xf0 0x50 \bCMYKDIRECT 16626>>101 beshort&0xf0 0x60 \bNCOMPONENT 16627>>101 beshort&0xf0 0x70 \bRGB 16628>>101 beshort&0xf0 0x80 \bRGBE 16629>>101 beshort&0xf0 >0x80 \b(reserved 0x%x) 16630 16631# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 16632# 16633# BPG (Better Portable Graphics) format 16634# https://bellard.org/bpg/ 16635# http://fileformats.archiveteam.org/wiki/BPG 16636# 166370 string \x42\x50\x47\xFB BPG (Better Portable Graphics) 16638!:mime image/bpg 16639 16640# From: Joerg Jenderek 16641# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format 166420 string icns Mac OS X icon 16643!:mime image/x-icns 16644!:apple ????icns 16645!:ext icns 16646>4 ubelong >0 16647# file size 16648>>4 ubelong x \b, %d bytes 16649# icon type 16650>>8 string x \b, "%4.4s" type 16651 16652# TIM images 166530 lelong 0x00000010 TIM image, 16654>4 lelong 0x8 4-Bit, 16655>4 lelong 0x9 8-Bit, 16656>4 lelong 0x2 15-Bit, 16657>4 lelong 0x3 24-Bit, 16658>4 lelong &8 16659>>(8.l+12) leshort x Pixel at (%d, 16660>>(8.l+14) leshort x \b%d) 16661>>(8.l+16) leshort x Size=%dx 16662>>(8.l+18) leshort x \b%d, 16663>>4 lelong 0x8 16 CLUT Entries at 16664>>4 lelong 0x9 256 CLUT Entries at 16665>>12 leshort x (%d, 16666>>14 leshort x \b%d) 16667>4 lelong ^8 16668>>12 leshort x Pixel at (%d, 16669>>14 leshort x \b%d) 16670>>16 leshort x Size=%dx 16671>>18 leshort x \b%d 16672 16673# MDEC streams 166740 lelong 0x80010160 MDEC video stream, 16675>16 leshort x %dx 16676>18 leshort x \b%d 16677#>8 lelong x %d frames 16678#>4 leshort x secCount=%d; 16679#>6 leshort x nSectors=%d; 16680#>12 lelong x frameSize=%d; 16681 16682# BS encoded bitstreams 166832 leshort 0x3800 BS image, 16684>6 leshort x Version %d, 16685>4 leshort x Quantization %d, 16686>0 leshort x (Decompresses to %d words) 16687 16688# Type: farbfeld image. 16689# Url: http://tools.suckless.org/farbfeld/ 16690# From: Ian D. Scott <ian@iandouglasscott.com> 16691# 166920 string farbfeld farbfeld image data, 16693>8 ubelong x %dx 16694>12 ubelong x \b%d 16695 16696# Type: Microsoft DirectDraw Surface (common data) 16697# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 16698# From: Morten Hustveit <morten@debian.org> 16699# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 167000 name ms-directdraw-surface 16701>0x10 ulelong x %u x 16702>0x0C ulelong x %u 16703# Color depth. 16704>0x58 ulelong >0 \b, %u-bit color 16705# Determine the pixel format. 16706>0x50 ulelong&0x4 4 16707# FIXME: Handle DX10 and XBOX formats. 16708>>0x54 string x \b, compressed using %.4s 16709>0x50 ulelong&0x2 0x2 \b, alpha only 16710>0x50 ulelong&0x200 0x200 \b, YUV 16711>0x50 ulelong&0x20000 0x20000 \b, luminance 16712# RGB pixel format 16713>0x50 ulelong&0x40 0x40 16714 16715# Determine the RGB format using the color masks. 16716# ulequad order: 0xGGGGGGGGRRRRRRRR, 0xAAAAAAAABBBBBBBB 16717 16718>>0x58 ulelong 16 16719 16720# NOTE: 15-bit color formats usually have 16-bit listed as the color depth. 16721>>>0x5C ulequad 0x000003E000007C00 16722>>>>0x64 ulequad 0x000000000000001F \b, RGB555 16723>>>0x5C ulequad 0x000003E000001F00 16724>>>>0x64 ulequad 0x000000000000007C \b, BGR555 16725 16726>>>0x5C ulequad 0x000007E00000F800 16727>>>>0x64 ulequad 0x000000000000001F \b, RGB565 16728>>>0x5C ulequad 0x000007E000001F00 16729>>>>0x64 ulequad 0x00000000000000F8 \b, BGR565 16730 16731>>>0x5C ulequad 0x000000F000000F00 16732>>>>0x64 ulequad 0x0000F0000000000F \b, ARGB4444 16733>>>0x5C ulequad 0x000000F00000000F 16734>>>>0x64 ulequad 0x0000F00000000F00 \b, ABGR4444 16735 16736>>>0x5C ulequad 0x00000F000000F000 16737>>>>0x64 ulequad 0x0000000F000000F0 \b, RGBA4444 16738>>>0x5C ulequad 0x00000F00000000F0 16739>>>>0x64 ulequad 0x0000000F0000F000 \b, BGRA4444 16740 16741>>>0x5C ulequad 0x000000F000000F00 16742>>>>0x64 ulequad 0x000000000000000F \b, xRGB4444 16743>>>0x5C ulequad 0x000000F00000000F 16744>>>>0x64 ulequad 0x0000000000000F00 \b, xBGR4444 16745 16746>>>0x5C ulequad 0x00000F000000F000 16747>>>>0x64 ulequad 0x00000000000000F0 \b, RGBx4444 16748>>>0x5C ulequad 0x00000F00000000F0 16749>>>>0x64 ulequad 0x000000000000F000 \b, BGRx4444 16750 16751>>>0x5C ulequad 0x000003E000007C00 16752>>>>0x64 ulequad 0x000080000000001F \b, ARGB1555 16753>>>0x5C ulequad 0x000003E000001F00 16754>>>>0x64 ulequad 0x000080000000007C \b, ABGR1555 16755>>>0x5C ulequad 0x000007C00000F800 16756>>>>0x64 ulequad 0x000000010000003E \b, RGBA5551 16757>>>0x5C ulequad 0x000007C00000003E 16758>>>>0x64 ulequad 0x000000010000F800 \b, BGRA5551 16759 16760>>88 ulelong 24 16761>>>0x5C ulequad 0x0000FF0000FF0000 16762>>>>0x64 ulequad 0x00000000000000FF \b, RGB888 16763>>>0x5C ulequad 0x0000FF00000000FF 16764>>>>0x64 ulequad 0x0000000000FF0000 \b, BGR888 16765 16766>>88 ulelong 32 16767>>>0x5C ulequad 0x0000FF0000FF0000 16768>>>>0x64 ulequad 0xFF000000000000FF \b, ARGB8888 16769>>>0x5C ulequad 0x0000FF00000000FF 16770>>>>0x64 ulequad 0xFF00000000FF0000 \b, ABGR8888 16771 16772>>>0x5C ulequad 0x00FF0000FF000000 16773>>>>0x64 ulequad 0x000000FF0000FF00 \b, RGBA8888 16774>>>0x5C ulequad 0x00FF00000000FF00 16775>>>>0x64 ulequad 0x000000FFFF000000 \b, BGBA8888 16776 16777>>>0x5C ulequad 0x0000FF0000FF0000 16778>>>>0x64 ulequad 0x00000000000000FF \b, xRGB8888 16779>>>0x5C ulequad 0x0000FF00000000FF 16780>>>>0x64 ulequad 0x0000000000FF0000 \b, xBGR8888 16781 16782>>>0x5C ulequad 0x00FF0000FF000000 16783>>>>0x64 ulequad 0x000000000000FF00 \b, RGBx8888 16784>>>0x5C ulequad 0x00FF00000000FF00 16785>>>>0x64 ulequad 0x00000000FF000000 \b, BGBx8888 16786 16787# Less common 32-bit color formats. 16788>>>0x5C ulequad 0xFFFF00000000FFFF 16789>>>>0x64 ulequad 0x0000000000000000 \b, G16R16 16790>>>0x5C ulequad 0x0000FFFFFFFF0000 16791>>>>0x64 ulequad 0x0000000000000000 \b, R16G16 16792 16793>>>0x5C ulequad 0x000FFC003FF00000 16794>>>>0x64 ulequad 0xC0000000000003FF \b, A2R10G10B10 16795>>>0x5C ulequad 0x000FFC00000003FF 16796>>>>0x64 ulequad 0xC00000003FF00000 \b, A2B10G10R10 16797 16798# Type: Microsoft DirectDraw Surface 16799# URL: https://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp 16800# From: Morten Hustveit <morten@debian.org> 16801# Updated by: David Korth <gerbilsoft@gerbilsoft.com> 168020 string/b DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS): 16803>0 use ms-directdraw-surface 16804 16805# Type: Sega PVR image. 16806# From: David Korth <gerbilsoft@gerbilsoft.com> 16807# References: 16808# - https://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt 16809# - https://github.com/yazgoo/pvrx2png 16810# - https://github.com/nickworonekin/puyotools 16811 16812# Sega PVR header. 168130 name sega-pvr-image-header 16814>0x0C leshort x %u x 16815>0x0E leshort x %u 16816# Image format. 16817>0x08 byte 0 \b, ARGB1555 16818>0x08 byte 1 \b, RGB565 16819>0x08 byte 2 \b, ARGB4444 16820>0x08 byte 3 \b, YUV442 16821>0x08 byte 4 \b, Bump 16822>0x08 byte 5 \b, 4bpp 16823>0x08 byte 6 \b, 8bpp 16824# Image data type. 16825>0x09 byte 0x01 \b, square twiddled 16826>0x09 byte 0x02 \b, square twiddled & mipmap 16827>0x09 byte 0x03 \b, VQ 16828>0x09 byte 0x04 \b, VQ & mipmap 16829>0x09 byte 0x05 \b, 8-bit CLUT twiddled 16830>0x09 byte 0x06 \b, 4-bit CLUT twiddled 16831>0x09 byte 0x07 \b, 8-bit direct twiddled 16832>0x09 byte 0x08 \b, 4-bit direct twiddled 16833>0x09 byte 0x09 \b, rectangle 16834>0x09 byte 0x0B \b, rectangular stride 16835>0x09 byte 0x0D \b, rectangular twiddled 16836>0x09 byte 0x10 \b, small VQ 16837>0x09 byte 0x11 \b, small VQ & mipmap 16838>0x09 byte 0x12 \b, square twiddled & mipmap 16839 16840# Sega PVR image. 168410 string PVRT 16842>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 16843>>0x20 use ms-directdraw-surface 16844>0x10 belong !0x44445320 Sega PVR image: 16845>>0 use sega-pvr-image-header 16846 16847# Sega PVR image with GBIX. 168480 string GBIX 16849>0x10 string PVRT 16850>>0x10 string DDS\040\174\000\000\000 Sega PVR (Xbox) image: 16851>>>0x20 use ms-directdraw-surface 16852>>0x10 belong !0x44445320 Sega PVR image: 16853>>>0x10 use sega-pvr-image-header 16854>>0x08 lelong x \b, global index = %u 16855 16856# Sega GVR header. 168570 name sega-gvr-image-header 16858>0x0C beshort x %u x 16859>0x0E beshort x %u 16860# Image data format. 16861>0x0B byte 0 \b, I4 16862>0x0B byte 1 \b, I8 16863>0x0B byte 2 \b, IA4 16864>0x0B byte 3 \b, IA8 16865>0x0B byte 4 \b, RGB565 16866>0x0B byte 5 \b, RGB5A3 16867>0x0B byte 6 \b, ARGB8888 16868>0x0B byte 8 \b, CI4 16869>0x0B byte 9 \b, CI8 16870>0x0B byte 14 \b, DXT1 16871 16872# Sega GVR image. 168730 string GVRT Sega GVR image: 16874>0x10 use sega-gvr-image-header 16875 16876# Sega GVR image with GBIX. 168770 string GBIX 16878>0x10 string GVRT Sega GVR image: 16879>>0x10 use sega-gvr-image-header 16880>>0x08 belong x \b, global index = %u 16881 16882# Sega GVR image with GCIX. (Wii) 168830 string GCIX 16884>0x10 string GVRT Sega GVR image: 16885>>0x10 use sega-gvr-image-header 16886>>0x08 belong x \b, global index = %u 16887 16888# Light Field Picture 16889# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx 16890# Typical file extensions: .lfp .lfr .lfx 16891 168920 belong 0x894C4650 16893>4 belong 0x0D0A1A0A 16894>12 belong 0x00000000 Lytro Light Field Picture 16895>8 belong x \b, version %d 16896 16897# Type: Vision Research Phantom CINE Format 16898# URL: https://www.phantomhighspeed.com/ 16899# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk 16900# From: Harry Mallon <hjmallon at gmail.com> 16901# 16902# This has a short "CI" code but the 44 is the size of the struct which is 16903# stable 169040 string CI 16905>2 leshort 44 Vision Research CINE Video, 16906>>4 leshort 0 Grayscale, 16907>>4 leshort 1 JPEG Compressed, 16908>>4 leshort 2 RAW, 16909>>6 leshort x version %d, 16910>>20 lelong x %d frames, 16911>>48 lelong x %dx 16912>>52 lelong x \b%d 16913 16914# Type: ARRI Raw Image 16915# Info: SMPTE RDD30:2014 16916# From: Harry Mallon <hjmallon at gmail.com> 169170 string ARRI ARRI ARI image data, 16918>4 lelong 0x78563412 little-endian, 16919>4 lelong 0x12345678 big-endian, 16920>12 lelong x version %d, 16921>20 lelong x %dx 16922>24 lelong x \b%d 16923 16924# Type: Khronos KTX texture. 16925# From: David Korth <gerbilsoft@gerbilsoft.com> 16926# References: 16927# - https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/ 16928 16929# glEnum decoding. 16930# NOTE: Only the most common formats are listed here. 169310 name khronos-ktx-glEnum 16932>0 lelong 0x1907 \b, RGB 16933>0 lelong 0x1908 \b, RGBA 16934>0 lelong 0x1909 \b, LUMINANCE 16935>0 lelong 0x190A \b, LUMINANCE_ALPHA 16936>0 lelong 0x80E1 \b, BGR 16937>0 lelong 0x80E2 \b, BGRA 16938>0 lelong 0x83A0 \b, RGB_S3TC 16939>0 lelong 0x83A1 \b, RGB4_S3TC 16940>0 lelong 0x83A2 \b, RGBA_S3TC 16941>0 lelong 0x83A3 \b, RGBA4_S3TC 16942>0 lelong 0x83A4 \b, RGBA_DXT5_S3TC 16943>0 lelong 0x83A5 \b, RGBA4_DXT5_S3TC 16944>0 lelong 0x8D64 \b, ETC1_RGB8_OES 16945>0 lelong 0x9270 \b, COMPRESSED_R11_EAC 16946>0 lelong 0x9271 \b, COMPRESSED_SIGNED_R11_EAC 16947>0 lelong 0x9272 \b, COMPRESSED_RG11_EAC 16948>0 lelong 0x9273 \b, COMPRESSED_SIGNED_RG11_EAC 16949>0 lelong 0x9274 \b, COMPRESSED_RGB8_ETC2 16950>0 lelong 0x9275 \b, COMPRESSED_SRGB8_ETC2 16951>0 lelong 0x9276 \b, COMPRESSED_RGB8_PUNCHTHROUGH_ALPHA1_ETC2 16952>0 lelong 0x9277 \b, COMPRESSED_SRGB8_PUNCHTHROUGH_ALPHA1_ETC2 16953>0 lelong 0x9278 \b, COMPRESSED_RGBA2_ETC2_EAC 16954>0 lelong 0x9279 \b, COMPRESSED_SRGB8_ALPHA8_ETC2_EAC 16955>0 lelong 0x93B0 \b, COMPRESSED_RGBA_ASTC_4x4_KHR 16956>0 lelong 0x93B1 \b, COMPRESSED_RGBA_ASTC_5x4_KHR 16957>0 lelong 0x93B2 \b, COMPRESSED_RGBA_ASTC_5x5_KHR 16958>0 lelong 0x93B3 \b, COMPRESSED_RGBA_ASTC_6x5_KHR 16959>0 lelong 0x93B4 \b, COMPRESSED_RGBA_ASTC_6x6_KHR 16960>0 lelong 0x93B5 \b, COMPRESSED_RGBA_ASTC_8x5_KHR 16961>0 lelong 0x93B6 \b, COMPRESSED_RGBA_ASTC_8x6_KHR 16962>0 lelong 0x93B7 \b, COMPRESSED_RGBA_ASTC_8x8_KHR 16963>0 lelong 0x93B8 \b, COMPRESSED_RGBA_ASTC_10x5_KHR 16964>0 lelong 0x93B9 \b, COMPRESSED_RGBA_ASTC_10x6_KHR 16965>0 lelong 0x93BA \b, COMPRESSED_RGBA_ASTC_10x8_KHR 16966>0 lelong 0x93BB \b, COMPRESSED_RGBA_ASTC_10x10_KHR 16967>0 lelong 0x93BC \b, COMPRESSED_RGBA_ASTC_12x10_KHR 16968>0 lelong 0x93BD \b, COMPRESSED_RGBA_ASTC_12x12_KHR 16969>0 lelong 0x93D0 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_4x4_KHR 16970>0 lelong 0x93D1 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x4_KHR 16971>0 lelong 0x93D2 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_5x5_KHR 16972>0 lelong 0x93D3 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x5_KHR 16973>0 lelong 0x93D4 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_6x6_KHR 16974>0 lelong 0x93D5 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x5_KHR 16975>0 lelong 0x93D6 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x6_KHR 16976>0 lelong 0x93D7 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_8x8_KHR 16977>0 lelong 0x93D8 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x5_KHR 16978>0 lelong 0x93D9 \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x6_KHR 16979>0 lelong 0x93DA \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x8_KHR 16980>0 lelong 0x93DB \b, COMPRESSED_SRGB8_ALPHA8_ASTC_10x10_KHR 16981>0 lelong 0x93DC \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x10_KHR 16982>0 lelong 0x93DD \b, COMPRESSED_SRGB8_ALPHA8_ASTC_12x12_KHR 16983 16984# Endian-specific KTX header. 16985# TODO: glType (all textures I've seen so far are GL_UNSIGNED_BYTE) 169860 name khronos-ktx-endian-header 16987>20 lelong x \b, %u 16988>24 lelong >1 x %u 16989>28 lelong >1 x %u 16990>8 lelong >0 16991>>8 use khronos-ktx-glEnum 16992>8 lelong 0 16993>>12 use khronos-ktx-glEnum 16994 16995# Main KTX header. 16996# Determine endianness, then check the rest of the header. 169970 string \xABKTX\ 11\xBB\r\n\x1A\n Khronos KTX texture 16998>12 lelong 0x04030201 (little-endian) 16999>>16 use khronos-ktx-endian-header 17000>12 belong 0x04030201 (big-endian) 17001>>16 use \^khronos-ktx-endian-header 17002 17003# Type: Valve VTF texture. 17004# From: David Korth <gerbilsoft@gerbilsoft.com> 17005# References: 17006# - https://developer.valvesoftware.com/wiki/Valve_Texture_Format 17007 17008# VTF image formats. 170090 name vtf-image-format 17010>0 lelong 0 RGBA8888 17011>0 lelong 1 ABGR8888 17012>0 lelong 2 RGB888 17013>0 lelong 3 BGR888 17014>0 lelong 4 RGB565 17015>0 lelong 5 I8 17016>0 lelong 6 IA88 17017>0 lelong 7 P8 17018>0 lelong 8 A8 17019>0 lelong 9 RGB888 (bluescreen) 17020>0 lelong 10 BGR888 (bluescreen) 17021>0 lelong 11 ARGB8888 17022>0 lelong 12 BGRA8888 17023>0 lelong 13 DXT1 17024>0 lelong 14 DXT3 17025>0 lelong 15 DXT5 17026>0 lelong 16 BGRx8888 17027>0 lelong 17 BGR565 17028>0 lelong 18 BGRx5551 17029>0 lelong 19 BGRA4444 17030>0 lelong 20 DXT1+A1 17031>0 lelong 21 BGRA5551 17032>0 lelong 22 UV88 17033>0 lelong 23 UVWQ8888 17034>0 lelong 24 RGBA16161616F 17035>0 lelong 25 RGBA16161616 17036>0 lelong 26 UVLX8888 17037 17038# Main VTF header. 170390 string VTF\0 Valve Texture Format 17040>4 lelong x v%u 17041>8 lelong x \b.%u 17042>0x10 leshort x \b, %u 17043>0x12 leshort >1 x %u 17044>4 lequad 0x0000000700000002 17045>>0x3F leshort >1 x %u 17046>0x18 leshort >1 \b, %u frames 17047>0x38 byte x \b, mipmaps: %u 17048>0x34 lelong >-1 \b, 17049>>0x34 use vtf-image-format 17050 17051# Type: Valve VTF3 (PS3) texture. 17052# From: David Korth <gerbilsoft@gerbilsoft.com> 170530 string VTF3 Valve Texture Format (PS3) 17054>0x14 beshort x \b, %u 17055>0x16 beshort x \b x %u 17056>0x10 belong&0x2000 0 \b, DXT1 17057>0x10 belong&0x2000 0x2000 \b, DXT5 17058 17059# Type: ASTC texture. 17060# From: David Korth <gerbilsoft@gerbilsoft.com> 17061# References: 17062# - https://stackoverflow.com/questions/22600678/determine-internal-format-of-given-astc-compressed-image-through-its-header 17063# - https://stackoverflow.com/a/22682244 170640 lelong 0x5ca1ab13 ASTC 17065>4 byte x %u 17066>5 byte x \bx%u 17067>6 byte >1 \bx%u 17068# X, Y, and Z dimensions are stored as 24-bit LE. 17069# Pretend it's 32-bit and mask off the high byte. 17070>7 lelong&0x00FFFFFF x texture, %u 17071>10 lelong&0x00FFFFFF x x %u 17072>13 lelong&0x00FFFFFF >1 x %u 17073 17074# Zebra Metafile graphic 17075# http://www.fileformat.info/format/zbr/egff.htm 170760 beshort 0x9a02 Zebra Metafile graphic 17077>2 leshort 1 (version 1.x) 17078>2 leshort 2 (version 1.1x or 1.2x) 17079>2 leshort 3 (version 1.49) 17080>2 leshort 4 (version 1.50) 17081>4 string x (comment = %s) 17082 17083# Microsoft Paint graphic 17084# http://www.fileformat.info/format/mspaint/egff.htm 170850 string DanM icrosoft Paint image data (version 1.x) 17086>4 leshort x (%d 17087>>6 leshort x x %d) 170880 string LinS Microsoft Paint image data (version 2.0) 17089>4 leshort x (%d 17090>>6 leshort x x %d) 17091 17092# reMarkable tablet internal file format (https://www.remarkable.com/) 17093# https://github.com/ax3l/lines-are-beautiful 17094# https://plasma.ninja/blog/devices/remarkable/binary/format/2017/12/26/\ 17095# reMarkable-lines-file-format.html#what-to-do-next 17096# from Axel Huebl 170970 string reMarkable 17098>11 string lines 17099>>17 string with 17100>>>22 string selections 17101>>>>33 string and 17102>>>>>37 string layers 17103>>>>>>43 lelong x reMarkable tablet notebook lines, 1404 x 1872, %x page(s) 17104 17105# newer per-page files for the reMarkable 171060 string reMarkable 17107>11 string .lines 17108>>18 string file, 17109>>>24 string version= 17110>>>>32 byte x reMarkable tablet page (v%c), 1404 x 1872, 17111>>>>>43 lelong x %d layer(s) 17112 17113# Type: PVR3 texture. 17114# From: David Korth <gerbilsoft@gerbilsoft.com> 17115# References: 17116# - http://cdn.imgtec.com/sdk-documentation/PVR+File+Format.Specification.pdf 17117 17118# PVR3 pixel formats. 171190 name pvr3-pixel-format 17120>4 ulelong 0 17121>>0 ulelong 0 PVRTC 2bpp RGB 17122>>0 ulelong 1 PVRTC 2bpp RGBA 17123>>0 ulelong 2 PVRTC 4bpp RGB 17124>>0 ulelong 3 PVRTC 4bpp RGBA 17125>>0 ulelong 4 PVRTC-II 2bpp 17126>>0 ulelong 5 PVRTC-II 4bpp 17127>>0 ulelong 6 ETC1 17128>>0 ulelong 7 DXT1 17129>>0 ulelong 8 DXT2 17130>>0 ulelong 9 DXT3 17131>>0 ulelong 10 DXT4 17132>>0 ulelong 11 DXT5 17133>>0 ulelong 12 BC4 17134>>0 ulelong 13 BC5 17135>>0 ulelong 14 BC6 17136>>0 ulelong 15 BC7 17137>>0 ulelong 16 UYVY 17138>>0 ulelong 17 YUY2 17139>>0 ulelong 18 BW1bpp 17140>>0 ulelong 19 R9G9B9E5 Shared Exponent 17141>>0 ulelong 20 RGBG8888 17142>>0 ulelong 21 GRGB8888 17143>>0 ulelong 22 ETC2 RGB 17144>>0 ulelong 23 ETC2 RGBA 17145>>0 ulelong 24 ETC2 RGB A1 17146>>0 ulelong 25 EAC R11 17147>>0 ulelong 26 EAC RG11 17148>>0 ulelong 27 ASTC_4x4 17149>>0 ulelong 28 ASTC_5x4 17150>>0 ulelong 29 ASTC_5x5 17151>>0 ulelong 30 ASTC_6x5 17152>>0 ulelong 31 ASTC_6x6 17153>>0 ulelong 32 ASTC_8x5 17154>>0 ulelong 33 ASTC_8x6 17155>>0 ulelong 34 ASTC_8x8 17156>>0 ulelong 35 ASTC_10x5 17157>>0 ulelong 36 ASTC_10x6 17158>>0 ulelong 37 ASTC_10x8 17159>>0 ulelong 38 ASTC_10x10 17160>>0 ulelong 39 ASTC_12x10 17161>>0 ulelong 40 ASTC_12x12 17162>>0 ulelong 41 ASTC_3x3x3 17163>>0 ulelong 42 ASTC_4x3x3 17164>>0 ulelong 43 ASTC_4x4x3 17165>>0 ulelong 44 ASTC_4x4x4 17166>>0 ulelong 45 ASTC_5x4x4 17167>>0 ulelong 46 ASTC_5x5x4 17168>>0 ulelong 47 ASTC_5x5x5 17169>>0 ulelong 48 ASTC_6x5x5 17170>>0 ulelong 49 ASTC_6x6x5 17171>>0 ulelong 50 ASTC_6x6x6 17172>4 ulelong !0 17173>>0 byte !0 %c 17174>>1 byte !0 \b%c 17175>>2 byte !0 \b%c 17176>>3 byte !0 \b%c 17177 171780 string PVR\x03 PVR 3.0 texture: 17179>0x18 ulelong x %u x 17180>0x1C ulelong x %u 17181>0x20 ulelong >1 x %u 17182>0x08 byte x \b, 17183>0x08 use pvr3-pixel-format 17184>0x10 ulelong 1 \b, sRGB 17185>0x04 ulelong&0x02 0x02 \b, premultiplied alpha 17186 17187# Type: Microsoft Xbox XPR0 texture. 17188# From: David Korth <gerbilsoft@gerbilsoft.com> 17189# References: 17190# - https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/develop/src/core/hle/D3D8/XbD3D8Types.h 17191 17192# XPR pixel formats. 171930 name xbox-xpr-pixel-format 17194>0 byte 0x00 L8 17195>0 byte 0x01 AL8 17196>0 byte 0x02 ARGB1555 17197>0 byte 0x03 RGB555 17198>0 byte 0x04 ARGB4444 17199>0 byte 0x05 RGB565 17200>0 byte 0x06 ARGB8888 17201>0 byte 0x07 xRGB8888 17202>0 byte 0x0B P8 17203>0 byte 0x0C DXT1 17204>0 byte 0x0E DXT2 17205>0 byte 0x0F DXT4 17206>0 byte 0x10 Linear ARGB1555 17207>0 byte 0x11 Linear RGB565 17208>0 byte 0x12 Linear ARGB8888 17209>0 byte 0x13 Linear L8 17210>0 byte 0x16 Linear R8B8 17211>0 byte 0x17 Linear G8B8 17212>0 byte 0x19 A8 17213>0 byte 0x1A A8L8 17214>0 byte 0x1B Linear AL8 17215>0 byte 0x1C Linear RGB555 17216>0 byte 0x1D Linear ARGB4444 17217>0 byte 0x1E Linear xRGB8888 17218>0 byte 0x1F Linear A8 17219>0 byte 0x20 Linear A8L8 17220>0 byte 0x24 YUY2 17221>0 byte 0x25 UYVY 17222>0 byte 0x27 L6V5U5 17223>0 byte 0x28 V8U8 17224>0 byte 0x29 R8B8 17225>0 byte 0x2A D24S8 17226>0 byte 0x2B F24S8 17227>0 byte 0x2C D16 17228>0 byte 0x2D F16 17229>0 byte 0x2E Linear D24S8 17230>0 byte 0x2F Linear F24S8 17231>0 byte 0x30 Linear D16 17232>0 byte 0x31 Linear F16 17233>0 byte 0x32 L16 17234>0 byte 0x33 V16U16 17235>0 byte 0x35 Linear L16 17236>0 byte 0x36 Linear V16U16 17237>0 byte 0x37 Linear L6V5U5 17238>0 byte 0x38 RGBA5551 17239>0 byte 0x39 RGBA4444 17240>0 byte 0x3A QWVU8888 17241>0 byte 0x3B BGRA8888 17242>0 byte 0x3C RGBA8888 17243>0 byte 0x3D Linear RGBA5551 17244>0 byte 0x3E Linear RGBA4444 17245>0 byte 0x3F Linear ABGR8888 17246>0 byte 0x40 Linear BGRA8888 17247>0 byte 0x41 Linear RGBA8888 17248>0 byte 0x64 Vertex Data 17249 172500 string XPR0 Microsoft Xbox XPR0 texture 17251>0x19 byte x \b, format: 17252>>0x19 use xbox-xpr-pixel-format 17253 17254#------------------------------------------------------------------------------ 17255# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $ 17256# inform: file(1) magic for Inform interactive fiction language 17257 17258# URL: http://www.inform-fiction.org/ 17259# From: Reuben Thomas <rrt@sc3d.org> 17260 172610 search/100/cW constant\ story Inform source text 17262 17263#------------------------------------------------------------------------------ 17264# $File: intel,v 1.17 2018/08/01 10:34:03 christos Exp $ 17265# intel: file(1) magic for x86 Unix 17266# 17267# Various flavors of x86 UNIX executable/object (other than Xenix, which 17268# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do 17269# Windows as well. 17270# 17271# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and 17272# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere 17273# as well, if, as, and when IBM makes it portable. 17274# 17275# The `versions' should be un-commented if they work for you. 17276# (Was the problem just one of endianness?) 17277# 172780 leshort 0502 basic-16 executable 17279>12 lelong >0 not stripped 17280#>22 leshort >0 - version %d 172810 leshort 0503 basic-16 executable (TV) 17282>12 lelong >0 not stripped 17283#>22 leshort >0 - version %d 172840 leshort 0510 x86 executable 17285>12 lelong >0 not stripped 172860 leshort 0511 x86 executable (TV) 17287>12 lelong >0 not stripped 172880 leshort =0512 iAPX 286 executable small model (COFF) 17289>12 lelong >0 not stripped 17290#>22 leshort >0 - version %d 172910 leshort =0522 iAPX 286 executable large model (COFF) 17292>12 lelong >0 not stripped 17293#>22 leshort >0 - version %d 17294# updated by Joerg Jenderek at Oct 2015 17295# https://de.wikipedia.org/wiki/Common_Object_File_Format 17296# http://www.delorie.com/djgpp/doc/coff/filhdr.html 17297# ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file" 17298# ./intel (version 5.25) label labeled the next entry as "80386 COFF executable" 17299# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 173000 leshort =0514 17301# use subroutine to display name+flags+variables for common object formated files 17302>0 use display-coff 17303#>12 lelong >0 not stripped 17304# no hint found, that at offset 22 is version 17305#>22 leshort >0 - version %d 173060 leshort 0x0200 17307>0 use display-coff 173080 leshort 0x8664 17309>0 use display-coff 17310 17311# rom: file(1) magic for BIOS ROM Extensions found in intel machines 17312# mapped into memory between 0xC0000 and 0xFFFFF 17313# From: Alex Myczko <alex@aiei.ch> 17314# updated by Joerg Jenderek 17315# https://en.wikipedia.org/wiki/Option_ROM 173160 beshort 0x55AA BIOS (ia32) ROM Ext. 17317!:mime application/octet-stream 17318!:ext rom/bin 17319>5 string USB USB 17320>7 string LDR UNDI image 17321>30 string IBM IBM comp. Video 17322>26 string Adaptec Adaptec 17323>28 string Adaptec Adaptec 17324>42 string PROMISE Promise 17325>2 byte x (%d*512) 17326 17327# Flash descriptors for Intel SPI flash roms. 17328# From Dr. Jesus <j@hug.gs> 173290 lelong 0x0ff0a55a Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step 1733016 lelong 0x0ff0a55a Intel serial flash for PCH ROM 17331 17332#------------------------------------------------------------------------------ 17333# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $ 17334# interleaf: file(1) magic for InterLeaf TPS: 17335# 173360 string =\210OPS Interleaf saved data 173370 string =<!OPS Interleaf document text 17338>5 string ,\ Version\ = \b, version 17339>>17 string >\0 %.3s 17340 17341#------------------------------------------------------------------------------ 17342# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $ 17343# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1 17344# "/etc/magic": 17345# From: guy@netapp.com (Guy Harris) 17346# 173474 string pgscriptver IslandWrite document 1734813 string DrawFile IslandDraw document 17349 17350 17351#------------------------------------------------------------------------------ 17352# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $ 17353# ispell: file(1) magic for ispell 17354# 17355# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic 17356# will match 0x9600 through 0x9603 in *both* little endian and big endian. 17357# (No other current magic entries collide.) 17358# 17359# Updated by Daniel Quinlan (quinlan@yggdrasil.com) 17360# 173610 leshort&0xFFFC 0x9600 little endian ispell 17362>0 byte 0 hash file (?), 17363>0 byte 1 3.0 hash file, 17364>0 byte 2 3.1 hash file, 17365>0 byte 3 hash file (?), 17366>2 leshort 0x00 8-bit, no capitalization, 26 flags 17367>2 leshort 0x01 7-bit, no capitalization, 26 flags 17368>2 leshort 0x02 8-bit, capitalization, 26 flags 17369>2 leshort 0x03 7-bit, capitalization, 26 flags 17370>2 leshort 0x04 8-bit, no capitalization, 52 flags 17371>2 leshort 0x05 7-bit, no capitalization, 52 flags 17372>2 leshort 0x06 8-bit, capitalization, 52 flags 17373>2 leshort 0x07 7-bit, capitalization, 52 flags 17374>2 leshort 0x08 8-bit, no capitalization, 128 flags 17375>2 leshort 0x09 7-bit, no capitalization, 128 flags 17376>2 leshort 0x0A 8-bit, capitalization, 128 flags 17377>2 leshort 0x0B 7-bit, capitalization, 128 flags 17378>2 leshort 0x0C 8-bit, no capitalization, 256 flags 17379>2 leshort 0x0D 7-bit, no capitalization, 256 flags 17380>2 leshort 0x0E 8-bit, capitalization, 256 flags 17381>2 leshort 0x0F 7-bit, capitalization, 256 flags 17382>4 leshort >0 and %d string characters 173830 beshort&0xFFFC 0x9600 big endian ispell 17384>1 byte 0 hash file (?), 17385>1 byte 1 3.0 hash file, 17386>1 byte 2 3.1 hash file, 17387>1 byte 3 hash file (?), 17388>2 beshort 0x00 8-bit, no capitalization, 26 flags 17389>2 beshort 0x01 7-bit, no capitalization, 26 flags 17390>2 beshort 0x02 8-bit, capitalization, 26 flags 17391>2 beshort 0x03 7-bit, capitalization, 26 flags 17392>2 beshort 0x04 8-bit, no capitalization, 52 flags 17393>2 beshort 0x05 7-bit, no capitalization, 52 flags 17394>2 beshort 0x06 8-bit, capitalization, 52 flags 17395>2 beshort 0x07 7-bit, capitalization, 52 flags 17396>2 beshort 0x08 8-bit, no capitalization, 128 flags 17397>2 beshort 0x09 7-bit, no capitalization, 128 flags 17398>2 beshort 0x0A 8-bit, capitalization, 128 flags 17399>2 beshort 0x0B 7-bit, capitalization, 128 flags 17400>2 beshort 0x0C 8-bit, no capitalization, 256 flags 17401>2 beshort 0x0D 7-bit, no capitalization, 256 flags 17402>2 beshort 0x0E 8-bit, capitalization, 256 flags 17403>2 beshort 0x0F 7-bit, capitalization, 256 flags 17404>4 beshort >0 and %d string characters 17405# ispell 4.0 hash files kromJx <kromJx@crosswinds.net> 17406# Ispell 4.0 174070 string ISPL ispell 17408>4 long x hash file version %d, 17409>8 long x lexletters %d, 17410>12 long x lexsize %d, 17411>16 long x hashsize %d, 17412>20 long x stblsize %d 17413 17414#------------------------------------------------------------------------------ 17415# $File: isz,v 1.5 2019/04/19 00:42:27 christos Exp $ 17416# ISO Zipped file format 17417# https://www.ezbsystems.com/isz/iszspec.txt 174180 string IsZ! ISO Zipped file 17419>4 byte x \b, header size %u 17420>5 byte x \b, version %u 17421>8 lelong x \b, serial %u 17422#12 leshort x \b, sector size %u 17423#>16 lelong x \b, total sectors %u 17424>17 byte >0 \b, password protected 17425#>24 lequad x \b, segment size %llu 17426#>32 lelong x \b, blocks %u 17427#>36 lelong x \b, block size %u 17428 17429#------------------------------------------------------------ 17430# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ 17431# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 17432# same magic number, 0xcafebabe, so they are both handled 17433# in the entry called "cafebabe". 17434#------------------------------------------------------------ 17435# Java serialization 17436# From Martin Pool (m.pool@pharos.com.au) 174370 beshort 0xaced Java serialization data 17438>2 beshort >0x0004 \b, version %d 17439 174400 belong 0xfeedfeed Java KeyStore 17441!:mime application/x-java-keystore 174420 belong 0xcececece Java JCE KeyStore 17443!:mime application/x-java-jce-keystore 17444 17445# Java source 174460 regex \^import.*;$ Java source 17447!:mime text/x-java 17448 17449# Java HPROF dumps 17450# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 174510 string JAVA\x20PROFILE\x201.0. 17452>0x12 byte 0 17453>>0x11 ubyte-0x31 <2 Java HPROF dump, 17454>>>0x17 beqdate/1000 x created %s 17455 17456# Java jmod module 17457# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 17458# Grr. 2 byte magic "JM", really? In 2019? 174590 belong 0x4a4d0100 Java jmod module version 1.0 17460!:mime application/x-java-jmod 17461 17462# Java jlinked image 17463# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 174640 belong 0xcafedada Java module image (big endian) 17465>4 beshort >0x00 \b, version %d 17466>6 beshort x \b.%d 17467!:mime application/x-java-image 17468 174690 lelong 0xcafedada Java module image (little endian) 17470>6 leshort >0x00 \b, version %d 17471>4 leshort x \b.%d 17472!:mime application/x-java-image 17473 17474#------------------------------------------------------------------------------ 17475# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $ 17476# javascript: magic for javascript and node.js scripts. 17477# 174780 search/1/w #!/bin/node Node.js script text executable 17479!:mime application/javascript 174800 search/1/w #!/usr/bin/node Node.js script text executable 17481!:mime application/javascript 174820 search/1/w #!/bin/nodejs Node.js script text executable 17483!:mime application/javascript 174840 search/1/w #!/usr/bin/nodejs Node.js script text executable 17485!:mime application/javascript 174860 search/1 #!/usr/bin/env\ node Node.js script text executable 17487!:mime application/javascript 174880 search/1 #!/usr/bin/env\ nodejs Node.js script text executable 17489!:mime application/javascript 17490 17491#------------------------------------------------------------------------------ 17492# $File: jpeg,v 1.32 2018/10/01 18:58:29 christos Exp $ 17493# JPEG images 17494# SunOS 5.5.1 had 17495# 17496# 0 string \377\330\377\340 JPEG file 17497# 0 string \377\330\377\356 JPG file 17498# 17499# both of which turn into "JPEG image data" here. 17500# 175010 beshort 0xffd8 JPEG image data 17502!:mime image/jpeg 17503!:apple 8BIMJPEG 17504!:strength *3 17505!:ext jpeg/jpg/jpe/jfif 17506>6 string JFIF \b, JFIF standard 17507# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 17508# in a vain attempt to add image size reporting for JFIF. Note that these 17509# tests are not fool-proof since some perfectly valid JPEGs are currently 17510# impossible to specify in magic(4) format. 17511# First, a little JFIF version info: 17512>>11 byte x \b %d. 17513>>12 byte x \b%02d 17514# Next, the resolution or aspect ratio of the image: 17515>>13 byte 0 \b, aspect ratio 17516>>13 byte 1 \b, resolution (DPI) 17517>>13 byte 2 \b, resolution (DPCM) 17518>>14 beshort x \b, density %dx 17519>>16 beshort x \b%d 17520>>4 beshort x \b, segment length %d 17521# Next, show thumbnail info, if it exists: 17522>>18 byte !0 \b, thumbnail %dx 17523>>>19 byte x \b%d 17524>6 string Exif \b, Exif standard: [ 17525>>12 indirect/r x 17526>>12 string x \b] 17527 17528# Jump to the first segment 17529>(4.S+4) use jpeg_segment 17530 17531# This uses recursion... 175320 name jpeg_segment 17533>0 beshort 0xFFFE 17534# Recursion handled by FFE0 17535#>>(2.S+2) use jpeg_segment 17536>>2 pstring/HJ x \b, comment: "%s" 17537 17538>0 beshort 0xFFC0 17539>>(2.S+2) use jpeg_segment 17540>>4 byte x \b, baseline, precision %d 17541>>7 beshort x \b, %dx 17542>>5 beshort x \b%d 17543>>9 byte x \b, components %d 17544 17545>0 beshort 0xFFC1 17546>>(2.S+2) use jpeg_segment 17547>>4 byte x \b, extended sequential, precision %d 17548>>7 beshort x \b, %dx 17549>>5 beshort x \b%d 17550>>9 byte x \b, components %d 17551 17552>0 beshort 0xFFC2 17553>>(2.S+2) use jpeg_segment 17554>>4 byte x \b, progressive, precision %d 17555>>7 beshort x \b, %dx 17556>>5 beshort x \b%d 17557>>9 byte x \b, components %d 17558 17559# Define Huffman Tables 17560>0 beshort 0xFFC4 17561>>(2.S+2) use jpeg_segment 17562 17563>0 beshort 0xFFE1 17564# Recursion handled by FFE0 17565#>>(2.S+2) use jpeg_segment 17566>>4 string Exif \b, Exif Standard: [ 17567>>>10 indirect/r x 17568>>>10 string x \b] 17569 17570# Application specific markers 17571>0 beshort&0xFFE0 =0xFFE0 17572>>(2.S+2) use jpeg_segment 17573 17574# DB: Define Quantization tables 17575# DD: Define Restart interval [XXX: wrong here, it is 4 bytes] 17576# D8: Start of image 17577# D9: End of image 17578# Dn: Restart 17579>0 beshort&0xFFD0 =0xFFD0 17580>>0 beshort&0xFFE0 !0xFFE0 17581>>>(2.S+2) use jpeg_segment 17582 17583#>0 beshort x unknown 0x%x 17584#>>(2.S+2) use jpeg_segment 17585 17586# HSI is Handmade Software's proprietary JPEG encoding scheme 175870 string hsi1 JPEG image data, HSI proprietary 17588 17589# From: David Santinoli <david@santinoli.com> 175900 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 17591# From: Johan van der Knijff <johan.vanderknijff@kb.nl> 17592# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes 17593# https://github.com/bitsgalore/jp2kMagic 17594# 17595# Now read value of 'Brand' field, which yields a few possibilities: 17596>20 string \x6a\x70\x32\x20 Part 1 (JP2) 17597!:mime image/jp2 17598>20 string \x6a\x70\x78\x20 Part 2 (JPX) 17599!:mime image/jpx 17600>20 string \x6a\x70\x6d\x20 Part 6 (JPM) 17601!:mime image/jpm 17602>20 string \x6d\x6a\x70\x32 Part 3 (MJ2) 17603!:mime video/mj2 17604 17605# Type: JPEG 2000 codesream 17606# From: Mathieu Malaterre <mathieu.malaterre@gmail.com> 176070 belong 0xff4fff51 JPEG 2000 codestream 1760845 beshort 0xff52 17609 17610# JPEG extended range 176110 string \x49\x49\xbc 17612>3 byte 1 17613>>4 lelong%2 0 JPEG-XR 17614!:mime image/jxr 17615!:ext jxr 17616 17617#------------------------------------------------------------------------------ 17618# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $ 17619# karma: file(1) magic for Karma data files 17620# 17621# From <rgooch@atnf.csiro.au> 17622 176230 string KarmaRHD\040Version Karma Data Structure Version 17624>16 belong x %u 17625 17626#------------------------------------------------------------------------------ 17627# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $ 17628# kde: file(1) magic for KDE 17629 176300 string/t [KDE\ Desktop\ Entry] KDE desktop entry 17631!:mime application/x-kdelnk 176320 string/t #\ KDE\ Config\ File KDE config file 17633!:mime application/x-kdelnk 176340 string/t #\ xmcd xmcd database file for kscd 17635!:mime text/x-xmcd 17636 17637#------------------------------------------------------------------------------ 17638# $File: keepass,v 1.2 2019/04/19 00:42:27 christos Exp $ 17639# keepass: file(1) magic for KeePass file 17640# 17641# Keepass Password Safe: 17642# * original one: https://keepass.info/ 17643# * *nix port: https://www.keepassx.org/ 17644# * android port: https://code.google.com/p/keepassdroid/ 17645 176460 lelong 0x9AA2D903 Keepass password database 17647>4 lelong 0xB54BFB65 1.x KDB 17648>>48 lelong >0 \b, %d groups 17649>>52 lelong >0 \b, %d entries 17650>>8 lelong&0x0f 1 \b, SHA-256 17651>>8 lelong&0x0f 2 \b, AES 17652>>8 lelong&0x0f 4 \b, RC4 17653>>8 lelong&0x0f 8 \b, Twofish 17654>>120 lelong >0 \b, %d key transformation rounds 17655>4 lelong 0xB54BFB67 2.x KDBX 17656 17657#------------------------------------------------------------------------------ 17658# $File: kerberos,v 1.3 2019/04/19 00:42:27 christos Exp $ 17659# kerberos: MIT kerberos file binary formats 17660# 17661 17662# This magic entry is for demonstration purposes and could be improved 17663# if the following features were implemented in file: 17664# 17665# Strings inside [[ .. ]] in the descriptions have special meanings and 17666# are not printed. 17667# 17668# - Provide some form of iteration in number of components 17669# [[${counter}=%d]] in the description 17670# then append 17671# [${counter}--] in the offset of the entries 17672# - Provide a way to round the next offset 17673# Add [R:4] after the offset? 17674# - Provide a way to have optional entries 17675# XXX: Syntax: 17676# - Provide a way to "save" entries to print them later. 17677# if the description is [[${name}=%s]], then nothing is 17678# printed and a subsequent entry in the same magic file 17679# can refer to ${name} 17680# - Provide a way to format strings as hex values 17681# 17682# https://www.gnu.org/software/shishi/manual/html_node/\ 17683# The-Keytab-Binary-File-Format.html 17684# 17685 176860 name keytab_entry 17687#>0 beshort x \b, size=%d 17688#>2 beshort x \b, components=%d 17689>4 pstring/H x \b, realm=%s 17690>>&0 pstring/H x \b, principal=%s/ 17691>>>&0 pstring/H x \b%s 17692>>>>&0 belong x \b, type=%d 17693>>>>>&0 bedate x \b, date=%s 17694>>>>>>&0 byte x \b, kvno=%u 17695#>>>>>>>&0 pstring/H x 17696#>>>>>>>>&0 belong x 17697#>>>>>>>>>>&0 use keytab_entry 17698 176990 belong 0x05020000 Kerberos Keytab file 17700>4 use keytab_entry 17701 17702#------------------------------------------------------------------------------ 17703# $File: kicad,v 1.1 2018/10/01 18:39:21 christos Exp $ 17704# kicad: file(1) magic for KiCad files 17705# 17706# See 17707# 17708# http://kicad-pcb.org 17709# 17710 17711# KiCad Schematic Document 177120 string EESchema 17713>8 byte 0x20 17714>>9 string Schematic 17715>>>18 byte 0x20 KiCad Schematic Document 17716!:ext sch/bak 17717>>>>24 string Version 17718>>>>>31 byte 0x20 17719>>>>>>32 string x (Version %s) 17720 17721# KiCad Symbol Library 177220 string EESchema-LIBRARY 17723>16 byte 0x20 KiCad Symbol Library 17724!:ext lib 17725>>17 string Version 17726>>>24 byte 0x20 17727>>>>25 string x (Version %s) 17728 17729# KiCad Symbol Library Documentation 177300 string EESchema-DOCLIB 17731>15 byte 0x20 KiCad Symbol Library Documentation 17732!:ext dcm 17733>>17 string Version 17734>>>24 byte 0x20 17735>>>>25 string x (Version %s) 17736 17737# KiCad Board Layout 177380 string (kicad_pcb 17739>10 byte 0x20 KiCad Board Layout 17740!:ext kicad_pcb/kicad_pcb-bak 17741>>11 string (version 17742>>>19 byte 0x20 17743>>>>20 byte x (Version %c) 17744 17745# KiCad Footprint 177460 string (module 17747>7 byte 0x20 KiCad Footprint 17748!:ext kicad_mod 17749 17750# KiCad Footprint (Legacy) 177510 string PCBNEW-LibModule-V1 KiCad Footprint (Legacy) 17752!:ext mod 17753 17754# KiCad Netlist 177550 string (export 17756>7 byte 0x20 KiCad Netlist 17757!:ext net 17758 17759# KiCad Symbol Library Table 177600 string (sym_lib_table 17761>14 byte 0xA KiCad Symbol Library Table 17762>14 byte 0xD KiCad Symbol Library Table 17763>14 byte 0x20 KiCad Symbol Library Table 17764 17765# KiCad Footprint Library Table 177660 string (fp_lib_table 17767>13 byte 0xA KiCad Footprint Library Table 17768>13 byte 0xD KiCad Footprint Library Table 17769>13 byte 0x20 KiCad Footprint Library Table 17770 17771#------------------------------------------------------------------------------ 17772# $File: kml,v 1.5 2019/04/19 00:42:27 christos Exp $ 17773# Type: Google KML, formerly Keyhole Markup Language 17774# Future development of this format has been handed 17775# over to the Open Geospatial Consortium. 17776# https://www.opengeospatial.org/standards/kml/ 17777# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 177780 string/t \<?xml 17779>20 search/400 \ xmlns= 17780>>&0 regex ['"]https://earth.google.com/kml Google KML document 17781!:mime application/vnd.google-earth.kml+xml 17782>>>&1 string 2.0' \b, version 2.0 17783>>>&1 string 2.1' \b, version 2.1 17784>>>&1 string 2.2' \b, version 2.2 17785 17786#------------------------------------------------------------------------------ 17787# Type: OpenGIS KML, formerly Keyhole Markup Language 17788# This standard is maintained by the 17789# Open Geospatial Consortium. 17790# https://www.opengeospatial.org/standards/kml/ 17791# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 17792>>&0 regex ['"]https://www.opengis.net/kml OpenGIS KML document 17793!:mime application/vnd.google-earth.kml+xml 17794>>>&1 string/t 2.2 \b, version 2.2 17795 17796#------------------------------------------------------------------------------ 17797# Type: Google KML Archive (ZIP based) 17798# https://code.google.com/apis/kml/documentation/kml_tut.html 17799# From: Asbjoern Sloth Toennesen <asbjorn@lila.io> 178000 string PK\003\004 17801>4 byte 0x14 17802>>30 string doc.kml Compressed Google KML Document, including resources. 17803!:mime application/vnd.google-earth.kmz 17804 17805#------------------------------------------------------------------------------ 17806# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $ 17807# DEC SRC Virtual Paper: Lectern files 17808# Karl M. Hegbloom <karlheg@inetarena.com> 178090 string lect DEC SRC Virtual Paper Lectern file 17810 17811#------------------------------------------------------------------------------ 17812# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $ 17813# lex: file(1) magic for lex 17814# 17815# derived empirically, your offsets may vary! 178160 search/100 yyprevious C program text (from lex) 17817>3 search/1 >\0 for %s 17818# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com> 178190 search/100 generated\ by\ flex C program text (from flex) 17820# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com> 178210 search/1 %{ lex description text 17822 17823#------------------------------------------------------------------------------ 17824# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $ 17825# lif: file(1) magic for lif 17826# 17827# (Daniel Quinlan <quinlan@yggdrasil.com>) 17828# 178290 beshort 0x8000 lif file 17830 17831#------------------------------------------------------------------------------ 17832# $File: linux,v 1.67 2019/04/19 00:42:27 christos Exp $ 17833# linux: file(1) magic for Linux files 17834# 17835# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 17836# The following basic Linux magic is useful for reference, but using 17837# "long" magic is a better practice in order to avoid collisions. 17838# 17839# 2 leshort 100 Linux/i386 17840# >0 leshort 0407 impure executable (OMAGIC) 17841# >0 leshort 0410 pure executable (NMAGIC) 17842# >0 leshort 0413 demand-paged executable (ZMAGIC) 17843# >0 leshort 0314 demand-paged executable (QMAGIC) 17844# 178450 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 17846>16 lelong 0 \b, stripped 178470 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 17848>16 lelong 0 \b, stripped 178490 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 17850>16 lelong 0 \b, stripped 178510 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 17852>16 lelong 0 \b, stripped 17853# 178540 string \007\001\000 Linux/i386 object file 17855>20 lelong >0x1020 \b, DLL library 17856# Linux-8086 stuff: 178570 string \01\03\020\04 Linux-8086 impure executable 17858>28 long !0 not stripped 178590 string \01\03\040\04 Linux-8086 executable 17860>28 long !0 not stripped 17861# 178620 string \243\206\001\0 Linux-8086 object file 17863# 178640 string \01\03\020\20 Minix-386 impure executable 17865>28 long !0 not stripped 178660 string \01\03\040\20 Minix-386 executable 17867>28 long !0 not stripped 178680 string \01\03\04\20 Minix-386 NSYM/GNU executable 17869>28 long !0 not stripped 17870# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 17871216 lelong 0421 Linux/i386 core file 17872!:strength / 2 17873>220 string >\0 of '%s' 17874>200 lelong >0 (signal %d) 17875# 17876# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 17877# this can be overridden by the DOS executable (COM) entry 178782 string LILO Linux/i386 LILO boot/chain loader 17879# 17880# Linux make config build file, from Ole Aamot <oka@oka.no> 17881# Updated by Ken Sharp 1788228 string make\ config Linux make config build file (old) 1788349 search/70 Kernel\ Configuration Linux make config build file 17884 17885# 17886# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 17887# Updated by Adam Buchbinder <adam.buchbinder@gmail.com> 17888# See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html 178890 leshort 0x0436 Linux/i386 PC Screen Font v1 data, 17890>2 byte&0x01 0 256 characters, 17891>2 byte&0x01 !0 512 characters, 17892>2 byte&0x02 0 no directory, 17893>2 byte&0x02 !0 Unicode directory, 17894>3 byte >0 8x%d 178950 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data, 17896>16 lelong x %d characters, 17897>12 lelong&0x01 0 no directory, 17898>12 lelong&0x01 !0 Unicode directory, 17899>24 lelong x %d 17900>28 lelong x \bx%d 17901 17902# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 179034086 string SWAP-SPACE Linux/i386 swap file 17904# From: Jeff Bailey <jbailey@ubuntu.com> 17905# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 179064076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 17907# From: James Hunt <james.hunt@ubuntu.com> 179084076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate) 17909# according to man page of mkswap (8) March 1999 17910# volume label and UUID Russell Coker 17911# https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/ 179124086 string SWAPSPACE2 Linux/i386 swap file (new style), 17913>0x400 long x version %d (4K pages), 17914>0x404 long x size %d pages, 17915>1052 string \0 no label, 17916>1052 string >\0 LABEL=%s, 17917>0x40c belong x UUID=%08x 17918>0x410 beshort x \b-%04x 17919>0x412 beshort x \b-%04x 17920>0x414 beshort x \b-%04x 17921>0x416 belong x \b-%08x 17922>0x41a beshort x \b%04x 17923# From Daniel Novotny <dnovotny@redhat.com> 17924# swap file for PowerPC 1792565526 string SWAPSPACE2 Linux/ppc swap file 17926>0x400 long x version %d, 17927>0x404 long x size %d pages, 17928>1052 string \0 no label, 17929>1052 string >\0 LABEL=%s, 17930>0x40c belong x UUID=%08x 17931>0x410 beshort x \b-%04x 17932>0x412 beshort x \b-%04x 17933>0x414 beshort x \b-%04x 17934>0x416 belong x \b-%08x 17935>0x41a beshort x \b%04x 1793616374 string SWAPSPACE2 Linux/ia64 swap file 17937# 17938# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 17939# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 17940# and Nicolas Lichtmaier <nick@debian.org> 17941# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 17942# Linux kernel boot images (i386 arch) (Wolfram Kleff) 17943# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt 17944514 string HdrS Linux kernel 17945!:strength + 55 17946# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes 17947# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin 17948# DamnSmallLinux 1.5 damnsmll.lnx 17949!:ext /dat/bin/lnx 17950>510 leshort 0xAA55 x86 boot executable 17951>>518 leshort >0x1ff 17952>>>529 byte 0 zImage, 17953>>>529 byte 1 bzImage, 17954>>>526 lelong >0 17955>>>>(526.s+0x200) string >\0 version %s, 17956>>498 leshort 1 RO-rootFS, 17957>>498 leshort 0 RW-rootFS, 17958>>508 leshort >0 root_dev 0x%X, 17959>>502 leshort >0 swap_dev 0x%X, 17960>>504 leshort >0 RAMdisksize %u KB, 17961>>506 leshort 0xFFFF Normal VGA 17962>>506 leshort 0xFFFE Extended VGA 17963>>506 leshort 0xFFFD Prompt for Videomode 17964>>506 leshort >0 Video mode %d 17965# This also matches new kernels, which were caught above by "HdrS". 179660 belong 0xb8c0078e Linux kernel 17967>0x1e3 string Loading version 1.3.79 or older 17968>0x1e9 string Loading from prehistoric times 17969 17970# System.map files - Nicolas Lichtmaier <nick@debian.org> 179718 search/1 \ A\ _text Linux kernel symbol map text 17972 17973# LSM entries - Nicolas Lichtmaier <nick@debian.org> 179740 search/1 Begin3 Linux Software Map entry text 179750 search/1 Begin4 Linux Software Map entry text (new format) 17976 17977# From Matt Zimmerman, enhanced for v3 by Matthew Palmer 179780 belong 0x4f4f4f4d User-mode Linux COW file 17979>4 belong <3 \b, version %d 17980>>8 string >\0 \b, backing file %s 17981>4 belong >2 \b, version %d 17982>>32 string >\0 \b, backing file %s 17983 17984############################################################################ 17985# Linux kernel versions 17986 179870 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 17988>497 leshort 0 x86 boot sector 17989>>514 belong 0x8e of a kernel from the dawn of time! 17990>>514 belong 0x908ed8b4 version 0.99-1.1.42 17991>>514 belong 0x908ed8b8 for memtest86 17992 17993>497 leshort !0 x86 kernel 17994>>504 leshort >0 RAMdisksize=%u KB 17995>>502 leshort >0 swap=0x%X 17996>>508 leshort >0 root=0x%X 17997>>>498 leshort 1 \b-ro 17998>>>498 leshort 0 \b-rw 17999>>506 leshort 0xFFFF vga=normal 18000>>506 leshort 0xFFFE vga=extended 18001>>506 leshort 0xFFFD vga=ask 18002>>506 leshort >0 vga=%d 18003>>514 belong 0x908ed881 version 1.1.43-1.1.45 18004>>514 belong 0x15b281cd 18005>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 18006>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 18007>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 18008>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 18009>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 18010>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 18011>>514 string HdrS 18012>>>518 leshort >0x1FF 18013>>>>529 byte 0 \b, zImage 18014>>>>529 byte 1 \b, bzImage 18015>>>>(526.s+0x200) string >\0 \b, version %s 18016 18017# Linux boot sector thefts. 180180 belong 0xb8c0078e Linux 18019>0x1e6 belong 0x454c4b53 ELKS Kernel 18020>0x1e6 belong !0x454c4b53 style boot sector 18021 18022############################################################################ 18023# Linux S390 kernel image 18024# Created by: Jan Kaluza <jkaluza@redhat.com> 180258 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390 18026>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc 18027# 64bit 18028>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel 18029>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel 18030>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel 18031>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel 18032# 32bit 18033>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel 18034>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel 18035>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel 18036>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel 18037 18038# Linux ARM compressed kernel image 18039# From: Kevin Cernekee <cernekee@gmail.com> 18040# Update: Joerg Jenderek 1804136 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian) 18042# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin" 18043!:ext img/bin 1804436 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian) 18045 18046############################################################################ 18047# Linux 8086 executable 180480 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 18049>5 string . 18050>>4 string >\0 \b, libc version %s 18051 180520 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 18053>2 byte&0x01 !0 \b, unmapped zero page 18054>2 byte&0x20 0 \b, impure 18055>2 byte&0x20 !0 18056>>2 byte&0x10 !0 \b, A_EXEC 18057>2 byte&0x02 !0 \b, A_PAL 18058>2 byte&0x04 !0 \b, A_NSYM 18059>2 byte&0x08 !0 \b, A_STAND 18060>2 byte&0x40 !0 \b, A_PURE 18061>2 byte&0x80 !0 \b, A_TOVLY 18062>28 long !0 \b, not stripped 18063>37 string . 18064>>36 string >\0 \b, libc version %s 18065 18066# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 18067# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 18068# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 18069# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 18070 18071# SYSLINUX boot logo files (from 'ppmtolss16' sources) 18072# https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename: 18073# file extension .lss .16 180740 lelong =0x1413f33d SYSLINUX' LSS16 image data 18075# syslinux-4.05/mime/image/x-lss16.xml 18076!:mime image/x-lss16 18077>4 leshort x \b, width %d 18078>6 leshort x \b, height %d 18079 180800 string OOOM User-Mode-Linux's Copy-On-Write disk image 18081>4 belong x version %d 18082 18083# SE Linux policy database 18084# From: Mike Frysinger <vapier@gentoo.org> 180850 lelong 0xf97cff8c SE Linux policy 18086>16 lelong x v%d 18087>20 lelong 1 MLS 18088>24 lelong x %d symbols 18089>28 lelong x %d ocons 18090 18091# Linux Logical Volume Manager (LVM) 18092# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 18093# 18094# System ID, UUID and volume group name are 128 bytes long 18095# but they should never be full and initialized with zeros... 18096# 18097# LVM1 18098# 180990x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 18100>0x12c string >\0 , System ID: %s 18101 181020x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 18103>0x12c string >\0 , System ID: %s 18104 18105# LVM2 18106# 18107# It seems that the label header can be in one the four first sector 18108# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 18109# 18110# 0x200 seems to be the common case 18111 181120x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 18113# read the offset to add to the start of the header, and the header 18114# start in 0x200 18115>&(&-12.l-0x21) byte x 18116# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 18117>>&0x0 string >\x2f \b, UUID: %.6s 18118>>&0x6 string >\x2f \b-%.4s 18119>>&0xa string >\x2f \b-%.4s 18120>>&0xe string >\x2f \b-%.4s 18121>>&0x12 string >\x2f \b-%.4s 18122>>&0x16 string >\x2f \b-%.4s 18123>>&0x1a string >\x2f \b-%.6s 18124>>&0x20 lequad x \b, size: %lld 18125 181260x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 18127>&(&-12.l-0x21) byte x 18128# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 18129>>&0x0 string >\x2f \b, UUID: %.6s 18130>>&0x6 string >\x2f \b-%.4s 18131>>&0xa string >\x2f \b-%.4s 18132>>&0xe string >\x2f \b-%.4s 18133>>&0x12 string >\x2f \b-%.4s 18134>>&0x16 string >\x2f \b-%.4s 18135>>&0x1a string >\x2f \b-%.6s 18136>>&0x20 lequad x \b, size: %lld 18137 181380x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 18139>&(&-12.l-0x21) byte x 18140# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 18141>>&0x0 string >\x2f \b, UUID: %.6s 18142>>&0x6 string >\x2f \b-%.4s 18143>>&0xa string >\x2f \b-%.4s 18144>>&0xe string >\x2f \b-%.4s 18145>>&0x12 string >\x2f \b-%.4s 18146>>&0x16 string >\x2f \b-%.4s 18147>>&0x1a string >\x2f \b-%.6s 18148>>&0x20 lequad x \b, size: %lld 18149 181500x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager) 18151>&(&-12.l-0x21) byte x 18152# display UUID in LVM format + display all 32 bytes (instead of max string length: 31) 18153>>&0x0 string >\x2f \b, UUID: %.6s 18154>>&0x6 string >\x2f \b-%.4s 18155>>&0xa string >\x2f \b-%.4s 18156>>&0xe string >\x2f \b-%.4s 18157>>&0x12 string >\x2f \b-%.4s 18158>>&0x16 string >\x2f \b-%.4s 18159>>&0x1a string >\x2f \b-%.6s 18160>>&0x20 lequad x \b, size: %lld 18161 18162# LVM snapshot 18163# from Jason Farrel 181640 string SnAp LVM Snapshot (CopyOnWrite store) 18165>4 lelong !0 - valid, 18166>4 lelong 0 - invalid, 18167>8 lelong x version %d, 18168>12 lelong x chunk_size %d 18169 18170# SE Linux policy database 181710 lelong 0xf97cff8c SE Linux policy 18172>16 lelong x v%d 18173>20 lelong 1 MLS 18174>24 lelong x %d symbols 18175>28 lelong x %d ocons 18176 18177# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec 18178# Anthon van der Neut (anthon@mnt.org) 181790 string LUKS\xba\xbe LUKS encrypted file, 18180>6 beshort x ver %d 18181>8 string x [%s, 18182>40 string x %s, 18183>72 string x %s] 18184>168 string x UUID: %s 18185 18186 18187# Summary: Xen saved domain file 18188# Created by: Radek Vokal <rvokal@redhat.com> 181890 string LinuxGuestRecord Xen saved domain 18190>20 search/256 (name 18191>>&1 string x (name %s) 18192 18193# Type: Xen, the virtual machine monitor 18194# From: Radek Vokal <rvokal@redhat.com> 181950 string LinuxGuestRecord Xen saved domain 18196#>2 regex \(name\ [^)]*\) %s 18197>20 search/256 (name (name 18198>>&1 string x %s...) 18199 18200# Systemd journald files 18201# See https://www.freedesktop.org/wiki/Software/systemd/journal-files/. 18202# From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> 18203 18204# check magic 182050 string LPKSHHRH 18206# check that state is one of known values 18207>16 ubyte&252 0 18208# check that each half of three unique id128s is non-zero 18209>>24 ubequad >0 18210>>>32 ubequad >0 18211>>>>40 ubequad >0 18212>>>>>48 ubequad >0 18213>>>>>>56 ubequad >0 18214>>>>>>>64 ubequad >0 Journal file 18215!:mime application/octet-stream 18216# provide more info 18217>>>>>>>>184 leqdate 0 empty 18218>>>>>>>>16 ubyte 0 \b, offline 18219>>>>>>>>16 ubyte 1 \b, online 18220>>>>>>>>16 ubyte 2 \b, archived 18221>>>>>>>>8 ulelong&1 1 \b, sealed 18222>>>>>>>>12 ulelong&1 1 \b, compressed 18223 18224# BCache backing and cache devices 18225# From: Gabriel de Perthuis <g2p.code@gmail.com> 182260x1008 lequad 8 18227>0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache 18228>>0x1010 ulequad 0 cache device 18229>>0x1010 ulequad 1 backing device 18230>>0x1010 ulequad 3 cache device 18231>>0x1010 ulequad 4 backing device 18232>>0x1048 string >0 \b, label "%.32s" 18233>>0x1028 ubelong x \b, uuid %08x 18234>>0x102c ubeshort x \b-%04x 18235>>0x102e ubeshort x \b-%04x 18236>>0x1030 ubeshort x \b-%04x 18237>>0x1032 ubelong x \b-%08x 18238>>0x1036 ubeshort x \b%04x 18239>>0x1038 ubelong x \b, set uuid %08x 18240>>0x103c ubeshort x \b-%04x 18241>>0x103e ubeshort x \b-%04x 18242>>0x1040 ubeshort x \b-%04x 18243>>0x1042 ubelong x \b-%08x 18244>>0x1046 ubeshort x \b%04x 18245 18246# Linux device tree: 18247# File format description can be found in the Linux kernel sources at 18248# Documentation/devicetree/booting-without-of.txt 18249# From Christoph Biedl 182500 belong 0xd00dfeed 18251# structure and strings must be within blob 18252>&(8.L) byte x 18253>>&(12.L) byte x 18254>>>20 belong >1 Device Tree Blob version %d 18255>>>>4 belong x \b, size=%d 18256>>>>20 belong >1 18257>>>>>28 belong x \b, boot CPU=%d 18258>>>>20 belong >2 18259>>>>>32 belong x \b, string block size=%d 18260>>>>20 belong >16 18261>>>>>36 belong x \b, DT structure block size=%d 18262 18263# glibc locale archive as defined in glibc locale/locarchive.h 182640 lelong 0xde020109 locale archive 18265>24 lelong x %d strings 18266 18267# Linux Software RAID (mdadm) 18268# Russell Coker <russell@coker.com.au> 182690 name linuxraid 18270>16 belong x UUID=%8x: 18271>20 belong x \b%8x: 18272>24 belong x \b%8x: 18273>28 belong x \b%8x 18274>32 string x name=%s 18275>72 lelong x level=%d 18276>92 lelong x disks=%d 18277 182784096 lelong 0xa92b4efc Linux Software RAID 18279>4100 lelong x version 1.2 (%d) 18280>4096 use linuxraid 18281 182820 lelong 0xa92b4efc Linux Software RAID 18283>4 lelong x version 1.1 (%d) 18284>0 use linuxraid 18285 18286# Summary: Database file for mlocate 18287# Description: A database file as used by mlocate, a fast implementation 18288# of locate/updatedb. It uses merging to reuse the existing 18289# database and avoid rereading most of the filesystem. It's 18290# the default version of locate on Arch Linux (and others). 18291# File path: /var/lib/mlocate/mlocate.db by default (but configurable) 18292# Site: https://fedorahosted.org/mlocate/ 18293# Format docs: https://linux.die.net/man/5/mlocate.db 18294# Type: mlocate database file 18295# URL: https://fedorahosted.org/mlocate/ 18296# From: Wander Nauta <info@wandernauta.nl> 182970 string \0mlocate mlocate database 18298>12 byte x \b, version %d 18299>13 byte 1 \b, require visibility 18300>16 string x \b, root %s 18301 18302# Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL: 18303# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2 18304# From: Pavel Emelyanov <xemul@parallels.com> 183050 lelong 0x45311224 iproute2 routes dump 183060 lelong 0x47361222 iproute2 addresses dump 18307 18308# Image and service files for CRIU tool. 18309# URL: https://criu.org 18310# From: Pavel Emelyanov <xemul@parallels.com> 183110 lelong 0x54564319 CRIU image file v1.1 183120 lelong 0x55105940 CRIU service file 183130 lelong 0x58313116 CRIU inventory 18314 18315# Kdump compressed dump files 18316# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION 18317 183180 string KDUMP Kdump compressed dump 18319>8 long x v%d 18320>12 string >\0 \b, system %s 18321>77 string >\0 \b, node %s 18322>142 string >\0 \b, release %s 18323>207 string >\0 \b, version %s 18324>272 string >\0 \b, machine %s 18325>337 string >\0 \b, domain %s 18326 18327#------------------------------------------------------------------------------ 18328# $File: lisp,v 1.26 2019/04/19 00:42:27 christos Exp $ 18329# lisp: file(1) magic for lisp programs 18330# 18331# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 18332 18333# updated by Joerg Jenderek 18334# GRR: This lot is too weak 18335#0 string ;; 18336# windows INF files often begin with semicolon and use CRLF as line end 18337# lisp files are mainly created on unix system with LF as line end 18338#>2 search/4096 !\r Lisp/Scheme program text 18339#>2 search/4096 \r Windows INF file 18340 183410 search/4096 (setq\ Lisp/Scheme program text 18342!:mime text/x-lisp 183430 search/4096 (defvar\ Lisp/Scheme program text 18344!:mime text/x-lisp 183450 search/4096 (defparam\ Lisp/Scheme program text 18346!:mime text/x-lisp 183470 search/4096 (defun\ Lisp/Scheme program text 18348!:mime text/x-lisp 183490 search/4096 (autoload\ Lisp/Scheme program text 18350!:mime text/x-lisp 183510 search/4096 (custom-set-variables\ Lisp/Scheme program text 18352!:mime text/x-lisp 18353 18354# URL: https://en.wikipedia.org/wiki/Emacs_Lisp 18355# Reference: https://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz 18356# Update: Joerg Jenderek 18357# Emacs 18 - this is always correct, but not very magical. 183580 string \012( 18359# look for emacs lisp keywords 18360# GRR: split regex because it is too long or get error like 18361# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|' 18362>&0 regex \^(defun|defvar|defconst|defmacro|setq|fset) Emacs v18 byte-compiled Lisp data 18363!:mime application/x-elc 18364# https://searchcode.com/codesearch/view/2173420/ 18365# not really pure text 18366!:apple EMAxTEXT 18367!:ext elc 18368# remaining regex 18369>&0 regex \^(put|provide|require|random) Emacs v18 byte-compiled Lisp data 18370!:mime application/x-elc 18371!:apple EMAxTEXT 18372!:ext elc 18373# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;; 18374 18375# Emacs 19+ - ver. recognition added by Ian Springer 18376# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs 18377# - Chris Chittleborough <cchittleborough@yahoo.com.au> 18378# Update: Joerg Jenderek 183790 string ;ELC 18380# version\0\0\0 18381>4 byte >18 Emacs/XEmacs v%d byte-compiled Lisp data 18382# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015 18383#>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data 18384!:mime application/x-elc 18385!:apple EMAxTEXT 18386!:ext elc 18387 18388# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr> 183890 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program (pre 2004-03-27) 183900 string (|SYSTEM|::|VERSION|\040' CLISP byte-compiled Lisp program text 18391 183920 long 0x70768BD2 CLISP memory image data 183930 long 0xD28B7670 CLISP memory image data, other endian 18394 18395#.com and .bin for MIT scheme 183960 string \372\372\372\372 MIT scheme (library?) 18397 18398# From: David Allouche <david@allouche.net> 183990 search/1 \<TeXmacs| TeXmacs document text 18400!:mime text/texmacs 18401 18402#------------------------------------------------------------------------------ 18403# $File: llvm,v 1.9 2019/04/19 00:42:27 christos Exp $ 18404# llvm: file(1) magic for LLVM byte-codes 18405# URL: https://llvm.org/docs/BitCodeFormat.html 18406# From: Al Stone <ahs3@fc.hp.com> 18407 184080 string llvm LLVM byte-codes, uncompressed 184090 string llvc0 LLVM byte-codes, null compression 184100 string llvc1 LLVM byte-codes, gzip compression 184110 string llvc2 LLVM byte-codes, bzip2 compression 18412 184130 lelong 0x0b17c0de LLVM bitcode, wrapper 18414# Are these Mach-O ABI values? They appear to be. 18415>16 lelong 0x01000007 x86_64 18416>16 lelong 0x00000007 i386 18417>16 lelong 0x00000012 ppc 18418>16 lelong 0x01000012 ppc64 18419>16 lelong 0x0000000c arm 18420 184210 string BC\xc0\xde LLVM IR bitcode 18422 18423#------------------------------------------------------------------------------ 18424# $File: lua,v 1.7 2019/04/19 00:42:27 christos Exp $ 18425# lua: file(1) magic for Lua scripting language 18426# URL: https://www.lua.org/ 18427# From: Reuben Thomas <rrt@sc3d.org>, Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 18428 18429# Lua scripts 184300 search/1/w #!\ /usr/bin/lua Lua script text executable 18431!:mime text/x-lua 184320 search/1/w #!\ /usr/local/bin/lua Lua script text executable 18433!:mime text/x-lua 184340 search/1 #!/usr/bin/env\ lua Lua script text executable 18435!:mime text/x-lua 184360 search/1 #!\ /usr/bin/env\ lua Lua script text executable 18437!:mime text/x-lua 18438 18439# Lua bytecode 184400 string \033Lua Lua bytecode, 18441>4 byte 0x50 version 5.0 18442>4 byte 0x51 version 5.1 18443>4 byte 0x52 version 5.2 18444 18445#------------------------------------------------------------------------------ 18446# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $ 18447# luks: file(1) magic for Linux Unified Key Setup 18448# URL: http://luks.endorphin.org/spec 18449# From: Anthon van der Neut <anthon@mnt.org> 18450 184510 string LUKS\xba\xbe LUKS encrypted file, 18452>6 beshort x ver %d 18453>8 string x [%s, 18454>40 string x %s, 18455>72 string x %s] 18456>168 string x UUID: %s 18457#------------------------------------------------------------------------------ 18458# $File: m4,v 1.3 2019/02/27 16:46:23 christos Exp $ 18459# make: file(1) magic for M4 scripts 18460# 184610 search/8192 dnl 18462>0 regex \^dnl\ M4 macro processor script text 18463!:mime text/x-m4 184640 search/8192 AC_DEFUN 18465>0 regex \^AC_DEFUN\\(\\[ M4 macro processor script text 18466!:strength + 15 18467!:mime text/x-m4 18468 18469#------------------------------------------------------------ 18470# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $ 18471# Mach has two magic numbers, 0xcafebabe and 0xfeedface. 18472# Unfortunately the first, cafebabe, is shared with 18473# Java ByteCode, so they are both handled in the file "cafebabe". 18474# The "feedface" ones are handled herein. 18475#------------------------------------------------------------ 18476# if set, it's for the 64-bit version of the architecture 18477# yes, this is separate from the low-order magic number bit 18478# it's also separate from the "64-bit libraries" bit in the 18479# upper 8 bits of the CPU subtype 18480 184810 name mach-o-cpu 18482>0 belong&0x01000000 0 18483# 18484# 32-bit ABIs. 18485# 18486# 1 vax 18487>>0 belong&0x00ffffff 1 18488>>>4 belong&0x00ffffff 0 vax 18489>>>4 belong&0x00ffffff 1 vax11/780 18490>>>4 belong&0x00ffffff 2 vax11/785 18491>>>4 belong&0x00ffffff 3 vax11/750 18492>>>4 belong&0x00ffffff 4 vax11/730 18493>>>4 belong&0x00ffffff 5 uvaxI 18494>>>4 belong&0x00ffffff 6 uvaxII 18495>>>4 belong&0x00ffffff 7 vax8200 18496>>>4 belong&0x00ffffff 8 vax8500 18497>>>4 belong&0x00ffffff 9 vax8600 18498>>>4 belong&0x00ffffff 10 vax8650 18499>>>4 belong&0x00ffffff 11 vax8800 18500>>>4 belong&0x00ffffff 12 uvaxIII 18501>>>4 belong&0x00ffffff >12 vax subarchitecture=%d 18502>>0 belong&0x00ffffff 2 romp 18503>>0 belong&0x00ffffff 3 architecture=3 18504>>0 belong&0x00ffffff 4 ns32032 18505>>0 belong&0x00ffffff 5 ns32332 18506>>0 belong&0x00ffffff 6 m68k 18507# 7 x86 18508>>0 belong&0x00ffffff 7 18509>>>4 belong&0x0000000f 3 i386 18510>>>4 belong&0x0000000f 4 i486 18511>>>>4 belong&0x00fffff0 0 18512>>>>4 belong&0x00fffff0 0x80 \bsx 18513>>>4 belong&0x0000000f 5 i586 18514>>>4 belong&0x0000000f 6 18515>>>>4 belong&0x00fffff0 0 p6 18516>>>>4 belong&0x00fffff0 0x10 pentium_pro 18517>>>>4 belong&0x00fffff0 0x20 pentium_2_m0x20 18518>>>>4 belong&0x00fffff0 0x30 pentium_2_m3 18519>>>>4 belong&0x00fffff0 0x40 pentium_2_m0x40 18520>>>>4 belong&0x00fffff0 0x50 pentium_2_m5 18521>>>>4 belong&0x00fffff0 >0x50 pentium_2_m0x%x 18522>>>4 belong&0x0000000f 7 celeron 18523>>>>4 belong&0x00fffff0 0x00 \b_m0x%x 18524>>>>4 belong&0x00fffff0 0x10 \b_m0x%x 18525>>>>4 belong&0x00fffff0 0x20 \b_m0x%x 18526>>>>4 belong&0x00fffff0 0x30 \b_m0x%x 18527>>>>4 belong&0x00fffff0 0x40 \b_m0x%x 18528>>>>4 belong&0x00fffff0 0x50 \b_m0x%x 18529>>>>4 belong&0x00fffff0 0x60 18530>>>>4 belong&0x00fffff0 0x70 \b_mobile 18531>>>>4 belong&0x00fffff0 >0x70 \b_m0x%x 18532>>>4 belong&0x0000000f 8 pentium_3 18533>>>>4 belong&0x00fffff0 0x00 18534>>>>4 belong&0x00fffff0 0x10 \b_m 18535>>>>4 belong&0x00fffff0 0x20 \b_xeon 18536>>>>4 belong&0x00fffff0 >0x20 \b_m0x%x 18537>>>4 belong&0x0000000f 9 pentiumM 18538>>>>4 belong&0x00fffff0 0x00 18539>>>>4 belong&0x00fffff0 >0x00 \b_m0x%x 18540>>>4 belong&0x0000000f 10 pentium_4 18541>>>>4 belong&0x00fffff0 0x00 18542>>>>4 belong&0x00fffff0 0x10 \b_m 18543>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 18544>>>4 belong&0x0000000f 11 itanium 18545>>>>4 belong&0x00fffff0 0x00 18546>>>>4 belong&0x00fffff0 0x10 \b_2 18547>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 18548>>>4 belong&0x0000000f 12 xeon 18549>>>>4 belong&0x00fffff0 0x00 18550>>>>4 belong&0x00fffff0 0x10 \b_mp 18551>>>>4 belong&0x00fffff0 >0x10 \b_m0x%x 18552>>>4 belong&0x0000000f >12 ia32 family=%d 18553>>>>4 belong&0x00fffff0 0x00 18554>>>>4 belong&0x00fffff0 >0x00 model=%x 18555>>0 belong&0x00ffffff 8 mips 18556>>>4 belong&0x00ffffff 1 R2300 18557>>>4 belong&0x00ffffff 2 R2600 18558>>>4 belong&0x00ffffff 3 R2800 18559>>>4 belong&0x00ffffff 4 R2000a 18560>>>4 belong&0x00ffffff 5 R2000 18561>>>4 belong&0x00ffffff 6 R3000a 18562>>>4 belong&0x00ffffff 7 R3000 18563>>>4 belong&0x00ffffff >7 subarchitecture=%d 18564>>0 belong&0x00ffffff 9 ns32532 18565>>0 belong&0x00ffffff 10 mc98000 18566>>0 belong&0x00ffffff 11 hppa 18567>>>4 belong&0x00ffffff 0 7100 18568>>>4 belong&0x00ffffff 1 7100LC 18569>>>4 belong&0x00ffffff >1 subarchitecture=%d 18570>>0 belong&0x00ffffff 12 arm 18571>>>4 belong&0x00ffffff 0 18572>>>4 belong&0x00ffffff 1 subarchitecture=%d 18573>>>4 belong&0x00ffffff 2 subarchitecture=%d 18574>>>4 belong&0x00ffffff 3 subarchitecture=%d 18575>>>4 belong&0x00ffffff 4 subarchitecture=%d 18576>>>4 belong&0x00ffffff 5 \bv4t 18577>>>4 belong&0x00ffffff 6 \bv6 18578>>>4 belong&0x00ffffff 7 \bv5tej 18579>>>4 belong&0x00ffffff 8 \bxscale 18580>>>4 belong&0x00ffffff 9 \bv7 18581>>>4 belong&0x00ffffff 10 \bv7f 18582>>>4 belong&0x00ffffff 11 \bv7s 18583>>>4 belong&0x00ffffff 12 \bv7k 18584>>>4 belong&0x00ffffff 13 \bv8 18585>>>4 belong&0x00ffffff 14 \bv6m 18586>>>4 belong&0x00ffffff 15 \bv7m 18587>>>4 belong&0x00ffffff 16 \bv7em 18588>>>4 belong&0x00ffffff >16 subarchitecture=%d 18589# 13 m88k 18590>>0 belong&0x00ffffff 13 18591>>>4 belong&0x00ffffff 0 mc88000 18592>>>4 belong&0x00ffffff 1 mc88100 18593>>>4 belong&0x00ffffff 2 mc88110 18594>>>4 belong&0x00ffffff >2 mc88000 subarchitecture=%d 18595>>0 belong&0x00ffffff 14 SPARC 18596>>0 belong&0x00ffffff 15 i860g 18597>>0 belong&0x00ffffff 16 alpha 18598>>0 belong&0x00ffffff 17 rs6000 18599>>0 belong&0x00ffffff 18 ppc 18600>>>4 belong&0x00ffffff 0 18601>>>4 belong&0x00ffffff 1 \b_601 18602>>>4 belong&0x00ffffff 2 \b_602 18603>>>4 belong&0x00ffffff 3 \b_603 18604>>>4 belong&0x00ffffff 4 \b_603e 18605>>>4 belong&0x00ffffff 5 \b_603ev 18606>>>4 belong&0x00ffffff 6 \b_604 18607>>>4 belong&0x00ffffff 7 \b_604e 18608>>>4 belong&0x00ffffff 8 \b_620 18609>>>4 belong&0x00ffffff 9 \b_650 18610>>>4 belong&0x00ffffff 10 \b_7400 18611>>>4 belong&0x00ffffff 11 \b_7450 18612>>>4 belong&0x00ffffff 100 \b_970 18613>>>4 belong&0x00ffffff >100 subarchitecture=%d 18614>>0 belong&0x00ffffff >18 architecture=%d 18615>0 belong&0x01000000 0x01000000 18616# 18617# 64-bit ABIs. 18618# 18619>>0 belong&0x00ffffff 0 64-bit architecture=%d 18620>>0 belong&0x00ffffff 1 64-bit architecture=%d 18621>>0 belong&0x00ffffff 2 64-bit architecture=%d 18622>>0 belong&0x00ffffff 3 64-bit architecture=%d 18623>>0 belong&0x00ffffff 4 64-bit architecture=%d 18624>>0 belong&0x00ffffff 5 64-bit architecture=%d 18625>>0 belong&0x00ffffff 6 64-bit architecture=%d 18626>>0 belong&0x00ffffff 7 x86_64 18627>>>4 belong&0x00ffffff 0 subarchitecture=%d 18628>>>4 belong&0x00ffffff 1 subarchitecture=%d 18629>>>4 belong&0x00ffffff 2 subarchitecture=%d 18630>>>4 belong&0x00ffffff 3 18631>>>4 belong&0x00ffffff 4 \b_arch1 18632>>>4 belong&0x00ffffff 8 \b_haswell 18633>>>4 belong&0x00ffffff >4 subarchitecture=%d 18634>>0 belong&0x00ffffff 8 64-bit architecture=%d 18635>>0 belong&0x00ffffff 9 64-bit architecture=%d 18636>>0 belong&0x00ffffff 10 64-bit architecture=%d 18637>>0 belong&0x00ffffff 11 64-bit architecture=%d 18638>>0 belong&0x00ffffff 12 arm64 18639>>>4 belong&0x00ffffff 0 18640>>>4 belong&0x00ffffff 1 \bv8 18641>>0 belong&0x00ffffff 13 64-bit architecture=%d 18642>>0 belong&0x00ffffff 14 64-bit architecture=%d 18643>>0 belong&0x00ffffff 15 64-bit architecture=%d 18644>>0 belong&0x00ffffff 16 64-bit architecture=%d 18645>>0 belong&0x00ffffff 17 64-bit architecture=%d 18646>>0 belong&0x00ffffff 18 ppc64 18647>>>4 belong&0x00ffffff 0 18648>>>4 belong&0x00ffffff 1 \b_601 18649>>>4 belong&0x00ffffff 2 \b_602 18650>>>4 belong&0x00ffffff 3 \b_603 18651>>>4 belong&0x00ffffff 4 \b_603e 18652>>>4 belong&0x00ffffff 5 \b_603ev 18653>>>4 belong&0x00ffffff 6 \b_604 18654>>>4 belong&0x00ffffff 7 \b_604e 18655>>>4 belong&0x00ffffff 8 \b_620 18656>>>4 belong&0x00ffffff 9 \b_650 18657>>>4 belong&0x00ffffff 10 \b_7400 18658>>>4 belong&0x00ffffff 11 \b_7450 18659>>>4 belong&0x00ffffff 100 \b_970 18660>>>4 belong&0x00ffffff >100 subarchitecture=%d 18661>>0 belong&0x00ffffff >18 64-bit architecture=%d 18662 18663 186640 name mach-o-be 18665>0 byte 0xcf 64-bit 18666>4 use mach-o-cpu 18667>12 belong 1 object 18668>12 belong 2 executable 18669>12 belong 3 fixed virtual memory shared library 18670>12 belong 4 core 18671>12 belong 5 preload executable 18672>12 belong 6 dynamically linked shared library 18673>12 belong 7 dynamic linker 18674>12 belong 8 bundle 18675>12 belong 9 dynamically linked shared library stub 18676>12 belong 10 dSYM companion file 18677>12 belong 11 kext bundle 18678>12 belong >11 18679>>12 belong x filetype=%d 18680>24 belong >0 \b, flags:< 18681>>24 belong &0x0000001 \bNOUNDEFS 18682>>24 belong &0x0000002 \b|INCRLINK 18683>>24 belong &0x0000004 \b|DYLDLINK 18684>>24 belong &0x0000008 \b|BINDATLOAD 18685>>24 belong &0x0000010 \b|PREBOUND 18686>>24 belong &0x0000020 \b|SPLIT_SEGS 18687>>24 belong &0x0000040 \b|LAZY_INIT 18688>>24 belong &0x0000080 \b|TWOLEVEL 18689>>24 belong &0x0000100 \b|FORCE_FLAT 18690>>24 belong &0x0000200 \b|NOMULTIDEFS 18691>>24 belong &0x0000400 \b|NOFIXPREBINDING 18692>>24 belong &0x0000800 \b|PREBINDABLE 18693>>24 belong &0x0001000 \b|ALLMODSBOUND 18694>>24 belong &0x0002000 \b|SUBSECTIONS_VIA_SYMBOLS 18695>>24 belong &0x0004000 \b|CANONICAL 18696>>24 belong &0x0008000 \b|WEAK_DEFINES 18697>>24 belong &0x0010000 \b|BINDS_TO_WEAK 18698>>24 belong &0x0020000 \b|ALLOW_STACK_EXECUTION 18699>>24 belong &0x0040000 \b|ROOT_SAFE 18700>>24 belong &0x0080000 \b|SETUID_SAFE 18701>>24 belong &0x0100000 \b|NO_REEXPORTED_DYLIBS 18702>>24 belong &0x0200000 \b|PIE 18703>>24 belong &0x0400000 \b|DEAD_STRIPPABLE_DYLIB 18704>>24 belong &0x0800000 \b|HAS_TLV_DESCRIPTORS 18705>>24 belong &0x1000000 \b|NO_HEAP_EXECUTION 18706>>24 belong &0x2000000 \b|APP_EXTENSION_SAFE 18707>>24 belong x \b> 18708 18709# 187100 lelong&0xfffffffe 0xfeedface Mach-O 18711!:strength +1 18712!:mime application/x-mach-binary 18713>0 use \^mach-o-be 18714 187150 belong&0xfffffffe 0xfeedface Mach-O 18716!:strength +1 18717!:mime application/x-mach-binary 18718>0 use mach-o-be 18719 18720#------------------------------------------------------------------------------ 18721# $File: macintosh,v 1.29 2019/04/19 00:42:27 christos Exp $ 18722# macintosh description 18723# 18724# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 18725# Daniel Quinlan, quinlan@yggdrasil.com 1872611 string must\ be\ converted\ with\ BinHex BinHex binary text 18727!:mime application/mac-binhex40 18728>41 string x \b, version %.3s 18729 18730# Stuffit archives are the de facto standard of compression for Macintosh 18731# files obtained from most archives. (franklsm@tuns.ca) 187320 string SIT! StuffIt Archive (data) 18733!:mime application/x-stuffit 18734!:apple SIT!SIT! 18735>2 string x : %s 187360 string SITD StuffIt Deluxe (data) 18737>2 string x : %s 187380 string Seg StuffIt Deluxe Segment (data) 18739>2 string x : %s 18740 18741# Newer StuffIt archives (grant@netbsd.org) 187420 string StuffIt StuffIt Archive 18743!:mime application/x-stuffit 18744!:apple SIT!SIT! 18745#>162 string >0 : %s 18746 18747# Macintosh Applications and Installation binaries (franklsm@tuns.ca) 18748# GRR: Too weak 18749#0 string APPL Macintosh Application (data) 18750#>2 string x \b: %s 18751 18752# Macintosh System files (franklsm@tuns.ca) 18753# GRR: Too weak 18754#0 string zsys Macintosh System File (data) 18755#0 string FNDR Macintosh Finder (data) 18756#0 string libr Macintosh Library (data) 18757#>2 string x : %s 18758#0 string shlb Macintosh Shared Library (data) 18759#>2 string x : %s 18760#0 string cdev Macintosh Control Panel (data) 18761#>2 string x : %s 18762#0 string INIT Macintosh Extension (data) 18763#>2 string x : %s 18764#0 string FFIL Macintosh Truetype Font (data) 18765#>2 string x : %s 18766#0 string LWFN Macintosh Postscript Font (data) 18767#>2 string x : %s 18768 18769# Additional Macintosh Files (franklsm@tuns.ca) 18770# GRR: Too weak 18771#0 string PACT Macintosh Compact Pro Archive (data) 18772#>2 string x : %s 18773#0 string ttro Macintosh TeachText File (data) 18774#>2 string x : %s 18775#0 string TEXT Macintosh TeachText File (data) 18776#>2 string x : %s 18777#0 string PDF Macintosh PDF File (data) 18778#>2 string x : %s 18779 18780# MacBinary format (Eric Fischer, enf@pobox.com) 18781# Update: Joerg Jenderek 18782# URL: https://en.wikipedia.org/wiki/MacBinary 18783# Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt 18784# 18785# Unfortunately MacBinary doesn't really have a magic number prior 18786# to the MacBinary III format. 18787# 18788 18789# old version number, must be kept at zero for compatibility 187900 byte 0 18791# length of filename (must be in the range 1-63) 18792>1 ubyte >0 18793# skip T.PIC.LZ INSTRUMENT.7T INVENTORY 18794>>1 ubyte <64 18795# skip Docs.MWII ReadMe.MacWrite "Notes (MacWrite II)" 18796# by looking for printable characters at beginning of file name 18797>>>2 ubelong >0x1F000000 18798# zero fill, must be zero for compatibility 18799>>>>74 byte 0 18800# zero fill, must be zero for compatibility 18801>>>>>82 byte 0 18802# MacBinary I test for valid version numbers 18803>>>>>>122 ubeshort 0 18804# additional check for creation date after 1 Jan 1970 ~ 7C25B080h 18805#>>>>>>>91 ubelong >0x7c25b07F 18806# additional check for undefined header fields in MacBinary I 18807#>>>>>>>101 ulong 0 18808>>>>>>>0 use mac-bin 18809# MacBinary II the newer versions begins at 129 18810>>>>>>122 ubeshort 0x8181 18811>>>>>>>0 use mac-bin 18812# MacBinary III with MacBinary II to read 18813>>>>>122 ubeshort 0x8281 18814>>>>>>0 use mac-bin 18815 18816# display information of MacBinary file 188170 name mac-bin 18818>122 ubyte x MacBinary 18819# versions for MacBinary II/III 18820>122 ubyte 129 II 18821>122 ubyte 130 III 18822# only in MacBinary III 18823>>102 string !mBIN with surprising version 18824!:mime application/x-macbinary 18825!:apple PSPTBINA 18826!:ext bin/macbin 18827# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary 18828#>1 ubyte >63 \b, name length %u too BIG! 18829#>122 ubeshort x \b, version 0x%x 18830# Finder flags if not 0 18831# >73 byte !0 \b, flags 0x 18832# >73 byte =0 18833# >>101 byte !0 \b, flags 0x 18834# # original Finder flags (Bits 8-15) 18835# >73 byte !0 \b%x 18836# # finder flags, bits 0-7 18837# >101 byte !0 \b%x 18838>73 byte &0x01 \b, inited 18839>73 byte &0x02 \b, changed 18840>73 byte &0x04 \b, busy 18841>73 byte &0x08 \b, bozo 18842>73 byte &0x10 \b, system 18843>73 byte &0x20 \b, bundle 18844>73 byte &0x40 \b, invisible 18845>73 byte &0x80 \b, locked 18846 18847# 75 beshort # vertical posn in window 18848#>75 beshort !0 \b, v.pos %u 18849# 77 beshort # horiz posn in window 18850#>77 beshort !0 \b, h.pos %u 18851# 79 beshort # window or folder ID 18852>79 ubeshort !0 \b, ID 0x%x 18853# protected flag 18854>81 byte !0 \b, protected 0x%x 18855# length of comment after resource 18856>99 ubeshort !0 \b, comment length %u 18857# char. code of file name 18858>106 ubyte !0 \b, char. code 0x%x 18859# still more Finder flags 18860>107 ubyte !0 \b, more flags 0x%x 18861# length of total files when unpacked only used when pack and unpack on the fly 18862>116 ubelong !0 \b, total length %u 18863# 120 beshort # length of add'l header 18864>120 ubeshort !0 \b, 2nd header length %u 18865# 124 beshort # checksum 18866#>124 ubeshort !0 \b, CRC 0x%x 18867# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080 18868>91 beldate-0x7C25B080 x \b, %s 18869# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow 18870>91 ubelong <0x7c25b080 INVALID date 18871#>91 belong-0x7C25B080 x \b, DEBUG DATE %d 18872# last modified date 18873>95 beldate-0x7C25B080 x \b, modified %s 18874# Apple creator+typ if not null 18875# file creator (normally expressed as four characters) 18876>69 ulong !0 \b, creator 18877# instead 4 character code display full creator name 18878>>69 use apple-creator 18879# file type (normally expressed as four characters) 18880>65 ulong !0 \b, type 18881>>65 use apple-type 18882# length of data segment 18883>83 ubelong !0 \b, %u bytes 18884# filename (in the range 1-63) 18885>1 pstring x "%s" 18886# print 1 space and then at offset 128 inspect data fork content if it has one 18887>83 ubelong !0 \b 18888>>128 indirect x 18889# Afterwards resource fork if length of resource segment not zero 18890>87 ubelong !0 18891# calculate resource fork offset 18892>>83 ubelong+128 x \b, at 0x%x 18893# length of resource segment 18894>>87 ubelong !0 %u bytes 18895>>(83.S+128) ubequad x resource 18896# further resource fork content inspection 18897>>>&-8 indirect x 18898 18899# Apple Type/Creator Database 18900# URL: https://en.wikipedia.org/wiki/Type_code 18901# Reference: https://www.lacikam.co.il/tcdb/ 18902# https://www.macdisk.com/macsigen.php 18903# Note: classic Mac OS files have two 4 character codes for type and creator. 18904# Thereby the Finder attach documents types to applications. 18905 18906#>65 string x \b, type "%4.4s" 18907 18908# display information about apple type 189090 name apple-type 18910>0 string 8BIM PhotoShop 18911>0 string ALB3 PageMaker 3 18912>0 string ALB4 PageMaker 4 18913>0 string ALT3 PageMaker 3 18914>0 string APPL application 18915>0 string AWWP AppleWorks word processor 18916>0 string CIRC simulated circuit 18917>0 string DRWG MacDraw 18918>0 string EPSF Encapsulated PostScript 18919>0 string FFIL font suitcase 18920>0 string FKEY function key 18921>0 string FNDR Macintosh Finder 18922>0 string GIFf GIF image 18923>0 string Gzip GNU gzip 18924>0 string INIT system extension 18925>0 string LIB\ library 18926>0 string LWFN PostScript font 18927>0 string MSBC Microsoft BASIC 18928>0 string PACT Compact Pro archive 18929>0 string PDF\ Portable Document Format 18930>0 string PICT picture 18931>0 string PNTG MacPaint picture 18932>0 string PREF preferences 18933>0 string PROJ Think C project 18934>0 string QPRJ Think Pascal project 18935>0 string SCFL Defender scores 18936>0 string SCRN startup screen 18937>0 string SITD StuffIt Deluxe 18938>0 string SPn3 SuperPaint 18939>0 string STAK HyperCard stack 18940>0 string Seg\ StuffIt segment 18941>0 string TARF Unix tar archive 18942>0 string TEXT ASCII 18943>0 string TIFF TIFF image 18944>0 string TOVF Eudora table of contents 18945>0 string WDBN Microsoft Word word processor 18946>0 string WORD MacWrite word processor 18947>0 string XLS\ Microsoft Excel 18948>0 string ZIVM compress (.Z) 18949>0 string ZSYS Pre-System 7 system file 18950>0 string acf3 Aldus FreeHand 18951>0 string cdev control panel 18952>0 string dfil Desk Accessory suitcase 18953>0 string libr library 18954>0 string nX^d WriteNow word processor 18955>0 string nX^w WriteNow dictionary 18956>0 string rsrc resource 18957>0 string scbk Scrapbook 18958>0 string shlb shared library 18959>0 string ttro SimpleText read-only 18960>0 string zsys system file 18961 18962# additional types added in Dec 2017 18963>0 string BINA binary file 18964>0 string BMPp BMP image 18965>0 string JPEG JPEG image 18966#>0 string W4BN Microsoft Word x.y word processor? 18967# if type name is not known display 4 character identifier 18968>0 default x 18969>>0 string x '%4.4s' 18970 18971#>69 string x \b, creator "%4.4s" 18972 18973# Now Apple has no repository of registered Creator IDs any more. These are 18974# just the ones that I happened to have files from and was able to identify. 18975 18976# display information about apple creator 189770 name apple-creator 18978>0 string 8BIM Adobe Photoshop 18979>0 string ALD3 PageMaker 3 18980>0 string ALD4 PageMaker 4 18981>0 string ALFA Alpha editor 18982>0 string APLS Apple Scanner 18983>0 string APSC Apple Scanner 18984>0 string BRKL Brickles 18985>0 string BTFT BitFont 18986>0 string CCL2 Common Lisp 2 18987>0 string CCL\ Common Lisp 18988>0 string CDmo The Talking Moose 18989>0 string CPCT Compact Pro 18990>0 string CSOm Eudora 18991>0 string DMOV Font/DA Mover 18992>0 string DSIM DigSim 18993>0 string EDIT Macintosh Edit 18994>0 string ERIK Macintosh Finder 18995>0 string EXTR self-extracting archive 18996>0 string Gzip GNU gzip 18997>0 string KAHL Think C 18998>0 string LWFU LaserWriter Utility 18999>0 string LZIV compress 19000>0 string MACA MacWrite 19001>0 string MACS Macintosh operating system 19002>0 string MAcK MacKnowledge terminal emulator 19003>0 string MLND Defender 19004>0 string MPNT MacPaint 19005>0 string MSBB Microsoft BASIC (binary) 19006>0 string MSWD Microsoft Word 19007>0 string NCSA NCSA Telnet 19008>0 string PJMM Think Pascal 19009>0 string PSAL Hunt the Wumpus 19010#>0 string PSI2 Apple File Exchange 19011>0 string R*ch BBEdit 19012>0 string RMKR Resource Maker 19013>0 string RSED Resource Editor 19014>0 string Rich BBEdit 19015>0 string SIT! StuffIt 19016>0 string SPNT SuperPaint 19017>0 string Unix NeXT Mac filesystem 19018>0 string VIM! Vim editor 19019>0 string WILD HyperCard 19020>0 string XCEL Microsoft Excel 19021>0 string aCa2 Fontographer 19022>0 string aca3 Aldus FreeHand 19023>0 string dosa Macintosh MS-DOS file system 19024>0 string movr Font/DA Mover 19025>0 string nX^n WriteNow 19026>0 string pdos Apple ProDOS file system 19027>0 string scbk Scrapbook 19028>0 string ttxt SimpleText 19029>0 string ufox Foreign File Access 19030# additional creators added in Dec 2017 19031# Claris/Apple Works 19032>0 string BOBO Apple Works 19033# CU-SeeMe_0.87b3_(68K).bin 19034#>0 string CUce bar 19035>0 string PSPT Apple File Exchange 19036# Disk_Copy_4.2.sea.bin 19037#>0 string NCse foo 19038# probably StuffIt/Aladdin by Smith Micro Software, Inc. 19039>0 string STi0 stuffit 19040# MacGzip-1.1.3.sea.bin 19041#>0 string aust bar 19042# D-Disk_Copy_6.3.3.smi.bin 19043>0 string oneb Disk Copy Self Mounting 19044# if creator name is not known display 4 character identifier 19045>0 default x 19046>>0 string x '%4.4s' 19047 19048# sas magic from Bruce Foster (bef@nwu.edu) 19049# 19050#0 string SAS SAS 19051#>8 string x %s 190520 string SAS SAS 19053>24 string DATA data file 19054>24 string CATALOG catalog 19055>24 string INDEX data file index 19056>24 string VIEW data view 19057# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) 19058# 190590x54 string SAS SAS 7+ 19060>0x9C string DATA data file 19061>0x9C string CATALOG catalog 19062>0x9C string INDEX data file index 19063>0x9C string VIEW data view 19064 19065# spss magic for SPSS system and portable files, 19066# from Bruce Foster (bef@nwu.edu). 19067 190680 long 0xc1e2c3c9 SPSS Portable File 19069>40 string x %s 19070 190710 string $FL2 SPSS System File 19072>24 string x %s 19073 190740 string $FL3 SPSS System File 19075>24 string x %s 19076 19077# Macintosh filesystem data 19078# From "Tom N Harris" <telliamed@mac.com> 19079# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> 19080# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these 19081# entries depend on the data arithmetic added after v.35 19082# There's also some Pascal strings in here, ditto... 19083 19084# The boot block signature, according to IM:Files, is 19085# "for HFS volumes, this field always contains the value 0x4C4B." 19086# But if this is true for MFS or HFS+ volumes, I don't know. 19087# Alternatively, the boot block is supposed to be zeroed if it's 19088# unused, so a simply >0 should suffice. 19089 190900x400 beshort 0xD2D7 Macintosh MFS data 19091>0 beshort 0x4C4B (bootable) 19092>0x40a beshort &0x8000 (locked) 19093>0x402 beldate-0x7C25B080 x created: %s, 19094>0x406 beldate-0x7C25B080 >0 last backup: %s, 19095>0x414 belong x block size: %d, 19096>0x412 beshort x number of blocks: %d, 19097>0x424 pstring x volume name: %s 19098 19099# *.hfs updated by Joerg Jenderek 19100# https://en.wikipedia.org/wiki/Hierarchical_File_System 19101# "BD" gives many false positives 191020x400 beshort 0x4244 19103# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h 19104# first block of volume bit map (always 3) 19105>0x40e ubeshort 0x0003 19106# maximal length of volume name is 27 19107>>0x424 ubyte <28 Macintosh HFS data 19108!:mime application/x-apple-diskimage 19109#!:apple hfsdINIT 19110#!:apple MACSdisk 19111# https://www.macdisk.com/macsigen.php 19112#!:apple ddskdevi 19113!:apple ????devi 19114# https://en.wikipedia.org/wiki/Apple_Disk_Image 19115!:ext hfs/dmg 19116>>>0 beshort 0x4C4B (bootable) 19117#>>>0 beshort 0x0000 (not bootable) 19118>>>0x40a beshort &0x8000 (locked) 19119>>>0x40a beshort ^0x0100 (mounted) 19120>>>0x40a beshort &0x0200 (spared blocks) 19121>>>0x40a beshort &0x0800 (unclean) 19122>>>0x47C beshort 0x482B (Embedded HFS+ Volume) 19123# https://www.epochconverter.com/ 19124# 0x7C245F00 seconds ~ 2082758400 ~ 01 Jan 2036 00:00:00 ~ 66 years to 1970 19125# 0x7C25B080 seconds ~ 2082844800 ~ 02 Jan 2036 00:00:00 19126# construct not working 19127#>>>0x402 beldate-0x7C25B080 x created: %s, 19128#>>>0x406 beldate-0x7C25B080 x last modified: %s, 19129#>>>0x440 beldate-0x7C25B080 >0 last backup: %s, 19130# found block sizes 200h,1200h,2800h 19131>>>0x414 belong x block size: %d, 19132>>>0x412 beshort x number of blocks: %d, 19133>>>0x424 pstring x volume name: %s 19134 191350x400 beshort 0x482B Macintosh HFS Extended 19136>&0 beshort x version %d data 19137>0 beshort 0x4C4B (bootable) 19138>0x404 belong ^0x00000100 (mounted) 19139>&2 belong &0x00000200 (spared blocks) 19140>&2 belong &0x00000800 (unclean) 19141>&2 belong &0x00008000 (locked) 19142>&6 string x last mounted by: '%.4s', 19143# really, that should be treated as a belong and we print a string 19144# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" 19145>&14 beldate-0x7C25B080 x created: %s, 19146# only the creation date is local time, all other timestamps in HFS+ are UTC. 19147>&18 bedate-0x7C25B080 x last modified: %s, 19148>&22 bedate-0x7C25B080 >0 last backup: %s, 19149>&26 bedate-0x7C25B080 >0 last checked: %s, 19150>&38 belong x block size: %d, 19151>&42 belong x number of blocks: %d, 19152>&46 belong x free blocks: %d 19153 19154## AFAIK, only the signature is different 19155# same as Apple Partition Map 19156# GRR: This magic is too weak, it is just "TS" 19157#0x200 beshort 0x5453 Apple Old Partition data 19158#>0x2 beshort x block size: %d, 19159#>0x230 string x first type: %s, 19160#>0x210 string x name: %s, 19161#>0x254 belong x number of blocks: %d, 19162#>0x400 beshort 0x504D 19163#>>0x430 string x second type: %s, 19164#>>0x410 string x name: %s, 19165#>>0x454 belong x number of blocks: %d, 19166#>>0x800 beshort 0x504D 19167#>>>0x830 string x third type: %s, 19168#>>>0x810 string x name: %s, 19169#>>>0x854 belong x number of blocks: %d, 19170#>>>0xa00 beshort 0x504D 19171#>>>>0xa30 string x fourth type: %s, 19172#>>>>0xa10 string x name: %s, 19173#>>>>0xa54 belong x number of blocks: %d 19174 19175# From: Remi Mommsen <mommsen@slac.stanford.edu> 191760 string BOMStore Mac OS X bill of materials (BOM) file 19177 19178# From: Adam Buchbinder <adam.buchbinder@gmail.com> 19179# URL: https://en.wikipedia.org/wiki/Datafork_TrueType 19180# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is 19181# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I 19182# don't know what they mean. 191830 belong 0x100 19184>(0x4.L+24) beshort x 19185>>&4 belong 0x73666e74 Mac OSX datafork font, TrueType 19186>>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT' 19187>>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT' 19188>>&4 belong 0x504f5354 Mac OSX datafork font, PostScript 19189 19190#------------------------------------------------------------------------------ 19191# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $ 19192# MacOS files 19193# 19194 191950 string book\0\0\0\0mark\0\0\0\0 MacOS Alias file 19196 19197#------------------------------------------------------------------------------ 19198# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $ 19199# magic: file(1) magic for magic files 19200# 192010 string/t #\ Magic magic text file for file(1) cmd 192020 lelong 0xF11E041C magic binary file for file(1) cmd 19203>4 lelong x (version %d) (little endian) 192040 belong 0xF11E041C magic binary file for file(1) cmd 19205>4 belong x (version %d) (big endian) 19206#------------------------------------------------------------------------------ 19207# $File: mail.news,v 1.24 2019/04/19 00:42:27 christos Exp $ 19208# mail.news: file(1) magic for mail and news 19209# 19210# Unfortunately, saved netnews also has From line added in some news software. 19211#0 string From mail text 192120 string/t Relay-Version: old news text 19213!:mime message/rfc822 192140 string/t #!\ rnews batched news text 19215!:mime message/rfc822 192160 string/t N#!\ rnews mailed, batched news text 19217!:mime message/rfc822 192180 string/t Forward\ to mail forwarding text 19219!:mime message/rfc822 192200 string/t Pipe\ to mail piping text 19221!:mime message/rfc822 192220 string/tc delivered-to: SMTP mail text 19223!:mime message/rfc822 192240 string/tc return-path: SMTP mail text 19225!:mime message/rfc822 192260 string/t Path: news text 19227!:mime message/news 192280 string/t Xref: news text 19229!:mime message/news 192300 string/t From: news or mail text 19231!:mime message/rfc822 192320 string/t Article saved news text 19233!:mime message/news 192340 string/t BABYL Emacs RMAIL text 192350 string/t Received: RFC 822 mail text 19236!:mime message/rfc822 192370 string/t MIME-Version: MIME entity text 19238#0 string/t Content- MIME entity text 19239 19240# TNEF files... 192410 lelong 0x223E9F78 Transport Neutral Encapsulation Format 19242!:mime application/vnd.ms-tnef 19243 19244# From: Kevin Sullivan <ksulliva@psc.edu> 192450 string *mbx* MBX mail folder 19246 19247# From: Simon Matter <simon.matter@invoca.ch> 192480 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB 192490 string \241\002\213\015twoskip\ file\0\0\0\0 Cyrus twoskip DB 19250 19251# JAM(mbp) Fidonet message area databases 19252# JHR file 192530 string JAM\0 JAM message area header file 19254>12 leshort >0 (%d messages) 19255 19256# Squish Fidonet message area databases 19257# SQD file (requires at least one message in the area) 19258# XXX: Weak magic 19259#256 leshort 0xAFAE4453 Squish message area data file 19260#>4 leshort >0 (%d messages) 19261 19262#0 string \<!--\ MHonArc text/html; x-type=mhonarc 19263 19264# Cyrus: file(1) magic for compiled Cyrus sieve scripts 19265# URL: https://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php 19266# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master 19267# From: Philipp Hahn <hahn@univention.de> 19268 19269# Compiled Cyrus sieve script 192700 string CyrSBytecode Cyrus sieve bytecode data, 19271>12 belong =1 version 1, big-endian 19272>12 lelong =1 version 1, little-endian 19273>12 belong x version %d, network-endian 19274#------------------------------------------------------------------------------ 19275# $File: make,v 1.4 2018/05/29 17:26:02 christos Exp $ 19276# make: file(1) magic for makefiles 19277# 19278# URL: https://en.wikipedia.org/wiki/Make_(software) 192790 regex/100l \^CFLAGS makefile script text 19280!:mime text/x-makefile 192810 regex/100l \^VPATH makefile script text 19282!:mime text/x-makefile 192830 regex/100l \^LDFLAGS makefile script text 19284!:mime text/x-makefile 192850 regex/100l \^all: makefile script text 19286!:mime text/x-makefile 192870 regex/100l \^\\.PRECIOUS makefile script text 19288!:mime text/x-makefile 19289# Update: Joerg Jenderek 19290# Reference: https://www.freebsd.org/cgi/man.cgi?make(1) 19291# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST" 19292# by additional escaping point character 192930 regex/100l \^\\.BEGIN BSD makefile script text 19294!:mime text/x-makefile 19295!:ext /mk 19296!:strength +10 19297# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT" 19298# and NSIS script with "!include" by additional escaping point character 192990 regex/100l \^\\.include BSD makefile script text 19300!:mime text/x-makefile 19301!:ext /mk 19302!:strength +10 193030 regex/100l \^\\.endif BSD makefile script text 19304!:mime text/x-makefile 19305!:ext /mk 19306!:strength +10 193070 regex/100l \^SUBDIRS automake makefile script text 19308!:mime text/x-makefile 19309!:strength +10 19310 19311 19312#------------------------------------------------------------------------------ 19313# $File: map,v 1.7 2019/04/30 04:02:04 christos Exp $ 19314# map: file(1) magic for Map data 19315# 19316 19317# Garmin .FIT files https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 193188 string .FIT FIT Map data 19319>15 byte 0 19320>>35 belong x \b, unit id %d 19321>>39 lelong x \b, serial %u 19322# https://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml 19323# 20 years after unix epoch 19324# TZ=GMT date -d '1989-12-31 0:00' +%s 19325>>43 leldate+631065600 x \b, %s 19326 19327>>47 leshort x \b, manufacturer %d 19328>>47 leshort 1 \b (garmin) 19329>>49 leshort x \b, product %d 19330>>53 byte x \b, type %d 19331>>53 byte 1 \b (Device) 19332>>53 byte 2 \b (Settings) 19333>>53 byte 3 \b (Sports/Cycling) 19334>>53 byte 4 \b (Activity) 19335>>53 byte 8 \b (Elevations) 19336>>53 byte 10 \b (Totals) 19337 19338# Summary: Garmin map 19339# From: Joerg Jenderek 19340# URL: https://en.wikipedia.org/wiki/Garmin_.img 19341# Reference: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 19342# sourceforge.net/projects/garmin-img/files/IMG%20File%20Format/1.0/imgformat-1.0.pdf 19343# GRR: similar to MBR boot sector handled by ./filesystems 193440x1FE leshort =0xAA55 19345# look for valid map signature 19346>0x13 string =IMG\0 19347>>0 use garmin-map 193480 name garmin-map 19349>0 ubyte x Garmin 19350!:mime application/x-garmin-map 19351# If non-zero, every byte of the entire .img file is to be XORed with this value 19352>0 ubyte !0 \b, 0x%x XORed 19353# goto block before FAT 19354>(0x40.b*512) ubyte x 19355# 1st fat name "DLLINFO TXT" only found for vpm 19356>>&512 string =DLLINFO\ TXT map (Voice Processing) 19357# there exist 2 other Garmin VPM formats; see ./audio 19358!:ext vpm 19359# Deutsch__Yannick_D4481-00_0210.vpm 19360#>>>512 search/0x0116da60/s RIFF \b; with 19361# determine type voice type by ./riff 19362#>>>>&0 indirect x \b 19363>>&512 string !DLLINFO\ TXT map 19364!:ext img 19365# 9 zeros 19366>1 ubelong !0 \b, zeroes 0x%x 19367# Map's version major 19368>8 ubyte x v%u 19369# Map's version minor 19370>9 ubyte x \b.%.2u 19371# Map description[20], 0x20 padded 19372>0x49 string x %.20s 19373# Map name, continued (0x20 padded, \0 terminated) 19374>0x65 string >\ \b%.31s 19375# Update year (+1900 for val >= 0x63, +2000 for val <= 0x62) 19376>0xB ubyte x \b, updated 19377>>0xB ubyte >0x62 19378>>>0xB ubyte-100 x 20%.2u 19379>>0xB ubyte <0x63 19380>>>0xB ubyte x 20%.2u 19381# Update month (0-11) 19382>0xA ubyte x \b-%.2u 19383# All zeroes 19384>0xc uleshort !0 \b, zeroes 0x%x 19385# Mapsource flag, 1 - file created by Mapsource, 0 - Garmin map visible in Basecamp and Homeport 19386#>0xE ubyte !0 \b, Mapsource flag 0x%x 19387>0xE ubyte 1 \b, Mapsource 19388# Checksum, sum of all bytes modulo 256 should be 0 19389#>0xF ubyte x \b, Checksum 0x%x 19390# Signature: DSKIMG 0x00 or DSDIMG 0x00 for demo map 19391>0x10 string !DSKIMG \b, signature "%.7s" 19392>0x39 use garmin-date 19393# Map file identifier like GARMIN\0 19394>0x41 string !GARMIN \b, id "%.7s" 19395# Block size exponent, E1; appears to always be 0x09; minimum block size 512 bytes 19396>0x61 ubyte !0x09 \b, E1=%u 19397# Block size exponent, E2 ; file blocksize=2**(E1+E2) 19398>>0x62 ubyte x \b, E2=%u 19399>0x61 ubyte =0x09 \b, blocksize 19400>>0x62 ubyte 0 512 19401>>0x62 ubyte 1 1024 19402>>0x62 ubyte 2 2048 19403>>0x62 ubyte 3 4096 19404>>0x62 ubyte 4 8192 19405>>0x62 ubyte 5 16384 19406>>0x62 default x 19407>>>0x62 ubyte x E2=%u 19408# MBR signature 19409>0x1FE leshort !0xAA55 \b, invalid MBR 19410# 512 zeros 19411>0x200 uquad !0 \b, zeroes 0x%llx 19412# First sub-file offset (absolute); sometimes NO/UNKNOWN sub file! 19413>0x40C ulelong >0 \b, at 0x%x 19414# sub-file Header length 19415#>>(0x40C.l) uleshort x \b, header len 0x%x 19416>>(0x40C.l) uleshort x %u bytes 19417# sub-file Type[10] like "GARMIN RGN" "GARMIN TRE", "GARMIN TYP", etc. 19418>>(0x40C.l+2) ubyte >0x1F 19419>>>(0x40C.l+2) ubyte <0xFF 19420>>>>(0x40C.l+2) string x "%.10s" 19421# 0x00 for most maps, 0x80 for locked maps (City Nav, City Select, etc.) 19422>>>>(0x40C.l+13) ubyte >0 \b, locked 0x%x 19423# Block sequence numbers like 0000 0100 0200 ... FFFF 19424# >0x420 ubequad >0 \b, seq. 0x%16.16llx 19425# >>0x428 ubequad >0 \b%16.16llx 19426# >>>0x430 ubequad >0 \b%16.16llx 19427# >>>>0x438 ubequad >0 \b%16.16llx 19428# >>>>>0x440 ubequad >0 \b%16.16llx 19429# >>>>>>0x448 ubequad >0 \b%16.16llx 19430# >>>>>>>0x450 ubequad >0 \b%16.16llx 19431# >>>>>>>>0x458 ubequad >0 \b%16.16llx 19432# >>>>>>>>>0x460 ubequad >0 \b%16.16llx 19433# >>>>>>>>>>0x468 ubequad >0 \b%16.16llx 19434# >>>>>>>>>>>0x470 ubequad >0 \b%16.16llx 19435# >>>>>>>>>>>>0x478 ubequad >0 \b%16.16llx 19436# >>>>>>>>>>>>>0x480 ubequad >0 \b%16.16llx 19437# >>>>>>>>>>>>>>0x488 ubequad >0 \b%16.16llx 19438# >>>>>>>>>>>>>>>0x490 ubequad >0 \b%16.16llx 19439# >>>>>>>>>>>>>>>>0x498 ubequad >0 \b%16.16llx 19440# >>>>>>>>>>>>>>>>>0x4A0 ubequad >0 \b%16.16llx 19441# >>>>>>>>>>>>>>>>>>0x4A8 ubequad >0 \b%16.16llx 19442# look for end of FAT 19443#>>0x420 search/512/s \xff\xff FAT END 19444# Physical block number of FAT header 19445#>0x40 ubyte x \b, FAT at phy. block %u 19446>0x40 ubyte x 19447>>(0x40.b*512) ubyte x 19448# 1st FAT block 19449>>>&511 use garmin-fat 19450# 2nd FAT block 19451>>>&1023 use garmin-fat 19452# 3th FAT block 19453>>>&1535 use garmin-fat 19454# 4th FAT block 19455>>>&2047 use garmin-fat 19456# ... xth FAT block 19457# 19458# 314 zeros but not in vpm and also gmaptz.img 19459>0x84 uquad !0 \b, at 0x84 0x%llx 19460# display FileAllocationTable block entry in garmin map 194610 name garmin-fat 19462>0 ubyte x \b; 19463# sub file part; 0x0003 seems to be garbage 19464>0x10 uleshort !0 next 0x%4.4x 19465>0x10 uleshort =0 19466# fat flag 0~dummy block 1~true sub file 19467>>0 ubyte !1 flag %u 19468>>0 ubyte =1 19469# sub-file name like MAKEGMAP 12345678 19470>>>0x1 string x %.8s 19471# sub-file typ like RGN TRE MDR LBL 19472>>>0x9 string x \b.%.3s 19473# size of sub file 19474>>>0xC ulelong x \b, %u bytes 19475# 32-bit block sequence numbers 19476#>>>0x20 ubequad x \b, seq. 0x%16.16llx 19477 19478# display date stored inside Garmin maps like yyyy-mm-dd h:mm:ss 194790 name garmin-date 19480# year like 2018 19481>0 uleshort x \b, created %u 19482# month (0-11) 19483>2 ubyte x \b-%.2u 19484# day (1-31) 19485>3 ubyte x \b-%.2u 19486# hour (0-23) 19487>4 ubyte x %u 19488# minute (0-59) 19489>5 ubyte x \b:%.2u 19490# second (0-59) 19491>6 ubyte x \b:%.2u 19492 19493# Summary: Garmin Map subfiles 19494# From: Joerg Jenderek 19495# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/IMG_File_Format 19496# Garmin Common Header 194972 string GARMIN\ 19498# skip ASCII text by checking for low header length 19499>0 uleshort <0x1000 Garmin map, 19500# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/GMP_Subfile_Format 19501>>9 string GMP subtile 19502!:mime application/x-garmin-gpm 19503!:ext gmp 19504# copyright message 19505>>>(0.s) string x %s 19506>>>0x0E use garmin-date 19507# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/MDR_Subfile_Format 19508# This contains the searchable address table used for finding routing destinations 19509>>9 string MDR address table 19510!:mime application/x-garmin-mdr 19511!:ext mdr 19512# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/NOD_Subfile_Format 19513# http://svn.parabola.me.uk/display/trunk/doc/nod.txt 19514# This contains the routing information 19515>>9 string NOD routing 19516!:mime application/x-garmin-nod 19517!:ext nod 19518>>>0x0E use garmin-date 19519#>>>0x15 ulelong x \b, at 0x%x 19520#>>>0x19 ulelong x 0x%x bytes NOD1 19521#>>>0x25 ulelong x \b, at 0x%x 19522#>>>0x29 ulelong x 0x%x bytes NOD2 19523#>>>0x31 ulelong x \b, at 0x%x 19524#>>>0x35 ulelong x 0x%x bytes NOD3 19525# URL: http://www.pinns.co.uk/osm/net.html 19526# routable highways (length, direction, allowed speed,house address information) 19527>>9 string NET highways 19528!:mime application/x-garmin-net 19529!:ext net 19530#>>>0x15 ulelong x \b, at 0x%x 19531#>>>0x19 ulelong x 0x%x bytes NET1 19532#>>>0x22 ulelong >0 19533#>>>>0x1E ulelong x \b, at 0x%x 19534#>>>>0x22 ulelong x 0x%x bytes NET2 19535#>>>0x2B ulelong >0 19536#>>>>0x27 ulelong x \b, at 0x%x 19537#>>>>0x2B ulelong x 0x%x bytes NET3 19538# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/LBL_Subfile_Format 19539>>9 string LBL labels 19540!:mime application/x-garmin-lbl 19541!:ext lbl 19542>>>(0.s) string x %s 19543# Label coding type 6h 9h and ah 19544>>>0x1E ubyte x \b, coding type 0x%x 19545#>>>0x15 ulelong x \b, at 0x%x 19546#>>>0x19 ulelong x 0x%x bytes LBL1 19547#>>>0x1F ulelong x \b, at 0x%x 19548#>>>0x23 ulelong x 0x%x bytes LBL2 19549#>>>0x2D ulelong x \b, at 0x%x 19550#>>>0x31 ulelong x 0x%x bytes LBL3 19551# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/SRT_Subfile_Format 19552# A lookup table of the chars in the map's codepage, and their collating sequence 19553>>9 string SRT sort table 19554!:mime application/x-garmin-srt 19555!:ext srt 19556>>>0x0E use garmin-date 19557# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/TRE_Subfile_Format 19558>>9 string TRE tree 19559!:mime application/x-garmin-tre 19560!:ext tre 19561# title like City Nav Europe NTU 2019.2 Basemap 19562# or OSM Street map 19563>>>(0.s) string x %s 19564# 2nd title like Copyright 1995-2018 by GARMIN Corporation. 19565# or http://www.openstreetmap.org/ 19566>>>>&1 string x %s 19567>>>0x0E use garmin-date 19568#>>>0x21 ulelong x \b, at 0x%x 19569#>>>0x25 ulelong x 0x%x bytes TRE1 19570#>>>0x29 ulelong x \b, at 0x%x 19571#>>>0x2D ulelong x 0x%x bytes TRE2 19572#>>>0x31 ulelong x \b, at 0x%x 19573#>>>0x35 ulelong x 0x%x bytes TRE3 19574# Copyright record size 19575#>>>0x39 uleshort x \b, copyright record size %u 19576# Map ID 19577>>>0x74 ulelong x \b, ID 0x%x 19578# URL: https://www.gpspower.net/garmin-tutorials/353310-basecamp-installing-free-desktop-map.html 19579# For road traffic information service (RDS/TMS/TMC). Commonly seen in City Navigator maps 19580>>9 string TRF traffic, 19581!:mime application/x-garmin-trf 19582!:ext trf 19583# city/region like Preitenegg 19584>>>(0.s+1) string x 1st %s 19585# highway part like L606/L148 19586>>>>&1 string x %s 19587# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/Format 19588# Reference: http://www.pinns.co.uk/osm/typformat.html 19589# customize the appearance of objects. For GPS and MapSource/Qlandkarte better looking maps 19590>>9 string TYP types 19591!:mime application/x-garmin-typ 19592!:ext typ 19593>>>0x0E use garmin-date 19594# character set 1252 65001~UTF8 19595>>>0x15 uleshort x \b, code page %u 19596# POIs 19597#>>>0x17 ulelong x \b, at 0x%x 19598#>>>0x1B ulelong x 0x%x bytes TYP1 19599# extra pois 19600#>>>0x5B ulelong x \b, at 0x%x 19601#>>>0x5F ulelong x 0x%x bytes TYP8 19602# URL: https://wiki.openstreetmap.org/wiki/OSM_Map_On_Garmin/RGN_Subfile_Format 19603# http://www.pinns.co.uk/osm/RGN.html 19604# region data used by the Garmin software 19605>>9 string RGN region 19606!:mime application/x-garmin-rgn 19607!:ext rgn 19608# POIs,Indexed POIs,Polylines or Polygons or first map level 19609#>>>0x15 ulelong x \b, at 0x%x 19610#>>>0x19 ulelong x 0x%x bytes RGN1 19611# polygons with extended types 19612#>>>0x21 ulelong >0 19613#>>>>0x1D ulelong x \b, at 0x%x 19614#>>>>0x21 ulelong x 0x%x bytes RGN2 19615# polylines with extended types 19616#>>>0x3D ulelong >0 19617#>>>>0x39 ulelong x \b, at 0x%x 19618#>>>>0x3D ulelong x 0x%x bytes RGN3 19619# extended POIs 19620#>>>0x59 ulelong >0 19621#>>>>0x55 ulelong x \b, at 0x%x 19622#>>>>0x59 ulelong x 0x%x bytes RGN3 19623#>>9 default x unknown map type 19624# Header length; GMP:31h 35h 3Dh,MDR:11Eh 238h 2C4h 310h,NOD:3Fh 7Fh,NET:64h, 19625# LBL:2A9h,SRT:1Dh 25h 27h,TRE:CFh 135h,TRF:5Ah,TYP:5Bh 6Eh 7Ch AEh,RGN:7Dh 19626>>0 uleshort x \b, header length 0x%x 19627 19628# TOM TOM GPS watches ttbin files: 19629# https://github.com/ryanbinns/ttwatch/tree/master/ttbin 19630# From: Daniel Lenski 196310 byte 0x20 19632>1 leshort 0x0007 19633>>0x76 byte 0x20 19634>>>0x77 leshort 0x0075 TomTom activity file, v7 19635>>>>8 leldate x (%s, 19636>>>>3 byte x device firmware %d. 19637>>>>4 byte x \b%d. 19638>>>>5 byte x \b%d, 19639>>>>6 leshort x product ID %04d) 19640 19641 19642#------------------------------------------------------------------------------ 19643# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $ 19644# maple: file(1) magic for maple files 19645# "H. Nanosecond" <aldomel@ix.netcom.com> 19646# Maple V release 4, a multi-purpose math program 19647# 19648 19649# maple library .lib 196500 string \000MVR4\nI MapleVr4 library 19651 19652# .ind 19653# no magic for these :-( 19654# they are compiled indexes for maple files 19655 19656# .hdb 196570 string \000\004\000\000 Maple help database 19658 19659# .mhp 19660# this has the form <PACKAGE=name> 196610 string \<PACKAGE= Maple help file 196620 string \<HELP\ NAME= Maple help file 196630 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck) 19664#0 string #\ Newton Maple help file, old style 196650 string #\ daub Maple help file, old style 19666#0 string #=========== Maple help file, old style 19667 19668# .mws 196690 string \000\000\001\044\000\221 Maple worksheet 19670#this is anomalous 196710 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird 19672# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n 19673# that is {VERSION major_version miunor_version computer_type version_string} 196740 string {VERSION\ Maple worksheet 19675>9 string >\0 version %.1s. 19676>>11 string >\0 %.1s 19677 19678# .mps 196790 string \0\0\001$ Maple something 19680# from byte 4 it is either 'nul E' or 'soh R' 19681# I think 'nul E' means a file that was saved as a different name 19682# a sort of revision marking 19683# 'soh R' means new 19684>4 string \000\105 An old revision 19685>4 string \001\122 The latest save 19686 19687# .mpl 19688# some of these are the same as .mps above 19689#0000000 000 000 001 044 000 105 same as .mps 19690#0000000 000 000 001 044 001 122 same as .mps 19691 196920 string #\n##\ <SHAREFILE= Maple something 196930 string \n#\n##\ <SHAREFILE= Maple something 196940 string ##\ <SHAREFILE= Maple something 196950 string #\r##\ <SHAREFILE= Maple something 196960 string \r#\r##\ <SHAREFILE= Maple something 196970 string #\ \r##\ <DESCRIBE> Maple something anomalous. 19698#-------------------------------------------- 19699# marc21: file(1) magic for MARC 21 Format 19700# 19701# Kevin Ford (kefo@loc.gov) 19702# 19703# MARC21 formats are for the representation and communication 19704# of bibliographic and related information in machine-readable 19705# form. For more info, see https://www.loc.gov/marc/ 19706 19707 19708# leader position 20-21 must be 45 19709# and 22-23 also 00 so far, but we check that later. 1971020 string 45 19711>0 search/2048 \x1e 19712 19713# leader starts with 5 digits, followed by codes specific to MARC format 19714>>0 regex/1l (^[0-9]{5})[acdnp][^bhlnqsu-z] MARC21 Bibliographic 19715!:mime application/marc 19716>>0 regex/1l (^[0-9]{5})[acdnosx][z] MARC21 Authority 19717!:mime application/marc 19718>>0 regex/1l (^[0-9]{5})[cdn][uvxy] MARC21 Holdings 19719!:mime application/marc 19720>>0 regex/1l (^[0-9]{5})[acdn][w] MARC21 Classification 19721!:mime application/marc 19722>>0 regex/1l (^[0-9]{5})[cdn][q] MARC21 Community 19723!:mime application/marc 19724 19725# leader position 22-23, should be "00" but is it? 19726>>0 regex/1l (^.{21})([^0]{2}) (non-conforming) 19727!:mime application/marc 19728 19729#------------------------------------------------------------------------------ 19730# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $ 19731# mathcad: file(1) magic for Mathcad documents 19732# URL: http://www.mathsoft.com/ 19733# From: Josh Triplett <josh@freedesktop.org> 19734 197350 string .MCAD\t Mathcad document 19736 19737#------------------------------------------------------------------------------ 19738# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $ 19739# mathematica: file(1) magic for mathematica files 19740# "H. Nanosecond" <aldomel@ix.netcom.com> 19741# Mathematica a multi-purpose math program 19742# versions 2.2 and 3.0 19743 19744#mathematica .mb 197450 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook 19746!:ext mb 197470 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook 19748!:ext mb 19749 19750# .ma 19751# multiple possibilites: 19752 197530 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook 19754#>41 string >\0 %s 19755!:ext mb 19756 19757#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x 19758 19759#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x 19760#>675 string >\0 %s #doesn't work well 19761 19762# there may be 'cr' instread of 'nl' in some does this matter? 19763 19764# generic: 197650 string (*^\r\r::[\011 Mathematica notebook version 2.x 19766!:ext mb 197670 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 19768!:ext mb 197690 string (*^\015 Mathematica notebook version 2.x 19770!:ext mb 197710 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 19772!:ext mb 197730 string (*^\r::[\011 Mathematica notebook version 2.x 19774!:ext mb 197750 string (*^\r\n::[\011 Mathematica notebook version 2.x 19776!:ext mb 197770 string (*^\n\n::[\011 Mathematica notebook version 2.x 19778!:ext mb 197790 string (*^\n::[\011 Mathematica notebook version 2.x 19780!:ext mb 19781 19782 19783# Mathematica .mx files 19784 19785#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file 197860 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file 19787#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000 19788# >71... is optional 19789>88 string >\0 from %s 19790 19791 19792# Mathematica files PBF: 19793# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000 197940 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think) 19795 19796# .ml files These are menu resources I think 19797# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 19798# how to put that into a magic rule? 197994 string \ A~ MAthematica .ml file 19800 19801# .nb files 19802#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook 198030 string (*********************** Mathematica 3.0 notebook 19804 19805# other (* matches it is a comment start in these langs 19806# GRR: Too weak; also matches other languages e.g. ML 19807#0 string (* Mathematica, or Pascal, Modula-2 or 3 code text 19808 19809######################### 19810# MatLab v5 198110 string MATLAB Matlab v5 mat-file 19812>126 short 0x494d (big endian) 19813>>124 beshort x version 0x%04x 19814>126 short 0x4d49 (little endian) 19815>>124 leshort x version 0x%04x 19816 19817 19818#------------------------------------------------------------------------------ 19819# $File: matroska,v 1.9 2019/04/19 00:42:27 christos Exp $ 19820# matroska: file(1) magic for Matroska files 19821# 19822# See https://www.matroska.org/ 19823# 19824 19825# EBML id: 198260 belong 0x1a45dfa3 19827# DocType id: 19828>4 search/4096 \x42\x82 19829# DocType contents: 19830>>&1 string webm WebM 19831!:mime video/webm 19832>>&1 string matroska Matroska data 19833!:mime video/x-matroska 19834 19835#------------------------------------------------------------------------------ 19836# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $ 19837# Mavroyanopoulos Nikos <nmav@hellug.gr> 19838# mcrypt: file(1) magic for mcrypt 2.2.x; 198390 string \0m\3 mcrypt 2.5 encrypted data, 19840>4 string >\0 algorithm: %s, 19841>>&1 leshort >0 keysize: %d bytes, 19842>>>&0 string >\0 mode: %s, 19843 198440 string \0m\2 mcrypt 2.2 encrypted data, 19845>3 byte 0 algorithm: blowfish-448, 19846>3 byte 1 algorithm: DES, 19847>3 byte 2 algorithm: 3DES, 19848>3 byte 3 algorithm: 3-WAY, 19849>3 byte 4 algorithm: GOST, 19850>3 byte 6 algorithm: SAFER-SK64, 19851>3 byte 7 algorithm: SAFER-SK128, 19852>3 byte 8 algorithm: CAST-128, 19853>3 byte 9 algorithm: xTEA, 19854>3 byte 10 algorithm: TWOFISH-128, 19855>3 byte 11 algorithm: RC2, 19856>3 byte 12 algorithm: TWOFISH-192, 19857>3 byte 13 algorithm: TWOFISH-256, 19858>3 byte 14 algorithm: blowfish-128, 19859>3 byte 15 algorithm: blowfish-192, 19860>3 byte 16 algorithm: blowfish-256, 19861>3 byte 100 algorithm: RC6, 19862>3 byte 101 algorithm: IDEA, 19863>4 byte 0 mode: CBC, 19864>4 byte 1 mode: ECB, 19865>4 byte 2 mode: CFB, 19866>4 byte 3 mode: OFB, 19867>4 byte 4 mode: nOFB, 19868>5 byte 0 keymode: 8bit 19869>5 byte 1 keymode: 4bit 19870>5 byte 2 keymode: SHA-1 hash 19871>5 byte 3 keymode: MD5 hash 19872 19873#------------------------------------------------------------------------------ 19874# $File: measure,v 1.2 2018/06/23 16:13:15 christos Exp $ 19875# measure: file(1) magic for measurement data 19876 19877# DIY-Thermocam raw data 198780 name diy-thermocam-parser 19879>0 beshort x scale %d- 19880>2 beshort x \b%d, 19881>4 lefloat x spot sensor temperature %f, 19882>9 ubyte 0 unit celsius, 19883>9 ubyte 1 unit fahrenheit, 19884>8 ubyte x color scheme %d 19885>10 ubyte 1 \b, show spot sensor 19886>11 ubyte 1 \b, show scale bar 19887>12 ubyte &1 \b, minimum point enabled 19888>12 ubyte &2 \b, maximum point enabled 19889>13 lefloat x \b, calibration: offset %f, 19890>17 lefloat x slope %f 19891 198920 name diy-thermocam-checker 19893>9 ubyte <2 19894>>10 ubyte <2 19895>>>11 ubyte <2 19896>>>>12 ubyte <4 19897>>>>>17 lefloat >0.0001 DIY-Thermocam raw data 19898 19899# V2 and Leption 3.x: 1990038408 ubyte <19 19901>38400 use diy-thermocam-checker 19902>>38400 default x (Lepton 3.x), 19903>>>38400 use diy-thermocam-parser 19904 19905# V1 or Lepton 2.x 199069608 ubyte <19 19907>9600 use diy-thermocam-checker 19908>>9600 default x (Lepton 2.x), 19909>>>9600 use diy-thermocam-parser 19910 19911 19912#------------------------------------------------------------------------------ 19913# $File: mercurial,v 1.5 2019/04/19 00:42:27 christos Exp $ 19914# mercurial: file(1) magic for Mercurial changeset bundles 19915# https://www.selenic.com/mercurial/wiki/ 19916# 19917# Jesse Glick (jesse.glick@sun.com) 19918# 19919 199200 string HG10 Mercurial changeset bundle 19921>4 string UN (uncompressed) 19922>4 string GZ (gzip compressed) 19923>4 string BZ (bzip2 compressed) 19924 19925#------------------------------------------------------------------------------ 19926# $File: metastore,v 1.3 2019/04/19 00:42:27 christos Exp $ 19927# metastore: file(1) magic for metastore files 19928# From: Thomas Wissen 19929# see https://david.hardeman.nu/software.php#metastore 199300 string MeTaSt00r3 Metastore data file, 19931>10 bequad x version %0llx 19932 19933#------------------------------------------------------------------------------ 19934# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $ 19935# rinex: file(1) magic for RINEX files 19936# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt 19937# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf 19938# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data 1993960 string RINEX 19940>80 search/256 XXRINEXB RINEX Data, GEO SBAS Broadcast 19941>>&32 string x \b, date %15.15s 19942>>5 string x \b, version %6.6s 19943!:mime rinex/broadcast 19944>80 search/256 XXRINEXD RINEX Data, Observation (Hatanaka comp) 19945>>&32 string x \b, date %15.15s 19946>>5 string x \b, version %6.6s 19947!:mime rinex/observation 19948>80 search/256 XXRINEXC RINEX Data, Clock 19949>>&32 string x \b, date %15.15s 19950>>5 string x \b, version %6.6s 19951!:mime rinex/clock 19952>80 search/256 XXRINEXH RINEX Data, GEO SBAS Navigation 19953>>&32 string x \b, date %15.15s 19954>>5 string x \b, version %6.6s 19955!:mime rinex/navigation 19956>80 search/256 XXRINEXG RINEX Data, GLONASS Navigation 19957>>&32 string x \b, date %15.15s 19958>>5 string x \b, version %6.6s 19959!:mime rinex/navigation 19960>80 search/256 XXRINEXL RINEX Data, Galileo Navigation 19961>>&32 string x \b, date %15.15s 19962>>5 string x \b, version %6.6s 19963!:mime rinex/navigation 19964>80 search/256 XXRINEXM RINEX Data, Meteorological 19965>>&32 string x \b, date %15.15s 19966>>5 string x \b, version %6.6s 19967!:mime rinex/meteorological 19968>80 search/256 XXRINEXN RINEX Data, Navigation 19969>>&32 string x \b, date %15.15s 19970>>5 string x \b, version %6.6s 19971!:mime rinex/navigation 19972>80 search/256 XXRINEXO RINEX Data, Observation 19973>>&32 string x \b, date %15.15s 19974>>5 string x \b, version %6.6s 19975!:mime rinex/observation 19976 19977# https://en.wikipedia.org/wiki/GRIB 199780 string GRIB 19979>7 byte =1 Gridded binary (GRIB) version 1 19980>7 byte =2 Gridded binary (GRIB) version 2 19981 19982#------------------------------------------------------------------------------ 19983# $File: microfocus,v 1.3 2019/04/19 00:42:27 christos Exp $ 19984# Micro Focus COBOL data files. 19985 19986# https://documentation.microfocus.com/help/index.jsp?topic=\ 19987# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html 19988# http://www.cobolproducts.com/datafile/data-viewer.html 19989# https://github.com/miracle2k/mfcobol-export 19990 199910 string \x30\x00\x00\x7C 19992>36 string \x00\x3E Micro Focus File with Header (DAT) 19993!:mime application/octet-stream 19994 199950 string \x30\x7E\x00\x00 19996>36 string \x00\x3E Micro Focus File with Header (DAT) 19997!:mime application/octet-stream 19998 1999939 string \x02 20000>136 string \x02\x02\x04\x04 Micro Focus Index File (IDX) 20001!:mime application/octet-stream 20002 20003#------------------------------------------------------------------------------ 20004# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $ 20005# mime: file(1) magic for MIME encoded files 20006# 200070 string/t Content-Type:\040 20008>14 string >\0 %s 200090 string/t Content-Type: 20010>13 string >\0 %s 20011 20012#------------------------------------------------------------------------------ 20013# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $ 20014# mips: file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX 20015# and DEC Ultrix 20016# 200170 beshort 0x0160 MIPSEB ECOFF executable 20018>20 beshort 0407 (impure) 20019>20 beshort 0410 (swapped) 20020>20 beshort 0413 (paged) 20021>8 belong >0 not stripped 20022>8 belong 0 stripped 20023>22 byte x - version %d 20024>23 byte x \b.%d 20025# 200260 beshort 0x0162 MIPSEL-BE ECOFF executable 20027>20 beshort 0407 (impure) 20028>20 beshort 0410 (swapped) 20029>20 beshort 0413 (paged) 20030>8 belong >0 not stripped 20031>8 belong 0 stripped 20032>23 byte x - version %d 20033>22 byte x \b.%d 20034# 200350 beshort 0x6001 MIPSEB-LE ECOFF executable 20036>20 beshort 03401 (impure) 20037>20 beshort 04001 (swapped) 20038>20 beshort 05401 (paged) 20039>8 belong >0 not stripped 20040>8 belong 0 stripped 20041>23 byte x - version %d 20042>22 byte x \b.%d 20043# 200440 beshort 0x6201 MIPSEL ECOFF executable 20045>20 beshort 03401 (impure) 20046>20 beshort 04001 (swapped) 20047>20 beshort 05401 (paged) 20048>8 belong >0 not stripped 20049>8 belong 0 stripped 20050>23 byte x - version %d 20051>22 byte x \b.%d 20052# 20053# MIPS 2 additions 20054# 200550 beshort 0x0163 MIPSEB MIPS-II ECOFF executable 20056>20 beshort 0407 (impure) 20057>20 beshort 0410 (swapped) 20058>20 beshort 0413 (paged) 20059>8 belong >0 not stripped 20060>8 belong 0 stripped 20061>22 byte x - version %d 20062>23 byte x \b.%d 20063# 200640 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable 20065>20 beshort 0407 (impure) 20066>20 beshort 0410 (swapped) 20067>20 beshort 0413 (paged) 20068>8 belong >0 not stripped 20069>8 belong 0 stripped 20070>22 byte x - version %d 20071>23 byte x \b.%d 20072# 200730 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable 20074>20 beshort 03401 (impure) 20075>20 beshort 04001 (swapped) 20076>20 beshort 05401 (paged) 20077>8 belong >0 not stripped 20078>8 belong 0 stripped 20079>23 byte x - version %d 20080>22 byte x \b.%d 20081# 200820 beshort 0x6601 MIPSEL MIPS-II ECOFF executable 20083>20 beshort 03401 (impure) 20084>20 beshort 04001 (swapped) 20085>20 beshort 05401 (paged) 20086>8 belong >0 not stripped 20087>8 belong 0 stripped 20088>23 byte x - version %d 20089>22 byte x \b.%d 20090# 20091# MIPS 3 additions 20092# 200930 beshort 0x0140 MIPSEB MIPS-III ECOFF executable 20094>20 beshort 0407 (impure) 20095>20 beshort 0410 (swapped) 20096>20 beshort 0413 (paged) 20097>8 belong >0 not stripped 20098>8 belong 0 stripped 20099>22 byte x - version %d 20100>23 byte x \b.%d 20101# 201020 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable 20103>20 beshort 0407 (impure) 20104>20 beshort 0410 (swapped) 20105>20 beshort 0413 (paged) 20106>8 belong >0 not stripped 20107>8 belong 0 stripped 20108>22 byte x - version %d 20109>23 byte x \b.%d 20110# 201110 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable 20112>20 beshort 03401 (impure) 20113>20 beshort 04001 (swapped) 20114>20 beshort 05401 (paged) 20115>8 belong >0 not stripped 20116>8 belong 0 stripped 20117>23 byte x - version %d 20118>22 byte x \b.%d 20119# 201200 beshort 0x4201 MIPSEL MIPS-III ECOFF executable 20121>20 beshort 03401 (impure) 20122>20 beshort 04001 (swapped) 20123>20 beshort 05401 (paged) 20124>8 belong >0 not stripped 20125>8 belong 0 stripped 20126>23 byte x - version %d 20127>22 byte x \b.%d 20128# 201290 beshort 0x180 MIPSEB Ucode 201300 beshort 0x182 MIPSEL-BE Ucode 20131 20132#------------------------------------------------------------------------------ 20133# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $ 20134# mirage: file(1) magic for Mirage executables 20135# 20136# XXX - byte order? 20137# 201380 long 31415 Mirage Assembler m.out executable 20139 20140#----------------------------------------------------------------------------- 20141# $File: misctools,v 1.18 2019/04/19 00:42:27 christos Exp $ 20142# misctools: file(1) magic for miscellaneous UNIX tools. 20143# 201440 search/1 %%!! X-Post-It-Note text 201450 string/c BEGIN:VCALENDAR vCalendar calendar file 20146!:mime text/calendar 20147# updated by Joerg Jenderek at Apr 2015 20148# Extension: .vcf 20149# https://en.wikipedia.org/wiki/VCard 201500 string/c BEGIN:VCARD vCard visiting card 20151# deprecated 20152#!:mime text/x-vcard 20153!:mime text/vcard 20154# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere 20155>12 search/14000/c VERSION: 20156# VERSION 2.1 , 3.0 or 4.0 20157>>&0 string x \b, version %-.3s 20158 20159# Summary: Libtool library file 20160# Extension: .la 20161# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl> 201620 search/80 .la\ -\ a\ libtool\ library\ file libtool library file 20163 20164# Summary: Libtool object file 20165# Extension: .lo 20166# Submitted by: Abel Cheung <abelcheung@gmail.com> 201670 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file 20168 20169# From: Daniel Novotny <dnovotny@redhat.com> 20170# Update: Joerg Jenderek 20171# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps 20172# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx 20173# 20174# "Windows Minidump" by TrID 20175# ./misctools (version 5.25) labeled the entry as "MDMP crash report data" 201760 string MDMP Mini DuMP crash report 20177# https://filext.com/file-extension/DMP 20178!:mime application/x-dmp 20179!:ext dmp/mdmp 20180# The high-order word is an internal value that is implementation specific. 20181# The low-order word is MINIDUMP_VERSION 0xA793 20182>4 ulelong&0x0000FFFF !0xA793 \b, version 0x%4.4x 20183# NumberOfStreams 8,9,10,13 20184>8 ulelong x \b, %d streams 20185# StreamDirectoryRva 0x20 20186>12 ulelong !0x20 \b, 0x%8.8x RVA 20187# CheckSum 0 20188>16 ulelong !0 \b, CheckSum 0x%8.8x 20189# Reserved or TimeDateStamp 20190>20 ledate x \b, %s 20191# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx 20192# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800 20193>24 ulelong x \b, 0x%x type 20194# >24 ulelong >0 \b; include 20195# >>24 ulelong &0x00000001 \b data sections, 20196# >>24 ulelong &0x00000020 \b list of unloaded modules, 20197# >>24 ulelong &0x00000100 \b process and thread information, 20198# >>24 ulelong &0x00000800 \b memory information, 20199 20200# Summary: abook addressbook file 20201# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu> 202020 string #\x20abook\x20addressbook\x20file abook address book 20203!:mime application/x-abook-addressbook 20204 20205#------------------------------------------------------------------------------ 20206# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $ 20207# mkid: file(1) magic for mkid(1) databases 20208# 20209# ID is the binary tags database produced by mkid(1). 20210# 20211# XXX - byte order? 20212# 202130 string \311\304 ID tags data 20214>2 short >0 version %d 20215 20216#------------------------------------------------------------------------------ 20217# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $ 20218# mlssa: file(1) magic for MLSSA datafiles 20219# 202200 lelong 0xffffabcd MLSSA datafile, 20221>4 leshort x algorithm %d, 20222>10 lelong x %d samples 20223 20224#------------------------------------------------------------------------------ 20225# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $ 20226# mmdf: file(1) magic for MMDF mail files 20227# 202280 string \001\001\001\001 MMDF mailbox 20229 20230#------------------------------------------------------------------------------ 20231# $File: modem,v 1.9 2019/04/19 00:42:27 christos Exp $ 20232# modem: file(1) magic for modem programs 20233# 20234# From: Florian La Roche <florian@knorke.saar.de> 202351 string PC\ Research,\ Inc Digifax-G3-File 20236>29 byte 1 \b, fine resolution 20237>29 byte 0 \b, normal resolution 20238 20239# Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header). 20240# Modified by: Joerg Jenderek 20241# URL: https://de.wikipedia.org/wiki/Fax 20242# Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm 20243# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others 202440 short 0x0100 20245# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER 20246>2 search/9 \0\0 20247# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 20248>2 default x 20249# skip IRCAM file (VAX big-endian) ./audio 20250>>0 belong !0x0001a364 20251# skip GEM Image data ./images 20252>>>2 beshort !0x0008 20253# look for first keyword of Panorama database *.pan 20254>>>>11 search/262 \x06DESIGN 20255# skip Panorama database 20256>>>>11 default x 20257# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files 20258>>>>>27118 search/1864 DreamWorld 20259>>>>>27118 default x 20260# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom 20261>>>>>>8 ubequad !0x2e01010454010203 20262# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom 20263>>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded 20264# version 5.25 labeled the entry above "raw G3 data, byte-padded" 20265!:mime image/g3fax 20266#!:apple ????TIFF 20267!:ext g3 20268# unusual image starting with black pixel 20269#0 short 0x1300 raw G3 (Group 3) FAX 202700 short 0x1400 20271# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom 20272>2 search/9 \0\0 20273# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3 20274>2 default x raw G3 (Group 3) FAX 20275# version 5.25 labeled the above entry as "raw G3 data" 20276!:mime image/g3fax 20277!:ext g3 20278# unusual image with black pixel near beginning 20279#0 short 0x1900 raw G3 (Group 3) FAX 20280 20281# 20282# Magic data for vgetty voice formats 20283# (Martin Seine & Marc Eberhard) 20284 20285# 20286# raw modem data version 1 20287# 202880 string RMD1 raw modem data 20289>4 string >\0 (%s / 20290>20 short >0 compression type 0x%04x) 20291 20292# 20293# portable voice format 1 20294# 202950 string PVF1\n portable voice format 20296>5 string >\0 (binary %s) 20297 20298# 20299# portable voice format 2 20300# 203010 string PVF2\n portable voice format 20302>5 string >\0 (ascii %s) 20303 20304# From: Bernd Nuernberger <bernd.nuernberger@web.de> 20305# Brooktrout G3 fax data incl. 128 byte header 20306# Common suffixes: 3??, BRK, BRT, BTR 203070 leshort 0x01bb 20308>2 leshort 0x0100 Brooktrout 301 fax image, 20309>>9 leshort x %d x 20310>>0x2d leshort x %d 20311>>6 leshort 200 \b, fine resolution 20312>>6 leshort 100 \b, normal resolution 20313>>11 byte 1 \b, G3 compression 20314>>11 byte 2 \b, G32D compression 20315 20316#------------------------------------------------------------------------------ 20317# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $ 20318# motorola: file(1) magic for Motorola 68K and 88K binaries 20319# 20320# 68K 20321# 203220 beshort 0520 mc68k COFF 20323>18 beshort ^00000020 object 20324>18 beshort &00000020 executable 20325>12 belong >0 not stripped 20326>168 string .lowmem Apple toolbox 20327>20 beshort 0407 (impure) 20328>20 beshort 0410 (pure) 20329>20 beshort 0413 (demand paged) 20330>20 beshort 0421 (standalone) 203310 beshort 0521 mc68k executable (shared) 20332>12 belong >0 not stripped 203330 beshort 0522 mc68k executable (shared demand paged) 20334>12 belong >0 not stripped 20335# 20336# Motorola/UniSoft 68K Binary Compatibility Standard (BCS) 20337# 203380 beshort 0554 68K BCS executable 20339# 20340# 88K 20341# 20342# Motorola/88Open BCS 20343# 203440 beshort 0555 88K BCS executable 20345# 20346# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de> 203470 string S0 Motorola S-Record; binary data in text format 20348 20349# ATARI ST relocatable PRG 20350# 20351# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 20352# (according to Roland Waldi, Oct 21, 1987) 20353# besides the magic 0x601a, the text segment size is checked to be 20354# not larger than 1 MB (which is a lot on ST). 20355# The additional 0x601b distinction I took from Doug Lee's magic. 203560 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable 20357>2 belong x (txt=%d, 20358>6 belong x dat=%d, 20359>10 belong x bss=%d, 20360>14 belong x sym=%d) 203610 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable 20362>2 belong x (txt=%d, 20363>6 belong x dat=%d, 20364>10 belong x bss=%d, 20365>14 belong x sym=%d) 20366 20367# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>) 203680 beshort 0x601A Atari 68xxx executable, 20369>2 belong x text len %u, 20370>6 belong x data len %u, 20371>10 belong x BSS len %u, 20372>14 belong x symboltab len %u, 20373>18 belong 0 20374>22 belong &0x01 fastload flag, 20375>22 belong &0x02 may be loaded to alternate RAM, 20376>22 belong &0x04 malloc may be from alternate RAM, 20377>22 belong x flags: 0x%X, 20378>26 beshort 0 no relocation tab 20379>26 beshort !0 + relocation tab 20380>30 string SFX [Self-Extracting LZH SFX archive] 20381>38 string SFX [Self-Extracting LZH SFX archive] 20382>44 string ZIP! [Self-Extracting ZIP SFX archive] 20383 203840 beshort 0x0064 Atari 68xxx CPX file 20385>8 beshort x (version %04x) 20386 20387#------------------------------------------------------------------------------ 20388# $File: mozilla,v 1.10 2019/04/19 00:42:27 christos Exp $ 20389# mozilla: file(1) magic for Mozilla XUL fastload files 20390# (XUL.mfasl and XPC.mfasl) 20391# URL: https://www.mozilla.org/ 20392# From: Josh Triplett <josh@freedesktop.org> 20393 203940 string XPCOM\nMozFASL\r\n\x1A Mozilla XUL fastload data 20395# Probably the next magic line contains misspelled "mozLz40\0" 203960 string mozLz4a Mozilla lz4 compressed bookmark data 20397# From: Joerg Jenderek 20398# URL: https://lz4.github.io/lz4/ 20399# Reference: https://github.com/avih/dejsonlz4/archive/master.zip/ 20400# dejsonlz4-master\src\dejsonlz4.c 20401# Note: mostly JSON compressed with a non-standard LZ4 header 20402# can be unpacked by dejsonlz4 but not lz4 programm. 204030 string mozLz40\0 Mozilla lz4 compressed data 20404!:mime application/x-lz4+json 20405# mozlz4 extension seems to be used for search/store, while jsonlz4 for bookmarks 20406!:ext jsonlz4/mozlz4 20407# decomp_size 20408>8 ulelong x \b, originally %u bytes 20409# lz4 data 20410#>12 ubequad x \b, lz4 data 0x%16.16llx 20411 20412# From: Joerg Jenderek 20413# URL: https://en.wikipedia.org/wiki/Firefox_4 20414# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT 20415# Note: Most ZIP utilities are able to extract such archives 20416# maybe only partly or after some warnings. Example: 20417# zip -FF omni.ja --out omni.zip 204184 string PK\001\002 Mozilla archive omni.ja 20419!:mime application/x-zip 20420!:ext ja 20421# TODO: 20422#>4 use zip-dir-entry 20423 20424#------------------------------------------------------------------------------ 20425# $File: msdos,v 1.128 2019/04/19 00:42:27 christos Exp $ 20426# msdos: file(1) magic for MS-DOS files 20427# 20428 20429# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 20430# updated by Joerg Jenderek at Oct 2008,Apr 2011 204310 string/t @ 20432>1 string/cW \ echo\ off DOS batch file text 20433!:mime text/x-msdos-batch 20434!:ext bat 20435>1 string/cW echo\ off DOS batch file text 20436!:mime text/x-msdos-batch 20437!:ext bat 20438>1 string/cW rem DOS batch file text 20439!:mime text/x-msdos-batch 20440!:ext bat 20441>1 string/cW set\ DOS batch file text 20442!:mime text/x-msdos-batch 20443!:ext bat 20444 20445 20446# OS/2 batch files are REXX. the second regex is a bit generic, oh well 20447# the matched commands seem to be common in REXX and uncommon elsewhere 20448100 search/0xffff rxfuncadd 20449>100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text 20450100 search/0xffff say 20451>100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text 20452 20453# updated by Joerg Jenderek at Oct 2015 20454# https://de.wikipedia.org/wiki/Common_Object_File_Format 20455# http://www.delorie.com/djgpp/doc/coff/filhdr.html 20456# ./intel already labeled COFF type 0x14c=0514 as "80386 COFF executable" 20457#0 leshort 0x14c MS Windows COFF Intel 80386 object file 20458#>4 ledate x stamp %s 204590 leshort 0x166 MS Windows COFF MIPS R4000 object file 20460#>4 ledate x stamp %s 204610 leshort 0x184 MS Windows COFF Alpha object file 20462#>4 ledate x stamp %s 204630 leshort 0x268 MS Windows COFF Motorola 68000 object file 20464#>4 ledate x stamp %s 204650 leshort 0x1f0 MS Windows COFF PowerPC object file 20466#>4 ledate x stamp %s 204670 leshort 0x290 MS Windows COFF PA-RISC object file 20468#>4 ledate x stamp %s 20469 20470# Tests for various EXE types. 20471# 20472# Many of the compressed formats were extraced from IDARC 1.23 source code. 20473# 204740 string/b MZ 20475# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file. 20476>0x18 leshort <0x40 MS-DOS executable 20477!:mime application/x-dosexec 20478# Windows and later versions of DOS will allow .EXEs to be named with a .COM 20479# extension, mostly for compatibility's sake. 20480!:ext exe/com 20481# These traditional tests usually work but not always. When test quality support is 20482# implemented these can be turned on. 20483#>>0x18 leshort 0x1c (Borland compiler) 20484#>>0x18 leshort 0x1e (MS compiler) 20485 20486# If the relocation table is 0x40 or more bytes into the file, it's definitely 20487# not a DOS EXE. 20488>0x18 leshort >0x3f 20489 20490# Maybe it's a PE? 20491>>(0x3c.l) string PE\0\0 PE 20492!:mime application/x-dosexec 20493>>>(0x3c.l+24) leshort 0x010b \b32 executable 20494>>>(0x3c.l+24) leshort 0x020b \b32+ executable 20495>>>(0x3c.l+24) leshort 0x0107 ROM image 20496>>>(0x3c.l+24) default x Unknown PE signature 20497>>>>&0 leshort x 0x%x 20498>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) 20499>>>(0x3c.l+92) leshort 1 20500# Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the 20501# drivers in Windows/System32/drivers/*.sys. 20502>>>>(0x3c.l+22) leshort&0x2000 >0 (native) 20503!:ext dll/sys 20504>>>>(0x3c.l+22) leshort&0x2000 0 (native) 20505!:ext exe/sys 20506>>>(0x3c.l+92) leshort 2 20507>>>>(0x3c.l+22) leshort&0x2000 >0 (GUI) 20508# These could probably be at least partially distinguished from one another by 20509# looking for specific exported functions. 20510# CPL: Control Panel item 20511# TLB: Type library 20512# OCX: OLE/ActiveX control 20513# ACM: Audio compression manager codec 20514# AX: DirectShow source filter 20515# IME: Input method editor 20516!:ext dll/cpl/tlb/ocx/acm/ax/ime 20517>>>>(0x3c.l+22) leshort&0x2000 0 (GUI) 20518# Screen savers typically include code from the scrnsave.lib static library, but 20519# that's not guaranteed. 20520!:ext exe/scr 20521>>>(0x3c.l+92) leshort 3 20522>>>>(0x3c.l+22) leshort&0x2000 >0 (console) 20523!:ext dll/cpl/tlb/ocx/acm/ax/ime 20524>>>>(0x3c.l+22) leshort&0x2000 0 (console) 20525!:ext exe/com 20526>>>(0x3c.l+92) leshort 7 (POSIX) 20527>>>(0x3c.l+92) leshort 9 (Windows CE) 20528>>>(0x3c.l+92) leshort 10 (EFI application) 20529>>>(0x3c.l+92) leshort 11 (EFI boot service driver) 20530>>>(0x3c.l+92) leshort 12 (EFI runtime driver) 20531>>>(0x3c.l+92) leshort 13 (EFI ROM) 20532>>>(0x3c.l+92) leshort 14 (XBOX) 20533>>>(0x3c.l+92) leshort 15 (Windows boot application) 20534>>>(0x3c.l+92) default x (Unknown subsystem 20535>>>>&0 leshort x 0x%x) 20536>>>(0x3c.l+4) leshort 0x14c Intel 80386 20537>>>(0x3c.l+4) leshort 0x166 MIPS R4000 20538>>>(0x3c.l+4) leshort 0x168 MIPS R10000 20539>>>(0x3c.l+4) leshort 0x184 Alpha 20540>>>(0x3c.l+4) leshort 0x1a2 Hitachi SH3 20541>>>(0x3c.l+4) leshort 0x1a6 Hitachi SH4 20542>>>(0x3c.l+4) leshort 0x1c0 ARM 20543>>>(0x3c.l+4) leshort 0x1c2 ARM Thumb 20544>>>(0x3c.l+4) leshort 0x1c4 ARMv7 Thumb 20545>>>(0x3c.l+4) leshort 0x1f0 PowerPC 20546>>>(0x3c.l+4) leshort 0x200 Intel Itanium 20547>>>(0x3c.l+4) leshort 0x266 MIPS16 20548>>>(0x3c.l+4) leshort 0x268 Motorola 68000 20549>>>(0x3c.l+4) leshort 0x290 PA-RISC 20550>>>(0x3c.l+4) leshort 0x366 MIPSIV 20551>>>(0x3c.l+4) leshort 0x466 MIPS16 with FPU 20552>>>(0x3c.l+4) leshort 0xebc EFI byte code 20553>>>(0x3c.l+4) leshort 0x8664 x86-64 20554>>>(0x3c.l+4) leshort 0xc0ee MSIL 20555>>>(0x3c.l+4) default x Unknown processor type 20556>>>>&0 leshort x 0x%x 20557>>>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB) 20558>>>(0x3c.l+22) leshort&0x1000 >0 system file 20559>>>(0x3c.l+24) leshort 0x010b 20560>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly 20561>>>(0x3c.l+24) leshort 0x020b 20562>>>>(0x3c.l+248) lelong >0 Mono/.Net assembly 20563 20564# hooray, there's a DOS extender using the PE format, with a valid PE 20565# executable inside (which just prints a message and exits if run in win) 20566>>>(8.s*16) string 32STUB \b, 32rtm DOS extender 20567>>>(8.s*16) string !32STUB \b, for MS Windows 20568>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed 20569>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed 20570>>>(0x3c.l+0xf8) search/0x140 UPX2 20571>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 20572>>>(0x3c.l+0xf8) search/0x140 .idata 20573>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) 20574>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive 20575>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive 20576>>>(0x3c.l+0xf8) search/0x140 .rsrc 20577>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive 20578>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive 20579>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive 20580>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive 20581>>>(0x3c.l+0xf8) search/0x140 .data 20582>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive 20583>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed 20584>>>>(0x3c.l+0xf7) byte x 20585>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive 20586>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive 20587>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive 20588>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) 20589>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive 20590>>>0x30 string Inno \b, InnoSetup self-extracting archive 20591 20592# Hmm, not a PE but the relocation table is too high for a traditional DOS exe, 20593# must be one of the unusual subformats. 20594>>(0x3c.l) string !PE\0\0 MS-DOS executable 20595!:mime application/x-dosexec 20596 20597>>(0x3c.l) string NE \b, NE 20598!:mime application/x-dosexec 20599>>>(0x3c.l+0x36) byte 1 for OS/2 1.x 20600>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x 20601>>>(0x3c.l+0x36) byte 3 for MS-DOS 20602>>>(0x3c.l+0x36) byte 4 for Windows 386 20603>>>(0x3c.l+0x36) byte 5 for Borland Operating System Services 20604>>>(0x3c.l+0x36) default x 20605>>>>(0x3c.l+0x36) byte x (unknown OS %x) 20606>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender 20607>>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font) 20608# DRV: Driver 20609# 3GR: Grabber device driver 20610# CPL: Control Panel Item 20611# VBX: Visual Basic Extension 20612# FON: Bitmap font 20613# FOT: Font resource file 20614!:ext dll/drv/3gr/cpl/vbx/fon/fot 20615>>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE) 20616!:ext exe/scr 20617>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive 20618>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) 20619 20620>>(0x3c.l) string LX\0\0 \b, LX 20621!:mime application/x-dosexec 20622>>>(0x3c.l+0x0a) leshort <1 (unknown OS) 20623>>>(0x3c.l+0x0a) leshort 1 for OS/2 20624>>>(0x3c.l+0x0a) leshort 2 for MS Windows 20625>>>(0x3c.l+0x0a) leshort 3 for DOS 20626>>>(0x3c.l+0x0a) leshort >3 (unknown OS) 20627>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) 20628>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) 20629>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) 20630>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) 20631>>>(0x3c.l+0x08) leshort 1 i80286 20632>>>(0x3c.l+0x08) leshort 2 i80386 20633>>>(0x3c.l+0x08) leshort 3 i80486 20634>>>(8.s*16) string emx \b, emx 20635>>>>&1 string x %s 20636>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive 20637 20638# MS Windows system file, supposedly a collection of LE executables 20639>>(0x3c.l) string W3 \b, W3 for MS Windows 20640!:mime application/x-dosexec 20641 20642>>(0x3c.l) string LE\0\0 \b, LE executable 20643!:mime application/x-dosexec 20644>>>(0x3c.l+0x0a) leshort 1 20645# some DOS extenders use LE files with OS/2 header 20646>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 20647>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender 20648>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender 20649>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender 20650>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) 20651>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) 20652>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) 20653# this is a wild guess; hopefully it is a specific signature 20654>>>>&0x24 lelong <0x50 20655>>>>>(&0x4c.l) string \xfc\xb8WATCOM 20656>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed 20657# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP 20658#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 20659# fails with DOS-Extenders. 20660>>>(0x3c.l+0x0a) leshort 2 for MS Windows 20661>>>(0x3c.l+0x0a) leshort 3 for DOS 20662>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) 20663# VXD: VxD for Windows 95/98/Me 20664# 386: VxD for Windows 2.10, 3.0, 3.1x 20665# PDR: Port driver 20666# MPD: Miniport driver (?) 20667!:ext vxd/386/pdr/mpd 20668>>>(&0x7c.l+0x26) string UPX \b, UPX compressed 20669>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive 20670 20671# looks like ASCII, probably some embedded copyright message. 20672# and definitely not NE/LE/LX/PE 20673>>0x3c lelong >0x20000000 20674>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS 20675!:mime application/x-dosexec 20676!:ext exe/com 20677# header data too small for extended executable 20678>2 long !0 20679>>0x18 leshort <0x40 20680>>>(4.s*512) leshort !0x014c 20681 20682>>>>&(2.s-514) string !LE 20683>>>>>&-2 string !BW \b, MZ for MS-DOS 20684!:mime application/x-dosexec 20685>>>>&(2.s-514) string LE \b, LE 20686>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender 20687# educated guess since indirection is still not capable enough for complex offset 20688# calculations (next embedded executable would be at &(&2*512+&0-2) 20689# I suspect there are only LE executables in these multi-exe files 20690>>>>&(2.s-514) string BW 20691>>>>>0x240 search/0x100 DOS/4G \b, LE for MS-DOS, DOS4GW DOS extender (embedded) 20692>>>>>0x240 search/0x100 !DOS/4G \b, BW collection for MS-DOS 20693 20694# This sequence skips to the first COFF segment, usually .text 20695>(4.s*512) leshort 0x014c \b, COFF 20696!:mime application/x-dosexec 20697>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender 20698>>(8.s*16) string emx 20699>>>&1 string x for DOS, Win or OS/2, emx %s 20700>>&(&0x42.l-3) byte x 20701>>>&0x26 string UPX \b, UPX compressed 20702# and yet another guess: small .text, and after large .data is unusal, could be 32lite 20703>>&0x2c search/0xa0 .text 20704>>>&0x0b lelong <0x2000 20705>>>>&0 lelong >0x6000 \b, 32lite compressed 20706 20707>(8.s*16) string $WdX \b, WDos/X DOS extender 20708 20709# By now an executable type should have been printed out. The executable 20710# may be a self-uncompressing archive, so look for evidence of that and 20711# print it out. 20712# 20713# Some signatures below from Greg Roelofs, newt@uchicago.edu. 20714# 20715>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed 20716>0xe7 string LH/2\ Self-Extract \b, %s 20717>0x1c string UC2X \b, UCEXE compressed 20718>0x1c string WWP\ \b, WWPACK compressed 20719>0x1c string RJSX \b, ARJ self-extracting archive 20720>0x1c string diet \b, diet compressed 20721>0x1c string LZ09 \b, LZEXE v0.90 compressed 20722>0x1c string LZ91 \b, LZEXE v0.91 compressed 20723>0x1c string tz \b, TinyProg compressed 20724>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. Self-extracting PKZIP archive 20725!:mime application/zip 20726# Yes, this really is "Copr", not "Corp." 20727>0x1e string PKLITE\ Copr. Self-extracting PKZIP archive 20728!:mime application/zip 20729# winarj stores a message in the stub instead of the sig in the MZ header 20730>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive 20731>0x20 string AIN 20732>>0x23 string 2 \b, AIN 2.x compressed 20733>>0x23 string <2 \b, AIN 1.x compressed 20734>>0x23 string >2 \b, AIN 1.x compressed 20735>0x24 string LHa's\ SFX \b, LHa self-extracting archive 20736!:mime application/x-lha 20737>0x24 string LHA's\ SFX \b, LHa self-extracting archive 20738!:mime application/x-lha 20739>0x24 string \ $ARX \b, ARX self-extracting archive 20740>0x24 string \ $LHarc \b, LHarc self-extracting archive 20741>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive 20742>0x40 string aPKG \b, aPackage self-extracting archive 20743>0x64 string W\ Collis\0\0 \b, Compack compressed 20744>0x7a string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive 20745>>&0xf4 search/0x140 \x0\x40\x1\x0 20746>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive 20747>1638 string -lh5- \b, LHa self-extracting archive v2.13S 20748>0x17888 string Rar! \b, RAR self-extracting archive 20749 20750# Skip to the end of the EXE. This will usually work fine in the PE case 20751# because the MZ image is hardcoded into the toolchain and almost certainly 20752# won't match any of these signatures. 20753>(4.s*512) long x 20754>>&(2.s-517) byte x 20755>>>&0 string PK\3\4 \b, ZIP self-extracting archive 20756>>>&0 string Rar! \b, RAR self-extracting archive 20757>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive 20758>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive 20759>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive 20760>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive 20761>>>&7 search/400 **ACE** \b, ACE self-extracting archive 20762>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive 20763 20764# a few unknown ZIP sfxes, no idea if they are needed or if they are 20765# already captured by the generic patterns above 20766>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) 20767# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive 20768# 20769 20770# TELVOX Teleinformatica CODEC self-extractor for OS/2: 20771>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 20772>>49824 leshort =1 \b, 1 file 20773>>49824 leshort >1 \b, %u files 20774 20775# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc 20776# and https://www.freedos.org/software/?prog=kpdos 20777# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD 207780 string/b KCF FreeDOS KEYBoard Layout collection 20779# only version=0x100 found 20780>3 uleshort x \b, version 0x%x 20781# length of string containing author,info and special characters 20782>6 ubyte >0 20783#>>6 pstring x \b, name=%s 20784>>7 string >\0 \b, author=%-.14s 20785>>7 search/254 \xff \b, info= 20786#>>>&0 string x \b%-s 20787>>>&0 string x \b%-.15s 20788# for FreeDOS *.KL files 207890 string/b KLF FreeDOS KEYBoard Layout file 20790# only version=0x100 or 0x101 found 20791>3 uleshort x \b, version 0x%x 20792# stringlength 20793>5 ubyte >0 20794>>8 string x \b, name=%-.2s 207950 string \xffKEYB\ \ \ \0\0\0\0 20796>12 string \0\0\0\0`\004\360 MS-DOS KEYBoard Layout file 20797 20798# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017 20799# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009 208000 ulequad&0x07a0ffffffff 0xffffffff 20801>0 use msdos-driver 208020 name msdos-driver DOS executable ( 20803#!:mime application/octet-stream 20804!:mime application/x-dosdriver 20805# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN 20806!:ext sys/dev/bin 20807>40 search/7 UPX! \bUPX compressed 20808# DOS device driver attributes 20809>4 uleshort&0x8000 0x0000 \bblock device driver 20810# character device 20811>4 uleshort&0x8000 0x8000 \b 20812>>4 uleshort&0x0008 0x0008 \bclock 20813# fast video output by int 29h 20814>>4 uleshort&0x0010 0x0010 \bfast 20815# standard input/output device 20816>>4 uleshort&0x0003 >0 \bstandard 20817>>>4 uleshort&0x0001 0x0001 \binput 20818>>>4 uleshort&0x0003 0x0003 \b/ 20819>>>4 uleshort&0x0002 0x0002 \boutput 20820>>4 uleshort&0x8000 0x8000 \bcharacter device driver 20821>0 ubyte x 20822# upx compressed device driver has garbage instead of real in name field of header 20823>>40 search/7 UPX! 20824>>40 default x 20825# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped 20826>>>12 ubyte >0x2E \b 20827>>>>10 ubyte >0x20 20828>>>>>10 ubyte !0x2E 20829>>>>>>10 ubyte !0x2A \b%c 20830>>>>11 ubyte >0x20 20831>>>>>11 ubyte !0x2E \b%c 20832>>>>12 ubyte >0x20 20833>>>>>12 ubyte !0x39 20834>>>>>>12 ubyte !0x2E \b%c 20835>>>13 ubyte >0x20 20836>>>>13 ubyte !0x2E \b%c 20837>>>>14 ubyte >0x20 20838>>>>>14 ubyte !0x2E \b%c 20839>>>>15 ubyte >0x20 20840>>>>>15 ubyte !0x2E \b%c 20841>>>>16 ubyte >0x20 20842>>>>>16 ubyte !0x2E 20843>>>>>>16 ubyte <0xCB \b%c 20844>>>>17 ubyte >0x20 20845>>>>>17 ubyte !0x2E 20846>>>>>>17 ubyte <0x90 \b%c 20847# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field 20848>>>12 ubyte <0x2F 20849# they have their real name at offset 22 20850# also block device drivers like DUMBDRV.SYS 20851>>>>22 string >\056 %-.6s 20852>4 uleshort&0x8000 0x0000 20853# 32 bit sector addressing ( > 32 MB) for block devices 20854>>4 uleshort&0x0002 0x0002 \b,32-bit sector- 20855# support by driver functions 13h, 17h, 18h 20856>4 uleshort&0x0040 0x0040 \b,IOCTL- 20857# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh 20858>4 uleshort&0x0800 0x0800 \b,close media- 20859# output until busy support by int 10h for character device driver 20860>4 uleshort&0x8000 0x8000 20861>>4 uleshort&0x2000 0x2000 \b,until busy- 20862# direct read/write support by driver functions 03h,0Ch 20863>4 uleshort&0x4000 0x4000 \b,control strings- 20864>4 uleshort&0x8000 0x8000 20865>>4 uleshort&0x6840 >0 \bsupport 20866>4 uleshort&0x8000 0x0000 20867>>4 uleshort&0x4842 >0 \bsupport 20868>0 ubyte x \b) 20869# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 208700 ulequad 0x0513c00000000012 20871>0 use msdos-driver 20872# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field 208730 ulequad 0x32f28000ffff0016 20874>0 use msdos-driver 208750 ulequad 0x007f00000000ffff 20876>0 use msdos-driver 208770 ulequad 0x001600000000ffff 20878>0 use msdos-driver 20879# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field 208800 ulequad 0x0bf708c2ffffffff 20881>0 use msdos-driver 208820 ulequad 0x07bd08c2ffffffff 20883>0 use msdos-driver 20884 20885# updated by Joerg Jenderek 20886# GRR: line below too general as it catches also 20887# rt.lib DYADISKS.PIC and many more 20888# start with assembler instruction MOV 208890 ubyte 0x8c 20890# skip "AppleWorks word processor data" like ARTICLE.1 ./apple 20891>4 string !O==== 20892# skip some unknown basic binaries like RocketRnger.SHR 20893>>5 string !MAIN 20894# skip "GPG symmetrically encrypted data" ./gnu 20895# skip "PGP symmetric key encrypted data" ./pgp 20896# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type 20897>>>4 ubyte >13 DOS executable (COM, 0x8C-variant) 20898# the remaining files should be DOS *.COM executables 20899# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd 20900# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4 20901# UNDELETE.COM 8cca 2e8916 6503 b430 cd21 8b 2e0200 8b 20902# BOOTFIX.COM 8cca 2e8916 9603 b430 cd21 8b 2e0200 8b 20903# RAWRITE3.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 20904# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b 20905# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e 20906# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e 20907!:mime application/x-dosexec 20908!:ext com 20909 20910# updated by Joerg Jenderek at Oct 2008 209110 ulelong 0xffff10eb DR-DOS executable (COM) 20912# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb 209130 ubeshort&0xeb8d >0xeb00 20914# DR-DOS STACKER.COM SCREATE.SYS missed 20915 209160 name msdos-com 20917>0 byte x DOS executable (COM) 20918!:mime application/x-dosexec 20919!:ext com 20920>6 string SFX\ of\ LHarc \b, %s 20921>0x1FE leshort 0xAA55 \b, boot code 20922>85 string UPX \b, UPX compressed 20923>4 string \ $ARX \b, ARX self-extracting archive 20924>4 string \ $LHarc \b, LHarc self-extracting archive 20925>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive 20926 20927# JMP 8bit 209280 byte 0xeb 20929# allow forward jumps only 20930>1 byte >-1 20931# that offset must be accessible 20932>>(1.b+2) byte x 20933>>>0 use msdos-com 20934 20935# JMP 16bit 209360 byte 0xe9 20937# forward jumps 20938>1 short >-1 20939# that offset must be accessible 20940>>(1.s+3) byte x 20941>>>0 use msdos-com 20942# negative offset, must not lead into PSP 20943>1 short <-259 20944# that offset must be accessible 20945>>(1,s+65539) byte x 20946>>>0 use msdos-com 20947 20948# updated by Joerg Jenderek at Oct 2008,2015 20949# following line is too general 209500 ubyte 0xb8 20951# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux 20952>0 string !\xb8\xc0\x07\x8e 20953# modified by Joerg Jenderek 20954# syslinux COM32 or COM32R executable 20955>>1 lelong&0xFFFFFFFe 0x21CD4CFe COM executable (32-bit COMBOOT 20956# https://www.syslinux.org/wiki/index.php/Comboot_API 20957# Since version 5.00 c32 modules switched from the COM32 object format to ELF 20958!:mime application/x-c32-comboot-syslinux-exec 20959!:ext c32 20960# https://syslinux.zytor.com/comboot.php 20961# older syslinux version ( <4 ) 20962# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode 20963# start with assembler instructions mov eax,21cd4cffh 20964>>>1 lelong 0x21CD4CFf \b) 20965# syslinux:doc/comboot.txt 20966# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov 20967# eax,21cd4cfeh) as a magic number. 20968# syslinux version (4.x) 20969# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID 20970>>>1 lelong 0x21CD4CFe \b, relocatable) 20971# remaining are DOS COM executables starting with assembler instruction MOV 20972# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM 20973# MS-DOS SYS.COM RESTART.COM 20974# SYSLINUX.COM (version 1.40 - 2.13) 20975# GFXBOOT.COM (version 3.75) 20976# COPYBS.COM POWEROFF.COM INT18.COM 20977>>1 default x COM executable for DOS 20978!:mime application/x-dosexec 20979#!:mime application/x-ms-dos-executable 20980#!:mime application/x-msdos-program 20981!:ext com 20982 209830 string/b \x81\xfc 20984>4 string \x77\x02\xcd\x20\xb9 20985>>36 string UPX! FREE-DOS executable (COM), UPX compressed 20986!:mime application/x-dosexec 20987!:ext com 20988252 string Must\ have\ DOS\ version DR-DOS executable (COM) 20989!:mime application/x-dosexec 20990!:ext com 20991# added by Joerg Jenderek at Oct 2008 20992# GRR search is not working 20993#34 search/2 UPX! FREE-DOS executable (COM), UPX compressed 2099434 string UPX! FREE-DOS executable (COM), UPX compressed 20995!:mime application/x-dosexec 20996!:ext com 2099735 string UPX! FREE-DOS executable (COM), UPX compressed 20998!:mime application/x-dosexec 20999!:ext com 21000# GRR search is not working 21001#2 search/28 \xcd\x21 COM executable for MS-DOS 21002#WHICHFAT.cOM 210032 string \xcd\x21 COM executable for DOS 21004!:mime application/x-dosexec 21005!:ext com 21006#DELTREE.cOM DELTREE2.cOM 210074 string \xcd\x21 COM executable for DOS 21008!:mime application/x-dosexec 21009!:ext com 21010#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM 210115 string \xcd\x21 COM executable for DOS 21012!:mime application/x-dosexec 21013!:ext com 21014#DELTMP.COm HASFAT32.cOM 210157 string \xcd\x21 21016>0 byte !0xb8 COM executable for DOS 21017!:mime application/x-dosexec 21018!:ext com 21019#COMP.cOM MORE.COm 2102010 string \xcd\x21 21021>5 string !\xcd\x21 COM executable for DOS 21022!:mime application/x-dosexec 21023!:ext com 21024#comecho.com 2102513 string \xcd\x21 COM executable for DOS 21026!:mime application/x-dosexec 21027!:ext com 21028#HELP.COm EDIT.coM 2102918 string \xcd\x21 COM executable for MS-DOS 21030!:mime application/x-dosexec 21031!:ext com 21032#NWRPLTRM.COm 2103323 string \xcd\x21 COM executable for MS-DOS 21034!:mime application/x-dosexec 21035!:ext com 21036#LOADFIX.cOm LOADFIX.cOm 2103730 string \xcd\x21 COM executable for MS-DOS 21038!:mime application/x-dosexec 21039!:ext com 21040#syslinux.com 3.11 2104170 string \xcd\x21 COM executable for DOS 21042!:mime application/x-dosexec 21043!:ext com 21044# many compressed/converted COMs start with a copy loop instead of a jump 210450x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS 21046!:mime application/x-dosexec 21047!:ext com 210480x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS 21049!:mime application/x-dosexec 21050!:ext com 21051>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 210520x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed 21053!:mime application/x-dosexec 21054!:ext com 21055# FIXME: missing diet .com compression 21056 21057# miscellaneous formats 210580 string/b LZ MS-DOS executable (built-in) 21059#0 byte 0xf0 MS-DOS program library data 21060# 21061 21062# AAF files: 21063# <stuartc@rd.bbc.co.uk> Stuart Cunningham 210640 string/b \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage 21065>30 byte 9 (512B sectors) 21066>30 byte 12 (4kB sectors) 210670 string/b \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage 21068>30 byte 9 (512B sectors) 21069>30 byte 12 (4kB sectors) 21070 21071# Popular applications 210722080 string Microsoft\ Word\ 6.0\ Document %s 21073!:mime application/msword 210742080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data 21075!:mime application/msword 21076# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) 210772112 string MSWordDoc Microsoft Word document data 21078!:mime application/msword 21079# 210800 belong 0x31be0000 Microsoft Word Document 21081!:mime application/msword 21082# 210830 string/b PO^Q` Microsoft Word 6.0 Document 21084!:mime application/msword 21085# 210864 long 0 21087>0 belong 0xfe320000 Microsoft Word for Macintosh 1.0 21088!:mime application/msword 21089!:ext mcw 21090>0 belong 0xfe340000 Microsoft Word for Macintosh 3.0 21091!:mime application/msword 21092!:ext mcw 21093>0 belong 0xfe37001c Microsoft Word for Macintosh 4.0 21094!:mime application/msword 21095!:ext mcw 21096>0 belong 0xfe370023 Microsoft Word for Macintosh 5.0 21097!:mime application/msword 21098!:ext mcw 21099 211000 string/b \333\245-\0\0\0 Microsoft Word 2.0 Document 21101!:mime application/msword 21102!:ext doc 21103# Note: seems already recognized as "OLE 2 Compound Document" in ./ole2compounddocs 21104#512 string/b \354\245\301 Microsoft Word Document 21105#!:mime application/msword 21106 21107# 211080 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 21109!:mime application/msword 21110# 211112080 string Microsoft\ Excel\ 5.0\ Worksheet %s 21112!:mime application/vnd.ms-excel 21113# 211140 string/b \xDB\xA5\x2D\x00 Microsoft WinWord 2.0 Document 21115!:mime application/msword 21116 211172080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s 21118!:mime application/vnd.ms-excel 21119# 21120# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) 211212114 string Biff5 Microsoft Excel 5.0 Worksheet 21122!:mime application/vnd.ms-excel 21123# Italian MS-Excel 211242121 string Biff5 Microsoft Excel 5.0 Worksheet 21125!:mime application/vnd.ms-excel 211260 string/b \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet 21127!:mime application/vnd.ms-excel 21128# 21129# Update: Joerg Jenderek 21130# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3 21131# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf 21132# Note: newer Lotus versions >2 use longer BOF record 21133# record type (BeginningOfFile=0000h) + length (001Ah) 211340 belong 0x00001a00 21135# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3 21136#>18 uleshort&0x73E0 0 21137# Lotus Multi Byte Character Set (LMBCS=1-31) 21138>20 ubyte >0 21139>>20 ubyte <32 Lotus 1-2-3 21140#!:mime application/x-123 21141!:mime application/vnd.lotus-1-2-3 21142!:apple ????L123 21143# (version 5.26) labeled the entry as "Lotus 1-2-3 wk3 document data" 21144>>>4 uleshort 0x1000 WorKsheet, version 3 21145!:ext wk3 21146# (version 5.26) labeled the entry as "Lotus 1-2-3 wk4 document data" 21147>>>4 uleshort 0x1002 WorKsheet, version 4 21148# also worksheet template 4 (.wt4) 21149!:ext wk4/wt4 21150# no example or documentation for wk5 21151#>>4 uleshort 0x???? WorKsheet, version 4 21152#!:ext wk5 21153# only MacrotoScript.123 example 21154>>>4 uleshort 0x1003 WorKsheet, version 97 21155# also worksheet template Smartmaster (.12M)? 21156!:ext 123 21157# only Set_Y2K.123 example 21158>>>4 uleshort 0x1005 WorKsheet, version 9.8 Millennium 21159!:ext 123 21160# no example for this version 21161>>>4 uleshort 0x8001 FoRMatting data 21162!:ext frm 21163# (version 5.26) labeled the entry as "Lotus 1-2-3 fm3 or fmb document data" 21164# TrID labeles the entry as "Formatting Data for Lotus 1-2-3 worksheet" 21165>>>4 uleshort 0x8007 ForMatting data, version 3 21166!:ext fm3 21167>>>4 default x unknown 21168# file revision sub code 0004h for worksheets 21169>>>>6 uleshort =0x0004 worksheet 21170!:ext wXX 21171>>>>6 uleshort !0x0004 formatting data 21172!:ext fXX 21173# main revision number 21174>>>>4 uleshort x \b, revision 0x%x 21175>>>6 uleshort =0x0004 \b, cell range 21176# active cellcoord range (start row, page,column ; end row, page, column) 21177# start values normally 0~1st sheet A1 21178>>>>8 ulelong !0 21179>>>>>10 ubyte >0 \b%d* 21180>>>>>8 uleshort x \b%d, 21181>>>>>11 ubyte x \b%d- 21182# end page mostly 0 21183>>>>14 ubyte >0 \b%d* 21184# end raw, column normally not 0 21185>>>>12 uleshort x \b%d, 21186>>>>15 ubyte x \b%d 21187# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??) 21188>>>>20 ubyte >1 \b, character set 0x%x 21189# flags 21190>>>>21 ubyte x \b, flags 0x%x 21191>>>6 uleshort !0x0004 21192# record type (FONTNAME=00AEh) 21193>>>>30 search/29 \0\xAE 21194# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n) 21195>>>>>&4 string >\0 \b, 1st font "%s" 21196# 21197# Update: Joerg Jenderek 21198# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3 21199# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT 21200# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x 21201# record type (BeginningOfFile=0000h) + length (0002h) 212020 belong 0x00000200 21203# GRR: line above is too general as it catches also MS Windows CURsor 21204# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1) 21205!:strength -1 21206# skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h 21207>7 ubyte 0 21208# skip Windows cursors with image width 256 and keep Lotus with positiv opcode 21209>>6 ubyte >0 Lotus 21210# !:mime application/x-123 21211!:mime application/vnd.lotus-1-2-3 21212!:apple ????L123 21213# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...) 21214# undocumented; (version 5.26) labeled the configurations as "Lotus 1-2-3" 21215>>>4 uleshort 0x0007 1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF) 21216!:ext cnf 21217>>>4 uleshort 0x0C05 1-2-3 CoNFiguration, version 2.4J 21218!:ext cnf 21219>>>4 uleshort 0x0801 1-2-3 CoNFiguration, version 1-2.1 21220!:ext cnf 21221>>>4 uleshort 0x0802 Symphony CoNFiguration 21222!:ext cnf 21223>>>4 uleshort 0x0804 1-2-3 CoNFiguration, version 2.2 21224!:ext cnf 21225>>>4 uleshort 0x080A 1-2-3 CoNFiguration, version 2.3-2.4 21226!:ext cnf 21227>>>4 uleshort 0x1402 1-2-3 CoNFiguration, version 3.x 21228!:ext cnf 21229>>>4 uleshort 0x1450 1-2-3 CoNFiguration, version 4.x 21230!:ext cnf 21231# (version 5.26) labeled the entry as "Lotus 123" 21232# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 21233>>>4 uleshort 0x0404 1-2-3 WorKSheet, version 1 21234# extension "wks" also for Microsoft Works document 21235!:ext wks 21236# (version 5.26) labeled the entry as "Lotus 123" 21237# TrID labeles the entry as "Lotus 123 Worksheet (generic)" 21238>>>4 uleshort 0x0405 Symphony WoRksheet, version 1.0 21239!:ext wrk/wr1 21240# (version 5.26) labeled the entry as "Lotus 1-2-3 wk1 document data" 21241# TrID labeles the entry as "Lotus 123 Worksheet (V2)" 21242>>>4 uleshort 0x0406 1-2-3/Symphony worksheet, version 2 21243# Symphony (.wr1) 21244!:ext wk1/wr1 21245# no example for this japan version 21246>>>4 uleshort 0x0600 1-2-3 WorKsheet, version 1.xJ 21247!:ext wj1 21248# no example or documentation for wk2 21249#>>>4 uleshort 0x???? 1-2-3 WorKsheet, version 2 21250#!:ext wk2 21251# undocumented japan version 21252>>>4 uleshort 0x0602 1-2-3 worksheet, version 2.4J 21253!:ext wj3 21254# (version 5.26) labeled the entry as "Lotus 1-2-3 fmt document data" 21255>>>4 uleshort 0x8006 1-2-3 ForMaTting data, version 2.x 21256# japan version 2.4J (fj3) 21257!:ext fmt/fj3 21258# no example for this version 21259>>>4 uleshort 0x8007 1-2-3 FoRMatting data, version 2.0 21260!:ext frm 21261# (version 5.26) labeled the entry as "Lotus 1-2-3" 21262>>>4 default x unknown worksheet or configuration 21263!:ext cnf 21264>>>>4 uleshort x \b, revision 0x%x 21265# 2nd record for most worksheets describes cells range 21266>>>6 use lotus-cells 21267# 3nd record for most japan worksheets describes cells range 21268>>>(8.s+10) use lotus-cells 21269# check and then display Lotus worksheet cells range 212700 name lotus-cells 21271# look for type (RANGE=0006h) + length (0008h) at record begin 21272>0 ubelong 0x06000800 \b, cell range 21273# cell range (start column, row, end column, row) start values normally 0,0~A1 cell 21274>>4 ulong !0 21275>>>4 uleshort x \b%d, 21276>>>6 uleshort x \b%d- 21277# end of cell range 21278>>8 uleshort x \b%d, 21279>>10 uleshort x \b%d 21280# EndOfLotus123 212810 string/b WordPro\0 Lotus WordPro 21282!:mime application/vnd.lotus-wordpro 212830 string/b WordPro\r\373 Lotus WordPro 21284!:mime application/vnd.lotus-wordpro 21285 21286 21287# Summary: Script used by InstallScield to uninstall applications 21288# Extension: .isu 21289# Submitted by: unknown 21290# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry) 212910 string \x71\xa8\x00\x00\x01\x02 21292>12 string Stirling\ Technologies, InstallShield Uninstall Script 21293 21294# Winamp .avs 21295#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player 212960 string/b Nullsoft\ AVS\ Preset\ Winamp plug in 21297 21298# Windows Metafile .WMF 212990 string/b \327\315\306\232 Windows metafile 21300!:mime image/wmf 21301!:ext wmf 213020 string/b \002\000\011\000 Windows metafile 21303!:mime image/wmf 21304!:ext wmf 213050 string/b \001\000\011\000 Windows metafile 21306!:mime image/wmf 21307!:ext wmf 21308 21309#tz3 files whatever that is (MS Works files) 213100 string/b \003\001\001\004\070\001\000\000 tz3 ms-works file 213110 string/b \003\002\001\004\070\001\000\000 tz3 ms-works file 213120 string/b \003\003\001\004\070\001\000\000 tz3 ms-works file 21313 21314# PGP sig files .sig 21315#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig 213160 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig 213170 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig 213180 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig 213190 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig 213200 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig 213210 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig 21322 21323# windows zips files .dmf 213240 string/b MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file 21325 21326 21327#ico files 213280 string/b \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows 21329 21330# Windows icons 21331# Update: Joerg Jenderek 21332# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 21333# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG 213340 belong 0x00000100 21335>9 byte 0 21336>>0 byte x 21337>>0 use cur-ico-dir 21338>9 ubyte 0xff 21339>>0 byte x 21340>>0 use cur-ico-dir 21341# displays number of icons and information for icon or cursor 213420 name cur-ico-dir 21343# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with 21344# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h 21345>18 ulelong &0x00000006 21346# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG) 21347>>(18.l) ulelong x MS Windows 21348>>>0 ubelong 0x00000100 icon resource 21349# https://www.iana.org/assignments/media-types/image/vnd.microsoft.icon 21350!:mime image/vnd.microsoft.icon 21351#!:mime image/x-icon 21352!:ext ico 21353>>>>4 uleshort x - %d icon 21354# plural s 21355>>>>4 uleshort >1 \bs 21356# 1st icon 21357>>>>0x06 use ico-entry 21358# 2nd icon 21359>>>>4 uleshort >1 21360>>>>>0x16 use ico-entry 21361>>>0 ubelong 0x00000200 cursor resource 21362#!:mime image/x-cur 21363!:mime image/x-win-bitmap 21364!:ext cur 21365>>>>4 uleshort x - %d icon 21366>>>>4 uleshort >1 \bs 21367# 1st cursor 21368>>>>0x06 use cur-entry 21369#>>>>0x16 use cur-entry 21370# display information of one cursor entry 213710 name cur-entry 21372>0 use cur-ico-entry 21373>4 uleshort x \b, hotspot @%dx 21374>6 uleshort x \b%d 21375# display information of one icon entry 213760 name ico-entry 21377>0 use cur-ico-entry 21378# normally 0 1 but also found 14 21379>4 uleshort >1 \b, %d planes 21380# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256 21381>6 uleshort >1 \b, %d bits/pixel 21382# display shared information of cursor or icon entry 213830 name cur-ico-entry 21384>0 byte =0 \b, 256x 21385>0 byte !0 \b, %dx 21386>1 byte =0 \b256 21387>1 byte !0 \b%d 21388# number of colors in palette 21389>2 ubyte !0 \b, %d colors 21390# reserved 0 FFh 21391#>3 ubyte x \b, reserved %x 21392#>8 ulelong x \b, image size %d 21393# offset of PNG or DIB image 21394#>12 ulelong x \b, offset 0x%x 21395# PNG header (\x89PNG) 21396>(12.l) ubelong =0x89504e47 21397# 1 space char after "with" to get phrase "with PNG image" by magic in ./images 21398>>&-4 indirect x \b with 21399# DIB image 21400>(12.l) ubelong !0x89504e47 21401#>>&-4 use dib-image 21402 21403# Windows non-animated cursors 21404# Update: Joerg Jenderek 21405# URL: https://en.wikipedia.org/wiki/CUR_(file_format) 21406# Note: similar to Windows ICOn. container for BMP ( only DIB part) 21407# GRR: line below is too general as it catches also Lotus 1-2-3 files 214080 belong 0x00000200 21409>9 byte 0 21410>>0 use cur-ico-dir 21411>9 ubyte 0xff 21412>>0 use cur-ico-dir 21413 21414# .chr files 214150 string/b PK\010\010BGI Borland font 21416>4 string >\0 %s 21417# then there is a copyright notice 21418 21419 21420# .bgi files 214210 string/b pk\010\010BGI Borland device 21422>4 string >\0 %s 21423# then there is a copyright notice 21424 21425 21426# Windows Recycle Bin record file (named INFO2) 21427# By Abel Cheung (abelcheung AT gmail dot com) 21428# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes 21429# Since Vista uses another structure, INFO2 structure probably won't change 21430# anymore. Detailed analysis in: 21431# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf 214320 lelong 0x00000004 21433>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below) 21434 214350 lelong 0x00000005 21436>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP) 21437 21438# From Doug Lee via a FreeBSD pr 214399 string GERBILDOC First Choice document 214409 string GERBILDB First Choice database 214419 string GERBILCLIP First Choice database 214420 string GERBIL First Choice device file 214439 string RABBITGRAPH RabbitGraph file 214440 string DCU1 Borland Delphi .DCU file 214450 string =!<spell> MKS Spell hash list (old format) 214460 string =!<spell2> MKS Spell hash list 21447# Too simple - MPi 21448#0 string AH Halo(TM) bitmapped font file 214490 lelong 0x08086b70 TurboC BGI file 214500 lelong 0x08084b50 TurboC Font file 21451 21452# Debian#712046: The magic below identifies "Delphi compiled form data". 21453# An additional source of information is available at: 21454# http://www.woodmann.com/fravia/dafix_t1.htm 214550 string TPF0 21456>4 pstring >\0 Delphi compiled form '%s' 21457 21458# tests for DBase files moved, updated and merged to database 21459 214600 string PMCC Windows 3.x .GRP file 214611 string RDC-meg MegaDots 21462>8 byte >0x2F version %c 21463>9 byte >0x2F \b.%c file 214640 lelong 0x4C 21465>4 lelong 0x00021401 Windows shortcut file 21466 21467# .PIF files added by Joerg Jenderek from https://smsoft.ru/en/pifdoc.htm 21468# only for windows versions equal or greater 3.0 214690x171 string MICROSOFT\ PIFEX\0 Windows Program Information File 21470!:mime application/x-dosexec 21471!:ext pif 21472#>2 string >\0 \b, Title:%.30s 21473>0x24 string >\0 \b for %.63s 21474>0x65 string >\0 \b, directory=%.64s 21475>0xA5 string >\0 \b, parameters=%.64s 21476#>0x181 leshort x \b, offset %x 21477#>0x183 leshort x \b, offsetdata %x 21478#>0x185 leshort x \b, section length %x 21479>0x187 search/0xB55 WINDOWS\ VMM\ 4.0\0 21480>>&0x5e ubyte >0 21481>>>&-1 string <PIFMGR.DLL \b, icon=%s 21482#>>>&-1 string PIFMGR.DLL \b, icon=%s 21483>>>&-1 string >PIFMGR.DLL \b, icon=%s 21484>>&0xF0 ubyte >0 21485>>>&-1 string <Terminal \b, font=%.32s 21486#>>>&-1 string =Terminal \b, font=%.32s 21487>>>&-1 string >Terminal \b, font=%.32s 21488>>&0x110 ubyte >0 21489>>>&-1 string <Lucida\ Console \b, TrueTypeFont=%.32s 21490#>>>&-1 string =Lucida\ Console \b, TrueTypeFont=%.32s 21491>>>&-1 string >Lucida\ Console \b, TrueTypeFont=%.32s 21492#>0x187 search/0xB55 WINDOWS\ 286\ 3.0\0 \b, Windows 3.X standard mode-style 21493#>0x187 search/0xB55 WINDOWS\ 386\ 3.0\0 \b, Windows 3.X enhanced mode-style 21494>0x187 search/0xB55 WINDOWS\ NT\ \ 3.1\0 \b, Windows NT-style 21495#>0x187 search/0xB55 WINDOWS\ NT\ \ 4.0\0 \b, Windows NT-style 21496>0x187 search/0xB55 CONFIG\ \ SYS\ 4.0\0 \b +CONFIG.SYS 21497#>>&06 string x \b:%s 21498>0x187 search/0xB55 AUTOEXECBAT\ 4.0\0 \b +AUTOEXEC.BAT 21499#>>&06 string x \b:%s 21500 21501# DOS EPS Binary File Header 21502# From: Ed Sznyter <ews@Black.Market.NET> 215030 belong 0xC5D0D3C6 DOS EPS Binary File 21504!:mime image/x-eps 21505>4 long >0 Postscript starts at byte %d 21506>>8 long >0 length %d 21507>>>12 long >0 Metafile starts at byte %d 21508>>>>16 long >0 length %d 21509>>>20 long >0 TIFF starts at byte %d 21510>>>>24 long >0 length %d 21511 21512# TNEF magic From "Joomy" <joomy@se-ed.net> 21513# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF) 215140 lelong 0x223e9f78 TNEF 21515!:mime application/vnd.ms-tnef 21516 21517# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C 21518# of http://www.davep.org/norton-guides/ng2h-105.tgz 21519# https://en.wikipedia.org/wiki/Norton_Guides 215200 string NG\0\001 21521# only value 0x100 found at offset 2 21522>2 ulelong 0x00000100 Norton Guide 21523# Title[40] 21524>>8 string >\0 "%-.40s" 21525#>>6 uleshort x \b, MenuCount=%u 21526# szCredits[5][66] 21527>>48 string >\0 \b, %-.66s 21528>>114 string >\0 %-.66s 21529 21530# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 21531# of https://www.4dos.info/ 21532# pointer,HelpID[8]=4DHnnnmm 215330 ulelong 0x48443408 4DOS help file 21534>4 string x \b, version %-4.4s 21535 21536# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp 215370 ulequad 0x3a000000024e4c MS Advisor help file 21538 21539# HtmlHelp files (.chm) 215400 string/b ITSF\003\000\000\000\x60\000\000\000 MS Windows HtmlHelp Data 21541 21542# GFA-BASIC (Wolfram Kleff) 215432 string/b GFA-BASIC3 GFA-BASIC 3 data 21544 21545#------------------------------------------------------------------------------ 21546# From Stuart Caie <kyzer@4u.net> (developer of cabextract) 21547# Update: Joerg Jenderek 21548# URL: https://en.wikipedia.org/wiki/Cabinet_(file_format) 21549# Reference: https://msdn.microsoft.com/en-us/library/bb267310.aspx 21550# Note: verified by `7z l *.cab` 21551# Microsoft Cabinet files 215520 string/b MSCF\0\0\0\0 Microsoft Cabinet archive data 21553# 21554# https://support.microsoft.com/en-us/help/973559/frequently-asked-questions-about-the-microsoft-support-diagnostic-tool 21555# CAB with *.{diagcfg,diagpkg} is used by Microsoft Support Diagnostic Tool MSDT.EXE 21556# because some archive does not have *.diag* as 1st or 2nd archive member like 21557# O15CTRRemove.diagcab or AzureStorageAnalyticsLogs_global.DiagCab 21558# brute looking after header for filenames with diagcfg or diagpkg extension in CFFILE section 21559>0x2c search/980/c .diag \b, Diagnostic 21560!:mime application/vnd.ms-cab-compressed 21561!:ext diagcab 21562# http://fileformats.archiveteam.org/wiki/PUZ 21563# Microsoft Publisher version about 2003 has a "Pack and Go" feature that 21564# bundles a Publisher document *PNG.pub with all links into a CAB 21565>0x2c search/300/c png.pub\0 \b, Publisher Packed and Go 21566!:mime application/vnd.ms-cab-compressed 21567!:ext puz 21568# ppz variant with Microsoft PowerPoint Viewer ppview32.exe to play PowerPoint presentation 21569>0x2c search/17/c ppview32.exe\0 \b, PowerPoint Viewer Packed and Go 21570!:mime application/vnd.ms-powerpoint 21571#!:mime application/mspowerpoint 21572!:ext ppz 21573# http://www.incredimail.com/ 21574# IncrediMail CAB contains an initialisation file "content.ini" like in im2.ims 21575>0x2c search/3369/c content.ini\0 \b, IncrediMail 21576!:mime application/x-incredimail 21577# member Flavor.htm implies IncrediMail ecard like in tell_a_friend.imf 21578>>0x2c search/83/c Flavor.htm\0 ecard 21579!:ext imf 21580# member Macromedia Flash data *.swf implies IncrediMail skin like in im2.ims 21581>>0x2c search/211/c .swf\0 skin 21582!:ext ims 21583# member anim.im3 implies IncrediMail animation like in letter_fold.ima 21584>>0x2c search/92/c anim.im3\0 animation 21585!:ext ima 21586# other IncrediMail cab archive 21587>>0x2c default x 21588>>>0x2c search/116/c thumb ecard, image, notifier or skin 21589!:ext imf/imi/imn/ims 21590# http://file-extension.net/seeker/file_extension_ime 21591>>>0x2c default x emoticons or sound 21592!:ext ime/imw 21593# no Diagnostic and IncrediMail 21594>0x2c default x 21595# look for 1st member name 21596>>(16.l+16) ubyte x 21597# https://en.wikipedia.org/wiki/SNP_file_format 21598>>>&-1 string/c _accrpt_.snp \b, Access report snapshot 21599!:mime application/msaccess 21600!:ext snp 21601# https://www.cabextract.org.uk/wince_cab_format/ 21602# extension of DOS 8+3 name with ".000" of 1st archive member name implies Windows CE installer 21603>>>&7 string =.000 \b, WinCE install 21604!:mime application/vnd.ms-cab-compressed 21605!:ext cab 21606 21607# https://support.microsoft.com/kb/934307/en-US 21608# All inspected MSU contain a file with name WSUSSCAN.cab 21609# that is called "Windows Update meta data" by Microsoft 21610>>>&-1 string/c wsusscan.cab \b, Microsoft Standalone Update 21611!:mime application/vnd.ms-cab-compressed 21612!:ext msu 21613>>>&-1 default x 21614# look at point charcter of 1st archive member name for file name extension 21615>>>>&-1 search/255 . 21616# http://www.pptfaq.com/FAQ00164_What_is_a_PPZ_file-.htm 21617# PPZ were created using Pack & Go feature of PowerPoint versions 97 - 2002 21618# packs optional files, a PowerPoint presentation *.ppt with optional PLAYLIST.LST to CAB 21619>>>>>&0 string/c ppt\0 \b, PowerPoint Packed and Go 21620!:mime application/vnd.ms-powerpoint 21621#!:mime application/mspowerpoint 21622!:ext ppz 21623# https://msdn.microsoft.com/en-us/library/windows/desktop/bb773190(v=vs.85).aspx 21624# first member *.theme implies Windows 7 Theme Pack like in CommunityShowcaseAqua3.themepack 21625# or Windows 8 Desktop Theme Pack like in PanoramicGlaciers.deskthemepack 21626>>>>>&0 string/c theme \b, Windows 21627!:mime application/x-windows-themepack 21628# https://www.drewkeller.com/content/using-theme-both-windows-7-and-windows-8 21629# 1st member Panoramic.theme or Panoramas.theme implies Windows 8-10 Theme Pack 21630# with MTSM=RJSPBS in [MasterThemeSelector] inside *.theme 21631>>>>>>(16.l+16) string =Panoram 8 21632!:ext deskthemepack 21633>>>>>>(16.l+16) string !Panoram 7 or 8 21634!:ext themepack/deskthemepack 21635>>>>>>(16.l+16) ubyte x Theme Pack 21636>>>>>&0 default x 21637# look for null terminator of 1st member name 21638>>>>>>&0 search/255 \0 21639# 2nd member name WSUSSCAN.cab like in Microsoft-Windows-MediaFeaturePack-OOB-Package.msu 21640>>>>>>>&16 string/c wsusscan.cab \b, Microsoft Standalone Update 21641!:mime application/vnd.ms-cab-compressed 21642!:ext msu 21643>>>>>>>&16 default x 21644# archive with more then one file need some output in version 5.32 to avoid error message like 21645# Magdir/msdos, 1138: Warning: Current entry does not yet have a description for adding a MIME type 21646# Magdir/msdos, 1139: Warning: Current entry does not yet have a description for adding a EXTENSION type 21647# file: could not find any valid magic files! 21648>>>>>>>>28 uleshort >1 \b, many 21649!:mime application/vnd.ms-cab-compressed 21650!:ext cab 21651# remaining archives with just one file 21652>>>>>>>>28 uleshort =1 21653# neither extra bytes nor cab chain implies Windows 2000,XP setup files in directory i386 21654>>>>>>>>>30 uleshort =0x0000 \b, Windows 2000/XP setup 21655# cut of last char of source extension and add underscore to generate extension 21656# TERMCAP._ ... FXSCOUNT.H_ ... L3CODECA.AC_ ... NPDRMV2.ZI_ 21657!:mime application/vnd.ms-cab-compressed 21658!:ext _/?_/??_ 21659# archive need some output like "single" in version 5.32 to avoid error messages 21660>>>>>>>>>30 uleshort !0x0000 \b, single 21661!:mime application/vnd.ms-cab-compressed 21662!:ext cab 21663# TODO: additional extensions like 21664# .xsn InfoPath Dynamic Form 21665# .xtp InfoPath Template Part 21666# .lvf Logitech Video Effects Face Accessory 21667>8 ulelong x \b, %u bytes 21668>28 uleshort 1 \b, 1 file 21669>28 uleshort >1 \b, %u files 21670# Reserved fields, set to zero 21671#>4 belong !0 \b, reserved1 %x 21672#>12 belong !0 \b, reserved2 %x 21673# offset of the first CFFILE entry coffFiles: minimal 2Ch 21674>16 ulelong x \b, at 0x%x 21675>(16.l) use cab-file 21676# at least also 2nd member 21677>28 uleshort >1 21678>>(16.l+16) ubyte x 21679>>>&0 search/255 \0 21680# second member info 21681>>>>&0 use cab-file 21682#>20 belong !0 \b, reserved %x 21683# Cabinet file format version. Currently, versionMajor = 1 and versionMinor = 3 21684>24 ubeshort !0x0301 \b version 0x%x 21685# number of CFFOLDER entries 21686>26 uleshort >1 \b, %u cffolders 21687# cabinet file option indicators 1~PREVIOUS, 2~NEXT, 4~reserved fields 21688# only found for flags 0 1 2 3 4 not 7 21689>30 uleshort >0 \b, flags 0x%x 21690# Cabinet files have a 16-bit cabinet setID field that is designed for application use. 21691# default is zero, however, the -i option of cabarc can be used to set this field 21692>32 uleshort >0 \b, ID %u 21693# iCabinet is number of this cabinet file in a set, where 0 for the first cabinet 21694#>34 uleshort x \b, iCabinet %u 21695# add one for display because humans start numbering by 1 and also fit to name of disk szDisk* 21696>34 uleshort+1 x \b, number %u 21697>30 uleshort &0x0004 \b, extra bytes 21698# cbCFHeader optional size of per-cabinet reserved area 14h 1800h 21699>>36 uleshort >0 %u in head 21700# cbCFFolder is optional size of per-folder reserved area 21701>>38 ubyte >0 %u in folder 21702# cbCFData is optional size of per-datablock reserved area 21703>>39 ubyte >0 %u in data block 21704# optional per-cabinet reserved area abReserve[cbCFHeader] 21705>>36 uleshort >0 21706# 1st CFFOLDER after reserved area in header 21707>>>(36.s+40) use cab-folder 21708# no reserved area in header 21709>30 uleshort ^0x0004 21710# no previous and next cab archive 21711>>30 uleshort =0x0000 21712>>>36 use cab-folder 21713# only previous cab archive 21714>>30 uleshort =0x0001 \b, previous 21715>>>36 use cab-anchor 21716# only next cab archive 21717>>30 uleshort =0x0002 \b, next 21718>>>36 use cab-anchor 21719# previous+next cab archive 21720# can not use sub routine cab-anchor to display previous and next cabinet together 21721#>>>36 use cab-anchor 21722#>>>>&0 use cab-anchor 21723>>30 uleshort =0x0003 \b, previous 21724>>>36 string x %s 21725# optional name of previous disk szDisk* 21726>>>>&1 string x disk %s 21727>>>>>&1 string x \b, next %s 21728# optional name of previous disk szDisk* 21729>>>>>>&1 string x disk %s 21730>>>>>>>&1 use cab-folder 21731# display filename and disk name of previous or next cabinet 217320 name cab-anchor 21733# optional name of previous/next cabinet file szCabinet*[255] 21734>&0 string x %s 21735# optional name of previous/next disk szDisk*[255] 21736>>&1 string x disk %s 21737# display folder structure CFFOLDER information like compression of cabinet 217380 name cab-folder 21739# offset of the CFDATA block in this folder 21740#>0 ulelong x \b, coffCabStart 0x%x 21741# number of CFDATA blocks in folder 21742>4 uleshort x \b, %u datablock 21743# plural s 21744>4 uleshort >1 \bs 21745# compression typeCompress: 0~None 1~MSZIP 0x1503~LZX:21 0x1003~LZX:16 0x0f03~LZX:15 21746>6 uleshort x \b, 0x%x compression 21747# optional per-folder reserved area 21748#>8 ubequad x \b, abReserve 0x%llx 21749# display member structure CFFILE information like member name of cabinet 217500 name cab-file 21751# cbFile is uncompressed size of file in bytes 21752#>0 ulelong x \b, cbFile %u 21753# uoffFolderStart is uncompressed offset of file in folder 21754#>4 ulelong >0 \b, uoffFolderStart 0x%x 21755# iFolder is index into the CFFOLDER area. 0 indicates first folder in cabinet 21756# define ifoldCONTINUED_FROM_PREV (0xFFFD) 21757# define ifoldCONTINUED_TO_NEXT (0xFFFE) 21758# define ifoldCONTINUED_PREV_AND_NEXT (0xFFFF) 21759>8 uleshort >0 \b, iFolder 0x%x 21760# date stamp for file 21761#>10 uleshort x \b, date 0x%x 21762# time stamp for file 21763#>12 uleshort x \b, time 0x%x 21764# attribs is attribute flags for file 21765# define _A_RDONLY (0x01) file is read-only 21766# define _A_HIDDEN (0x02) file is hidden 21767# define _A_SYSTEM (0x04) file is a system file 21768# define _A_ARCH (0x20) file modified since last backup 21769# example http://sebastien.kirche.free.fr/pebuilder_plugins/depends.cab 21770# define _A_EXEC (0x40) run after extraction 21771# define _A_NAME_IS_UTF (0x80) szName[] contains UTF 21772# define UNKNOWN (0x0100) undocumented or accident 21773#>14 uleshort x \b, attribs 0x%x 21774>14 uleshort >0 + 21775>>14 uleshort &0x0001 \bR 21776>>14 uleshort &0x0002 \bH 21777>>14 uleshort &0x0004 \bS 21778>>14 uleshort &0x0020 \bA 21779>>14 uleshort &0x0040 \bX 21780>>14 uleshort &0x0080 \bUtf 21781# unknown 0x0100 flag found on one XP_CD:\I386\DRIVER.CAB 21782>>14 uleshort &0x0100 \b? 21783# szName is name of archive member 21784>16 string x "%s" 21785# next archive member name if more files 21786#>>&17 string >\0 \b, NEXT NAME %-.50s 21787 21788# InstallShield Cabinet files 217890 string/b ISc( InstallShield Cabinet archive data 21790>5 byte&0xf0 =0x60 version 6, 21791>5 byte&0xf0 !0x60 version 4/5, 21792>(12.l+40) lelong x %u files 21793 21794# Windows CE package files 217950 string/b MSCE\0\0\0\0 Microsoft WinCE install header 21796>20 lelong 0 \b, architecture-independent 21797>20 lelong 103 \b, Hitachi SH3 21798>20 lelong 104 \b, Hitachi SH4 21799>20 lelong 0xA11 \b, StrongARM 21800>20 lelong 4000 \b, MIPS R4000 21801>20 lelong 10003 \b, Hitachi SH3 21802>20 lelong 10004 \b, Hitachi SH3E 21803>20 lelong 10005 \b, Hitachi SH4 21804>20 lelong 70001 \b, ARM 7TDMI 21805>52 leshort 1 \b, 1 file 21806>52 leshort >1 \b, %u files 21807>56 leshort 1 \b, 1 registry entry 21808>56 leshort >1 \b, %u registry entries 21809 21810 21811# Windows Enhanced Metafile (EMF) 21812# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 21813# for further information. 218140 ulelong 1 21815>40 string \ EMF Windows Enhanced Metafile (EMF) image data 21816>>44 ulelong x version 0x%x 21817 21818 218190 string/b \224\246\056 Microsoft Word Document 21820!:mime application/msword 21821 21822512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document 21823!:mime application/msword 21824 21825# From: "Nelson A. de Oliveira" <naoliv@gmail.com> 21826# Magic type for Dell's BIOS .hdr files 21827# Dell's .hdr 218280 string/b $RBU 21829>23 string Dell %s system BIOS 21830>5 byte 2 21831>>48 byte x version %d. 21832>>49 byte x \b%d. 21833>>50 byte x \b%d 21834>5 byte <2 21835>>48 string x version %.3s 21836 21837# Type: Microsoft Document Imaging Format (.mdi) 21838# URL: https://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format 21839# From: Daniele Sempione <scrows@oziosi.org> 21840# Too weak (EP) 21841#0 short 0x5045 Microsoft Document Imaging Format 21842 21843# MS eBook format (.lit) 218440 string/b ITOLITLS Microsoft Reader eBook Data 21845>8 lelong x \b, version %u 21846!:mime application/x-ms-reader 21847 21848# Windows CE Binary Image Data Format 21849# From: Dr. Jesus <j@hug.gs> 218500 string/b B000FF\n Windows Embedded CE binary image 21851 21852# The second byte of these signatures is a file version; I don't know what, 21853# if anything, produced files with version numbers 0-2. 21854# From: John Elliott <johne@seasip.demon.co.uk> 218550 string \xfc\x03\x00 Mallard BASIC program data (v1.11) 218560 string \xfc\x04\x00 Mallard BASIC program data (v1.29+) 218570 string \xfc\x03\x01 Mallard BASIC protected program data (v1.11) 218580 string \xfc\x04\x01 Mallard BASIC protected program data (v1.29+) 21859 218600 string MIOPEN Mallard BASIC Jetsam data 218610 string Jetsam0 Mallard BASIC Jetsam index data 21862 21863# DOS backup 2.0 to 3.2 21864 21865# backupid.@@@ 21866 21867# plausibility check for date 218680x3 ushort >1979 21869>0x5 ubyte-1 <31 21870>>0x6 ubyte-1 <12 21871# actually 121 nul bytes 21872>>>0x7 string \0\0\0\0\0\0\0\0 21873>>>>0x1 ubyte x DOS 2.0 backup id file, sequence %d 21874!:ext @@@ 21875>>>>0x0 ubyte 0xff \b, last disk 21876 21877# backed up file 21878 21879# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd 21880# by looking for trailing nul of maximal file name string 218810x52 ubyte 0 21882# test for flag byte: FFh~complete file, 00h~split file 21883# FFh -127 = -1 -127 = -128 21884# 00h -127 = 0 -127 = -127 21885>0 byte-127 <-126 21886# plausibility check for file name length 21887>>0x53 ubyte-1 <78 21888# looking for terminating nul of file name string 21889>>>(0x53.b+4) ubyte 0 21890# looking if last char of string is valid DOS file name 21891>>>>(0x53.b+3) ubyte >0x1F 21892# actually 44 nul bytes 21893# but sometimes garbage according to Ralf Quint. So can not be used as test 21894#>0x54 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 21895# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator 21896# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 21897>>>>>5 ubyte&0x8C 0x0C 21898# ./msdos (version 5.30) labeled the entry as 21899# "DOS 2.0 backed up file %s, split file, sequence %d" or 21900# "DOS 2.0 backed up file %s, complete file" 21901>>>>>>0 ubyte x DOS 2.0-3.2 backed up 21902#>>>>>>0 ubyte 0xff complete 21903>>>>>>0 ubyte 0 21904>>>>>>>1 uleshort x sequence %d of 21905# full file name with path but without drive letter and colon stored from 0x05 til 0x52 21906>>>>>>0x5 string x file %s 21907# backup name is original filename 21908#!:ext * 21909# magic/Magdir/msdos, 1169: Warning: EXTENSION type ` *' has bad char '*' 21910# file: line 1169: Bad magic entry ' *' 21911# after header original file content 21912>>>>>>128 indirect x \b; 21913 21914 21915# DOS backup 3.3 to 5.x 21916 21917# CONTROL.nnn files 219180 string \x8bBACKUP\x20 21919# actually 128 nul bytes 21920>0xa string \0\0\0\0\0\0\0\0 21921>>0x9 ubyte x DOS 3.3 backup control file, sequence %d 21922>>0x8a ubyte 0xff \b, last disk 21923 21924# NB: The BACKUP.nnn files consist of the files backed up, 21925# concatenated. 21926 21927#------------------------------------------------------------------------------ 21928# $File: msooxml,v 1.12 2019/04/19 00:42:27 christos Exp $ 21929# msooxml: file(1) magic for Microsoft Office XML 21930# From: Ralf Brown <ralf.brown@gmail.com> 21931 21932# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP 21933# archive. The first member file is normally "[Content_Types].xml". 21934# but some libreoffice generated files put this later. Perhaps skip 21935# the "[Content_Types].xml" test? 21936# Since MSOOXML doesn't have anything like the uncompressed "mimetype" 21937# file of ePub or OpenDocument, we'll have to scan for a filename 21938# which can distinguish between the three types 21939 219400 name msooxml 21941>0 string word/ Microsoft Word 2007+ 21942!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document 21943>0 string ppt/ Microsoft PowerPoint 2007+ 21944!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation 21945>0 string xl/ Microsoft Excel 2007+ 21946!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 21947 21948# start by checking for ZIP local file header signature 219490 string PK\003\004 21950!:strength +10 21951# make sure the first file is correct 21952>0x1E use msooxml 21953>0x1E regex \\[Content_Types\\]\\.xml|_rels/\\.rels|docProps 21954# skip to the second local file header 21955# since some documents include a 520-byte extra field following the file 21956# header, we need to scan for the next header 21957>>(18.l+49) search/6000 PK\003\004 21958# now skip to the *third* local file header; again, we need to scan due to a 21959# 520-byte extra field following the file header 21960>>>&26 search/6000 PK\003\004 21961# and check the subdirectory name to determine which type of OOXML 21962# file we have. Correct the mimetype with the registered ones: 21963# https://technet.microsoft.com/en-us/library/cc179224.aspx 21964>>>>&26 use msooxml 21965>>>>&26 default x 21966# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file 21967>>>>>&26 search/6000 PK\003\004 21968>>>>>>&26 use msooxml 21969>>>>>>&26 default x Microsoft OOXML 21970>>>>>&26 default x Microsoft OOXML 21971 21972#------------------------------------------------------------------------------ 21973# $File: msvc,v 1.10 2018/10/01 19:14:03 christos Exp $ 21974# msvc: file(1) magic for msvc 21975# "H. Nanosecond" <aldomel@ix.netcom.com> 21976# Microsoft visual C 21977# 21978# I have version 1.0 21979 21980# .aps 219810 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 21982 21983# .ide 21984#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 219850 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 21986 21987# .res 219880 string \000\000\000\000\040\000\000\000\377 MSVC .res 219890 string \377\003\000\377\001\000\020\020\350 MSVC .res 219900 string \377\003\000\377\001\000\060\020\350 MSVC .res 21991 21992#.lib 219930 string \360\015\000\000 Microsoft Visual C library 219940 string \360\075\000\000 Microsoft Visual C library 219950 string \360\175\000\000 Microsoft Visual C library 21996 21997#.pch 219980 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 21999 22000# Summary: Symbol Table / Debug info used by Microsoft compilers 22001# URL: https://en.wikipedia.org/wiki/Program_database 22002# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format 22003# Update: Joerg Jenderek 22004# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86 22005# info does only applies partly for older files like msvbvm50.pdb about year 2001 220060 string Microsoft\ C/C++\040 22007# "Microsoft Program DataBase" by TrID 22008>24 search/14 \r\n\x1A MSVC program database 22009!:mime application/x-ms-pdb 22010!:ext pdb 22011# "MSF 7.00" "program database 2.00" for msvbvm50.pdb 22012>>16 regex \([0-9.]+\) ver %s 22013#>>>0x38 search/128123456 /LinkInfo \b with linkinfo 22014# "MSF 7.00" variant 22015>>0x1e leshort 0 22016# PageSize 400h 1000h 22017>>>0x20 lelong x \b, %d 22018# Page Count 22019>>>0x28 lelong x \b*%d bytes 22020# "program database 2.00" variant 22021>>0x1e leshort !0 22022# PageSize 400h 22023>>>0x2c lelong x \b, %d 22024# Page Count for msoo-dll.pdb 4379h 22025>>>0x32 leshort x \b*%d bytes 22026 22027# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d 220280 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Roslyn C# debugging symbols version 1.0 22029 22030#.sbr 220310 string \000\002\000\007\000 MSVC .sbr 22032>5 string >\0 %s 22033 22034#.bsc 220350 string \002\000\002\001 MSVC .bsc 22036 22037#.wsp 220380 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 22039# these seem to start with the version and contain menus 22040 22041#------------------------------------------------------------------------------ 22042# msx: file(1) magic for the MSX Home Computer 22043# v1.3 22044# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 22045 22046############## MSX Music file formats ############## 22047 22048# Gigamix MGSDRV music file 220490 string/b MGS MSX Gigamix MGSDRV3 music file, 22050>6 ubeshort 0x0D0A 22051>>3 byte x \bv%c 22052>>4 byte x \b.%c 22053>>5 byte x \b%c 22054>>8 string >\0 \b, title: %s 22055 220561 string/b mgs2\ MSX Gigamix MGSDRV2 music file 22057>6 uleshort 0x80 22058>>0x2E uleshort 0 22059>>>0x30 string >\0 \b, title: %s 22060 22061# KSS music file 220620 string/b KSCC KSS music file v1.03 22063>0xE byte 0 22064>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 22065>>0xF byte&0x02 2 \b, soundchip(s): SN76489 22066>>>0xF byte&0x04 4 stereo 22067>>0xF byte&0x01 1 \b, YM2413 22068>>0xF byte&0x08 8 \b, Y8950 22069 220700 string/b KSSX KSS music file v1.20 22071>0xE byte&0xEF 0 22072>>0xF byte&0x40 0x00 \b, 60Hz 22073>>0xF byte&0x40 0x40 \b, 50Hz 22074>>0xF byte&0x02 0 \b, soundchips: AY-3-8910, SCC(+) 22075>>0xF byte&0x02 0x02 \b, soundchips: SN76489 22076>>>0xF byte&0x04 0x04 stereo 22077>>0xF byte&0x01 0x01 \b, 22078>>>0xF byte&0x18 0x00 \bYM2413 22079>>>0xF byte&0x18 0x08 \bYM2413, Y8950 22080>>>0xF byte&0x18 0x18 \bYM2413+Y8950 pseudostereo 22081>>0xF byte&0x18 0x10 \b, Majyutsushi DAC 22082 22083# Moonblaster for Moonsound 220840 string/b MBMS 22085>4 byte 0x10 MSX Moonblaster for MoonSound music 22086 22087# Music Player K-kaz 220880 string/b MPK MSX Music Player K-kaz song 22089>6 ubeshort 0x0D0A 22090>>3 byte x v%c 22091>>4 byte x \b.%c 22092>>5 byte x \b%c 22093 22094# I don't know why these don't work 22095#0 search/0xFFFF \r\n.FM9 22096#>0 search/0xFFFF \r\n#FORMAT MSX Music Player K-kaz source MML file 22097#0 search/0xFFFF \r\nFM1\ \= 22098#>0 search/0xFFFF \r\nPSG1\= 22099#>>0 search/0xFFFF \r\nSCC1\= MSX MuSiCa MML source file 22100 22101# OPX Music file 221020x35 beshort 0x0d0a 22103>0x7B beshort 0x0d0a 22104>>0x7D byte 0x1a 22105>>>0x87 uleshort 0 MSX OPX Music file 22106>>>>0x86 byte 0 v1.5 22107>>>>>0 string >\32 \b, title: %s 22108>>>>0x86 byte 1 v2.4 22109>>>>>0 string >\32 \b, title: %s 22110 22111# SCMD music file 221120x8B string/b SCMD 22113>0xCE uleshort 0 MSX SCMD Music file 22114#>>-2 uleshort 0x6a71 ; The file must end with this value. How to code this here? 22115>>0x8F string >\0 \b, title: %s 22116 221170 search/0xFFFF \r\n@title 22118>&0 search/0xFFFF \r\n@m=[ MSX SCMD source MML file 22119 22120 22121############## MSX image file formats ############## 22122 22123# MSX raw VRAM dump 221240 ubyte 0xFE 22125>1 uleshort 0 22126>>5 uleshort 0 22127>>>3 uleshort 0x37FF MSX SC2/GRP raw image 22128>>>3 uleshort 0x6A00 MSX Graph Saurus SR5 raw image 22129>>>3 uleshort >0x769E 22130>>>>3 uleshort <0x8000 MSX GE5/GE6 raw image 22131>>>>>3 uleshort 0x7FFF \b, with sprite patterns 22132>>>3 uleshort 0xD3FF MSX screen 7-12 raw image 22133>>>3 uleshort 0xD400 MSX Graph Saurus SR7/SR8/SRS raw image 22134 22135# Graph Saurus compressed images 221360 ubyte 0xFD 22137>1 uleshort 0 22138>>5 uleshort 0 22139>>>3 uleshort >0x013D MSX Graph Saurus compressed image 22140 22141# MSX G9B image file 221420 string/b G9B 22143>1 uleshort 11 22144>>3 uleshort >10 22145>>>5 ubyte >0 MSX G9B image, depth=%d 22146>>>>8 uleshort x \b, %dx 22147>>>>10 uleshort x \b%d 22148>>>>5 ubyte <9 22149>>>>>6 ubyte 0 22150>>>>>>7 ubyte x \b, codec=%d RGB color palettes 22151>>>>>6 ubyte 64 \b, codec=RGB fixed color 22152>>>>>6 ubyte 128 \b, codec=YJK 22153>>>>>6 ubyte 192 \b, codec=YUV 22154>>>>5 ubyte >8 codec=RGB fixed color 22155>>>>12 ubyte 0 \b, raw 22156>>>>12 ubyte 1 \b, bitbuster compression 22157 22158############## Other MSX file formats ############## 22159 22160# MSX internal ROMs 221610 ubeshort 0xF3C3 22162>2 uleshort <0x4000 22163>>8 ubyte 0xC3 22164>>>9 uleshort <0x4000 22165>>>>0x0B ubeshort 0x00C3 22166>>>>>0x0D uleshort <0x4000 22167>>>>>>0x0F ubeshort 0x00C3 22168>>>>>>>0x11 uleshort <0x4000 22169>>>>>>>>0x13 ubeshort 0x00C3 22170>>>>>>>>>0x15 uleshort <0x4000 22171>>>>>>>>>>0x50 ubyte 0xC3 22172>>>>>>>>>>>0x51 uleshort <0x4000 22173>>>>>>>>>>>>(9.s) ubyte 0xC3 22174>>>>>>>>>>>>>&0 uleshort >0x4000 22175>>>>>>>>>>>>>>&0 ubyte 0xC3 MSX BIOS+BASIC 22176>>>>>>>>>>>>>>>0x002D ubyte+1 <3 \b. version=MSX%d 22177>>>>>>>>>>>>>>>0x002D ubyte 2 \b, version=MSX2+ 22178>>>>>>>>>>>>>>>0x002D ubyte 3 \b, version=MSX Turbo-R 22179>>>>>>>>>>>>>>>0x002D ubyte >3 \b, version=Unknown MSX %d version 22180>>>>>>>>>>>>>>>0x0006 ubyte x \b, VDP.DR=0x%2x 22181>>>>>>>>>>>>>>>0x0007 ubyte x \b, VDP.DW=0x%2x 22182>>>>>>>>>>>>>>>0x002B ubyte&0xF 0 \b, charset=Japanese 22183>>>>>>>>>>>>>>>0x002B ubyte&0xF 1 \b, charset=International 22184>>>>>>>>>>>>>>>0x002B ubyte&0xF 2 \b, charset=Korean 22185>>>>>>>>>>>>>>>0x002B ubyte&0xF >2 \b, charset=Unknown id:%d 22186>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x00 \b, date format=Y-M-D 22187>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x10 \b, date format=M-D-Y 22188>>>>>>>>>>>>>>>0x002B ubyte&0x70 0x20 \b, date format=D-M-Y 22189>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x00 \b, vfreq=60Hz 22190>>>>>>>>>>>>>>>0x002B ubyte&0x80 0x80 \b, vfreq=50Hz 22191>>>>>>>>>>>>>>>0x002C ubyte&0x0F 0 \b, keyboard=Japanese 22192>>>>>>>>>>>>>>>0x002C ubyte&0x0F 1 \b, keyboard=International 22193>>>>>>>>>>>>>>>0x002C ubyte&0x0F 2 \b, keyboard=French 22194>>>>>>>>>>>>>>>0x002C ubyte&0x0F 3 \b, keyboard=UK 22195>>>>>>>>>>>>>>>0x002C ubyte&0x0F 4 \b, keyboard=German 22196>>>>>>>>>>>>>>>0x002C ubyte&0x0F 5 \b, keyboard=Unknown id:%d 22197>>>>>>>>>>>>>>>0x002C ubyte&0x0F 6 \b, keyboard=Spanish 22198>>>>>>>>>>>>>>>0x002C ubyte&0x0F >6 \b, keyboard=Unknown id:%d 22199>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x00 \b, basic=Japanese 22200>>>>>>>>>>>>>>>0x002C ubyte&0xF0 0x10 \b, basic=International 22201>>>>>>>>>>>>>>>0x002C ubyte&0xF0 >0x10 \b, basic=Unknown id:%d 22202>>>>>>>>>>>>>>>0x002E ubyte&1 1 \b, built-in MIDI 22203 22204 222050 string/b CD 22206>2 uleshort >0x10 22207>>2 uleshort <0x4000 22208>>>4 uleshort <0x4000 22209>>>>6 uleshort <0x4000 22210>>>>>8 ubyte 0xC3 22211>>>>>>9 uleshort <0x4000 22212>>>>>>>0x10 ubyte 0xC3 22213>>>>>>>>0x11 uleshort <0x4000 22214>>>>>>>>>0x14 ubyte 0xC3 22215>>>>>>>>>>0x15 uleshort <0x4000 MSX2/2+/TR SubROM 22216 222170 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 22218>0x5F0 ubequad 0x8282828244380000 22219>>0x150 ubyte 0x38 22220>>>0x170 string \20\20\20 22221>>>>0x1E32 string ()) 22222>>>>>0x2130 ubequad 0xA5A5594924231807 22223>>>>>0x2138 ubequad 0x4A4A3424488830C0 MSX Kanji Font 22224 22225 22226 22227# MSX extension ROMs 222280 string/b AB 22229>2 uleshort 0x0010 MSX ROM 22230>>2 uleshort x \b, init=0x%4x 22231>>4 uleshort >0 \b, stahdl=0x%4x 22232>>6 uleshort >0 \b, devhdl=0x%4x 22233>>8 uleshort >0 \b, bas=0x%4x 22234>2 uleshort 0x4010 MSX ROM 22235>>2 uleshort x \b, init=0x%04x 22236>>4 uleshort >0 \b, stahdl=0x%04x 22237>>6 uleshort >0 \b, devhdl=0x%04x 22238>>8 uleshort >0 \b, bas=0x%04x 22239>2 uleshort 0x8010 MSX ROM 22240>>2 uleshort x \b, init=0x%04x 22241>>4 uleshort >0 \b, stahdl=0x%04x 22242>>6 uleshort >0 \b, devhdl=0x%04x 22243>>8 uleshort >0 \b, bas=0x%04x 222440 string/b AB\0\0 22245>6 uleshort 0 22246>>4 uleshort >0x400F MSX-BASIC extension ROM 22247>>>4 uleshort >0 \b, stahdl=0x%04x 22248>>>6 uleshort >0 \b, devhdl=0x%04x 22249>>>0x1C string OPLL \b, MSX-Music 22250>>>>0x18 string PAC2 \b (external) 22251>>>>0x18 string APRL \b (internal) 22252 222530 string/b AB\0\0\0\0 22254>6 uleshort >0x400F MSX device BIOS 22255>>6 uleshort >0 \b, devhdl=0x%04x 22256 22257 222580 string/b AB 22259#>2 string 5JSuperLAYDOCK MSX Super Laydock ROM 22260#>3 string @HYDLIDE3MSX MSX Hydlide-3 ROM 22261#>3 string @3\x80IA862 Golvellius MSX1 ROM 22262>2 uleshort >15 22263>>2 uleshort <0xC000 22264>>>8 string \0\0\0\0\0\0\0\0 22265>>>>(2.s&0x3FFF) uleshort >0 MSX ROM 22266>>>>>0x10 string YZ\0\0\0\0 Konami Game Master 2 MSX ROM 22267>>>>>0x10 string CD \b, Konami RC- 22268>>>>>>0x12 ubyte x \b%d 22269>>>>>>0x13 ubyte/16 x \b%d 22270>>>>>>0x13 ubyte&0xF x \b%d 22271>>>>>0x10 string EF \b, Konami RC- 22272>>>>>>0x12 ubyte x \b%d 22273>>>>>>0x13 ubyte/16 x \b%d 22274>>>>>>0x13 ubyte&0xF x \b%d 22275>>>>>2 uleshort x \b, init=0x%04x 22276>>>>>4 uleshort >0 \b, stahdl=0x%04x 22277>>>>>6 uleshort >0 \b, devhdl=0x%04x 22278>>>>>8 uleshort >0 \b, bas=0x%04x 22279>>>2 uleshort 0 22280>>>>4 uleshort 0 22281>>>>>6 uleshort 0 22282>>>>>>8 uleshort >0 MSX BASIC program in ROM, bas=0x%04x 22283 222840x4000 string/b AB 22285>0x4002 uleshort >0x400F 22286>>0x400A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 22287>>>0x4002 uleshort x \b, init=0x%04x 22288>>>0x4004 uleshort >0 \b, stahdl=0x%04x 22289>>>0x4006 uleshort >0 \b, devhdl=0x%04x 22290>>>0x4008 uleshort >0 \b, bas=0x%04x 22291 222920x8000 string/b AB 22293>0x8002 uleshort >0x400F 22294>>0x800A string \0\0\0\0\0\0 MSX ROM with nonstandard page order 22295>>>0x8002 uleshort x \b, init=0x%04x 22296>>>0x8004 uleshort >0 \b, stahdl=0x%04x 22297>>>0x8006 uleshort >0 \b, devhdl=0x%04x 22298>>>0x8008 uleshort >0 \b, bas=0x%04x 22299 22300 223010x3C000 string/b AB 22302>0x3C008 string \0\0\0\0\0\0\0\0 MSX MegaROM with nonstandard page order 22303>>0x3C002 uleshort x \b, init=0x%04x 22304>>0x3C004 uleshort >0 \b, stahdl=0x%04x 22305>>0x3C006 uleshort >0 \b, devhdl=0x%04x 22306>>0x3C008 uleshort >0 \b, bas=0x%04x 22307 22308# MSX BIN file 22309#0 byte 0xFE 22310#>1 uleshort >0x8000 22311#>>3 uleshort >0x8004 22312#>>>5 uleshort >0x8000 MSX BIN file 22313 22314# MSX-BASIC file 223150 byte 0xFF 22316>3 uleshort 0x000A 22317>>1 uleshort >0x8000 MSX-BASIC program 22318 22319# MSX .CAS file 223200 string/b \x1F\xA6\xDE\xBA\xCC\x13\x7D\x74 MSX cassette archive 22321 22322# Mega-Assembler file 223230 byte 0xFE 22324>1 uleshort 0x0001 22325>>5 uleshort 0xffff 22326>>>6 byte 0x0A MSX Mega-Assembler source 22327 22328# Execrom Patchfile 223290 string ExecROM\ patchfile\x1A MSX ExecROM patchfile 22330>0x12 ubyte/16 x v%d 22331>0x12 ubyte&0xF x \b.%d 22332>0x13 ubyte x \b, contains %d patches 22333 22334# Konami's King's Valley-2 custom stage (ELG file) 223354 uleshort 0x0900 22336>0xF byte 1 22337>>0x14 byte 0 22338>>>0x1E string \040\040\040 22339>>>>0x23 byte 1 22340>>>>>0x25 byte 0 22341>>>>>>0x15 string >\x30 22342>>>>>>>0x15 string <\x5A Konami King's Valley-2 custom stage, title: "%-8.8s" 22343>>>>>>>>0x1D byte <32 \b, theme: %d 22344 22345# Metal Gear 1 savegame 22346#0x4F string \x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 22347#>>0x60 string \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF 22348#>>>0x7B string \0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00 Metal Gear 1 savegame 22349 22350# ------------------------------------------------------------------------ 22351# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $ 22352# mup: file(1) magic for Mup (Music Publisher) input file. 22353# 22354# From: Abel Cheung <abel (@) oaka.org> 22355# 22356# NOTE: This header is mainly proposed in the Arkkra mailing list, 22357# and is not a mandatory header because of old mup input file 22358# compatibility. Noteedit also use mup format, but is not forcing 22359# user to use any header as well. 22360# 223610 search/1 //!Mup Mup music publication program input text 22362>6 string -Arkkra (Arkkra) 22363>>13 string - 22364>>>16 string . 22365>>>>14 string x \b, need V%.4s 22366>>>15 string . 22367>>>>14 string x \b, need V%.3s 22368>6 string - 22369>>9 string . 22370>>>7 string x \b, need V%.4s 22371>>8 string . 22372>>>7 string x \b, need V%.3s 22373#------------------------------------------------------------------------------ 22374# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $ 22375# music: file (1) magic for music formats 22376 22377# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks 22378# and Bagpipe Writer by Doug Wickstrom 22379# 223800 string Bagpipe Bagpipe 22381>8 string Reader Reader 22382>>15 string >\0 (version %.3s) 22383>8 string Music\ Writer Music Writer 22384>>20 string : 22385>>>21 string >\0 (version %.3s) 22386>>21 string Gold Gold 22387>>>25 string : 22388>>>>26 string >\0 (version %.3s) 22389 22390 22391#------------------------------------------------------------------------------ 22392# nasa: file(1) magic 22393 22394# From: Barry Carter <carter.barry@gmail.com> 223950 string DAF/SPK NASA SPICE file (binary format) 223960 string DAFETF\ NAIF\ DAF\ ENCODED NASA SPICE file (transfer format) 22397 22398#----------------------------------------------------------------------------- 22399# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $ 22400# natinst: file(1) magic for National Instruments Code Files 22401 22402# 22403# From <egamez@fcfm.buap.mx> Enrique Gamez-Flores 22404# version 1 22405# Many formats still missing, we use, for the moment LabVIEW 22406# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing 22407# 224080 string RSRC National Instruments, 22409# Check if it's a LabVIEW File 22410>8 string LV LabVIEW File, 22411# Check which kind of file it is 22412>>10 string SB Code Resource File, data 22413>>10 string IN Virtual Instrument Program, data 22414>>10 string AR VI Library, data 22415# This is for Menu Libraries 22416>8 string LMNULBVW Portable File Names, data 22417# This is for General Resources 22418>8 string rsc Resources File, data 22419# This is for VXI Package 224200 string VMAP National Instruments, VXI File, data 22421 22422#------------------------------------------------------------------------------ 22423# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $ 22424# ncr: file(1) magic for NCR Tower objects 22425# 22426# contributed by 22427# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa 22428# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP 22429# 224300 beshort 000610 Tower/XP rel 2 object 22431>12 belong >0 not stripped 22432>20 beshort 0407 executable 22433>20 beshort 0410 pure executable 22434>22 beshort >0 - version %d 224350 beshort 000615 Tower/XP rel 2 object 22436>12 belong >0 not stripped 22437>20 beshort 0407 executable 22438>20 beshort 0410 pure executable 22439>22 beshort >0 - version %d 224400 beshort 000620 Tower/XP rel 3 object 22441>12 belong >0 not stripped 22442>20 beshort 0407 executable 22443>20 beshort 0410 pure executable 22444>22 beshort >0 - version %d 224450 beshort 000625 Tower/XP rel 3 object 22446>12 belong >0 not stripped 22447>20 beshort 0407 executable 22448>20 beshort 0410 pure executable 22449>22 beshort >0 - version %d 224500 beshort 000630 Tower32/600/400 68020 object 22451>12 belong >0 not stripped 22452>20 beshort 0407 executable 22453>20 beshort 0410 pure executable 22454>22 beshort >0 - version %d 224550 beshort 000640 Tower32/800 68020 22456>18 beshort &020000 w/68881 object 22457>18 beshort &040000 compatible object 22458>18 beshort &060000 object 22459>20 beshort 0407 executable 22460>20 beshort 0413 pure executable 22461>12 belong >0 not stripped 22462>22 beshort >0 - version %d 224630 beshort 000645 Tower32/800 68010 22464>18 beshort &040000 compatible object 22465>18 beshort &060000 object 22466>20 beshort 0407 executable 22467>20 beshort 0413 pure executable 22468>12 belong >0 not stripped 22469>22 beshort >0 - version %d 22470 22471#------------------------------------------------------------ 22472# $File: neko,v 1.2 2019/04/19 00:42:27 christos Exp $ 22473 22474# From: Mikhail Gusarov <dottedmag@dottedmag.net> 22475# NekoVM (https://nekovm.org/) bytecode 224760 string NEKO NekoVM bytecode 22477>4 lelong x (%d global symbols, 22478>8 lelong x %d global fields, 22479>12 lelong x %d bytecode ops) 22480!:mime application/x-nekovm-bytecode 22481 22482 22483#------------------------------------------------------------------------------ 22484# $File: netbsd,v 1.26 2019/01/01 03:11:23 christos Exp $ 22485# netbsd: file(1) magic for NetBSD objects 22486# 22487# All new-style magic numbers are in network byte order. 22488# The old-style magic numbers are indistinguishable from the same magic 22489# numbers used in other systems, and are handled, for all those systems, 22490# in aout. 22491# 22492 224930 name netbsd-detail 22494>20 lelong x @%#x 22495>4 lelong >0 \b+T=%d 22496>8 lelong >0 \b+D=%d 22497>12 lelong >0 \b+B=%d 22498>16 lelong >0 \b+S=%d 22499>24 lelong >0 \b+TR=%d 22500>28 lelong >0 \b+TD=%d 22501 225020 name netbsd-4096 22503>0 byte &0x80 22504>>20 lelong <4096 shared library 22505>>20 lelong =4096 dynamically linked executable 22506>>20 lelong >4096 dynamically linked executable 22507>0 byte ^0x80 executable 22508>16 lelong >0 not stripped 22509 225100 name netbsd-8192 22511>0 byte &0x80 22512>>20 lelong <8192 shared library 22513>>20 lelong =8192 dynamically linked executable 22514>>20 lelong >8192 dynamically linked executable 22515>0 byte ^0x80 executable 22516>16 lelong >0 not stripped 22517>0 use netbsd-detail 22518 225190 name netbsd-normal 22520>0 byte &0x80 dynamically linked executable 22521>0 byte ^0x80 22522>>0 byte &0x40 position independent 22523>>20 lelong !0 executable 22524>>20 lelong =0 object file 22525>16 lelong >0 not stripped 22526>0 use netbsd-detail 22527 225280 name netbsd-pure 22529>0 byte &0x80 dynamically linked executable 22530>0 byte ^0x80 executable 22531>16 lelong >0 not stripped 22532>0 use netbsd-detail 22533 225340 name netbsd-core 22535>12 string >\0 from '%s' 22536>32 lelong !0 (signal %d) 22537 225380 belong&0377777777 041400413 a.out NetBSD/i386 demand paged 22539>0 use netbsd-4096 22540 225410 belong&0377777777 041400410 a.out NetBSD/i386 pure 22542>0 use netbsd-pure 22543 225440 belong&0377777777 041400407 a.out NetBSD/i386 22545>0 use netbsd-normal 22546 225470 belong&0377777777 041400507 a.out NetBSD/i386 core 22548>0 use netbsd-core 22549 225500 belong&0377777777 041600413 a.out NetBSD/m68k demand paged 22551>0 use \^netbsd-8192 22552 225530 belong&0377777777 041600410 a.out NetBSD/m68k pure 22554>0 use \^netbsd-pure 22555 225560 belong&0377777777 041600407 a.out NetBSD/m68k 22557>0 use \^netbsd-normal 22558 225590 belong&0377777777 041600507 a.out NetBSD/m68k core 22560>0 use \^netbsd-core 22561 225620 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged 22563>0 use \^netbsd-4096 22564 225650 belong&0377777777 042000410 a.out NetBSD/m68k4k pure 22566>0 use \^netbsd-pure 22567 225680 belong&0377777777 042000407 a.out NetBSD/m68k4k 22569>0 use \^netbsd-normal 22570 225710 belong&0377777777 042000507 a.out NetBSD/m68k4k core 22572>0 use \^netbsd-core 22573 225740 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged 22575>0 use netbsd-4096 22576 225770 belong&0377777777 042200410 a.out NetBSD/ns32532 pure 22578>0 use netbsd-pure 22579 225800 belong&0377777777 042200407 a.out NetBSD/ns32532 22581>0 use netbsd-normal 22582 225830 belong&0377777777 042200507 a.out NetBSD/ns32532 core 22584>0 use netbsd-core 22585 225860 belong&0377777777 045200507 a.out NetBSD/powerpc core 22587>0 use netbsd-core 22588 225890 belong&0377777777 042400413 a.out NetBSD/SPARC demand paged 22590>0 use \^netbsd-8192 22591 225920 belong&0377777777 042400410 a.out NetBSD/SPARC pure 22593>0 use \^netbsd-pure 22594 225950 belong&0377777777 042400407 a.out NetBSD/SPARC 22596>0 use \^netbsd-normal 22597 225980 belong&0377777777 042400507 a.out NetBSD/SPARC core 22599>0 use \^netbsd-core 22600 226010 belong&0377777777 042600413 a.out NetBSD/pmax demand paged 22602>0 use netbsd-4096 22603 226040 belong&0377777777 042600410 a.out NetBSD/pmax pure 22605>0 use \^netbsd-pure 22606 226070 belong&0377777777 042600407 a.out NetBSD/pmax 22608>0 use netbsd-normal 22609 226100 belong&0377777777 042600507 a.out NetBSD/pmax core 22611>0 use netbsd-core 22612 226130 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged 22614>0 use netbsd-4096 22615 226160 belong&0377777777 043000410 a.out NetBSD/vax 1k pure 22617>0 use netbsd-pure 22618 226190 belong&0377777777 043000407 a.out NetBSD/vax 1k 22620>0 use netbsd-normal 22621 226220 belong&0377777777 043000507 a.out NetBSD/vax 1k core 22623>0 use netbsd-core 22624 226250 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged 22626>0 use netbsd-4096 22627 226280 belong&0377777777 045400410 a.out NetBSD/vax 4k pure 22629>0 use netbsd-pure 22630 226310 belong&0377777777 045400407 a.out NetBSD/vax 4k 22632>0 use netbsd-normal 22633 226340 belong&0377777777 045400507 a.out NetBSD/vax 4k core 22635>0 use netbsd-core 22636 22637# NetBSD/alpha does not support (and has never supported) a.out objects, 22638# so no rules are provided for them. NetBSD/alpha ELF objects are 22639# dealt with in "elf". 226400 lelong 0x00070185 ECOFF NetBSD/alpha binary 22641>10 leshort 0x0001 not stripped 22642>10 leshort 0x0000 stripped 226430 belong&0377777777 043200507 a.out NetBSD/alpha core 22644>12 string >\0 from '%s' 22645>32 lelong !0 (signal %d) 22646 226470 belong&0377777777 043400413 a.out NetBSD/mips demand paged 22648>0 use \^netbsd-8192 22649 22650>16 belong >0 not stripped 226510 belong&0377777777 043400410 a.out NetBSD/mips pure 22652>0 use netbsd-pure 22653 226540 belong&0377777777 043400407 a.out NetBSD/mips 22655>0 use netbsd-normal 22656 226570 belong&0377777777 043400507 a.out NetBSD/mips core 22658>0 use netbsd-core 22659 226600 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged 22661>0 use netbsd-4096 22662 226630 belong&0377777777 043600410 a.out NetBSD/arm32 pure 22664>0 use netbsd-pure 22665 226660 belong&0377777777 043600407 a.out NetBSD/arm32 22667>0 use netbsd-normal 22668 22669# NetBSD/arm26 has always used ELF objects, but it shares a core file 22670# format with NetBSD/arm32. 226710 belong&0377777777 043600507 a.out NetBSD/arm core 22672>0 use netbsd-core 22673 22674# Kernel core dump format 226750 belong&0x0000ffff 0x00008fca NetBSD kernel core file 22676>0 belong&0x03ff0000 0x00000000 \b, Unknown 22677>0 belong&0x03ff0000 0x00010000 \b, sun 68010/68020 22678>0 belong&0x03ff0000 0x00020000 \b, sun 68020 22679>0 belong&0x03ff0000 0x00640000 \b, 386 PC 22680>0 belong&0x03ff0000 0x00860000 \b, i386 BSD 22681>0 belong&0x03ff0000 0x00870000 \b, m68k BSD (8K pages) 22682>0 belong&0x03ff0000 0x00880000 \b, m68k BSD (4K pages) 22683>0 belong&0x03ff0000 0x00890000 \b, ns32532 BSD 22684>0 belong&0x03ff0000 0x008a0000 \b, SPARC/32 BSD 22685>0 belong&0x03ff0000 0x008b0000 \b, pmax BSD 22686>0 belong&0x03ff0000 0x008c0000 \b, vax BSD (1K pages) 22687>0 belong&0x03ff0000 0x008d0000 \b, alpha BSD 22688>0 belong&0x03ff0000 0x008e0000 \b, mips BSD (Big Endian) 22689>0 belong&0x03ff0000 0x008f0000 \b, arm6 BSD 22690>0 belong&0x03ff0000 0x00900000 \b, m68k BSD (2K pages) 22691>0 belong&0x03ff0000 0x00910000 \b, sh3 BSD 22692>0 belong&0x03ff0000 0x00950000 \b, ppc BSD (Big Endian) 22693>0 belong&0x03ff0000 0x00960000 \b, vax BSD (4K pages) 22694>0 belong&0x03ff0000 0x00970000 \b, mips1 BSD 22695>0 belong&0x03ff0000 0x00980000 \b, mips2 BSD 22696>0 belong&0x03ff0000 0x00990000 \b, m88k BSD 22697>0 belong&0x03ff0000 0x00920000 \b, parisc BSD 22698>0 belong&0x03ff0000 0x009b0000 \b, sh5/64 BSD 22699>0 belong&0x03ff0000 0x009c0000 \b, SPARC/64 BSD 22700>0 belong&0x03ff0000 0x009d0000 \b, amd64 BSD 22701>0 belong&0x03ff0000 0x009e0000 \b, sh5/32 BSD 22702>0 belong&0x03ff0000 0x009f0000 \b, ia64 BSD 22703>0 belong&0x03ff0000 0x00b70000 \b, aarch64 BSD 22704>0 belong&0x03ff0000 0x00b80000 \b, or1k BSD 22705>0 belong&0x03ff0000 0x00b90000 \b, Risk-V BSD 22706>0 belong&0x03ff0000 0x00c80000 \b, hp200 BSD 22707>0 belong&0x03ff0000 0x012c0000 \b, hp300 BSD 22708>0 belong&0x03ff0000 0x020b0000 \b, hp800 HP-UX 22709>0 belong&0x03ff0000 0x020c0000 \b, hp200/hp300 HP-UX 22710>0 belong&0xfc000000 0x04000000 \b, CPU 22711>0 belong&0xfc000000 0x08000000 \b, DATA 22712>0 belong&0xfc000000 0x10000000 \b, STACK 22713>4 leshort x \b, (headersize = %d 22714>6 leshort x \b, segmentsize = %d 22715>8 lelong x \b, segments = %d) 22716 22717# little endian only for now. 227180 name ktrace 22719>4 leshort 7 22720>>6 leshort <3 NetBSD ktrace file version %d 22721>>>12 string x from %s 22722>>>56 string x \b, emulation %s 22723>>>8 lelong <65536 \b, pid=%d 22724 2272556 string netbsd 22726>0 use ktrace 2272756 string linux 22728>0 use ktrace 2272956 string sunos 22730>0 use ktrace 2273156 string hpux 22732>0 use ktrace 22733 22734#------------------------------------------------------------------------------ 22735# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $ 22736# netscape: file(1) magic for Netscape files 22737# "H. Nanosecond" <aldomel@ix.netcom.com> 22738# version 3 and 4 I think 22739# 22740 22741# Netscape Address book .nab 227420 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book 22743 22744# Netscape Communicator address book 227450 string \000\017\102\111 Netscape Communicator address book 22746 22747# .snm Caches 227480 string #\ Netscape\ folder\ cache Netscape folder cache 227490 string \000\036\204\220\000 Netscape folder cache 22750# .n2p 22751# Net 2 Phone 22752#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060 227530 string SX961999 Net2phone 22754 22755# 22756#This is files ending in .art, FIXME add more rules 227570 string JG\004\016\0\0\0\0 AOL ART image 227580 string JG\003\016\0\0\0\0 AOL ART image 22759 22760#------------------------------------------------------------------------------ 22761# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $ 22762# netware: file(1) magic for NetWare Loadable Modules (NLMs) 22763# From: Mads Martin Joergensen <mmj@suse.de> 22764 227650 string NetWare\ Loadable\ Module NetWare Loadable Module 22766 22767#------------------------------------------------------------------------------ 22768# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $ 22769# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews") 22770# 227710 string StartFontMetrics ASCII font metrics 227720 string StartFont ASCII font bits 227730 belong 0x137A2944 NeWS bitmap font 227740 belong 0x137A2947 NeWS font family 227750 belong 0x137A2950 scalable OpenFont binary 227760 belong 0x137A2951 encrypted scalable OpenFont binary 227778 belong 0x137A2B45 X11/NeWS bitmap font 227788 belong 0x137A2B48 X11/NeWS font family 22779 22780#------------------------------------------------------------------------------ 22781# $File: nitpicker,v 1.8 2019/04/19 00:42:27 christos Exp $ 22782# nitpicker: file(1) magic for Flowfiles. 22783# From: Christian Jachmann <C.Jachmann@gmx.net> https://www.nitpicker.de 227840 string NPFF NItpicker Flow File 22785>4 byte x V%d. 22786>5 byte x %d 22787>6 bedate x started: %s 22788>10 bedate x stopped: %s 22789>14 belong x Bytes: %u 22790>18 belong x Bytes1: %u 22791>22 belong x Flows: %u 22792>26 belong x Pkts: %u 22793 22794#------------------------------------------------------------------------------ 22795# $File: numpy,v 1.1 2019/05/09 16:24:36 christos Exp $ 22796# numpy: file(1) magic for NumPy array binary serialization format 22797# Reference: https://docs.scipy.org/doc/numpy/reference/generated/numpy.lib.format.html 227980 string \x93NUMPY NumPy array, 22799>6 ubyte x version %d 22800>7 ubyte x \b.%d, 22801>8 uleshort x header length %d 22802 22803#------------------------------------------------------------------------------ 22804# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $ 22805# OASIS 22806# Summary: OASIS stream file 22807# Long description: Open Artwork System Interchange Standard 22808# File extension: .oas 22809# Full name: Ben Cowley (bcowley@broadcom.com) 22810# Philip Dixon (pdixon@broadcom.com) 22811# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf 22812# (see page 3) 228130 string %SEMI-OASIS\r\n OASIS Stream file 22814 22815#------------------------------------------------------------------------------ 22816# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $ 22817# ocaml: file(1) magic for Objective Caml files. 228180 string Caml1999 OCaml 22819>8 string X exec file 22820>8 string I interface file (.cmi) 22821>8 string O object file (.cmo) 22822>8 string A library file (.cma) 22823>8 string Y native object file (.cmx) 22824>8 string Z native library file (.cmxa) 22825>8 string M abstract syntax tree implementation file 22826>8 string N abstract syntax tree interface file 22827>9 string >\0 (Version %3.3s) 22828 22829#------------------------------------------------------------------------------ 22830# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $ 22831# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org> 228320 string Octave-1-L Octave binary data (little endian) 228330 string Octave-1-B Octave binary data (big endian) 22834 22835#------------------------------------------------------------------------------ 22836# $File: ole2compounddocs,v 1.6 2019/04/19 00:42:27 christos Exp $ 22837# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured 22838# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format) 22839# Additional tests for OLE 2 Compound Documents should be under this recipe. 22840 228410 string \320\317\021\340\241\261\032\341 OLE 2 Compound Document 22842# - Microstation V8 DGN files (www.bentley.com) 22843# Last update on 10/23/2006 by Lester Hightower 22844> 0x480 string D\000g\000n\000~\000H : Microstation V8 DGN 22845# - Visio documents 22846# Last update on 10/23/2006 by Lester Hightower 22847> 0x480 string V\000i\000s\000i\000o\000D\000o\000c : Visio Document 22848 22849# Note: moved & merged Microsoft Office parts from ./msdos Oct 2017 22850# Update: Joerg Jenderek 22851# from https://filext.com by Derek M Jones <derek@knosof.co.uk> 22852# False positive with PPT (also currently this string is too long) 22853#0 string/b \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer 22854#0 string/b \320\317\021\340\241\261\032\341 Microsoft Office Document 22855#>48 byte 0x1B Excel Document 22856#!:mime application/vnd.ms-excel 22857>546 string bjbj : Microsoft Word Document 22858!:mime application/msword 22859# https://www.macdisk.com/macsigen.php 22860!:apple MSWDWDBN 22861!:ext doc/dot 22862>546 string jbjb : Microsoft Word Document 22863!:mime application/msword 22864!:apple MSWDWDBN 22865!:ext doc 22866 22867 22868#------------------------------------------------------------------------------ 22869# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $ 22870# olf: file(1) magic for OLF executables 22871# 22872# We have to check the byte order flag to see what byte order all the 22873# other stuff in the header is in. 22874# 22875# MIPS R3000 may also be for MIPS R2000. 22876# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? 22877# 22878# Created by Erik Theisen <etheisen@openbsd.org> 22879# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> 228800 string \177OLF OLF 22881>4 byte 0 invalid class 22882>4 byte 1 32-bit 22883>4 byte 2 64-bit 22884>7 byte 0 invalid os 22885>7 byte 1 OpenBSD 22886>7 byte 2 NetBSD 22887>7 byte 3 FreeBSD 22888>7 byte 4 4.4BSD 22889>7 byte 5 Linux 22890>7 byte 6 SVR4 22891>7 byte 7 esix 22892>7 byte 8 Solaris 22893>7 byte 9 Irix 22894>7 byte 10 SCO 22895>7 byte 11 Dell 22896>7 byte 12 NCR 22897>5 byte 0 invalid byte order 22898>5 byte 1 LSB 22899>>16 leshort 0 no file type, 22900>>16 leshort 1 relocatable, 22901>>16 leshort 2 executable, 22902>>16 leshort 3 shared object, 22903# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> 22904# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> 22905>>16 leshort 4 core file 22906>>>(0x38+0xcc) string >\0 of '%s' 22907>>>(0x38+0x10) lelong >0 (signal %d), 22908>>16 leshort &0xff00 processor-specific, 22909>>18 leshort 0 no machine, 22910>>18 leshort 1 AT&T WE32100 - invalid byte order, 22911>>18 leshort 2 SPARC - invalid byte order, 22912>>18 leshort 3 Intel 80386, 22913>>18 leshort 4 Motorola 68000 - invalid byte order, 22914>>18 leshort 5 Motorola 88000 - invalid byte order, 22915>>18 leshort 6 Intel 80486, 22916>>18 leshort 7 Intel 80860, 22917>>18 leshort 8 MIPS R3000_BE - invalid byte order, 22918>>18 leshort 9 Amdahl - invalid byte order, 22919>>18 leshort 10 MIPS R3000_LE, 22920>>18 leshort 11 RS6000 - invalid byte order, 22921>>18 leshort 15 PA-RISC - invalid byte order, 22922>>18 leshort 16 nCUBE, 22923>>18 leshort 17 VPP500, 22924>>18 leshort 18 SPARC32PLUS, 22925>>18 leshort 20 PowerPC, 22926>>18 leshort 0x9026 Alpha, 22927>>20 lelong 0 invalid version 22928>>20 lelong 1 version 1 22929>>36 lelong 1 MathCoPro/FPU/MAU Required 22930>8 string >\0 (%s) 22931>5 byte 2 MSB 22932>>16 beshort 0 no file type, 22933>>16 beshort 1 relocatable, 22934>>16 beshort 2 executable, 22935>>16 beshort 3 shared object, 22936>>16 beshort 4 core file, 22937>>>(0x38+0xcc) string >\0 of '%s' 22938>>>(0x38+0x10) belong >0 (signal %d), 22939>>16 beshort &0xff00 processor-specific, 22940>>18 beshort 0 no machine, 22941>>18 beshort 1 AT&T WE32100, 22942>>18 beshort 2 SPARC, 22943>>18 beshort 3 Intel 80386 - invalid byte order, 22944>>18 beshort 4 Motorola 68000, 22945>>18 beshort 5 Motorola 88000, 22946>>18 beshort 6 Intel 80486 - invalid byte order, 22947>>18 beshort 7 Intel 80860, 22948>>18 beshort 8 MIPS R3000_BE, 22949>>18 beshort 9 Amdahl, 22950>>18 beshort 10 MIPS R3000_LE - invalid byte order, 22951>>18 beshort 11 RS6000, 22952>>18 beshort 15 PA-RISC, 22953>>18 beshort 16 nCUBE, 22954>>18 beshort 17 VPP500, 22955>>18 beshort 18 SPARC32PLUS, 22956>>18 beshort 20 PowerPC or cisco 4500, 22957>>18 beshort 21 cisco 7500, 22958>>18 beshort 24 cisco SVIP, 22959>>18 beshort 25 cisco 7200, 22960>>18 beshort 36 cisco 12000, 22961>>18 beshort 0x9026 Alpha, 22962>>20 belong 0 invalid version 22963>>20 belong 1 version 1 22964>>36 belong 1 MathCoPro/FPU/MAU Required 22965 22966#------------------------------------------------------------------------------ 22967# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $ 22968# os2: file(1) magic for OS/2 files 22969# 22970 22971# Provided 1998/08/22 by 22972# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 229731 search/100 InternetShortcut MS Windows 95 Internet shortcut text 22974>17 search/100 URL= (URL=< 22975>>&0 string x \b%s>) 22976 22977# OS/2 URL objects 22978# Provided 1998/08/22 by 22979# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 22980#0 string http: OS/2 URL object text 22981#>5 string >\ (WWW) <http:%s> 22982#0 string mailto: OS/2 URL object text 22983#>7 string >\ (email) <%s> 22984#0 string news: OS/2 URL object text 22985#>5 string >\ (Usenet) <%s> 22986#0 string ftp: OS/2 URL object text 22987#>4 string >\ (FTP) <ftp:%s> 22988#0 string file: OS/2 URL object text 22989#>5 string >\ (Local file) <%s> 22990 22991# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) 22992# Carl Hauser (chauser.parc@xerox.com) and 22993# Marcus Groeber (marcusg@ph-cip.uni-koeln.de) 22994# list the following header format in inf02a.doc: 22995# 22996# int16 ID; // ID magic word (5348h = "HS") 22997# int8 unknown1; // unknown purpose, could be third letter of ID 22998# int8 flags; // probably a flag word... 22999# // bit 0: set if INF style file 23000# // bit 4: set if HLP style file 23001# // patching this byte allows reading HLP files 23002# // using the VIEW command, while help files 23003# // seem to work with INF settings here as well. 23004# int16 hdrsize; // total size of header 23005# int16 unknown2; // unknown purpose 23006# 230070 string HSP\x01\x9b\x00 OS/2 INF 23008>107 string >0 (%s) 230090 string HSP\x10\x9b\x00 OS/2 HLP 23010>107 string >0 (%s) 23011 23012# OS/2 INI (this is a guess) 230130 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI 23014 23015#------------------------------------------------------------------------------ 23016# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $ 23017# os400: file(1) magic for IBM OS/400 files 23018# 23019# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com 23020# In spite of its quite variable format (due to internal memory page 23021# length differences between CISC and RISC versions of the OS) the 23022# SAVF structure hasn't suitable offsets to identify the catalog 23023# header in the first descriptor where there are some useful infos, 23024# so we must search in a somewhat large area for a particular string 23025# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore 23026# descriptor space) preceded by a two byte constant. 23027# 230281090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data 23029>&212 byte 0x01 \b, created with SAVOBJ 23030>&212 byte 0x02 \b, created with SAVLIB 23031>&212 byte 0x07 \b, created with SAVCFG 23032>&212 byte 0x08 \b, created with SAVSECDTA 23033>&212 byte 0x0A \b, created with SAVSECDTA 23034>&212 byte 0x0B \b, created with SAVDLO 23035>&212 byte 0x0D \b, created with SAVLICPGM 23036>&212 byte 0x11 \b, created with SAVCHGOBJ 23037>&213 byte 0x44 \b, at least V5R4 to open 23038>&213 byte 0x43 \b, at least V5R3 to open 23039>&213 byte 0x42 \b, at least V5R2 to open 23040>&213 byte 0x41 \b, at least V5R1 to open 23041>&213 byte 0x40 \b, at least V4R5 to open 23042>&213 byte 0x3F \b, at least V4R4 to open 23043>&213 byte 0x3E \b, at least V4R3 to open 23044>&213 byte 0x3C \b, at least V4R2 to open 23045>&213 byte 0x3D \b, at least V4R1M4 to open 23046>&213 byte 0x3B \b, at least V4R1 to open 23047>&213 byte 0x3A \b, at least V3R7 to open 23048>&213 byte 0x35 \b, at least V3R6 to open 23049>&213 byte 0x36 \b, at least V3R2 to open 23050>&213 byte 0x34 \b, at least V3R1 to open 23051>&213 byte 0x31 \b, at least V3R0M5 to open 23052>&213 byte 0x30 \b, at least V2R3 to open 23053 23054#------------------------------------------------------------------------------ 23055# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $ 23056# 23057# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved. 23058# 23059# Redistribution and use in source and binary forms, with or without 23060# modification, are permitted provided that the following conditions 23061# are met: 23062# 1. Redistributions of source code must retain the above copyright 23063# notice, this list of conditions and the following disclaimer. 23064# 2. Redistributions in binary form must reproduce the above copyright 23065# notice, this list of conditions and the following disclaimer in the 23066# documentation and/or other materials provided with the distribution. 23067# 23068# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 23069# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23070# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23071# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 23072# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 23073# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 23074# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 23075# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 23076# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 23077# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 23078# 23079# 23080# 23081# OS9/6809 module descriptions: 23082# 230830 beshort 0x87CD OS9/6809 module: 23084# 23085>6 byte&0x0f 0x00 non-executable 23086>6 byte&0x0f 0x01 machine language 23087>6 byte&0x0f 0x02 BASIC I-code 23088>6 byte&0x0f 0x03 Pascal P-code 23089>6 byte&0x0f 0x04 C I-code 23090>6 byte&0x0f 0x05 COBOL I-code 23091>6 byte&0x0f 0x06 Fortran I-code 23092# 23093>6 byte&0xf0 0x10 program executable 23094>6 byte&0xf0 0x20 subroutine 23095>6 byte&0xf0 0x30 multi-module 23096>6 byte&0xf0 0x40 data module 23097# 23098>6 byte&0xf0 0xC0 system module 23099>6 byte&0xf0 0xD0 file manager 23100>6 byte&0xf0 0xE0 device driver 23101>6 byte&0xf0 0xF0 device descriptor 23102# 23103# OS9/m68k stuff (to be continued) 23104# 231050 beshort 0x4AFC OS9/68K module: 23106# 23107# attr 23108>0x14 byte&0x80 0x80 re-entrant 23109>0x14 byte&0x40 0x40 ghost 23110>0x14 byte&0x20 0x20 system-state 23111# 23112# lang: 23113# 23114>0x13 byte 1 machine language 23115>0x13 byte 2 BASIC I-code 23116>0x13 byte 3 Pascal P-code 23117>0x13 byte 4 C I-code 23118>0x13 byte 5 COBOL I-code 23119>0x13 byte 6 Fortran I-code 23120# 23121# 23122# type: 23123# 23124>0x12 byte 1 program executable 23125>0x12 byte 2 subroutine 23126>0x12 byte 3 multi-module 23127>0x12 byte 4 data module 23128>0x12 byte 11 trap library 23129>0x12 byte 12 system module 23130>0x12 byte 13 file manager 23131>0x12 byte 14 device driver 23132>0x12 byte 15 device descriptor 23133 23134#------------------------------------------------------------------------------ 23135# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $ 23136# 23137# Mach magic number info 23138# 231390 long 0xefbe OSF/Rose object 23140# I386 magic number info 23141# 231420 short 0565 i386 COFF object 23143 23144#------------------------------------------------------------------------------ 23145# $File: palm,v 1.14 2019/04/19 00:42:27 christos Exp $ 23146# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks 23147# 23148# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> 23149 23150# These are weak, byte 59 is not guaranteed to be 0 and there are 23151# 8 character identifiers at byte 60, one I found for appl is BIGb. 23152# What are the possibilities and where is this documented? 23153 23154# The common header format for PalmOS .pdb/.prc files is 23155# { 23156# char name[ 32 ]; 23157# Word attributes; 23158# Word version; 23159# DWord creationDate; 23160# DWord modificationDate; 23161# DWord lastBackupDate; 23162# DWord modificationNumber; 23163# DWord appInfoID; 23164# DWord sortInfoID; 23165# char type[4]; 23166# char creator[4]; 23167# DWord uniqueIDSeed; 23168# RecordListType recordList; 23169# }; 23170# 23171# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904), 23172# or Unix/POSIX time + 2082844800. 23173 231740 name aportisdoc 23175# date is supposed to be big-endian seconds since 1 Jan 1904, but many 23176# files contain the timestamp in little-endian or a completely 23177# nonsensical value... 23178#>36 bedate-2082844800 >0 \b, created %s 23179# compression: 1=uncomp, 2=orig, 0x4448=HuffDic 23180>(78.L) beshort =1 \b, uncompressed 23181# compressed 23182>(78.L) beshort >1 23183>>(78.L+4) belong x \b, %d bytes uncompressed 23184 23185# appl 23186#60 string appl PalmOS application 23187#>0 string >\0 "%s" 23188 23189# HACK 23190#60 string HACK HackMaster hack 23191#>0 string >\0 "%s" 23192 23193# iSiloX e-book 2319460 string SDocSilX iSiloX E-book 23195>0 string >\0 "%s" 23196 23197# Mobipocket (www.mobipocket.com), donated by Carl Witty 23198# expanded by Ralf Brown 2319960 string BOOKMOBI Mobipocket E-book 23200# MobiPocket stores a full title, pointed at by the belong at offset 23201# 0x54 in its header at (78.L), with length given by the belong at 23202# offset 0x58. 23203# there's no guarantee that the title string is null-terminated, but 23204# we currently can't specify a variable-length string where the length 23205# field is not at the start of the string; in practice, the data 23206# following the string always seems to start with a zero byte 23207>(78.L) belong x 23208>>&(&0x50.L-4) string >\0 "%s" 23209>0 use aportisdoc 23210>>(78.L+0x68) belong >0 \b, version %d 23211>>(78.L+0x1C) belong !0 \b, codepage %d 23212>>(78.L+0x0C) beshort >0 \b, encrypted (type %d) 23213 23214# AportisDoc/PalmDOC 2321560 string TEXtREAd AportisDoc/PalmDOC E-book 23216>0 string >\0 "%s" 23217>0 use aportisdoc 23218 23219# Variety of PalmOS document types 23220# Michael-John Turner <mj@debian.org> 23221# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType 2322260 string BVokBDIC BDicty PalmOS document 23223>0 string >\0 "%s" 2322460 string DB99DBOS DB PalmOS document 23225>0 string >\0 "%s" 2322660 string vIMGView FireViewer/ImageViewer PalmOS document 23227>0 string >\0 "%s" 2322860 string PmDBPmDB HanDBase PalmOS document 23229>0 string >\0 "%s" 2323060 string InfoINDB InfoView PalmOS document 23231>0 string >\0 "%s" 2323260 string ToGoToGo iSilo PalmOS document 23233>0 string >\0 "%s" 2323460 string JfDbJBas JFile PalmOS document 23235>0 string >\0 "%s" 2323660 string JfDbJFil JFile Pro PalmOS document 23237>0 string >\0 "%s" 2323860 string DATALSdb List PalmOS document 23239>0 string >\0 "%s" 2324060 string Mdb1Mdb1 MobileDB PalmOS document 23241>0 string >\0 "%s" 2324260 string PNRdPPrs PeanutPress PalmOS document 23243>0 string >\0 "%s" 2324460 string DataPlkr Plucker PalmOS document 23245>0 string >\0 "%s" 2324660 string DataSprd QuickSheet PalmOS document 23247>0 string >\0 "%s" 2324860 string SM01SMem SuperMemo PalmOS document 23249>0 string >\0 "%s" 2325060 string TEXtTlDc TealDoc PalmOS document 23251>0 string >\0 "%s" 2325260 string InfoTlIf TealInfo PalmOS document 23253>0 string >\0 "%s" 2325460 string DataTlMl TealMeal PalmOS document 23255>0 string >\0 "%s" 2325660 string DataTlPt TealPaint PalmOS document 23257>0 string >\0 "%s" 2325860 string dataTDBP ThinkDB PalmOS document 23259>0 string >\0 "%s" 2326060 string TdatTide Tides PalmOS document 23261>0 string >\0 "%s" 2326260 string ToRaTRPW TomeRaider PalmOS document 23263>0 string >\0 "%s" 23264 23265# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) 23266# For version 1.xx zTXTs, outputs version and numbers of bookmarks and 23267# annotations. 23268# For other versions, just outputs version. 23269# 2327060 string zTXT A GutenPalm zTXT e-book 23271>0 string >\0 "%s" 23272>(0x4E.L) byte 0 23273>>(0x4E.L+1) byte x (v0.%02d) 23274>(0x4E.L) byte 1 23275>>(0x4E.L+1) byte x (v1.%02d) 23276>>>(0x4E.L+10) beshort >0 23277>>>>(0x4E.L+10) beshort <2 - 1 bookmark 23278>>>>(0x4E.L+10) beshort >1 - %d bookmarks 23279>>>(0x4E.L+14) beshort >0 23280>>>>(0x4E.L+14) beshort <2 - 1 annotation 23281>>>>(0x4E.L+14) beshort >1 - %d annotations 23282>(0x4E.L) byte >1 (v%d. 23283>>(0x4E.L+1) byte x %02d) 23284 23285# Palm OS .prc file types 2328660 string libr 23287# flags, only bit 0 or bit 6 23288# https://en.wikipedia.org/wiki/PRC_%28Palm_OS%29 23289# https://web.mit.edu/tytso/www/pilot/prc-format.html 23290>0x20 beshort&0xffbe 0 23291>>0 string >\0 Palm OS dynamic library data "%s" 2329260 string ptch Palm OS operating system patch data 23293>0 string >\0 "%s" 23294 23295# Mobipocket (www.mobipocket.com), donated by Carl Witty 2329660 string BOOKMOBI Mobipocket E-book 23297>0 string >\0 "%s" 23298 23299#------------------------------------------------------------------------------ 23300# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $ 23301# 23302# Parix COFF executables 23303# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de> 23304# 233050 beshort&0xfff 0xACE PARIX 23306>0 byte&0xf0 0x80 T800 23307>0 byte&0xf0 0x90 T9000 23308>19 byte&0x02 0x02 executable 23309>19 byte&0x02 0x00 object 23310>19 byte&0x0c 0x00 not stripped 23311#------------------------------------------------------------------------------ 23312# $File: parrot,v 1.2 2019/04/19 00:42:27 christos Exp $ 23313# parrot: file(1) magic for Parrot Virtual Machine 23314# URL: https://www.lua.org/ 23315# From: Lubomir Rintel <lkundrak@v3.sk> 23316 23317# Compiled Parrot byte code 233180 string \376PBC\r\n\032\n Parrot bytecode 23319>64 byte x %d. 23320>72 byte x \b%d, 23321>8 byte >0 %d byte words, 23322>16 byte 0 little-endian, 23323>16 byte 1 big-endian, 23324>32 byte 0 IEEE-754 8 byte double floats, 23325>32 byte 1 x86 12 byte long double floats, 23326>32 byte 2 IEEE-754 16 byte long double floats, 23327>32 byte 3 MIPS 16 byte long double floats, 23328>32 byte 4 AIX 16 byte long double floats, 23329>32 byte 5 4-byte floats, 23330>40 byte x Parrot %d. 23331>48 byte x \b%d. 23332>56 byte x \b%d 23333#------------------------------------------------------------------------------ 23334# $File: pascal,v 1.2 2014/07/14 14:21:33 rrt Exp $ 23335# pascal: file(1) magic for Pascal source 23336# 233370 search/8192 (input, Pascal source text 23338!:mime text/x-pascal 23339#0 regex \^program Pascal source text 23340#!:mime text/x-pascal 23341#0 regex \^record Pascal source text 23342#!:mime text/x-pascal 23343 23344#------------------------------------------------------------------------------ 23345# $File: pbf,v 1.3 2019/04/19 00:42:27 christos Exp $ 23346# file(1) magic(5) data for OpenStreetMap 23347 23348# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf) 23349# https://wiki.openstreetmap.org/wiki/PBF_Format 23350# From: Markus Heidelberg <markus.heidelberg@web.de> 233510 belong&0xfffffff0 0 23352>4 beshort 0x0A09 23353>>6 string OSMHeader OpenStreetMap Protocolbuffer Binary Format 23354 23355#------------------------------------------------------------------------------ 23356# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $ 23357# pbm: file(1) magic for Portable Bitmap files 23358# 23359# XXX - byte order? 23360# 233610 short 0x2a17 "compact bitmap" format (Poskanzer) 23362#------------------------------------------------------------------------------ 23363# pc88: file(1) magic for the NEC Home Computer 23364# v1.0 23365# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 23366 23367# PC88 2D disk image 233680x20 ulelong&0xFFFFFEFF 0x2A0 23369>0x10 string \0\0\0\0\0\0\0\0\0\0 23370>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 23371>>>0x1A ubyte&0xEF 0 23372>>>>0x1B ubyte&0x8F 0 23373>>>>>0x1B ubyte&70 <0x40 23374>>>>>>0x1C ulelong >0x21 23375>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s 23376>>>>>>>>0x1B ubyte 0 \b, media=2D 23377>>>>>>>>0x1B ubyte 0x10 \b, media=2DD 23378>>>>>>>>0x1B ubyte 0x20 \b, media=2HD 23379>>>>>>>>0x1B ubyte 0x30 \b, media=1D 23380>>>>>>>>0x1B ubyte 0x40 \b, media=1DD 23381>>>>>>>>0x1A ubyte 0x10 \b, write-protected 23382 23383 23384 23385 23386#------------------------------------------------------------------------------ 23387# pc98: file(1) magic for the MSX Home Computer 23388# v1.0 23389# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 23390 23391# Maki-chan v1 Graphic format 23392# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn't find a way to do so 23393# http://www.jisyo.com/viewer/faq/maki_tech.htm 233940 string/b MAKI01 Maki-chan v1. 23395>6 ubyte|0x20 x \b%c image 23396>8 ubelong >0x40404040 \b, system ID: 23397>>8 byte x %c 23398>>9 byte x \b%c 23399>>10 byte x \b%c 23400>>11 byte x \b%c 23401>44 ubeshort x \b, %dx 23402>46 ubeshort x \b%d 23403>38 ubeshort&2 0 \b, 16 paletted RGB colors 23404>38 ubeshort&2 2 \b, 8 fixed RGB colors 23405>38 ubeshort&1 1 \b, 2:1 dot aspect ratio 23406 23407# Maki-chan v2 Graphic format 23408# http://www.jisyo.com/viewer/faq/mag_tech.htm 23409# https://mooncore.eu/bunny/txt/makichan.htm 23410# http://metanest.jp/mag/mag.xhtml 234110 string/b MAKI02\ \ Maki-chan v2 image, 23412>8 byte x system ID: %c 23413>9 byte x \b%c 23414>10 byte x \b%c 23415>11 byte x \b%c, 23416>13 search/0x200 \x1A 23417#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing: 23418#1) When offset1(ubeshort) !=0x0344: 23419# 1.1) And offset3(ubyte).b7=0: 23420# - b0=pixel aspect ratio: 1=2:1 (note: this ignores that the machine's 1:1 pixel aspect ratio isn't really 1:1) 23421# - b1=number of colors: 0=16 colors, 1=8 colors 23422# - b2=Palette or fixed colors flag (called "analog" and "digital" in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data 23423# 1.2) And offset3(ubyte).B7=1: 23424# - b0=256 paletted colors 23425# - b1=256 fixed colors using the MSX SCR8 palette 23426#2) When offset1(ubeshort) =0x0344: 23427# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored 23428>>&1 ubeshort 0x0344 256x212, 19268 fixed YJK colors 23429>>&1 ubeshort !0x0344 23430>>>&5 uleshort+1 x %dx 23431>>>&7 uleshort+1 x \b%d, 23432>>>&0 ubyte&0x86 0x00 16 paletted RGB colors 23433>>>&0 ubyte&0x86 0x02 8 paletted RGB colors 23434>>>&0 ubyte&0x86 0x04 16 fixed RGB colors 23435>>>&0 ubyte&0x86 0x06 8 fixed RGB colors 23436>>>&0 ubyte&0x81 0x80 256 paletted RGB colors 23437>>>&0 ubyte&0x81 0x81 256 fixed MSX-SCR8 colors 23438>>>&0 ubyte&0x01 1 \b, 2:1 dot aspect ratio 23439 23440# XLD4 (Q4) picture 2344111 string/b MAJYO XLD4(Q4) picture 23442 23443# Yanagisawa Pi picture 23444#0 string Pi\x1A\0 Yanagisawa Pi picture 23445#>3 search/0x200 \x04 234460 string Pi 23447>2 search/0x200 \x1A 23448>>&0 ubyte 0 23449>>>&3 ubyte 4 Yanagisawa Pi 16 color picture, 23450>>>&4 byte x system ID: %c 23451>>>&5 byte x \b%c 23452>>>&6 byte x \b%c 23453>>>&7 byte x \b%c, 23454>>>&10 ubeshort x %dx 23455>>>&12 ubeshort x \b%d 23456>>>&3 ubyte 8 Yanagisawa Pi 256 color picture 23457>>>&4 byte x system ID: %c 23458>>>&5 byte x \b%c 23459>>>&6 byte x \b%c 23460>>>&7 byte x \b%c, 23461>>>&10 ubeshort x %dx 23462>>>&12 ubeshort x \b%d 23463 23464#------------------------------------------------------------------------------ 23465# $File: pdf,v 1.10 2018/05/23 22:21:01 christos Exp $ 23466# pdf: file(1) magic for Portable Document Format 23467# 23468 234690 string %PDF- PDF document 23470!:mime application/pdf 23471!:strength +60 23472>5 byte x \b, version %c 23473>7 byte x \b.%c 23474 234750 string \012%PDF- PDF document 23476!:mime application/pdf 23477!:strength +60 23478>6 byte x \b, version %c 23479>8 byte x \b.%c 23480 23481# From: Nick Schmalenberger <nick@schmalenberger.us> 23482# Forms Data Format 234830 string %FDF- FDF document 23484!:mime application/vnd.fdf 23485!:strength +60 23486>5 byte x \b, version %c 23487>7 byte x \b.%c 23488 234890 search/256 %PDF- PDF document 23490!:mime application/pdf 23491!:strength +60 23492>&0 byte x \b, version %c 23493>&2 byte x \b.%c 23494 23495#------------------------------------------------------------------------------ 23496# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $ 23497# pdp: file(1) magic for PDP-11 executable/object and APL workspace 23498# 234990 lelong 0101555 PDP-11 single precision APL workspace 235000 lelong 0101554 PDP-11 double precision APL workspace 23501# 23502# PDP-11 a.out 23503# 235040 leshort 0407 PDP-11 executable 23505>8 leshort >0 not stripped 23506>15 byte >0 - version %d 23507 23508# updated by Joerg Jenderek at Mar 2013 23509# GRR: line below too general as it catches also Windows precompiled setup information *.PNF 235100 leshort 0401 23511# skip *.PNF with WinDirPathOffset 58h 23512>68 ulelong !0x00000058 PDP-11 UNIX/RT ldp 23513# skip *.PNF with high byte of InfVersionDatumCount zero 23514#>>15 byte !0 PDP-11 UNIX/RT ldp 235150 leshort 0405 PDP-11 old overlay 23516 235170 leshort 0410 PDP-11 pure executable 23518>8 leshort >0 not stripped 23519>15 byte >0 - version %d 23520 235210 leshort 0411 PDP-11 separate I&D executable 23522>8 leshort >0 not stripped 23523>15 byte >0 - version %d 23524 235250 leshort 0437 PDP-11 kernel overlay 23526 23527# These last three are derived from 2.11BSD file(1) 235280 leshort 0413 PDP-11 demand-paged pure executable 23529>8 leshort >0 not stripped 23530 235310 leshort 0430 PDP-11 overlaid pure executable 23532>8 leshort >0 not stripped 23533 235340 leshort 0431 PDP-11 overlaid separate executable 23535>8 leshort >0 not stripped 23536#------------------------------------------------------------------------------ 23537# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $ 23538# perl: file(1) magic for Larry Wall's perl language. 23539# 23540# The `eval' lines recognizes an outrageously clever hack. 23541# Keith Waclena <keith@cerberus.uchicago.edu> 23542# Send additions to <perl5-porters@perl.org> 235430 search/1024 eval\ "exec\ perl Perl script text 23544!:mime text/x-perl 235450 search/1024 eval\ "exec\ /bin/perl Perl script text 23546!:mime text/x-perl 235470 search/1024 eval\ "exec\ /usr/bin/perl Perl script text 23548!:mime text/x-perl 235490 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text 23550!:mime text/x-perl 235510 search/1024 eval\ 'exec\ perl Perl script text 23552!:mime text/x-perl 235530 search/1024 eval\ 'exec\ /bin/perl Perl script text 23554!:mime text/x-perl 235550 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text 23556!:mime text/x-perl 235570 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text 23558!:mime text/x-perl 235590 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text 23560!:mime text/x-perl 235610 string #!/usr/bin/env\ perl Perl script text executable 23562!:mime text/x-perl 235630 string #!\ /usr/bin/env\ perl Perl script text executable 23564!:mime text/x-perl 235650 string #! 23566>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable 23567!:mime text/x-perl 23568 23569# by Dmitry V. Levin and Alexey Tourbin 23570# check the first line 235710 search/8192 package 23572>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text 23573!:strength + 40 23574# not 'p', check other lines 235750 search/8192 !p 23576>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; 23577>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text 23578!:strength + 75 23579 23580# Perl POD documents 23581# From: Tom Hukins <tom@eborcom.com> 235820 search/1024/W \=pod\n Perl POD document text 235830 search/1024/W \n\=pod\n Perl POD document text 235840 search/1024/W \=head1\ Perl POD document text 235850 search/1024/W \n\=head1\ Perl POD document text 235860 search/1024/W \=head2\ Perl POD document text 235870 search/1024/W \n\=head2\ Perl POD document text 235880 search/1024/W \=encoding\ Perl POD document text 235890 search/1024/W \n\=encoding\ Perl POD document text 23590 23591 23592# Perl Storable data files. 235930 string perl-store perl Storable (v0.6) data 23594>4 byte >0 (net-order %d) 23595>>4 byte &01 (network-ordered) 23596>>4 byte =3 (major 1) 23597>>4 byte =2 (major 1) 23598 235990 string pst0 perl Storable (v0.7) data 23600>4 byte >0 23601>>4 byte &01 (network-ordered) 23602>>4 byte =5 (major 2) 23603>>4 byte =4 (major 2) 23604>>5 byte >0 (minor %d) 23605 23606# This is Debian #742949 by Zefram <zefram@fysh.org>: 23607# ----------------------------------------------------------- 23608# The Perl module Hash::SharedMem 23609# <https://metacpan.org/release/Hash-SharedMem> defines a file format 23610# for a key/value store. Details of the file format are in the "DESIGN" 23611# file in the module distribution. Magic: 236120 bequad =0xa58afd185cbf5af7 Hash::SharedMem master file, big-endian 23613>8 bequad <0x1000000 23614>>15 byte >2 \b, line size 2^%d byte 23615>>14 byte >2 \b, page size 2^%d byte 23616>>13 byte &1 23617>>>13 byte >1 \b, max fanout %d 236180 lequad =0xa58afd185cbf5af7 Hash::SharedMem master file, little-endian 23619>8 lequad <0x1000000 23620>>8 byte >2 \b, line size 2^%d byte 23621>>9 byte >2 \b, page size 2^%d byte 23622>>10 byte &1 23623>>>10 byte >1 \b, max fanout %d 236240 bequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, big-endian 23625>8 bequad <0x1000000 23626>>15 byte >2 \b, line size 2^%d byte 23627>>14 byte >2 \b, page size 2^%d byte 23628>>13 byte &1 23629>>>13 byte >1 \b, max fanout %d 236300 lequad =0xc693dac5ed5e47c2 Hash::SharedMem data file, little-endian 23631>8 lequad <0x1000000 23632>>8 byte >2 \b, line size 2^%d byte 23633>>9 byte >2 \b, page size 2^%d byte 23634>>10 byte &1 23635>>>10 byte >1 \b, max fanout %d 23636 23637#------------------------------------------------------------------------------ 23638# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $ 23639# pgf: file(1) magic for Progressive Graphics File (PGF) 23640# 23641# <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf> 23642# 2013 by Philipp Hahn <pmhahn debian org> 236430 string PGF Progressive Graphics image data, 23644!:mime image/x-pgf 23645>3 string 2 version %s, 23646>3 string 4 version %s, 23647>3 string 5 version %s, 23648>3 string 6 version %s, 23649# PGFPreHeader 23650#>>4 lelong x header size %d, 23651# PGFHeader 23652>>8 lelong x %d x 23653>>12 lelong x %d, 23654>>16 byte x %d levels, 23655>>17 byte x compression level %d, 23656>>18 byte x %d bpp, 23657>>19 byte x %d channels, 23658>>20 clear x 23659>>20 byte 0 bitmap, 23660>>20 byte 1 gray scale, 23661>>20 byte 2 indexed color, 23662>>20 byte 3 RGB color, 23663>>20 byte 4 CYMK color, 23664>>20 byte 5 HSL color, 23665>>20 byte 6 HSB color, 23666>>20 byte 7 multi-channel, 23667>>20 byte 8 duo tone, 23668>>20 byte 9 LAB color, 23669>>20 byte 10 gray scale 16, 23670>>20 byte 11 RGB color 48, 23671>>20 byte 12 LAB color 48, 23672>>20 byte 13 CYMK color 64, 23673>>20 byte 14 deep multi-channel, 23674>>20 byte 15 duo tone 16, 23675>>20 byte 17 RGBA color, 23676>>20 byte 18 gray scale 32, 23677>>20 byte 19 RGB color 12, 23678>>20 byte 20 RGB color 16, 23679>>20 byte 255 unknown format, 23680>>20 default x format 23681>>>20 byte x \b %d, 23682>>21 byte x %d bpc 23683# PGFPostHeader 23684# Level-Sizes 23685#>>(4.l+4) lelong x level 0 size: %d 23686#>>(4.l+8) lelong x level 1 size: %d 23687#>>(4.l+12) lelong x level 2 size: %d 23688 23689#------------------------------------------------------------------------------ 23690# $File: pgp,v 1.17 2019/04/19 00:42:27 christos Exp $ 23691# pgp: file(1) magic for Pretty Good Privacy 23692# see https://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html 23693# 23694# Update: Joerg Jenderek 23695# Note: verified by `gpg -v --debug 0x02 --list-packets < PUBRING263_10.PGP` 23696#0 byte 0x99 MAYBE PGP 0x99 236970 byte 0x99 23698# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length 23699# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh 23700#>1 ubeshort x \b, body length 0x%.4x 23701# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number 23702#>3 ubyte x \b, V=%u 23703#>3 ubyte <5 VERSION OK 23704>3 ubyte <5 23705# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet 23706#>>(1.S+3) ubyte x \b, next packet type 0x%x 23707# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1) 23708#>>(1.S+3) ubyte >0x7F TYPE OK, 23709>>(1.S+3) ubyte >0x7F 23710# old versions 2,3 implies Pretty Good Privacy 23711>>>3 ubyte <4 PGP key public ring (v%u) 23712!:mime application/pgp-keys 23713!:ext pgp/ASD 23714>>>>4 beldate x created %s 23715# days that this key is valid. If this number is zero, then it does not expire 23716>>>>8 ubeshort >0 \b, %u days valid 23717>>>>8 ubeshort =0 \b, not expire 23718# display key algorithm 1~RSA (Encrypt or Sign) 23719>>>>10 use key_algo 23720# Multiprecision Integers (MPI) size 23721>>>>11 ubeshort x %u bits 23722# MPI 23723>>>>13 ubequad x MPI=0x%16.16llx... 23724# new version implies Pretty Good Privacy (PGP) >= 5.0 or Gnu Privacy Guard (GPG) 23725>>>3 ubyte >3 PGP/GPG key public ring (v%u) 23726!:mime application/pgp-keys 23727!:ext pgp/gpg/pkr/asd 23728>>>>4 beldate x created %s 23729# display key algorithm 17~DSA 23730>>>>8 use key_algo 23731# Multiprecision Integers (MPI) size 23732>>>>9 ubeshort x %u bits 23733>>>>11 ubequad x MPI=0x%16.16llx... 23734 237350 beshort 0x9501 PGP key security ring 23736!:mime application/x-pgp-keyring 237370 beshort 0x9500 PGP key security ring 23738!:mime application/x-pgp-keyring 237390 beshort 0xa600 PGP encrypted data 23740#!:mime application/pgp-encrypted 23741#0 string -----BEGIN\040PGP text/PGP armored data 23742!:mime text/PGP # encoding: armored data 23743#>15 string PUBLIC\040KEY\040BLOCK- public key block 23744#>15 string MESSAGE- message 23745#>15 string SIGNED\040MESSAGE- signed message 23746#>15 string PGP\040SIGNATURE- signature 23747 237482 string ---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK- PGP public key block 23749!:mime application/pgp-keys 23750>10 search/100 \n\n 23751>>&0 use pgp 237520 string -----BEGIN\040PGP\040MESSAGE- PGP message 23753!:mime application/pgp 23754>10 search/100 \n\n 23755>>&0 use pgp 237560 string -----BEGIN\040PGP\040SIGNATURE- PGP signature 23757!:mime application/pgp-signature 23758>10 search/100 \n\n 23759>>&0 use pgp 23760 23761# Decode the type of the packet based on it's base64 encoding. 23762# Idea from Mark Martinec 23763# The specification is in RFC 4880, section 4.2 and 4.3: 23764# https://tools.ietf.org/html/rfc4880#section-4.2 23765 237660 name pgp 23767>0 byte 0x67 Reserved (old) 23768>0 byte 0x68 Public-Key Encrypted Session Key (old) 23769>0 byte 0x69 Signature (old) 23770>0 byte 0x6a Symmetric-Key Encrypted Session Key (old) 23771>0 byte 0x6b One-Pass Signature (old) 23772>0 byte 0x6c Secret-Key (old) 23773>0 byte 0x6d Public-Key (old) 23774>0 byte 0x6e Secret-Subkey (old) 23775>0 byte 0x6f Compressed Data (old) 23776>0 byte 0x70 Symmetrically Encrypted Data (old) 23777>0 byte 0x71 Marker (old) 23778>0 byte 0x72 Literal Data (old) 23779>0 byte 0x73 Trust (old) 23780>0 byte 0x74 User ID (old) 23781>0 byte 0x75 Public-Subkey (old) 23782>0 byte 0x76 Unused (old) 23783>0 byte 0x77 23784>>1 byte&0xc0 0x00 Reserved 23785>>1 byte&0xc0 0x40 Public-Key Encrypted Session Key 23786>>1 byte&0xc0 0x80 Signature 23787>>1 byte&0xc0 0xc0 Symmetric-Key Encrypted Session Key 23788>0 byte 0x78 23789>>1 byte&0xc0 0x00 One-Pass Signature 23790>>1 byte&0xc0 0x40 Secret-Key 23791>>1 byte&0xc0 0x80 Public-Key 23792>>1 byte&0xc0 0xc0 Secret-Subkey 23793>0 byte 0x79 23794>>1 byte&0xc0 0x00 Compressed Data 23795>>1 byte&0xc0 0x40 Symmetrically Encrypted Data 23796>>1 byte&0xc0 0x80 Marker 23797>>1 byte&0xc0 0xc0 Literal Data 23798>0 byte 0x7a 23799>>1 byte&0xc0 0x00 Trust 23800>>1 byte&0xc0 0x40 User ID 23801>>1 byte&0xc0 0x80 Public-Subkey 23802>>1 byte&0xc0 0xc0 Unused [z%x] 23803>0 byte 0x30 23804>>1 byte&0xc0 0x00 Unused [0%x] 23805>>1 byte&0xc0 0x40 User Attribute 23806>>1 byte&0xc0 0x80 Sym. Encrypted and Integrity Protected Data 23807>>1 byte&0xc0 0xc0 Modification Detection Code 23808 23809# magic signatures to detect PGP crypto material (from stef) 23810# detects and extracts metadata from: 23811# - symmetric encrypted packet header 23812# - RSA (e=65537) secret (sub-)keys 23813 23814# 1024b RSA encrypted data 23815 238160 string \x84\x8c\x03 PGP RSA encrypted session key - 23817>3 lelong x keyid: %X 23818>7 lelong x %X 23819>11 byte 0x01 RSA (Encrypt or Sign) 1024b 23820>11 byte 0x02 RSA Encrypt-Only 1024b 23821>12 string \x04\x00 23822>12 string \x03\xff 23823>12 string \x03\xfe 23824>12 string \x03\xfd 23825>12 string \x03\xfc 23826>12 string \x03\xfb 23827>12 string \x03\xfa 23828>12 string \x03\xf9 23829>142 byte 0xd2 . 23830 23831# 2048b RSA encrypted data 23832 238330 string \x85\x01\x0c\x03 PGP RSA encrypted session key - 23834>4 lelong x keyid: %X 23835>8 lelong x %X 23836>12 byte 0x01 RSA (Encrypt or Sign) 2048b 23837>12 byte 0x02 RSA Encrypt-Only 2048b 23838>13 string \x08\x00 23839>13 string \x07\xff 23840>13 string \x07\xfe 23841>13 string \x07\xfd 23842>13 string \x07\xfc 23843>13 string \x07\xfb 23844>13 string \x07\xfa 23845>13 string \x07\xf9 23846>271 byte 0xd2 . 23847 23848# 3072b RSA encrypted data 23849 238500 string \x85\x01\x8c\x03 PGP RSA encrypted session key - 23851>4 lelong x keyid: %X 23852>8 lelong x %X 23853>12 byte 0x01 RSA (Encrypt or Sign) 3072b 23854>12 byte 0x02 RSA Encrypt-Only 3072b 23855>13 string \x0c\x00 23856>13 string \x0b\xff 23857>13 string \x0b\xfe 23858>13 string \x0b\xfd 23859>13 string \x0b\xfc 23860>13 string \x0b\xfb 23861>13 string \x0b\xfa 23862>13 string \x0b\xf9 23863>399 byte 0xd2 . 23864 23865# 3072b RSA encrypted data 23866 238670 string \x85\x02\x0c\x03 PGP RSA encrypted session key - 23868>4 lelong x keyid: %X 23869>8 lelong x %X 23870>12 byte 0x01 RSA (Encrypt or Sign) 4096b 23871>12 byte 0x02 RSA Encrypt-Only 4096b 23872>13 string \x10\x00 23873>13 string \x0f\xff 23874>13 string \x0f\xfe 23875>13 string \x0f\xfd 23876>13 string \x0f\xfc 23877>13 string \x0f\xfb 23878>13 string \x0f\xfa 23879>13 string \x0f\xf9 23880>527 byte 0xd2 . 23881 23882# 4096b RSA encrypted data 23883 238840 string \x85\x04\x0c\x03 PGP RSA encrypted session key - 23885>4 lelong x keyid: %X 23886>8 lelong x %X 23887>12 byte 0x01 RSA (Encrypt or Sign) 8129b 23888>12 byte 0x02 RSA Encrypt-Only 8129b 23889>13 string \x20\x00 23890>13 string \x1f\xff 23891>13 string \x1f\xfe 23892>13 string \x1f\xfd 23893>13 string \x1f\xfc 23894>13 string \x1f\xfb 23895>13 string \x1f\xfa 23896>13 string \x1f\xf9 23897>1039 byte 0xd2 . 23898 23899# crypto algo mapper 23900 239010 name crypto 23902>0 byte 0x00 Plaintext or unencrypted data 23903>0 byte 0x01 IDEA 23904>0 byte 0x02 TripleDES 23905>0 byte 0x03 CAST5 (128 bit key) 23906>0 byte 0x04 Blowfish (128 bit key, 16 rounds) 23907>0 byte 0x07 AES with 128-bit key 23908>0 byte 0x08 AES with 192-bit key 23909>0 byte 0x09 AES with 256-bit key 23910>0 byte 0x0a Twofish with 256-bit key 23911 23912# hash algo mapper 23913 239140 name hash 23915>0 byte 0x01 MD5 23916>0 byte 0x02 SHA-1 23917>0 byte 0x03 RIPE-MD/160 23918>0 byte 0x08 SHA256 23919>0 byte 0x09 SHA384 23920>0 byte 0x0a SHA512 23921>0 byte 0x0b SHA224 23922 23923# display public key algorithms as human readable text 239240 name key_algo 23925>0 byte 0x01 RSA (Encrypt or Sign) 23926# keep old look of version 5.28 without parentheses 23927>0 byte 0x02 RSA Encrypt-Only 23928>0 byte 0x03 RSA (Sign-Only) 23929>0 byte 16 ElGamal (Encrypt-Only) 23930>0 byte 17 DSA 23931>0 byte 18 Elliptic Curve 23932>0 byte 19 ECDSA 23933>0 byte 20 ElGamal (Encrypt or Sign) 23934>0 byte 21 Diffie-Hellman 23935>0 default x 23936>>0 ubyte <22 unknown (pub %d) 23937# this should never happen 23938>>0 ubyte >21 invalid (%d) 23939 23940# pgp symmetric encrypted data 23941 239420 byte 0x8c PGP symmetric key encrypted data - 23943>1 byte 0x0d 23944>1 byte 0x0c 23945>2 byte 0x04 23946>3 use crypto 23947>4 byte 0x01 salted - 23948>>5 use hash 23949>>14 byte 0xd2 . 23950>>14 byte 0xc9 . 23951>4 byte 0x03 salted & iterated - 23952>>5 use hash 23953>>15 byte 0xd2 . 23954>>15 byte 0xc9 . 23955 23956# encrypted keymaterial needs s2k & can be checksummed/hashed 23957 239580 name chkcrypto 23959>0 use crypto 23960>1 byte 0x00 Simple S2K 23961>1 byte 0x01 Salted S2K 23962>1 byte 0x03 Salted&Iterated S2K 23963>2 use hash 23964 23965# all PGP keys start with this prolog 23966# containing version, creation date, and purpose 23967 239680 name keyprolog 23969>0 byte 0x04 23970>1 beldate x created on %s - 23971>5 byte 0x01 RSA (Encrypt or Sign) 23972>5 byte 0x02 RSA Encrypt-Only 23973 23974# end of secret keys known signature 23975# contains e=65537 and the prolog to 23976# the encrypted parameters 23977 239780 name keyend 23979>0 string \x00\x11\x01\x00\x01 e=65537 23980>5 use crypto 23981>5 byte 0xff checksummed 23982>>6 use chkcrypto 23983>5 byte 0xfe hashed 23984>>6 use chkcrypto 23985 23986# PGP secret keys contain also the public parts 23987# these vary by bitsize of the key 23988 239890 name x1024 23990>0 use keyprolog 23991>6 string \x03\xfe 23992>6 string \x03\xff 23993>6 string \x04\x00 23994>136 use keyend 23995 239960 name x2048 23997>0 use keyprolog 23998>6 string \x80\x00 23999>6 string \x07\xfe 24000>6 string \x07\xff 24001>264 use keyend 24002 240030 name x3072 24004>0 use keyprolog 24005>6 string \x0b\xfe 24006>6 string \x0b\xff 24007>6 string \x0c\x00 24008>392 use keyend 24009 240100 name x4096 24011>0 use keyprolog 24012>6 string \x10\x00 24013>6 string \x0f\xfe 24014>6 string \x0f\xff 24015>520 use keyend 24016 24017# \x00|\x1f[\xfe\xff]).{1024})' 240180 name x8192 24019>0 use keyprolog 24020>6 string \x20\x00 24021>6 string \x1f\xfe 24022>6 string \x1f\xff 24023>1032 use keyend 24024 24025# depending on the size of the pkt 24026# we branch into the proper key size 24027# signatures defined as x{keysize} 24028 24029>0 name pgpkey 24030>0 string \x01\xd8 1024b 24031>>2 use x1024 24032>0 string \x01\xeb 1024b 24033>>2 use x1024 24034>0 string \x01\xfb 1024b 24035>>2 use x1024 24036>0 string \x01\xfd 1024b 24037>>2 use x1024 24038>0 string \x01\xf3 1024b 24039>>2 use x1024 24040>0 string \x01\xee 1024b 24041>>2 use x1024 24042>0 string \x01\xfe 1024b 24043>>2 use x1024 24044>0 string \x01\xf4 1024b 24045>>2 use x1024 24046>0 string \x02\x0d 1024b 24047>>2 use x1024 24048>0 string \x02\x03 1024b 24049>>2 use x1024 24050>0 string \x02\x05 1024b 24051>>2 use x1024 24052>0 string \x02\x15 1024b 24053>>2 use x1024 24054>0 string \x02\x00 1024b 24055>>2 use x1024 24056>0 string \x02\x10 1024b 24057>>2 use x1024 24058>0 string \x02\x04 1024b 24059>>2 use x1024 24060>0 string \x02\x06 1024b 24061>>2 use x1024 24062>0 string \x02\x16 1024b 24063>>2 use x1024 24064>0 string \x03\x98 2048b 24065>>2 use x2048 24066>0 string \x03\xab 2048b 24067>>2 use x2048 24068>0 string \x03\xbb 2048b 24069>>2 use x2048 24070>0 string \x03\xbd 2048b 24071>>2 use x2048 24072>0 string \x03\xcd 2048b 24073>>2 use x2048 24074>0 string \x03\xb3 2048b 24075>>2 use x2048 24076>0 string \x03\xc3 2048b 24077>>2 use x2048 24078>0 string \x03\xc5 2048b 24079>>2 use x2048 24080>0 string \x03\xd5 2048b 24081>>2 use x2048 24082>0 string \x03\xae 2048b 24083>>2 use x2048 24084>0 string \x03\xbe 2048b 24085>>2 use x2048 24086>0 string \x03\xc0 2048b 24087>>2 use x2048 24088>0 string \x03\xd0 2048b 24089>>2 use x2048 24090>0 string \x03\xb4 2048b 24091>>2 use x2048 24092>0 string \x03\xc4 2048b 24093>>2 use x2048 24094>0 string \x03\xc6 2048b 24095>>2 use x2048 24096>0 string \x03\xd6 2048b 24097>>2 use x2048 24098>0 string \x05X 3072b 24099>>2 use x3072 24100>0 string \x05k 3072b 24101>>2 use x3072 24102>0 string \x05{ 3072b 24103>>2 use x3072 24104>0 string \x05} 3072b 24105>>2 use x3072 24106>0 string \x05\x8d 3072b 24107>>2 use x3072 24108>0 string \x05s 3072b 24109>>2 use x3072 24110>0 string \x05\x83 3072b 24111>>2 use x3072 24112>0 string \x05\x85 3072b 24113>>2 use x3072 24114>0 string \x05\x95 3072b 24115>>2 use x3072 24116>0 string \x05n 3072b 24117>>2 use x3072 24118>0 string \x05\x7e 3072b 24119>>2 use x3072 24120>0 string \x05\x80 3072b 24121>>2 use x3072 24122>0 string \x05\x90 3072b 24123>>2 use x3072 24124>0 string \x05t 3072b 24125>>2 use x3072 24126>0 string \x05\x84 3072b 24127>>2 use x3072 24128>0 string \x05\x86 3072b 24129>>2 use x3072 24130>0 string \x05\x96 3072b 24131>>2 use x3072 24132>0 string \x07[ 4096b 24133>>2 use x4096 24134>0 string \x07\x18 4096b 24135>>2 use x4096 24136>0 string \x07+ 4096b 24137>>2 use x4096 24138>0 string \x07; 4096b 24139>>2 use x4096 24140>0 string \x07= 4096b 24141>>2 use x4096 24142>0 string \x07M 4096b 24143>>2 use x4096 24144>0 string \x073 4096b 24145>>2 use x4096 24146>0 string \x07C 4096b 24147>>2 use x4096 24148>0 string \x07E 4096b 24149>>2 use x4096 24150>0 string \x07U 4096b 24151>>2 use x4096 24152>0 string \x07. 4096b 24153>>2 use x4096 24154>0 string \x07> 4096b 24155>>2 use x4096 24156>0 string \x07@ 4096b 24157>>2 use x4096 24158>0 string \x07P 4096b 24159>>2 use x4096 24160>0 string \x074 4096b 24161>>2 use x4096 24162>0 string \x07D 4096b 24163>>2 use x4096 24164>0 string \x07F 4096b 24165>>2 use x4096 24166>0 string \x07V 4096b 24167>>2 use x4096 24168>0 string \x0e[ 8192b 24169>>2 use x8192 24170>0 string \x0e\x18 8192b 24171>>2 use x8192 24172>0 string \x0e+ 8192b 24173>>2 use x8192 24174>0 string \x0e; 8192b 24175>>2 use x8192 24176>0 string \x0e= 8192b 24177>>2 use x8192 24178>0 string \x0eM 8192b 24179>>2 use x8192 24180>0 string \x0e3 8192b 24181>>2 use x8192 24182>0 string \x0eC 8192b 24183>>2 use x8192 24184>0 string \x0eE 8192b 24185>>2 use x8192 24186>0 string \x0eU 8192b 24187>>2 use x8192 24188>0 string \x0e. 8192b 24189>>2 use x8192 24190>0 string \x0e> 8192b 24191>>2 use x8192 24192>0 string \x0e@ 8192b 24193>>2 use x8192 24194>0 string \x0eP 8192b 24195>>2 use x8192 24196>0 string \x0e4 8192b 24197>>2 use x8192 24198>0 string \x0eD 8192b 24199>>2 use x8192 24200>0 string \x0eF 8192b 24201>>2 use x8192 24202>0 string \x0eV 8192b 24203>>2 use x8192 24204 24205# PGP RSA (e=65537) secret (sub-)key header 24206 242070 byte 0x95 PGP Secret Key - 24208>1 use pgpkey 242090 byte 0x97 PGP Secret Sub-key - 24210>1 use pgpkey 242110 byte 0x9d 24212# Update: Joerg Jenderek 24213# secret subkey packet (tag 7) with same structure as secret key packet (tag 5) 24214# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len 24215>1 ubeshort >0 24216#>1 ubeshort x \b, body length 0x%x 24217# next packet type often 88h,89h~(tag 2)~Signature Packet 24218#>>(1.S+3) ubyte x \b, next packet type 0x%x 24219# skip Dragon.SHR DEMO.INIT by looking for positive version 24220>>3 ubyte >0 24221# skip BUISSON.13 GUITAR1 by looking for low version number 24222>>>3 ubyte <5 PGP Secret Sub-key 24223# sub-key are normally part of secret key. So it does not occur as standalone file 24224#!:ext bin 24225# version 2,3~old 4~new . Comment following line for version 5.28 look 24226>>>>3 ubyte x (v%d) 24227>>>>3 ubyte x - 24228# old versions 2 or 3 but no real example found 24229>>>>3 ubyte <4 24230# 2 byte for key bits in version 5.28 look 24231>>>>>11 ubeshort x %db 24232>>>>>4 beldate x created on %s - 24233# old versions use 2 additional bytes after time stamp 24234#>>>>>8 ubeshort x 0x%x 24235# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman 24236>>>>>10 use key_algo 24237>>>>>(11.S/8) ubequad x 24238# look after first key 24239>>>>>>&5 use keyend 24240# new version 24241>>>>3 ubyte >3 24242>>>>>9 ubeshort x %db 24243>>>>>4 beldate x created on %s - 24244# display key algorithm 24245>>>>>8 use key_algo 24246>>>>>(9.S/8) ubequad x 24247# look after first key for something like s2k 24248>>>>>>&3 use keyend 24249 24250#------------------------------------------------------------------------------ 24251# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $ 24252# pkgadd: file(1) magic for SysV R4 PKG Datastreams 24253# 242540 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) 24255!:mime application/x-svr4-package 24256 24257#------------------------------------------------------------------------------ 24258# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $ 24259# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables 24260# From: "Stefan A. Haubenthal" <polluks@web.de> 24261# 242620 belong 0x00000107 Plan 9 executable, Motorola 68k 242630 belong 0x000001EB Plan 9 executable, Intel 386 242640 belong 0x00000247 Plan 9 executable, Intel 960 242650 belong 0x000002AB Plan 9 executable, SPARC 242660 belong 0x00000407 Plan 9 executable, MIPS R3000 242670 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 242680 belong 0x00000517 Plan 9 executable, MIPS R4000 BE 242690 belong 0x000005AB Plan 9 executable, AMD 29000 242700 belong 0x00000647 Plan 9 executable, ARM 7-something 242710 belong 0x000006EB Plan 9 executable, PowerPC 242720 belong 0x00000797 Plan 9 executable, MIPS R4000 LE 242730 belong 0x0000084B Plan 9 executable, DEC Alpha 24274 24275#------------------------------------------------------------------------------ 24276# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $ 24277# plus5: file(1) magic for Plus Five's UNIX MUMPS 24278# 24279# XXX - byte order? Paging Hokey.... 24280# 242810 short 0x259 mumps avl global 24282>2 byte >0 (V%d) 24283>6 byte >0 with %d byte name 24284>7 byte >0 and %d byte data cells 242850 short 0x25a mumps blt global 24286>2 byte >0 (V%d) 24287>8 short >0 - %d byte blocks 24288>15 byte 0x00 - P/D format 24289>15 byte 0x01 - P/K/D format 24290>15 byte 0x02 - K/D format 24291>15 byte >0x02 - Bad Flags 24292 24293#------------------------------------------------------------------------------ 24294# $File: polyml,v 1.2 2019/04/19 00:42:27 christos Exp $ 24295# polyml: file(1) magic for PolyML 24296# 24297# PolyML 24298# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) 24299# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) 24300 24301# [0]: https://www.polyml.org/ 24302# [1]: https://github.com/polyml/polyml/blob/master/\ 24303# libpolyml/savestate.cpp#L146-L147 24304# [2]: https://github.com/polyml/polyml/blob/master/\ 24305# libpolyml/savestate.cpp#L1262-L1263 24306 24307# Type: Poly/ML saved data 24308# From: Matthew Fernandez <matthew.fernandez@gmail.com> 24309 243100 string POLYSAVE Poly/ML saved state 24311>8 long x version %u 24312 243130 string POLYMODU Poly/ML saved module 24314>8 long x version %u 24315 24316#------------------------------------------------------------------------------ 24317# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $ 24318# printer: file(1) magic for printer-formatted files 24319# 24320 24321# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com) 243220 string %! PostScript document text 24323!:mime application/postscript 24324!:apple ASPSTEXT 24325>2 string PS-Adobe- conforming 24326>>11 string >\0 DSC level %.3s 24327>>>15 string EPS \b, type %s 24328>>>15 string Query \b, type %s 24329>>>15 string ExitServer \b, type %s 24330>>>15 search/1000 %%LanguageLevel:\040 24331>>>>&0 string >\0 \b, Level %s 24332# Some PCs have the annoying habit of adding a ^D as a document separator 243330 string \004%! PostScript document text 24334!:mime application/postscript 24335!:apple ASPSTEXT 24336>3 string PS-Adobe- conforming 24337>>12 string >\0 DSC level %.3s 24338>>>16 string EPS \b, type %s 24339>>>16 string Query \b, type %s 24340>>>16 string ExitServer \b, type %s 24341>>>16 search/1000 %%LanguageLevel:\040 24342>>>>&0 string >\0 \b, Level %s 243430 string \033%-12345X%!PS PostScript document 24344 24345# DOS EPS Binary File Header 24346# From: Ed Sznyter <ews@Black.Market.NET> 243470 belong 0xC5D0D3C6 DOS EPS Binary File 24348>4 long >0 Postscript starts at byte %d 24349>>8 long >0 length %d 24350>>>12 long >0 Metafile starts at byte %d 24351>>>>16 long >0 length %d 24352>>>20 long >0 TIFF starts at byte %d 24353>>>>24 long >0 length %d 24354 24355# Summary: Adobe's PostScript Printer Description File 24356# Extension: .ppd 24357# Reference: https://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8 24358# Submitted by: Yves Arrouye <arrouye@marin.fdn.fr> 24359# 243600 string *PPD-Adobe:\x20 PPD file 24361>&0 string x \b, version %s 24362 24363# HP Printer Job Language 243640 string \033%-12345X@PJL HP Printer Job Language data 24365# HP Printer Job Language 24366# The header found on Win95 HP plot files is the "Silliest Thing possible" 24367# (TM) 24368# Every driver puts the language at some random position, with random case 24369# (LANGUAGE and Language) 24370# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 24371# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> 24372# 243730 string \033%-12345X@PJL HP Printer Job Language data 24374>&0 string >\0 %s 24375>>&0 string >\0 %s 24376>>>&0 string >\0 %s 24377>>>>&0 string >\0 %s 24378#>15 string \ ENTER\ LANGUAGE\ = 24379#>31 string PostScript PostScript 24380 24381# From: Stefan Thurner <thurners@nicsys.de> 243820 string \033%-12345X@PJL 24383>&0 search/10000 %! PJL encapsulated PostScript document text 24384 24385# Rick Richardson <rickrich@gmail.com> 24386 24387# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language 24388# For Oki Data Printers - HIPERC 24389# For Konica Minolta Printers - LAVAFLOW 24390# For Samsung Printers - QPDL 24391# For HP Printers - ZJS stands for Zenographics ZJStream 243920 string \033%-12345X@PJL HP Printer Job Language data 24393>0 search/10000 @PJL\ ENTER\ LANGUAGE=HBPL - HBPL 24394>0 search/10000 @PJL\ ENTER\ LANGUAGE=HIPERC - Oki Data HIPERC 24395>0 search/10000 @PJL\ ENTER\ LANGUAGE=LAVAFLOW - Konica Minolta LAVAFLOW 24396>0 search/10000 @PJL\ ENTER\ LANGUAGE=QPDL - Samsung QPDL 24397>0 search/10000 @PJL\ ENTER\ LANGUAGE\ =\ QPDL - Samsung QPDL 24398>0 search/10000 @PJL\ ENTER\ LANGUAGE=ZJS - HP ZJS 24399 24400 24401# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 244020 string \033E\033 HP PCL printer data 24403>3 string \&l0A - default page size 24404>3 string \&l1A - US executive page size 24405>3 string \&l2A - US letter page size 24406>3 string \&l3A - US legal page size 24407>3 string \&l26A - A4 page size 24408>3 string \&l80A - Monarch envelope size 24409>3 string \&l81A - No. 10 envelope size 24410>3 string \&l90A - Intl. DL envelope size 24411>3 string \&l91A - Intl. C5 envelope size 24412>3 string \&l100A - Intl. B5 envelope size 24413>3 string \&l-81A - No. 10 envelope size (landscape) 24414>3 string \&l-90A - Intl. DL envelope size (landscape) 24415 24416# IMAGEN printer-ready files: 244170 string @document( Imagen printer 24418# this only works if "language xxx" is first item in Imagen header. 24419>10 string language\ impress (imPRESS data) 24420>10 string language\ daisy (daisywheel text) 24421>10 string language\ diablo (daisywheel text) 24422>10 string language\ printer (line printer emulation) 24423>10 string language\ tektronix (Tektronix 4014 emulation) 24424# Add any other languages that your Imagen uses - remember 24425# to keep the word `text' if the file is human-readable. 24426# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)] 24427# 24428# Now magic for IMAGEN font files... 244290 string Rast RST-format raster font data 24430>45 string >0 face %s 24431# From Jukka Ukkonen 244320 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data 24433 24434# From <mike@flyn.org> 24435# These are the /etc/magic entries to decode data sent to an Epson printer. 244360 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data 24437 24438 24439#------------------------------------------------------------------------------ 24440# zenographics: file(1) magic for Zenographics ZjStream printer data 24441# Rick Richardson <rickrich@gmail.com> 244420 string JZJZ 24443>0x12 string ZZ Zenographics ZjStream printer data (big-endian) 244440 string ZJZJ 24445>0x12 string ZZ Zenographics ZjStream printer data (little-endian) 24446 24447 24448#------------------------------------------------------------------------------ 24449# Oak Technologies printer stream 24450# Rick Richardson <rickrich@gmail.com> 244510 string OAK 24452>0x07 byte 0 24453>0x0b byte 0 Oak Technologies printer stream 24454 24455# This would otherwise be recognized as PostScript - nick@debian.org 244560 string %!VMF SunClock's Vector Map Format data 24457 24458#------------------------------------------------------------------------------ 24459# HP LaserJet 1000 series downloadable firmware file 244600 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware 24461 24462# From: Paolo <oopla@users.sf.net> 24463# Epson ESC/Page, ESC/PageColor 244640 string \x1b\x01@EJL Epson ESC/Page language printer data 24465 24466#------------------------------------------------------------------------------ 24467# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $ 24468# project: file(1) magic for Project management 24469# 24470# Magic strings for ftnchek project files. Alexander Mai 244710 string FTNCHEK_\ P project file for ftnchek 24472>10 string 1 version 2.7 24473>10 string 2 version 2.8 to 2.10 24474>10 string 3 version 2.11 or later 24475 24476#------------------------------------------------------------------------------ 24477# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $ 24478# psdbms: file(1) magic for psdatabase 24479# 24480# Update: Joerg Jenderek 24481# GRR: line below too general as it catches also some Panorama database *.pan , 24482# AppleWorks word processor 244830 belong&0xff00ffff 0x56000000 24484# assume version starts with digit 24485>1 regex/s =^[0-9] ps database 24486>>1 string >\0 version %s 24487# kernel name 24488>>4 string >\0 from kernel %s 24489 24490#------------------------------------------------------------------------------ 24491# $File: psl,v 1.3 2019/04/19 00:42:27 christos Exp $ 24492# psl: file(1) magic for Public Suffix List representations 24493# From: Daniel Kahn Gillmor <dkg@fifthhorseman.net> 24494# URL: https://publicsuffix.org 24495# see also: https://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166 24496 244970 search/512 \n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data 24498 244990 string .DAFSA@PSL_ 24500>15 string \n Public Suffix List data (optimized) 24501>>11 byte >0x2f 24502>>>11 byte <0x3a (Version %c) 24503 24504#------------------------------------------------------------------------------ 24505# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $ 24506# pulsar: file(1) magic for Pulsar POP3 daemon binary files 24507# 24508# http://pulsar.sourceforge.net 24509# mailto:rok.papez@lugos.si 24510# 24511 245120 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file. 24513>4 ubelong x Version: %d. 24514>8 ubelong x \b%d 24515 24516 24517#------------------------------------------------------------------------------ 24518# $File: pwsafe,v 1.2 2019/04/19 00:42:27 christos Exp $ 24519# pwsafe: file(1) magic for passwordsafe file 24520# 24521# Password Safe 24522# http://passwordsafe.sourceforge.net/ 24523# file format specs 24524# https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt 24525# V2 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt 24526# V1 https://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt 24527# V2 and V1 have no easy identifier that I can find 24528# .psafe3 245290 string PWS3 Password Safe V3 database 24530 24531#------------------------------------------------------------------------------ 24532# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $ 24533# pyramid: file(1) magic for Pyramids 24534# 24535# XXX - byte order? 24536# 245370 long 0x50900107 Pyramid 90x family executable 245380 long 0x50900108 Pyramid 90x family pure executable 24539>16 long >0 not stripped 245400 long 0x5090010b Pyramid 90x family demand paged pure executable 24541>16 long >0 not stripped 24542 24543#------------------------------------------------------------------------------ 24544# $File: python,v 1.36 2019/04/09 18:28:25 christos Exp $ 24545# python: file(1) magic for python 24546# 24547# Outlook puts """ too for urgent messages 24548# From: David Necas <yeti@physics.muni.cz> 24549# often the module starts with a multiline string 245500 string/t """ Python script text executable 24551# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming 24552# that Py_UnicodeFlag is off for Python 2) 24553# two bytes of magic followed by "\r\n" in little endian order 245540 belong 0x994e0d0a python 1.5/1.6 byte-compiled 245550 belong 0x87c60d0a python 2.0 byte-compiled 245560 belong 0x2aeb0d0a python 2.1 byte-compiled 245570 belong 0x2ded0d0a python 2.2 byte-compiled 245580 belong 0x3bf20d0a python 2.3 byte-compiled 245590 belong 0x6df20d0a python 2.4 byte-compiled 245600 belong 0xb3f20d0a python 2.5 byte-compiled 245610 belong 0xd1f20d0a python 2.6 byte-compiled 245620 belong 0x03f30d0a python 2.7 byte-compiled 245630 belong 0x3b0c0d0a python 3.0 byte-compiled 245640 belong 0x4f0c0d0a python 3.1 byte-compiled 245650 belong 0x6c0c0d0a python 3.2 byte-compiled 245660 belong 0x9e0c0d0a python 3.3 byte-compiled 245670 belong 0xee0c0d0a python 3.4 byte-compiled 245680 belong 0x160d0d0a python 3.5.1- byte-compiled 245690 belong 0x170d0d0a python 3.5.2+ byte-compiled 245700 belong 0x330d0d0a python 3.6 byte-compiled 245710 belong 0x420d0d0a python 3.7 byte-compiled 24572 24573 245740 search/1/w #!\ /usr/bin/python Python script text executable 24575!:strength + 15 24576!:mime text/x-python 245770 search/1/w #!\ /usr/local/bin/python Python script text executable 24578!:strength + 15 24579!:mime text/x-python 245800 search/1 #!/usr/bin/env\ python Python script text executable 24581!:strength + 15 24582!:mime text/x-python 245830 search/10 #!\ /usr/bin/env\ python Python script text executable 24584!:strength + 15 24585!:mime text/x-python 24586 24587 24588# from module.submodule import func1, func2 245890 search/8192 import 24590>0 regex \^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$ Python script text executable 24591!:strength + 15 24592!:mime text/x-python 24593 24594# def __init__ (self, ...): 245950 search/4096 def\ __init__ 24596>&0 search/64 self Python script text executable 24597!:strength + 15 24598!:mime text/x-python 24599 24600# if __name__ == "__main__": 246010 search/4096 if\ __name__ 24602>&0 search/64 '__main__' Python script text executable 24603>&0 search/64 "__main__" Python script text executable 24604!:strength + 15 24605!:mime text/x-python 24606 24607# import module [as abrev] 246080 search/8192 import 24609>0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable 24610!:mime text/x-python 24611 24612# comments 24613#0 search/4096 ''' 24614#>&0 regex .*'''$ Python script text executable 24615#!:mime text/x-python 24616 24617#0 search/4096 """ 24618#>&0 regex .*"""$ Python script text executable 24619#!:mime text/x-python 24620 24621# try: 24622# except: or finally: 24623# block 246240 search/4096 try: 24625>&0 regex \^[[:space:]]*except.*:$ Python script text executable 24626!:strength + 15 24627!:mime text/x-python 24628>&0 search/4096 finally: Python script text executable 24629!:mime text/x-python 24630 24631# class name[(base classes,)]: [pass] 246320 search/8192 class 24633>0 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable 24634!:strength + 15 24635!:mime text/x-python 24636 24637# def name(*args, **kwargs): 246380 search/8192 def\ 24639>0 regex \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100} 24640>>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable 24641!:strength + 15 24642!:mime text/x-python 24643 24644#------------------------------------------------------------------------------ 24645# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $ 24646# qt: file(1) magic for Qt 24647 24648# https://doc.qt.io/qt-5/resources.html 246490 string \<!DOCTYPE\040RCC\> Qt Resource Collection file 24650 24651# https://qt.gitorious.org/qt/qtbase/source/\ 24652# 5367fa356233da4c0f28172a8f817791525f5457:\ 24653# src/tools/rcc/rcc.cpp#L840 246540 string qres\0\0 Qt Binary Resource file 246550 search/1024 The\040Resource\040Compiler\040for\040Qt Qt C-code resource file 24656 24657# https://qt.gitorious.org/qt/qtbase/source/\ 24658# 5367fa356233da4c0f28172a8f817791525f5457:\ 24659# src/corelib/kernel/qtranslator.cpp#L62 246600 string \x3c\xb8\x64\x18\xca\xef\x9c\x95 24661>8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file 24662 24663#------------------------------------------------------------------------------ 24664# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $ 24665# file(1) magic for revision control files 24666# From Hendrik Scholz <hendrik@scholz.net> 246670 string/t /1\ :pserver: cvs password text file 24668 24669# Conary changesets 24670# From: Jonathan Smith <smithj@rpath.com> 246710 belong 0xea3f81bb Conary changeset data 24672 24673# Type: Git bundles (git-bundle) 24674# From: Josh Triplett <josh@freedesktop.org> 246750 string #\ v2\ git\ bundle\n Git bundle 24676 24677# Type: Git pack 24678# From: Adam Buchbinder <adam.buchbinder@gmail.com> 24679# Update: Joerg Jenderek 24680# URL: http://fileformats.archiveteam.org/wiki/Git 24681# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt 24682# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, 24683# those have a little-endian offset immediately following the magic 'PACK', 24684# the first byte of which is never 0, while the first byte of the Git pack 24685# version, since it's a tiny number stored in big-endian format, is always 0. 246860 string PACK 24687# GRR: line above is too general as it matches also PackDir archive ./acorn 24688# test for major version. Git 2017 accepts version number 2 or 3 24689>4 ubelong <9 24690# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc 24691# or SystemDevice::foobar 24692>>9 search/13 :: 24693# but in git binary 24694>>9 default x Git pack 24695!:mime application/x-git 24696!:ext pack 24697# 4 GB limit implies unsigned integer 24698>>>4 ubelong x \b, version %u 24699>>>8 ubelong x \b, %u objects 24700 24701# Type: Git pack index 24702# From: Adam Buchbinder <adam.buchbinder@gmail.com> 247030 string \377tOc Git pack index 24704>4 belong =2 \b, version 2 24705 24706# Type: Git index file 24707# From: Frederic Briare <fbriere@fbriere.net> 247080 string DIRC Git index 24709>4 belong >0 \b, version %d 24710>>8 belong >0 \b, %d entries 24711 24712# Type: Mercurial bundles 24713# From: Seo Sanghyeon <tinuviel@sparcs.kaist.ac.kr> 247140 string HG10 Mercurial bundle, 24715>4 string UN uncompressed 24716>4 string BZ bzip2 compressed 24717 24718# Type: Subversion (SVN) dumps 24719# From: Uwe Zeisberger <zeisberg@informatik.uni-freiburg.de> 247200 string SVN-fs-dump-format-version: Subversion dumpfile 24721>28 string >\0 (version: %s) 24722 24723# Type: Bazaar revision bundles and merge requests 24724# URL: https://www.bazaar-vcs.org/ 24725# From: Jelmer Vernooij <jelmer@samba.org> 247260 string #\ Bazaar\ revision\ bundle\ v Bazaar Bundle 247270 string #\ Bazaar\ merge\ directive\ format Bazaar merge directive 24728 24729#------------------------------------------------------------------------------ 24730# $File: riff,v 1.34 2019/04/19 00:42:27 christos Exp $ 24731# riff: file(1) magic for RIFF format 24732# See 24733# 24734# https://www.seanet.com/users/matts/riffmci/riffmci.htm 24735# http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf 24736# 24737 24738# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz 247390 name riff-wave 24740>0 leshort 1 \b, Microsoft PCM 24741>>14 leshort >0 24742>>>14 leshort <1024 \b, %d bit 24743>0 leshort 2 \b, Microsoft ADPCM 24744>0 leshort 6 \b, ITU G.711 A-law 24745>0 leshort 7 \b, ITU G.711 mu-law 24746>0 leshort 8 \b, Microsoft DTS 24747>0 leshort 17 \b, IMA ADPCM 24748>0 leshort 20 \b, ITU G.723 ADPCM (Yamaha) 24749>0 leshort 49 \b, GSM 6.10 24750>0 leshort 64 \b, ITU G.721 ADPCM 24751>0 leshort 80 \b, MPEG 24752>0 leshort 85 \b, MPEG Layer 3 24753>0 leshort 0x2001 \b, DTS 24754>2 leshort =1 \b, mono 24755>2 leshort =2 \b, stereo 24756>2 leshort >2 24757>>2 leshort <128 \b, %d channels 24758>4 lelong >0 24759>>4 lelong <1000000 %d Hz 24760 24761# try to find "fmt " 247620 name riff-walk 24763>0 string fmt\x20 24764>>4 lelong <0x80 24765>>>8 use riff-wave 24766>0 string LIST 24767>>&(4.l+4) use riff-walk 24768>0 string DISP 24769>>&(4.l+4) use riff-walk 24770>0 string bext 24771>>&(4.l+4) use riff-walk 24772>0 string Fake 24773>>&(4.l+4) use riff-walk 24774>0 string fact 24775>>&(4.l+4) use riff-walk 24776>0 string VP8 24777>>11 byte 0x9d 24778>>>12 byte 0x01 24779>>>>13 byte 0x2a \b, VP8 encoding 24780>>>>>14 leshort&0x3fff x \b, %d 24781>>>>>16 leshort&0x3fff x \bx%d, Scaling: 24782>>>>>14 leshort&0xc000 0x0000 \b [none] 24783>>>>>14 leshort&0xc000 0x1000 \b [5/4] 24784>>>>>14 leshort&0xc000 0x2000 \b [5/3] 24785>>>>>14 leshort&0xc000 0x3000 \b [2] 24786>>>>>14 leshort&0xc000 0x0000 \bx[none] 24787>>>>>14 leshort&0xc000 0x1000 \bx[5/4] 24788>>>>>14 leshort&0xc000 0x2000 \bx[5/3] 24789>>>>>14 leshort&0xc000 0x3000 \bx[2] 24790>>>>>15 byte&0x80 =0x00 \b, YUV color 24791>>>>>15 byte&0x80 =0x80 \b, bad color specification 24792>>>>>15 byte&0x40 =0x40 \b, no clamping required 24793>>>>>15 byte&0x40 =0x00 \b, decoders should clamp 24794#>0 string x we got %s 24795#>>&(4.l+4) use riff-walk 24796 24797# AVI section extended by Patrik Radman <patrik+file-magic@iki.fi> 24798# 247990 string RIFF RIFF (little-endian) data 24800# RIFF Palette format 24801# Update: Joerg Jenderek 24802# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format 24803# Reference: https://worms2d.info/Palette_file 24804>8 string PAL\ \b, palette 24805!:mime application/x-riff 24806# color palette by Microsoft Corporation 24807!:ext pal 24808# file size = chunk size + 8 in most cases 24809>>4 ulelong+8 x \b, %u bytes 24810# Extended PAL Format 24811>>12 string plth \b, extended 24812# Simple PAL Format 24813>>12 string data 24814# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes 24815>>>16 ulelong x \b, data size %u 24816# palVersion is always 0x0300 24817#>>>20 leshort x \b, version 0x%4.4x 24818# palNumEntries specifies the number of palette color entries 24819>>>22 uleshort x \b, %u entries 24820# after palPalEntry sized (number of color entries * 4 ) vector 24821>>>(22.s*4) ubequad x 24822# jump relative 22 ( 8 + 16) bytes forward points after end of file or to 24823# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal 24824>>>>&16 ubelong x \b, extra bytes 24825>>>>>&-4 ubelong >0 0x%8.8x 24826# RIFF Device Independent Bitmap format 24827>8 string RDIB \b, device-independent bitmap 24828>>16 string BM 24829>>>30 leshort 12 \b, OS/2 1.x format 24830>>>>34 leshort x \b, %d x 24831>>>>36 leshort x %d 24832>>>30 leshort 64 \b, OS/2 2.x format 24833>>>>34 leshort x \b, %d x 24834>>>>36 leshort x %d 24835>>>30 leshort 40 \b, Windows 3.x format 24836>>>>34 lelong x \b, %d x 24837>>>>38 lelong x %d x 24838>>>>44 leshort x %d 24839# RIFF MIDI format 24840>8 string RMID \b, MIDI 24841# RIFF Multimedia Movie File format 24842>8 string RMMP \b, multimedia movie 24843# RIFF wrapper for MP3 24844>8 string RMP3 \b, MPEG Layer 3 audio 24845# Microsoft WAVE format (*.wav) 24846>8 string WAVE \b, WAVE audio 24847!:mime audio/x-wav 24848>>12 string >\0 24849>>>12 use riff-walk 24850# Corel Draw Picture 24851>8 string CDRA \b, Corel Draw Picture 24852!:mime image/x-coreldraw 24853>8 string CDR6 \b, Corel Draw Picture, version 6 24854!:mime image/x-coreldraw 24855>8 string NUNDROOT \b, Steinberg CuBase 24856# AVI == Audio Video Interleave 24857>8 string AVI\040 \b, AVI 24858!:mime video/x-msvideo 24859>>12 string LIST 24860>>>20 string hdrlavih 24861>>>>&36 lelong x \b, %u x 24862>>>>&40 lelong x %u, 24863>>>>&4 lelong >1000000 <1 fps, 24864>>>>&4 lelong 1000000 1.00 fps, 24865>>>>&4 lelong 500000 2.00 fps, 24866>>>>&4 lelong 333333 3.00 fps, 24867>>>>&4 lelong 250000 4.00 fps, 24868>>>>&4 lelong 200000 5.00 fps, 24869>>>>&4 lelong 166667 6.00 fps, 24870>>>>&4 lelong 142857 7.00 fps, 24871>>>>&4 lelong 125000 8.00 fps, 24872>>>>&4 lelong 111111 9.00 fps, 24873>>>>&4 lelong 100000 10.00 fps, 24874# ]9.9,10.1[ 24875>>>>&4 lelong <101010 24876>>>>>&-4 lelong >99010 24877>>>>>>&-4 lelong !100000 ~10 fps, 24878>>>>&4 lelong 83333 12.00 fps, 24879# ]11.9,12.1[ 24880>>>>&4 lelong <84034 24881>>>>>&-4 lelong >82645 24882>>>>>>&-4 lelong !83333 ~12 fps, 24883>>>>&4 lelong 66667 15.00 fps, 24884# ]14.9,15.1[ 24885>>>>&4 lelong <67114 24886>>>>>&-4 lelong >66225 24887>>>>>>&-4 lelong !66667 ~15 fps, 24888>>>>&4 lelong 50000 20.00 fps, 24889>>>>&4 lelong 41708 23.98 fps, 24890>>>>&4 lelong 41667 24.00 fps, 24891# ]23.9,24.1[ 24892>>>>&4 lelong <41841 24893>>>>>&-4 lelong >41494 24894>>>>>>&-4 lelong !41708 24895>>>>>>>&-4 lelong !41667 ~24 fps, 24896>>>>&4 lelong 40000 25.00 fps, 24897# ]24.9,25.1[ 24898>>>>&4 lelong <40161 24899>>>>>&-4 lelong >39841 24900>>>>>>&-4 lelong !40000 ~25 fps, 24901>>>>&4 lelong 33367 29.97 fps, 24902>>>>&4 lelong 33333 30.00 fps, 24903# ]29.9,30.1[ 24904>>>>&4 lelong <33445 24905>>>>>&-4 lelong >33223 24906>>>>>>&-4 lelong !33367 24907>>>>>>>&-4 lelong !33333 ~30 fps, 24908>>>>&4 lelong <32224 >30 fps, 24909##>>>>&4 lelong x (%lu) 24910##>>>>&20 lelong x %lu frames, 24911# Note: The tests below assume that the AVI has 1 or 2 streams, 24912# "vids" optionally followed by "auds". 24913# (Should cover 99.9% of all AVIs.) 24914# assuming avih length = 56 24915>>>88 string LIST 24916>>>>96 string strlstrh 24917>>>>>108 string vids video: 24918>>>>>>&0 lelong 0 uncompressed 24919# skip past vids strh 24920>>>>>>(104.l+108) string strf 24921>>>>>>>(104.l+132) lelong 1 RLE 8bpp 24922>>>>>>>(104.l+132) string/c cvid Cinepak 24923>>>>>>>(104.l+132) string/c i263 Intel I.263 24924>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 24925>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 24926>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 24927>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 24928>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 24929>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 24930>>>>>>>(104.l+132) string/c mjpg Motion JPEG 24931>>>>>>>(104.l+132) string/c div3 DivX 3 24932>>>>>>>>112 string/c div3 Low-Motion 24933>>>>>>>>112 string/c div4 Fast-Motion 24934>>>>>>>(104.l+132) string/c divx DivX 4 24935>>>>>>>(104.l+132) string/c dx50 DivX 5 24936>>>>>>>(104.l+132) string/c xvid XviD 24937>>>>>>>(104.l+132) string/c h264 H.264 24938>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 24939>>>>>>>(104.l+132) string/c h264 X.264 or H.264 24940>>>>>>>(104.l+132) lelong 0 24941##>>>>>>>(104.l+132) string x (%.4s) 24942# skip past first (video) LIST 24943>>>>(92.l+96) string LIST 24944>>>>>(92.l+104) string strlstrh 24945>>>>>>(92.l+116) string auds \b, audio: 24946# auds strh length = 56: 24947>>>>>>>(92.l+172) string strf 24948>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM 24949>>>>>>>>(92.l+180) leshort 0x0002 ADPCM 24950>>>>>>>>(92.l+180) leshort 0x0006 aLaw 24951>>>>>>>>(92.l+180) leshort 0x0007 uLaw 24952>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 24953>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 24954>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 24955>>>>>>>>(92.l+180) leshort 0x0161 DivX 24956##>>>>>>>>(92.l+180) leshort x (0x%.4x) 24957>>>>>>>>(92.l+182) leshort 1 (mono, 24958>>>>>>>>(92.l+182) leshort 2 (stereo, 24959>>>>>>>>(92.l+182) leshort >2 (%d channels, 24960>>>>>>>>(92.l+184) lelong x %d Hz) 24961# auds strh length = 64: 24962>>>>>>>(92.l+180) string strf 24963>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM 24964>>>>>>>>(92.l+188) leshort 0x0002 ADPCM 24965>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 24966>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 24967>>>>>>>>(92.l+188) leshort 0x0161 DivX 24968##>>>>>>>>(92.l+188) leshort x (0x%.4x) 24969>>>>>>>>(92.l+190) leshort 1 (mono, 24970>>>>>>>>(92.l+190) leshort 2 (stereo, 24971>>>>>>>>(92.l+190) leshort >2 (%d channels, 24972>>>>>>>>(92.l+192) lelong x %d Hz) 24973# Animated Cursor format 24974>8 string ACON \b, animated cursor 24975# SoundFont 2 <mpruett@sgi.com> 24976>8 string sfbk SoundFont/Bank 24977# MPEG-1 wrapped in a RIFF, apparently 24978>8 string CDXA \b, wrapped MPEG-1 (CDXA) 24979>8 string 4XMV \b, 4X Movie file 24980# AMV-type AVI file: https://wiki.multimedia.cx/index.php?title=AMV 24981>8 string AMV\040 \b, AMV 24982>8 string WEBP \b, Web/P image 24983!:mime image/webp 24984>>12 use riff-walk 24985 24986# 24987# XXX - some of the below may only appear in little-endian form. 24988# 24989# Also "MV93" appears to be for one form of Macromedia Director 24990# files, and "GDMF" appears to be another multimedia format. 24991# 249920 string RIFX RIFF (big-endian) data 24993# RIFF Palette format 24994>8 string PAL \b, palette 24995>>16 beshort x \b, version %d 24996>>18 beshort x \b, %d entries 24997# RIFF Device Independent Bitmap format 24998>8 string RDIB \b, device-independent bitmap 24999>>16 string BM 25000>>>30 beshort 12 \b, OS/2 1.x format 25001>>>>34 beshort x \b, %d x 25002>>>>36 beshort x %d 25003>>>30 beshort 64 \b, OS/2 2.x format 25004>>>>34 beshort x \b, %d x 25005>>>>36 beshort x %d 25006>>>30 beshort 40 \b, Windows 3.x format 25007>>>>34 belong x \b, %d x 25008>>>>38 belong x %d x 25009>>>>44 beshort x %d 25010# RIFF MIDI format 25011>8 string RMID \b, MIDI 25012# RIFF Multimedia Movie File format 25013>8 string RMMP \b, multimedia movie 25014# Microsoft WAVE format (*.wav) 25015>8 string WAVE \b, WAVE audio 25016>>20 leshort 1 \b, Microsoft PCM 25017>>>34 leshort >0 \b, %d bit 25018>>22 beshort =1 \b, mono 25019>>22 beshort =2 \b, stereo 25020>>22 beshort >2 \b, %d channels 25021>>24 belong >0 %d Hz 25022# Corel Draw Picture 25023>8 string CDRA \b, Corel Draw Picture 25024>8 string CDR6 \b, Corel Draw Picture, version 6 25025# AVI == Audio Video Interleave 25026>8 string AVI\040 \b, AVI 25027# Animated Cursor format 25028>8 string ACON \b, animated cursor 25029# Notation Interchange File Format (big-endian only) 25030>8 string NIFF \b, Notation Interchange File Format 25031# SoundFont 2 <mpruett@sgi.com> 25032>8 string sfbk SoundFont/Bank 25033 25034#------------------------------------------------------------------------------ 25035# Sony Wave64 25036# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf 25037# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian 250380 string riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00 Sony Wave64 RIFF data 25039# 128 bit + total file size (64 bits) so 24 bytes 25040# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A } 25041>24 string wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b, WAVE 64 audio 25042!:mime audio/x-w64 25043# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A } 25044>>40 search/256 fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A \b 25045>>>&10 leshort =1 \b, mono 25046>>>&10 leshort =2 \b, stereo 25047>>>&10 leshort >2 \b, %d channels 25048>>>&12 lelong >0 %d Hz 25049 25050#------------------------------------------------------------------------------ 25051# MBWF/RF64 25052# see EBU TECH 3306 https://tech.ebu.ch/docs/tech/tech3306-2009.pdf 250530 string RF64\xff\xff\xff\xffWAVEds64 MBWF/RF64 audio 25054!:mime audio/x-wav 25055>40 search/256 fmt\x20 \b 25056>>&6 leshort =1 \b, mono 25057>>&6 leshort =2 \b, stereo 25058>>&6 leshort >2 \b, %d channels 25059>>&8 lelong >0 %d Hz 25060 25061#------------------------------------------------------------------------------ 25062# $File: rpi,v 1.1 2018/01/01 05:25:17 christos Exp $ 25063# rpi: file(1) magic for Raspberry Pi images 25064-44 lelong 0 25065>4 lelong 0 25066>>8 lelong 1 25067>>12 lelong 4 25068>>>16 string 283x 25069>>>>20 lelong 1 25070>>>>>24 lelong 4 25071>>>>>>28 string DTOK 25072>>>>>>>32 lelong 44 25073>>>>>>>>36 lelong 4 25074>>>>>>>>>40 string RPTL Raspberry PI kernel image 25075 25076#------------------------------------------------------------------------------ 25077# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $ 25078# 25079# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com) 25080# 250810 belong 0xedabeedb RPM 25082!:mime application/x-rpm 25083>4 byte x v%d 25084>5 byte x \b.%d 25085>6 beshort 1 src 25086>6 beshort 0 bin 25087>>8 beshort 1 i386/x86_64 25088>>8 beshort 2 Alpha/Sparc64 25089>>8 beshort 3 Sparc 25090>>8 beshort 4 MIPS 25091>>8 beshort 5 PowerPC 25092>>8 beshort 6 68000 25093>>8 beshort 7 SGI 25094>>8 beshort 8 RS6000 25095>>8 beshort 9 IA64 25096>>8 beshort 10 Sparc64 25097>>8 beshort 11 MIPSel 25098>>8 beshort 12 ARM 25099>>8 beshort 13 MiNT 25100>>8 beshort 14 S/390 25101>>8 beshort 15 S/390x 25102>>8 beshort 16 PowerPC64 25103>>8 beshort 17 SuperH 25104>>8 beshort 18 Xtensa 25105>>8 beshort 255 noarch 25106>>10 string x %s 25107 25108#delta RPM Daniel Novotny (dnovotny@redhat.com) 251090 string drpm Delta RPM 25110!:mime application/x-rpm 25111>12 string x %s 25112>>8 beshort 11 MIPSel 25113>>8 beshort 12 ARM 25114>>8 beshort 13 MiNT 25115>>8 beshort 14 S/390 25116>>8 beshort 15 S/390x 25117>>8 beshort 16 PowerPC64 25118>>8 beshort 17 SuperH 25119>>8 beshort 18 Xtensa 25120>>10 string x %s 25121 25122#------------------------------------------------------------------------------ 25123# $File: rpmsg,v 1.1 2019/04/19 00:40:47 christos Exp $ 25124# rpmsg: file(1) magic for restricted-permission messages (or "rights-protected" messages) 25125# see https://en.wikipedia.org/wiki/Rpmsg 25126 251270 string \x76\xe8\x04\x60\xc4\x11\xe3\x86 rpmsg Restricted Permission Message 25128 25129#------------------------------------------------------------------------------ 25130# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $ 25131# rtf: file(1) magic for Rich Text Format (RTF) 25132# 25133# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk 25134# 251350 string {\\rtf Rich Text Format data, 25136!:mime text/rtf 25137>5 string 1 version 1, 25138>>6 string \\ansi ANSI 25139>>6 string \\mac Apple Macintosh 25140>>6 string \\pc IBM PC, code page 437 25141>>6 string \\pca IBM PS/2, code page 850 25142>>6 default x unknown character set 25143>5 default x unknown version 25144 25145#------------------------------------------------------------------------------ 25146# $File: ruby,v 1.9 2019/04/19 00:42:27 christos Exp $ 25147# ruby: file(1) magic for Ruby scripting language 25148# URL: https://www.ruby-lang.org/ 25149# From: Reuben Thomas <rrt@sc3d.org> 25150 25151# Ruby scripts 251520 search/1/w #!\ /usr/bin/ruby Ruby script text executable 25153!:strength + 15 25154!:mime text/x-ruby 251550 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable 25156!:strength + 15 25157!:mime text/x-ruby 251580 search/1 #!/usr/bin/env\ ruby Ruby script text executable 25159!:strength + 15 25160!:mime text/x-ruby 251610 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable 25162!:strength + 15 25163!:mime text/x-ruby 25164 25165# What looks like ruby, but does not have a shebang 25166# (modules and such) 25167# From: Lubomir Rintel <lkundrak@v3.sk> 251680 search/8192 require 25169>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' 25170>>0 regex def\ [a-z]|\ do$ 25171>>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 25172!:strength + 30 25173!:mime text/x-ruby 251740 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 25175>0 regex (modul|includ)e\ [A-Z]|def\ [a-z] 25176>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 25177!:strength + 30 25178!:mime text/x-ruby 25179# Classes with no modules or defs, beats simple ASCII 251800 regex \^[[:space:]]*(class|module)[[:space:]][A-Z] 25181>&0 regex \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text 25182!:strength + 10 25183!:mime text/x-ruby 25184# Looks for function definition to balance python magic 25185# def name (args) 25186# end 251870 search/8192 def\ 25188>0 regex \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z] 25189>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text 25190!:strength + 10 25191!:mime text/x-ruby 25192 251930 search/8192 require 25194>0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' Ruby script text 25195!:mime text/x-ruby 251960 search/8192 include 25197>0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text 25198!:mime text/x-ruby 25199 25200#------------------------------------------------------------------------------ 25201# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $ 25202# sc: file(1) magic for "sc" spreadsheet 25203# 2520438 string Spreadsheet sc spreadsheet file 25205!:mime application/x-sc 25206 25207#------------------------------------------------------------------------------ 25208# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $ 25209# sccs: file(1) magic for SCCS archives 25210# 25211# SCCS archive structure: 25212# \001h01207 25213# \001s 00276/00000/00000 25214# \001d D 1.1 87/09/23 08:09:20 ian 1 0 25215# \001c date and time created 87/09/23 08:09:20 by ian 25216# \001e 25217# \001u 25218# \001U 25219# ... etc. 25220# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). 25221# *Sigh*. And these both came from various parts of the USG. 25222# Maybe we should just switch everybody from SCCS to RCS! 25223# Further, you can't just say '\001h0', because the five-digit number 25224# is a checksum that could (presumably) have any leading digit, 25225# and we don't have regular expression matching yet. 25226# Hence the following official kludge: 252278 string \001s\ SCCS archive data 25228 25229#------------------------------------------------------------------------------ 25230# $File: scientific,v 1.13 2019/04/19 00:42:27 christos Exp $ 25231# scientific: file(1) magic for scientific formats 25232# 25233# From: Joe Krahn <krahn@niehs.nih.gov> 25234 25235######################################################## 25236# CCP4 data and plot files: 252370 string MTZ\040 MTZ reflection file 25238 2523992 string PLOT%%84 Plot84 plotting file 25240>52 byte 1 , Little-endian 25241>55 byte 1 , Big-endian 25242 25243######################################################## 25244# Electron density MAP/MASK formats 25245 252460 string EZD_MAP NEWEZD Electron Density Map 25247109 string MAP\040( Old EZD Electron Density Map 25248 252490 string/c :-)\040Origin BRIX Electron Density Map 25250>170 string >0 , Sigma:%.12s 25251#>4 string >0 %.178s 25252#>4 addr x %.178s 25253 252547 string 18\040!NTITLE XPLOR ASCII Electron Density Map 252559 string \040!NTITLE\012\040REMARK CNS ASCII electron density map 25256 25257208 string MAP\040 CCP4 Electron Density Map 25258# Assumes same stamp for float and double (normal case) 25259>212 byte 17 \b, Big-endian 25260>212 byte 34 \b, VAX format 25261>212 byte 68 \b, Little-endian 25262>212 byte 85 \b, Convex native 25263 25264############################################################ 25265# X-Ray Area Detector images 252660 string R-AXIS4\ \ \ R-Axis Area Detector Image: 25267>796 lelong <20 Little-endian, IP #%d, 25268>>768 lelong >0 Size=%dx 25269>>772 lelong >0 \b%d 25270>796 belong <20 Big-endian, IP #%d, 25271>>768 belong >0 Size=%dx 25272>>772 belong >0 \b%d 25273 252740 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: 25275>796 lelong <20 Little-endian, IP #%d, 25276>>768 lelong >0 Size=%dx 25277>>772 lelong >0 \b%d 25278>796 belong <20 Big-endian, IP #%d, 25279>>768 belong >0 Size=%dx 25280>>772 belong >0 \b%d 25281 25282 252831028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, 25284>1072 ulong >1 Compressed(%d), 25285>1100 ulong >1 %d headers, 25286>1104 ulong >0 %d x 25287>1108 ulong >0 %d, 25288>1120 ulong >0 %d bits/pixel 25289 25290# Type: GEDCOM genealogical (family history) data 25291# From: Giuseppe Bilotta 252920 search/1/c 0\ HEAD GEDCOM genealogy text 25293>&0 search 1\ GEDC 25294>>&0 search 2\ VERS version 25295>>>&1 string >\0 %s 25296# From: Phil Endecott <phil05@chezphil.org> 252970 string \000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 252980 string \060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 252990 string \376\377\000\060\000\040\000\110\000\105\000\101\000\104 GEDCOM data 253000 string \377\376\060\000\040\000\110\000\105\000\101\000\104\000 GEDCOM data 25301 25302# PDB: Protein Data Bank files 25303# Adam Buchbinder <adam.buchbinder@gmail.com> 25304# 25305# https://www.wwpdb.org/documentation/format32/sect2.html 25306# https://www.ch.ic.ac.uk/chemime/ 25307# 25308# The PDB file format is fixed-field, 80 columns. From the spec: 25309# 25310# COLS DATA 25311# 1 - 6 "HEADER" 25312# 11 - 50 String(40) 25313# 51 - 59 Date 25314# 63 - 66 IDcode 25315# 25316# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the 25317# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and 25318# uppercase letters. However, examples have been seen without the date string, 25319# e.g., the example on the chemime site. 253200 string HEADER\ \ \ \040 25321>&0 regex/1l \^.{40} 25322>>&0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3} 25323>>>&0 regex/1ls [A-Z0-9]{4}.{14}$ 25324>>>>&0 regex/1l [A-Z0-9]{4} Protein Data Bank data, ID Code %s 25325!:mime chemical/x-pdb 25326>>>>0 regex/1l [0-9]{2}-[A-Z]{3}-[0-9]{2} \b, %s 25327 25328# Type: GDSII Stream file 253290 belong 0x00060002 GDSII Stream file 25330>4 byte 0x00 25331>>5 byte x version %d.0 25332>4 byte >0x00 version %d 25333>>5 byte x \b.%d 25334 25335# Type: LXT (interLaced eXtensible Trace) 25336# chrysn <chrysn@fsfe.org> 253370 beshort 0x0138 interLaced eXtensible Trace (LXT) file 25338>2 beshort >0 (Version %u) 25339 25340#------------------------------------------------------------------------------ 25341# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $ 253420 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text 253430 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text 253440 belong 0xedfeedfe Sun 'jks' Java Keystore File data 25345 253460 string \0volume_key volume_key escrow packet 25347# Type: SE Linux policy modules *.pp reference policy 25348# for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny. 25349# URL: https://doc.coker.com.au/computers/selinux-magic 25350# From: Russell Coker <russell@coker.com.au> 25351 253520 lelong 0xf97cff8f SE Linux modular policy 25353>4 lelong x version %d, 25354>8 lelong x %d sections, 25355>>(12.l) lelong 0xf97cff8d 25356>>>(12.l+27) lelong x mod version %d, 25357>>>(12.l+31) lelong 0 Not MLS, 25358>>>(12.l+31) lelong 1 MLS, 25359>>>(12.l+23) lelong 2 25360>>>>(12.l+47) string >\0 module name %s 25361>>>(12.l+23) lelong 1 base 25362 253631 string policy_module( SE Linux policy module source 253642 string policy_module( SE Linux policy module source 25365 253660 string ##\ <summary> SE Linux policy interface source 25367 25368#0 search gen_context( SE Linux policy file contexts 25369 25370#0 search gen_sens( SE Linux policy MLS constraints source 25371 25372#------------------------------------------------------------------------------ 25373# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $ 25374# sendmail: file(1) magic for sendmail config files 25375# 25376# XXX - byte order? 25377# 25378# Update: Joerg Jenderek 25379# GRR: this test is too general as it catches also 25380# READ.ME.FIRST.AWP Sendmail frozen configuration 25381# - version ====|====|====|====|====|====|====|====|====|====|====|====|=== 25382# Email_23_f217153422.ts Sendmail frozen configuration 25383# - version \330jK\354 253840 byte 046 25385# https://www.sendmail.com/sm/open_source/docs/older_release_notes/ 25386# freezed configuration file (dbm format?) created from sendmal.cf with -bz 25387# by older sendmail. til version 8.6 support for frozen configuration files is removed 25388# valid version numbers look like "7.14.4" and should be similar to output of commands 25389# "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf" 25390>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 25391# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc 25392!:ext fc 25393>>16 string >\0 - version %s 253940 short 0x271c 25395# look for valid version number 25396>16 regex/s =^[0-78][0-9.]{4} Sendmail frozen configuration 25397!:ext fc 25398>>16 string >\0 - version %s 25399 25400#------------------------------------------------------------------------------ 25401# sendmail: file(1) magic for sendmail m4(1) files 25402# 25403# From Hendrik Scholz <hendrik@scholz.net> 25404# i.e. files in /usr/share/sendmail/cf/ 25405# 254060 string divert(-1)\n sendmail m4 text file 25407 25408 25409#------------------------------------------------------------------------------ 25410# $File: sequent,v 1.14 2019/04/19 00:42:27 christos Exp $ 25411# sequent: file(1) magic for Sequent machines 25412# 25413# Sequent information updated by Don Dwiggins <atsun!dwiggins>. 25414# For Sequent's multiprocessor systems (incomplete). 254150 lelong 0x00ea BALANCE NS32000 .o 25416>16 lelong >0 not stripped 25417>124 lelong >0 version %d 254180 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) 25419>16 lelong >0 not stripped 25420>124 lelong >0 version %d 254210 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) 25422>16 lelong >0 not stripped 25423>124 lelong >0 version %d 254240 lelong 0x30ea BALANCE NS32000 standalone executable 25425>16 lelong >0 not stripped 25426>124 lelong >0 version %d 25427# 25428# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>. 25429# Symmetry magic nums will not be reached if DOS COM comes before them; 25430# byte 0xeb is matched before these get a chance. 254310 leshort 0x12eb SYMMETRY i386 .o 25432>16 lelong >0 not stripped 25433>124 lelong >0 version %d 254340 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) 25435>16 lelong >0 not stripped 25436>124 lelong >0 version %d 254370 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) 25438>16 lelong >0 not stripped 25439>124 lelong >0 version %d 25440# https://en.wikipedia.org/wiki/Sequent_Computer_Systems 25441# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader 25442#0 leshort 0x42eb SYMMETRY i386 standalone executable 254430 leshort 0x42eb 25444# skip unlike negative version 25445>124 lelong >-1 25446# assuming version 28867614 is very low probable 25447>>124 lelong !28867614 SYMMETRY i386 standalone executable 25448>>>16 lelong >0 not stripped 25449>>>124 lelong >0 version %d 25450 25451#------------------------------------------------------------------------------ 25452# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $ 25453# sereal: file(1) magic the Sereal binary serialization format 25454# 25455# From: Ævar Arnfjörð Bjarmason <avarab@gmail.com> 25456# 25457# See the specification of the format at 25458# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format 25459# 25460# I'd have liked to do the byte&0xF0 matching against 0, 1, 2 ... by 25461# doing (byte&0xF0)>>4 here, but unfortunately that's not 25462# supported. So when we print out a message about an unknown format 25463# we'll print out e.g. 0x30 instead of the more human-readable 25464# 0x30>>4. 25465# 25466# See https://github.com/Sereal/Sereal/commit/35372ae01d in the 25467# Sereal.git repository for test Sereal data. 254680 name sereal 25469>4 byte&0x0F x (version %d, 25470>4 byte&0xF0 0x00 uncompressed) 25471>4 byte&0xF0 0x10 compressed with non-incremental Snappy) 25472>4 byte&0xF0 0x20 compressed with incremental Snappy) 25473>4 byte&0xF0 >0x20 unknown subformat, flag: %d>>4) 25474 254750 string/b \=srl Sereal data packet 25476!:mime application/sereal 25477>&0 use sereal 254780 string/b \=\xF3rl Sereal data packet 25479!:mime application/sereal 25480>&0 use sereal 254810 string/b \=\xC3\xB3rl Sereal data packet, UTF-8 encoded 25482!:mime application/sereal 25483>&0 use sereal 25484 25485 25486#------------------------------------------------------------------------------ 25487# $File: sgi,v 1.23 2018/05/29 02:26:56 christos Exp $ 25488# sgi: file(1) magic for Silicon Graphics operating systems and applications 25489# 25490# Executable images are handled either in aout (for old-style a.out 25491# files for 68K; they are indistinguishable from other big-endian 32-bit 25492# a.out files) or in mips (for MIPS ECOFF and Ucode files) 25493# 25494 25495# kbd file definitions 254960 string kbd!map kbd map file 25497>8 byte >0 Ver %d: 25498>10 short >0 with %d table(s) 25499 255000 beshort 0x8765 disk quotas file 25501 255020 beshort 0x0506 IRIS Showcase file 25503>2 byte 0x49 - 25504>3 byte x - version %d 255050 beshort 0x0226 IRIS Showcase template 25506>2 byte 0x63 - 25507>3 byte x - version %d 255080 belong 0x5343464d IRIS Showcase file 25509>4 byte x - version %d 255100 belong 0x5443464d IRIS Showcase template 25511>4 byte x - version %d 255120 belong 0xdeadbabe IRIX Parallel Arena 25513>8 belong >0 - version %d 25514 25515# core files 25516# 25517# 32bit core file 255180 belong 0xdeadadb0 IRIX core dump 25519>4 belong 1 of 25520>16 string >\0 '%s' 25521# 64bit core file 255220 belong 0xdeadad40 IRIX 64-bit core dump 25523>4 belong 1 of 25524>16 string >\0 '%s' 25525# N32bit core file 255260 belong 0xbabec0bb IRIX N32 core dump 25527>4 belong 1 of 25528>16 string >\0 '%s' 25529# New style crash dump file 255300 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of 25531>36 string >\0 '%s' 25532 25533# Trusted IRIX info 255340 string SGIAUDIT SGI Audit file 25535>8 byte x - version %d 25536>9 byte x \b.%d 25537# 255380 string WNGZWZSC Wingz compiled script 255390 string WNGZWZSS Wingz spreadsheet 255400 string WNGZWZHP Wingz help file 25541# 255420 string #Inventor\040V IRIS Inventor 1.0 file 255430 string #Inventor\040V2 Open Inventor 2.0 file 25544# GLF is OpenGL stream encoding 255450 string glfHeadMagic(); GLF_TEXT 255464 belong 0x7d000000 GLF_BINARY_LSB_FIRST 25547!:strength -30 255484 belong 0x0000007d GLF_BINARY_MSB_FIRST 25549!:strength -30 25550# GLS is OpenGL stream encoding; GLS is the successor of GLF 255510 string glsBeginGLS( GLS_TEXT 255524 belong 0x10000000 GLS_BINARY_LSB_FIRST 25553!:strength -30 255544 belong 0x00000010 GLS_BINARY_MSB_FIRST 25555!:strength -30 25556 25557# Performance Co-Pilot file types 255580 string PmNs PCP compiled namespace (V.0) 255590 string PmN PCP compiled namespace 25560>3 string >\0 (V.%1.1s) 25561#3 lelong 0x84500526 PCP archive 255623 belong 0x84500526 PCP archive 25563>7 byte x (V.%d) 25564#>20 lelong -2 temporal index 25565#>20 lelong -1 metadata 25566#>20 lelong 0 log volume #0 25567#>20 lelong >0 log volume #%d 25568>20 belong -2 temporal index 25569>20 belong -1 metadata 25570>20 belong 0 log volume #0 25571>20 belong >0 log volume #%d 25572>24 string >\0 host: %s 255730 string PCPFolio PCP 25574>9 string Version: Archive Folio 25575>18 string >\0 (V.%s) 255760 string #pmchart PCP pmchart view 25577>9 string Version 25578>17 string >\0 (V%-3.3s) 255790 string #kmchart PCP kmchart view 25580>9 string Version 25581>17 string >\0 (V.%s) 255820 string pmview PCP pmview config 25583>7 string Version 25584>15 string >\0 (V%-3.3s) 255850 string #pmlogger PCP pmlogger config 25586>10 string Version 25587>18 string >\0 (V%1.1s) 255880 string #pmdahotproc PCP pmdahotproc config 25589>13 string Version 25590>21 string >\0 (V%-3.3s) 255910 string PcPh PCP Help 25592>4 string 1 Index 25593>4 string 2 Text 25594>5 string >\0 (V.%1.1s) 255950 string #pmieconf-rules PCP pmieconf rules 25596>16 string >\0 (V.%1.1s) 255973 string pmieconf-pmie PCP pmie config 25598>17 string >\0 (V.%1.1s) 255990 string MMV PCP memory mapped values 25600>4 long x (V.%d) 25601 25602# SpeedShop data files 256030 lelong 0x13130303 SpeedShop data file 25604 25605# mdbm files 256060 lelong 0x01023962 mdbm file, version 0 (obsolete) 256070 string mdbm mdbm file, 25608>5 byte x version %d, 25609>6 byte x 2^%d pages, 25610>7 byte x pagesize 2^%d, 25611>17 byte x hash %d, 25612>11 byte x dataformat %d 25613 25614# Alias Maya files 256150 string/t //Maya\040ASCII Alias Maya Ascii File, 25616>13 string >\0 version %s 256178 string MAYAFOR4 Alias Maya Binary File, 25618>32 string >\0 version %s scene 256198 string MayaFOR4 Alias Maya Binary File, 25620>32 string >\0 version %s scene 256218 string CIMG Alias Maya Image File 256228 string DEEP Alias Maya Image File 25623 25624#------------------------------------------------------------------------------ 25625# $File: sgml,v 1.39 2019/04/19 00:42:27 christos Exp $ 25626# Type: SVG Vectorial Graphics 25627# From: Noel Torres <tecnico@ejerciciosresueltos.com> 256280 string \<?xml\ version= 25629>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 25630>>19 search/4096 \<svg SVG Scalable Vector Graphics image 25631!:mime image/svg+xml 25632>>19 search/4096 \<gnc-v2 GnuCash file 25633!:mime application/x-gnucash 256340 string \<svg SVG Scalable Vector Graphics image 25635!:mime image/svg 25636 25637# Sitemap file 256380 string/t \<?xml\ version= 25639>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 25640>>19 search/4096 \<urlset XML Sitemap document text 25641!:mime application/xml-sitemap 25642 25643# OpenStreetMap XML (.osm) 25644# https://wiki.openstreetmap.org/wiki/OSM_XML 25645# From: Markus Heidelberg <markus.heidelberg@web.de> 256460 string \<?xml\ version= 25647>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 25648>>19 search/4096 \<osm OpenStreetMap XML data 25649 25650# xhtml 256510 string/t \<?xml\ version=" 25652>19 search/4096/cWbt \<!doctype\ html XHTML document text 25653>>15 string >\0 (version %.3s) 25654!:mime text/html 256550 string/t \<?xml\ version=' 25656>19 search/4096/cWbt \<!doctype\ html XHTML document text 25657>>15 string >\0 (version %.3s) 25658!:mime text/html 256590 string/t \<?xml\ version=" 25660>19 search/4096/cWbt \<html broken XHTML document text 25661>>15 string >\0 (version %.3s) 25662!:mime text/html 25663 25664#------------------------------------------------------------------------------ 25665# sgml: file(1) magic for Standard Generalized Markup Language 25666# HyperText Markup Language (HTML) is an SGML document type, 25667# from Daniel Quinlan (quinlan@yggdrasil.com) 25668# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org) 256690 search/4096/cWt \<!doctype\ html HTML document text 25670!:mime text/html 25671!:strength + 5 25672 25673# SVG document 25674# https://www.w3.org/TR/SVG/single-page.html 256750 search/4096/cWbt \<!doctype\ svg SVG XML document 25676!:mime image/svg+xml 25677!:strength + 5 25678 256790 search/4096/cwt \<head\> HTML document text 25680!:mime text/html 25681!:strength + 5 256820 search/4096/cWt \<head\ HTML document text 25683!:mime text/html 25684!:strength + 5 256850 search/4096/cwt \<title\> HTML document text 25686!:mime text/html 25687!:strength + 5 256880 search/4096/cWt \<title\ HTML document text 25689!:mime text/html 25690!:strength + 5 256910 search/4096/cwt \<html\> HTML document text 25692!:mime text/html 25693!:strength + 5 256940 search/4096/cWt \<html\ HTML document text 25695!:mime text/html 25696!:strength + 5 256970 search/4096/cwt \<script\> HTML document text 25698!:mime text/html 25699!:strength + 5 257000 search/4096/cWt \<script\ HTML document text 25701!:mime text/html 25702!:strength + 5 257030 search/4096/cwt \<style\> HTML document text 25704!:mime text/html 25705!:strength + 5 257060 search/4096/cWt \<style\ HTML document text 25707!:mime text/html 25708!:strength + 5 257090 search/4096/cwt \<table\> HTML document text 25710!:mime text/html 25711!:strength + 5 257120 search/4096/cWt \<table\ HTML document text 25713!:mime text/html 25714!:strength + 5 25715 257160 search/4096/cwt \<a\ href= HTML document text 25717!:mime text/html 25718!:strength + 5 25719 25720# Extensible markup language (XML), a subset of SGML 25721# from Marc Prud'hommeaux (marc@apocalypse.org) 257220 search/1/cwt \<?xml XML document text 25723!:mime text/xml 25724!:strength + 5 257250 string/t \<?xml\ version\ " XML 25726!:mime text/xml 25727!:strength + 5 257280 string/t \<?xml\ version=" XML 25729!:mime text/xml 25730!:strength + 5 25731>15 string/t >\0 %.3s document text 25732>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 25733>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 257340 string \<?xml\ version=' XML 25735!:mime text/xml 25736!:strength + 5 25737>15 string/t >\0 %.3s document text 25738>>23 search/1 \<xsl:stylesheet (XSL stylesheet) 25739>>24 search/1 \<xsl:stylesheet (XSL stylesheet) 257400 search/1/wt \<?XML broken XML document text 25741!:mime text/xml 25742!:strength - 10 25743 25744 25745# SGML, mostly from rph@sq 257460 search/4096/cwt \<!doctype exported SGML document text 257470 search/4096/cwt \<!subdoc exported SGML subdocument text 257480 search/4096/cwt \<!-- exported SGML document text 25749!:strength - 10 25750 25751# Web browser cookie files 25752# (Mozilla, Galeon, Netscape 4, Konqueror..) 25753# Ulf Harnhammar <ulfh@update.uu.se> 257540 search/1 #\ HTTP\ Cookie\ File Web browser cookie text 257550 search/1 #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text 257560 search/1 #\ KDE\ Cookie\ File Konqueror cookie text 25757 25758# XML-based format representing braille pages in a digital format. 25759# 25760# Specification: 25761# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html 25762# 25763# Simon Aittamaa <simon.aittamaa@gmail.com> 257640 string \<?xml\ version= 25765>14 regex ['"\ \t]*[0-9.]+['"\ \t]* 25766>>19 search/4096 \<pef Portable Embosser Format 25767!:mime application/x-pef+xml 25768#------------------------------------------------------------------------ 25769# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $ 25770# file(1) magic for sharc files 25771# 25772# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 25773# FutureGroove Music (dsp@futuregroove.de) 25774 25775#------------------------------------------------------------------------ 25776#0 string Draw RiscOS Drawfile 25777#0 string PACK RiscOS PackdDir archive 25778 25779#------------------------------------------------------------------------ 25780# SHARC DSP stuff (based on the FGM SHARC DSP SDK) 25781 25782#0 string =! Assembler source 25783#0 string Analog ADi asm listing file 257840 string .SYSTEM SHARC architecture file 257850 string .system SHARC architecture file 25786 257870 leshort 0x521C SHARC COFF binary 25788>2 leshort >1 , %d sections 25789>>12 lelong >0 , not stripped 25790 25791#------------------------------------------------------------------------------ 25792# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $ 25793# sinclair: file(1) sinclair QL 25794 25795# additions to /etc/magic by Thomas M. Ott (ThMO) 25796 25797# Sinclair QL floppy disk formats (ThMO) 257980 string =QL5 QL disk dump data, 25799>3 string =A 720 KB, 25800>3 string =B 1.44 MB, 25801>3 string =C 3.2 MB, 25802>4 string >\0 label:%.10s 25803 25804# Sinclair QL OS dump (ThMO) 258050 belong =0x30000 25806>49124 belong <47104 25807>>49128 belong <47104 25808>>>49132 belong <47104 25809>>>>49136 belong <47104 QL OS dump data, 25810>>>>>49148 string >\0 type %.3s, 25811>>>>>49142 string >\0 version %.4s 25812 25813# Sinclair QL firmware executables (ThMO) 258140 string NqNqNq`\004 QL firmware executable (BCPL) 25815 25816# Sinclair QL libraries (was ThMO) 258170 beshort 0xFB01 QDOS object 25818>2 pstring x '%s' 25819 25820# Sinclair QL executables (was ThMO) 258214 belong 0x4AFB QDOS executable 25822>9 pstring x '%s' 25823 25824# Sinclair QL ROM (ThMO) 258250 belong =0x4AFB0001 QL plugin-ROM data, 25826>9 pstring =\0 un-named 25827>9 pstring >\0 named: %s 25828# Type: SiSU Markup Language 25829# URL: http://www.sisudoc.org/ 25830# From: Ralph Amissah <ralph.amissah@gmail.com> 25831 258320 regex \^%?[\ \t]*SiSU[\ \t]+insert SiSU text insert 25833>5 regex [0-9.]+ %s 25834 258350 regex \^%[\ \t]+SiSU[\ \t]+master SiSU text master 25836>5 regex [0-9.]+ %s 25837 258380 regex \^%?[\ \t]*SiSU[\ \t]+text SiSU text 25839>5 regex [0-9.]+ %s 25840 258410 regex \^%?[\ \t]*SiSU[\ \t][0-9.]+ SiSU text 25842>5 regex [0-9.]+ %s 25843 258440 regex \^%*[\ \t]*sisu-[0-9.]+ SiSU text 25845>5 regex [0-9.]+ %s 25846 25847#------------------------------------------------------------------------------ 25848# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $ 25849# Sketch Drawings: http://sketch.sourceforge.net/ 25850# From: Edwin Mons <e@ik.nu> 258510 search/1 ##Sketch Sketch document text 25852 25853#----------------------------------------------- 25854# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $ 25855# GNU Smalltalk image, starting at version 1.6.2 25856# From: catull_us@yahoo.com 25857# 258580 string GSTIm\0\0 GNU SmallTalk 25859# little-endian 25860>7 byte&1 =0 LE image version 25861>>10 byte x %d. 25862>>9 byte x \b%d. 25863>>8 byte x \b%d 25864#>>12 lelong x , data: %ld 25865#>>16 lelong x , table: %ld 25866#>>20 lelong x , memory: %ld 25867# big-endian 25868>7 byte&1 =1 BE image version 25869>>8 byte x %d. 25870>>9 byte x \b%d. 25871>>10 byte x \b%d 25872#>>12 belong x , data: %ld 25873#>>16 belong x , table: %ld 25874#>>20 belong x , memory: %ld 25875 25876 25877 25878#------------------------------------------------------------------------------ 25879# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $ 25880# smile: file(1) magic for Smile serialization 25881# 25882# The Smile serialization format uses a 4-byte header: 25883# 25884# Constant byte #0: 0x3A (ASCII ':') 25885# Constant byte #1: 0x29 (ASCII ')') 25886# Constant byte #2: 0x0A (ASCII linefeed, '\n') 25887# Variable byte #3, consisting of bits: 25888# Bits 4-7 (4 MSB): 4-bit version number 25889# Bits 3: Reserved 25890# Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content 25891# Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false 25892# Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true 25893# 25894# Reference: http://wiki.fasterxml.com/SmileFormatSpec 25895# Created by: Pierre-Alexandre Meyer <pierre@mouraf.org> 25896 25897# Detection 258980 string :)\n Smile binary data 25899 25900# Versioning 25901>3 byte&0xF0 x version %d: 25902 25903# Properties 25904>3 byte&0x04 0x04 binary raw, 25905>3 byte&0x04 0x00 binary encoded, 25906>3 byte&0x02 0x02 shared String values enabled, 25907>3 byte&0x02 0x00 shared String values disabled, 25908>3 byte&0x01 0x01 shared field names enabled 25909>3 byte&0x01 0x00 shared field names disabled 25910 25911 25912#------------------------------------------------------------------------------ 25913# $File: sniffer,v 1.25 2019/05/05 17:03:41 christos Exp $ 25914# sniffer: file(1) magic for packet capture files 25915# 25916# From: guy@alum.mit.edu (Guy Harris) 25917# 25918 25919# 25920# Microsoft Network Monitor 1.x capture files. 25921# 259220 string RTSS NetMon capture file 25923>5 byte x - version %d 25924>4 byte x \b.%d 25925>6 leshort 0 (Unknown) 25926>6 leshort 1 (Ethernet) 25927>6 leshort 2 (Token Ring) 25928>6 leshort 3 (FDDI) 25929>6 leshort 4 (ATM) 25930>6 leshort >4 (type %d) 25931 25932# 25933# Microsoft Network Monitor 2.x capture files. 25934# 259350 string GMBU NetMon capture file 25936>5 byte x - version %d 25937>4 byte x \b.%d 25938>6 leshort 0 (Unknown) 25939>6 leshort 1 (Ethernet) 25940>6 leshort 2 (Token Ring) 25941>6 leshort 3 (FDDI) 25942>6 leshort 4 (ATM) 25943>6 leshort 5 (IP-over-IEEE 1394) 25944>6 leshort 6 (802.11) 25945>6 leshort 7 (Raw IP) 25946>6 leshort 8 (Raw IP) 25947>6 leshort 9 (Raw IP) 25948>6 leshort >9 (type %d) 25949 25950# 25951# Network General Sniffer capture files. 25952# Sorry, make that "Network Associates Sniffer capture files." 25953# Sorry, make that "Network General old DOS Sniffer capture files." 25954# 259550 string TRSNIFF\040data\040\040\040\040\032 Sniffer capture file 25956>33 byte 2 (compressed) 25957>23 leshort x - version %d 25958>25 leshort x \b.%d 25959>32 byte 0 (Token Ring) 25960>32 byte 1 (Ethernet) 25961>32 byte 2 (ARCNET) 25962>32 byte 3 (StarLAN) 25963>32 byte 4 (PC Network broadband) 25964>32 byte 5 (LocalTalk) 25965>32 byte 6 (Znet) 25966>32 byte 7 (Internetwork Analyzer) 25967>32 byte 9 (FDDI) 25968>32 byte 10 (ATM) 25969 25970# 25971# Cinco Networks NetXRay capture files. 25972# Sorry, make that "Network General Sniffer Basic capture files." 25973# Sorry, make that "Network Associates Sniffer Basic capture files." 25974# Sorry, make that "Network Associates Sniffer Basic, and Windows 25975# Sniffer Pro", capture files." 25976# Sorry, make that "Network General Sniffer capture files." 25977# Sorry, make that "NetScout Sniffer capture files." 25978# 259790 string XCP\0 NetXRay capture file 25980>4 string >\0 - version %s 25981>44 leshort 0 (Ethernet) 25982>44 leshort 1 (Token Ring) 25983>44 leshort 2 (FDDI) 25984>44 leshort 3 (WAN) 25985>44 leshort 8 (ATM) 25986>44 leshort 9 (802.11) 25987 25988# 25989# "libpcap" capture files. 25990# https://www.tcpdump.org/manpages/pcap-savefile.5.html 25991# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is 25992# the main program that uses that format, but there are other programs 25993# that use "libpcap", or that use the same capture file format.) 25994# 259950 name pcap-be 25996>4 beshort x - version %d 25997>6 beshort x \b.%d 25998# clear that continuation level match 25999>20 clear x 26000>20 belong 0 (No link-layer encapsulation 26001>20 belong 1 (Ethernet 26002>20 belong 2 (3Mb Ethernet 26003>20 belong 3 (AX.25 26004>20 belong 4 (ProNET 26005>20 belong 5 (CHAOS 26006>20 belong 6 (Token Ring 26007>20 belong 7 (BSD ARCNET 26008>20 belong 8 (SLIP 26009>20 belong 9 (PPP 26010>20 belong 10 (FDDI 26011>20 belong 11 (RFC 1483 ATM 26012>20 belong 12 (raw IP 26013>20 belong 13 (BSD/OS SLIP 26014>20 belong 14 (BSD/OS PPP 26015>20 belong 19 (Linux ATM Classical IP 26016>20 belong 50 (PPP or Cisco HDLC 26017>20 belong 51 (PPP-over-Ethernet 26018>20 belong 99 (Symantec Enterprise Firewall 26019>20 belong 100 (RFC 1483 ATM 26020>20 belong 101 (raw IP 26021>20 belong 102 (BSD/OS SLIP 26022>20 belong 103 (BSD/OS PPP 26023>20 belong 104 (BSD/OS Cisco HDLC 26024>20 belong 105 (802.11 26025>20 belong 106 (Linux Classical IP over ATM 26026>20 belong 107 (Frame Relay 26027>20 belong 108 (OpenBSD loopback 26028>20 belong 109 (OpenBSD IPsec encrypted 26029>20 belong 112 (Cisco HDLC 26030>20 belong 113 (Linux cooked v1 26031>20 belong 114 (LocalTalk 26032>20 belong 117 (OpenBSD PFLOG 26033>20 belong 119 (802.11 with Prism header 26034>20 belong 122 (RFC 2625 IP over Fibre Channel 26035>20 belong 123 (SunATM 26036>20 belong 127 (802.11 with radiotap header 26037>20 belong 129 (Linux ARCNET 26038>20 belong 130 (Juniper Multi-Link PPP 26039>20 belong 131 (Juniper Multi-Link Frame Relay 26040>20 belong 132 (Juniper Encryption Services PIC 26041>20 belong 133 (Juniper GGSN PIC 26042>20 belong 134 (Juniper FRF.16 Frame Relay 26043>20 belong 135 (Juniper ATM2 PIC 26044>20 belong 136 (Juniper Advanced Services PIC 26045>20 belong 137 (Juniper ATM1 PIC 26046>20 belong 138 (Apple IP over IEEE 1394 26047>20 belong 139 (SS7 MTP2 with pseudo-header 26048>20 belong 140 (SS7 MTP2 26049>20 belong 141 (SS7 MTP3 26050>20 belong 142 (SS7 SCCP 26051>20 belong 143 (DOCSIS 26052>20 belong 144 (Linux IrDA 26053>20 belong 147 (Private use 0 26054>20 belong 148 (Private use 1 26055>20 belong 149 (Private use 2 26056>20 belong 150 (Private use 3 26057>20 belong 151 (Private use 4 26058>20 belong 152 (Private use 5 26059>20 belong 153 (Private use 6 26060>20 belong 154 (Private use 7 26061>20 belong 155 (Private use 8 26062>20 belong 156 (Private use 9 26063>20 belong 157 (Private use 10 26064>20 belong 158 (Private use 11 26065>20 belong 159 (Private use 12 26066>20 belong 160 (Private use 13 26067>20 belong 161 (Private use 14 26068>20 belong 162 (Private use 15 26069>20 belong 163 (802.11 with AVS header 26070>20 belong 164 (Juniper Passive Monitor PIC 26071>20 belong 165 (BACnet MS/TP 26072>20 belong 166 (PPPD 26073>20 belong 167 (Juniper PPPoE 26074>20 belong 168 (Juniper PPPoE/ATM 26075>20 belong 169 (GPRS LLC 26076>20 belong 170 (GPF-T 26077>20 belong 171 (GPF-F 26078>20 belong 174 (Juniper PIC Peer 26079>20 belong 175 (Ethernet with Endace ERF header 26080>20 belong 176 (Packet-over-SONET with Endace ERF header 26081>20 belong 177 (Linux LAPD 26082>20 belong 178 (Juniper Ethernet 26083>20 belong 179 (Juniper PPP 26084>20 belong 180 (Juniper Frame Relay 26085>20 belong 181 (Juniper C-HDLC 26086>20 belong 182 (FRF.16 Frame Relay 26087>20 belong 183 (Juniper Voice PIC 26088>20 belong 184 (Arinc 429 26089>20 belong 185 (Arinc 653 Interpartition Communication 26090>20 belong 186 (USB with FreeBSD header 26091>20 belong 187 (Bluetooth HCI H4 26092>20 belong 188 (802.16 MAC Common Part Sublayer 26093>20 belong 189 (Linux USB 26094>20 belong 190 (Controller Area Network (CAN) v. 2.0B 26095>20 belong 191 (802.15.4 with Linux padding 26096>20 belong 192 (PPI 26097>20 belong 193 (802.16 MAC Common Part Sublayer plus radiotap header 26098>20 belong 194 (Juniper Integrated Service Module 26099>20 belong 195 (802.15.4 with FCS 26100>20 belong 196 (SITA 26101>20 belong 197 (Endace ERF 26102>20 belong 198 (Ethernet with u10 Networks pseudo-header 26103>20 belong 199 (IPMB 26104>20 belong 200 (Juniper Secure Tunnel 26105>20 belong 201 (Bluetooth HCI H4 with pseudo-header 26106>20 belong 202 (AX.25 with KISS header 26107>20 belong 203 (LAPD 26108>20 belong 204 (PPP with direction pseudo-header 26109>20 belong 205 (Cisco HDLC with direction pseudo-header 26110>20 belong 206 (Frame Relay with direction pseudo-header 26111>20 belong 209 (Linux IPMB 26112>20 belong 215 (802.15.4 with non-ASK PHY header 26113>20 belong 216 (Linux evdev events 26114>20 belong 219 (MPLS with label as link-layer header 26115>20 belong 220 (Memory-mapped Linux USB 26116>20 belong 221 (DECT 26117>20 belong 222 (AOS Space Data Link protocol 26118>20 belong 223 (Wireless HART 26119>20 belong 224 (Fibre Channel FC-2 26120>20 belong 225 (Fibre Channel FC-2 with frame delimiters 26121>20 belong 226 (Solaris IPNET 26122>20 belong 227 (SocketCAN 26123>20 belong 228 (Raw IPv4 26124>20 belong 229 (Raw IPv6 26125>20 belong 230 (802.15.4 without FCS 26126>20 belong 231 (D-Bus messages 26127>20 belong 232 (Juniper Virtual Server 26128>20 belong 233 (Juniper SRX E2E 26129>20 belong 234 (Juniper Fibre Channel 26130>20 belong 235 (DVB-CI 26131>20 belong 236 (MUX27010 26132>20 belong 237 (STANAG 5066 D_PDUs 26133>20 belong 238 (Juniper ATM CEMIC 26134>20 belong 239 (Linux netfilter log messages 26135>20 belong 240 (Hilscher netAnalyzer 26136>20 belong 241 (Hilscher netAnalyzer with delimiters 26137>20 belong 242 (IP-over-Infiniband 26138>20 belong 243 (MPEG-2 Transport Stream packets 26139>20 belong 244 (ng4t ng40 26140>20 belong 245 (NFC LLCP 26141>20 belong 246 (Packet filter state syncing 26142>20 belong 247 (InfiniBand 26143>20 belong 248 (SCTP 26144>20 belong 249 (USB with USBPcap header 26145>20 belong 250 (Schweitzer Engineering Laboratories RTAC packets 26146>20 belong 251 (Bluetooth Low Energy air interface 26147>20 belong 252 (Wireshark Upper PDU export 26148>20 belong 253 (Linux netlink 26149>20 belong 254 (Bluetooth Linux Monitor 26150>20 belong 255 (Bluetooth Basic Rate/Enhanced Data Rate baseband packets 26151>20 belong 256 (Bluetooth Low Energy air interface with pseudo-header 26152>20 belong 257 (PROFIBUS data link layer 26153>20 belong 258 (Apple DLT_PKTAP 26154>20 belong 259 (Ethernet with 802.3 Clause 65 EPON preamble 26155>20 belong 260 (IPMI trace packets 26156>20 belong 261 (Z-Wave RF profile R1 and R2 packets 26157>20 belong 262 (Z-Wave RF profile R3 packets 26158>20 belong 263 (WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto 26159>20 belong 264 (ISO 14443 messages 26160>20 belong 265 (IEC 62106 Radio Data System groups 26161>20 belong 266 (USB with Darwin header 26162>20 belong 267 (OpenBSD DLT_OPENFLOW 26163>20 belong 268 (IBM SDLC frames 26164>20 belong 269 (TI LLN sniffer frames 26165>20 belong 271 (Linux vsock 26166>20 belong 272 (Nordic Semiconductor Bluetooth LE sniffer frames 26167>20 belong 273 (Excentis XRA-31 DOCSIS 3.1 RF sniffer frames 26168>20 belong 274 (802.3br mPackets 26169>20 belong 275 (DisplayPort AUX channel monitoring data 26170>20 belong 276 (Linux cooked v2 26171>20 belong 278 (OpenVizsla USB 26172>20 belong 279 (Elektrobit High Speed Capture and Replay (EBHSCR) 26173>20 belong 281 (Broadcom tag 26174>20 belong 282 (Broadcom tag (prepended) 26175# print default match 26176>20 default x 26177>>20 belong x (linktype#%u 26178>16 belong x \b, capture length %u) 26179 26180# packets time stamps in seconds and microseconds. 261810 ubelong 0xa1b2c3d4 pcap capture file, microseconds ts (big-endian) 26182!:mime application/vnd.tcpdump.pcap 26183>0 use pcap-be 261840 ulelong 0xa1b2c3d4 pcap capture file, microsecond ts (little-endian) 26185!:mime application/vnd.tcpdump.pcap 26186>0 use \^pcap-be 26187 26188# packets time stamps in seconds and nanoseconds. 261890 ubelong 0xa1b23c4d pcap capture file, nanosecond ts (big-endian) 26190!:mime application/vnd.tcpdump.pcap 26191>0 use pcap-be 261920 ulelong 0xa1b23c4d pcap capture file, nanosecond ts (little-endian) 26193!:mime application/vnd.tcpdump.pcap 26194>0 use \^pcap-be 26195 26196# 26197# "libpcap"-with-Alexey-Kuznetsov's-patches capture files. 26198# 261990 ubelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (big-endian) 26200>0 use pcap-be 262010 ulelong 0xa1b2cd34 pcap capture file, microsecond ts, extensions (little-endian) 26202>0 use \^pcap-be 26203 26204# 26205# "pcapng" capture files. 26206# https://github.com/pcapng/pcapng 26207# Pcapng files can contain multiple sections. Printing the endianness, 26208# snaplen, or other information from the first SHB may be misleading. 26209# 262100 ubelong 0x0a0d0d0a 26211>8 ubelong 0x1a2b3c4d pcapng capture file 26212>>12 beshort x - version %d 26213>>14 beshort x \b.%d 262140 ulelong 0x0a0d0d0a 26215>8 ulelong 0x1a2b3c4d pcapng capture file 26216>>12 leshort x - version %d 26217>>14 leshort x \b.%d 26218 26219# 26220# AIX "iptrace" capture files. 26221# 262220 string iptrace\0401.0 AIX iptrace capture file 262230 string iptrace\0402.0 AIX iptrace capture file 26224 26225# 26226# Novell LANalyzer capture files. 26227# 262280 leshort 0x1001 Novell LANalyzer capture file 262290 leshort 0x1007 Novell LANalyzer capture file 26230 26231# 26232# HP-UX "nettl" capture files. 26233# 262340 string \x54\x52\x00\x64\x00 HP/UX nettl capture file 26235 26236# 26237# RADCOM WAN/LAN Analyzer capture files. 26238# 262390 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file 26240 26241# 26242# NetStumbler log files. Not really packets, per se, but about as 26243# close as you can get. These are log files from NetStumbler, a 26244# Windows program, that scans for 802.11b networks. 26245# 262460 string NetS NetStumbler log file 26247>8 lelong x \b, %d stations found 26248 26249# 26250# *Peek tagged capture files. 26251# 262520 string \177ver EtherPeek/AiroPeek/OmniPeek capture file 26253 26254# 26255# Visual Networks traffic capture files. 26256# 262570 string \x05VNF Visual Networks traffic capture file 26258 26259# 26260# Network Instruments Observer capture files. 26261# 262620 string ObserverPktBuffe Network Instruments Observer capture file 26263 26264# 26265# Files from Accellent Group's 5View products. 26266# 262670 string \xaa\xaa\xaa\xaa 5View capture file 26268 26269#------------------------------------------------------------------------------ 26270# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $ 26271# softquad: file(1) magic for SoftQuad Publishing Software 26272# 26273# Author/Editor and RulesBuilder 26274# 26275# XXX - byte order? 26276# 262770 string \<!SQ\ DTD> Compiled SGML rules file 26278>9 string >\0 Type %s 262790 string \<!SQ\ A/E> A/E SGML Document binary 26280>9 string >\0 Type %s 262810 string \<!SQ\ STS> A/E SGML binary styles file 26282>9 string >\0 Type %s 262830 short 0xc0de Compiled PSI (v1) data 262840 short 0xc0da Compiled PSI (v2) data 26285>3 string >\0 (%s) 26286# Binary sqtroff font/desc files... 262870 short 0125252 SoftQuad DESC or font file binary 26288>2 short >0 - version %d 26289# Bitmaps... 262900 search/1 SQ\ BITMAP1 SoftQuad Raster Format text 26291#0 string SQ\ BITMAP2 SoftQuad Raster Format data 26292# sqtroff intermediate language (replacement for ditroff int. lang.) 262930 string X\ SoftQuad troff Context intermediate 26294>2 string 495 for AT&T 495 laser printer 26295>2 string hp for Hewlett-Packard LaserJet 26296>2 string impr for IMAGEN imPRESS 26297>2 string ps for PostScript 26298 26299# From: Michael Piefel <piefel@debian.org> 26300# sqtroff intermediate language (replacement for ditroff int. lang.) 263010 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer 263020 string X\ hp SoftQuad troff Context intermediate for HP LaserJet 263030 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS 263040 string X\ ps SoftQuad troff Context intermediate for PostScript 26305 26306#------------------------------------------------------------------------------ 26307# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $ 26308# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) 26309# 26310# Cloyce D. Spradling <cloyce@headgear.org> 26311 263120 string spec SPEC 26313>4 string .cpu CPU 26314>>8 string <: \b%.4s 26315>>12 string . raw result text 26316 2631717 string version=SPECjbb SPECjbb 26318>32 string <: \b%.4s 26319>>37 string <: v%.4s raw result text 26320 263210 string BEGIN\040SPECWEB SPECweb 26322>13 string <: \b%.2s 26323>>15 string _SSL \b_SSL 26324>>>20 string <: v%.4s raw result text 26325>>16 string <: v%.4s raw result text 26326 26327#------------------------------------------------------------------------------ 26328# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $ 26329# spectrum: file(1) magic for Spectrum emulator files. 26330# 26331# John Elliott <jce@seasip.demon.co.uk> 26332 26333# 26334# Spectrum +3DOS header 26335# 263360 string PLUS3DOS\032 Spectrum +3 data 26337>15 byte 0 - BASIC program 26338>15 byte 1 - number array 26339>15 byte 2 - character array 26340>15 byte 3 - memory block 26341>>16 belong 0x001B0040 (screen) 26342>15 byte 4 - Tasword document 26343>15 string TAPEFILE - ZXT tapefile 26344# 26345# Tape file. This assumes the .TAP starts with a Spectrum-format header, 26346# which nearly all will. 26347# 26348# Update: Sanity-check string contents to be printable. 26349# -Adam Buchbinder <adam.buchbinder@gmail.com> 26350# 263510 string \023\000\000 26352>4 string >\0 26353>>4 string <\177 Spectrum .TAP data "%-10.10s" 26354>>>3 byte 0 - BASIC program 26355>>>3 byte 1 - number array 26356>>>3 byte 2 - character array 26357>>>3 byte 3 - memory block 26358>>>>14 belong 0x001B0040 (screen) 26359 26360# The following three blocks are from pak21-spectrum@srcf.ucam.org 26361# TZX tape images 263620 string ZXTape!\x1a Spectrum .TZX data 26363>8 byte x version %d 26364>9 byte x \b.%d 26365 26366# RZX input recording files 263670 string RZX! Spectrum .RZX data 26368>4 byte x version %d 26369>5 byte x \b.%d 26370 26371# Floppy disk images 263720 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data 263730 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data 263740 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data 263750 string SINCLAIR Spectrum .SCL Betadisk image 26376 26377# Hard disk images 263780 string RS-IDE\x1a Spectrum .HDF hard disk image 26379>7 byte x \b, version 0x%02x 26380 26381# SZX snapshots (fuse and spectaculator) 26382# Martin M. S. Pedersen <martin@linux.com> 26383# http://www.spectaculator.com/docs/zx-state/header.shtml 26384# 263850 string ZXST zx-state snapshot 26386>4 byte x version %d 26387>5 byte x \b.%d 26388>>6 byte 0 16k ZX Spectrum 26389>>6 byte 1 48k ZX Spectrum/ZX Spectrum+ 26390>>6 byte 2 ZX Spectrum 128 26391>>6 byte 3 ZX Spectrum +2 26392>>6 byte 4 ZX Spectrum +2A/+2B 26393>>6 byte 5 ZX Spectrum +3 26394>>6 byte 6 ZX Spectrum +3e 26395>>6 byte 7 Pentagon 128 26396>>6 byte 8 Timex Sinclair TC2048 26397>>6 byte 9 Timex Sinclair TC2068 26398>>6 byte 10 Scorpion ZS-256 26399>>6 byte 11 ZX Spectrum SE 26400>>6 byte 12 Timex Sinclair TS2068 26401>>6 byte 13 Pentagon 512 26402>>6 byte 14 Pentagon 1024 26403>>6 byte 15 48k ZX Spectrum (NTSC) 26404>>6 byte 16 ZX Spectrum 12Ke 26405>>>7 byte 1 (alternate timings) 26406 26407#------------------------------------------------------------------------------ 26408# $File: sql,v 1.22 2019/04/19 00:42:27 christos Exp $ 26409# sql: file(1) magic for SQL files 26410# 26411# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> 26412# Recognize some MySQL files. 26413# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures 26414# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic 26415# 264160 beshort 0xfe01 MySQL table definition file 26417>2 byte x Version %d 26418>3 byte 0 \b, type UNKNOWN 26419>3 byte 1 \b, type DIAM_ISAM 26420>3 byte 2 \b, type HASH 26421>3 byte 3 \b, type MISAM 26422>3 byte 4 \b, type PISAM 26423>3 byte 5 \b, type RMS_ISAM 26424>3 byte 6 \b, type HEAP 26425>3 byte 7 \b, type ISAM 26426>3 byte 8 \b, type MRG_ISAM 26427>3 byte 9 \b, type MYISAM 26428>3 byte 10 \b, type MRG_MYISAM 26429>3 byte 11 \b, type BERKELEY_DB 26430>3 byte 12 \b, type INNODB 26431>3 byte 13 \b, type GEMINI 26432>3 byte 14 \b, type NDBCLUSTER 26433>3 byte 15 \b, type EXAMPLE_DB 26434>3 byte 16 \b, type CSV_DB 26435>3 byte 17 \b, type FEDERATED_DB 26436>3 byte 18 \b, type BLACKHOLE_DB 26437>3 byte 19 \b, type PARTITION_DB 26438>3 byte 20 \b, type BINLOG 26439>3 byte 21 \b, type SOLID 26440>3 byte 22 \b, type PBXT 26441>3 byte 23 \b, type TABLE_FUNCTION 26442>3 byte 24 \b, type MEMCACHE 26443>3 byte 25 \b, type FALCON 26444>3 byte 26 \b, type MARIA 26445>3 byte 27 \b, type PERFORMANCE_SCHEMA 26446>3 byte 127 \b, type DEFAULT 26447>0x0033 ulong x \b, MySQL version %d 264480 belong&0xffffff00 0xfefe0500 MySQL ISAM index file 26449>3 byte x Version %d 264500 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file 26451>3 byte x Version %d 264520 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file 26453>3 byte x Version %d 26454>14 beshort x \b, %d key parts 26455>16 beshort x \b, %d unique key parts 26456>18 byte x \b, %d keys 26457>28 bequad x \b, %lld records 26458>36 bequad x \b, %lld deleted records 264590 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file 26460>3 byte x Version %d 264610 belong&0xffffff00 0xfefe0900 MySQL Maria index file 26462>3 byte x Version %d 264630 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file 26464>3 byte x Version %d 264650 belong&0xffffff00 0xfefe0c00 26466>4 string MACF MySQL Maria control file 26467>>3 byte x Version %d 264680 string \376bin MySQL replication log, 26469>9 long x server id %d 26470>8 byte 1 26471>>13 long 69 \b, MySQL V3.2.3 26472>>>19 string x \b, server version %s 26473>>13 long 75 \b, MySQL V4.0.2-V4.1 26474>>>25 string x \b, server version %s 26475>8 byte 15 MySQL V5+, 26476>>25 string x server version %s 26477>4 string MARIALOG MySQL Maria transaction log file 26478>>3 byte x Version %d 26479 26480#------------------------------------------------------------------------------ 26481# iRiver H Series database file 26482# From Ken Guest <ken@linux.ie> 26483# As observed from iRivNavi.iDB and unencoded firmware 26484# 264850 string iRivDB iRiver Database file 26486>11 string >\0 Version %s 26487>39 string iHP-100 [H Series] 26488 26489#------------------------------------------------------------------------------ 26490# SQLite database files 26491# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg 26492# 26493# Version 1 used GDBM internally; its files cannot be distinguished 26494# from other GDBM files. 26495# 26496# Version 2 used this format: 264970 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database 26498 26499# Version 3 of SQLite allows applications to embed their own "user version" 26500# number in the database at offset 60. Later, SQLite added an "application id" 26501# at offset 68 that is preferred over "user version" for indicating the 26502# associated application. 26503# 265040 string SQLite\ format\ 3 SQLite 3.x database 26505!:mime application/x-sqlite3 26506# seldom found extension sqlite3 like in SyncData.sqlite3 26507# db 26508# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe 26509# Unfortunately extension sqlite also used for other databases starting with string 26510# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite 26511# and with string "ZV-zlib" in like extra.sqlite 26512!:ext sqlite/sqlite3/db/dbe 26513>60 belong =0x5f4d544e (Monotone source repository) 26514>68 belong =0x0f055112 (Fossil checkout) 26515>68 belong =0x0f055113 (Fossil global configuration) 26516>68 belong =0x0f055111 (Fossil repository) 26517>68 belong =0x42654462 (Bentley Systems BeSQLite Database) 26518>68 belong =0x42654c6e (Bentley Systems Localization File) 26519>68 belong =0x47504b47 (OGC GeoPackage file) 26520>68 default x 26521>>68 belong !0 \b, application id %u 26522>>60 belong !0 \b, user version %d 26523>96 belong x \b, last written using SQLite version %d 26524 26525 26526# SQLite Write-Ahead Log from SQLite version >= 3.7.0 26527# https://www.sqlite.org/fileformat.html#walformat 265280 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, 26529!:ext sqlite-wal/db-wal 26530>4 belong x version %d 26531 26532# SQLite Rollback Journal 26533# https://www.sqlite.org/fileformat.html#rollbackjournal 265340 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal 26535 26536# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek 26537# https://github.com/PredatH0r/ChanSort 265380 string PSDB\0 Panasonic channel list DataBase 26539!:ext db/bin 26540#!:mime application/x-db-svl-panasonic 26541>126 string SQLite\ format\ 3 26542#!:mime application/x-panasonic-sqlite3 26543>>&-15 indirect x \b; contains 26544 26545# H2 Database from https://www.h2database.com/ 265460 string --\ H2\ 0.5/B\ --\ \n H2 Database file 26547# Type: OpenSSH key files 26548# From: Nicolas Collignon <tsointsoin@gmail.com> 26549 265500 string SSH\ PRIVATE\ KEY OpenSSH RSA1 private key, 26551>28 string >\0 version %s 265520 string -----BEGIN\ OPENSSH\ PRIVATE\ KEY----- OpenSSH private key 26553 265540 string ssh-dss\ OpenSSH DSA public key 265550 string ssh-rsa\ OpenSSH RSA public key 265560 string ecdsa-sha2-nistp256 OpenSSH ECDSA public key 265570 string ecdsa-sha2-nistp384 OpenSSH ECDSA public key 265580 string ecdsa-sha2-nistp521 OpenSSH ECDSA public key 265590 string ssh-ed25519 OpenSSH ED25519 public key 26560 26561#------------------------------------------------------------------------------ 26562# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $ 26563# ssl: file(1) magic for SSL file formats 26564 26565# Type: OpenSSL certificates/key files 26566# From: Nicolas Collignon <tsointsoin@gmail.com> 26567 265680 string -----BEGIN\040CERTIFICATE----- PEM certificate 265690 string -----BEGIN\040CERTIFICATE\040REQ PEM certificate request 265700 string -----BEGIN\040RSA\040PRIVATE PEM RSA private key 265710 string -----BEGIN\040DSA\040PRIVATE PEM DSA private key 265720 string -----BEGIN\040EC\040PRIVATE PEM EC private key 265730 string -----BEGIN\040ECDSA\040PRIVATE PEM ECDSA private key 26574 26575# From Luc Gommans 26576# OpenSSL enc file (recognized by a magic string preceding the password's salt) 265770 string Salted__ openssl enc'd data with salted password 26578# Using the -a or -base64 option, OpenSSL will base64-encode the data. 265790 string U2FsdGVkX1 openssl enc'd data with salted password, base64 encoded 26580 26581#------------------------------------------------------------------------------ 26582# $File: sun,v 1.28 2019/04/19 00:42:27 christos Exp $ 26583# sun: file(1) magic for Sun machines 26584# 26585# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x 26586# releases. (5.x uses ELF.) Entries for executables without an 26587# architecture type, used before the 68020-based Sun-3's came out, 26588# are in aout, as they're indistinguishable from other big-endian 26589# 32-bit a.out files. 26590# 265910 belong&077777777 0600413 a.out SunOS SPARC demand paged 26592>0 byte &0x80 26593>>20 belong <4096 shared library 26594>>20 belong =4096 dynamically linked executable 26595>>20 belong >4096 dynamically linked executable 26596>0 byte ^0x80 executable 26597>16 belong >0 not stripped 26598 265990 belong&077777777 0600410 a.out SunOS SPARC pure 26600>0 byte &0x80 dynamically linked executable 26601>0 byte ^0x80 executable 26602>16 belong >0 not stripped 26603 266040 belong&077777777 0600407 a.out SunOS SPARC 26605>0 byte &0x80 dynamically linked executable 26606>0 byte ^0x80 executable 26607>16 belong >0 not stripped 26608 266090 belong&077777777 0400413 a.out SunOS mc68020 demand paged 26610>0 byte &0x80 26611>>20 belong <4096 shared library 26612>>20 belong =4096 dynamically linked executable 26613>>20 belong >4096 dynamically linked executable 26614>0 byte ^0x80 executable 26615>16 belong >0 not stripped 26616 266170 belong&077777777 0400410 a.out SunOS mc68020 pure 26618>0 byte &0x80 dynamically linked executable 26619>0 byte ^0x80 executable 26620>16 belong >0 not stripped 26621 266220 belong&077777777 0400407 a.out SunOS mc68020 26623>0 byte &0x80 dynamically linked executable 26624>0 byte ^0x80 executable 26625>16 belong >0 not stripped 26626 266270 belong&077777777 0200413 a.out SunOS mc68010 demand paged 26628>0 byte &0x80 26629>>20 belong <4096 shared library 26630>>20 belong =4096 dynamically linked executable 26631>>20 belong >4096 dynamically linked executable 26632>0 byte ^0x80 executable 26633>16 belong >0 not stripped 26634 266350 belong&077777777 0200410 a.out SunOS mc68010 pure 26636>0 byte &0x80 dynamically linked executable 26637>0 byte ^0x80 executable 26638>16 belong >0 not stripped 26639 266400 belong&077777777 0200407 a.out SunOS mc68010 26641>0 byte &0x80 dynamically linked executable 26642>0 byte ^0x80 executable 26643>16 belong >0 not stripped 26644 26645# 26646# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC 26647# binary executed in compatibility mode under SunOS 5.x". 26648# 266490 belong 0x080456 SunOS core file 26650>4 belong 432 (SPARC) 26651>>132 string >\0 from '%s' 26652>>116 belong =3 (quit) 26653>>116 belong =4 (illegal instruction) 26654>>116 belong =5 (trace trap) 26655>>116 belong =6 (abort) 26656>>116 belong =7 (emulator trap) 26657>>116 belong =8 (arithmetic exception) 26658>>116 belong =9 (kill) 26659>>116 belong =10 (bus error) 26660>>116 belong =11 (segmentation violation) 26661>>116 belong =12 (bad argument to system call) 26662>>116 belong =29 (resource lost) 26663>>120 belong x (T=%dK, 26664>>124 belong x D=%dK, 26665>>128 belong x S=%dK) 26666>4 belong 826 (68K) 26667>>128 string >\0 from '%s' 26668>4 belong 456 (SPARC 4.x BCP) 26669>>152 string >\0 from '%s' 26670# Sun SunPC 266710 long 0xfa33c08e SunPC 4.0 Hard Disk 266720 string #SUNPC_CONFIG SunPC 4.0 Properties Values 26673# Sun snoop (see RFC 1761, which describes the capture file format, 26674# RFC 3827, which describes some additional datalink types, and 26675# https://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml, 26676# which is the IANA registry of Snoop datalink types) 26677# 266780 string snoop Snoop capture file 26679>8 belong >0 - version %d 26680>12 belong 0 (IEEE 802.3) 26681>12 belong 1 (IEEE 802.4) 26682>12 belong 2 (IEEE 802.5) 26683>12 belong 3 (IEEE 802.6) 26684>12 belong 4 (Ethernet) 26685>12 belong 5 (HDLC) 26686>12 belong 6 (Character synchronous) 26687>12 belong 7 (IBM channel-to-channel adapter) 26688>12 belong 8 (FDDI) 26689>12 belong 9 (Other) 26690>12 belong 10 (type %d) 26691>12 belong 11 (type %d) 26692>12 belong 12 (type %d) 26693>12 belong 13 (type %d) 26694>12 belong 14 (type %d) 26695>12 belong 15 (type %d) 26696>12 belong 16 (Fibre Channel) 26697>12 belong 17 (ATM) 26698>12 belong 18 (ATM Classical IP) 26699>12 belong 19 (type %d) 26700>12 belong 20 (type %d) 26701>12 belong 21 (type %d) 26702>12 belong 22 (type %d) 26703>12 belong 23 (type %d) 26704>12 belong 24 (type %d) 26705>12 belong 25 (type %d) 26706>12 belong 26 (IP over Infiniband) 26707>12 belong >26 (type %d) 26708 26709#--------------------------------------------------------------------------- 26710# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a 26711# lead Sun/Cobalt developer) who agrees that they are good and worthy of 26712# inclusion. 26713 26714# Boot ROM images for Sun/Cobalt Linux server appliances 267150 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom 26716>38 string x V%.4s 26717 26718# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code 26719# at the very end where file(1) can't get it. 267200 string CRfs COBALT boot rom data (Flat boot rom or file system) 26721 26722#------------------------------------------------------------------------------ 26723# msx: file(1) magic for the SymbOS operating system 26724# http://www.symbos.de 26725# Fabio R. Schmidlin <frs@pop.com.br> 26726 26727# SymbOS EXE file 267280x30 string SymExe SymbOS executable 26729>0x36 ubyte x v%c 26730>0x37 ubyte x \b.%c 26731>0xF string x \b, name: %s 26732 26733# SymbOS DOX document 267340 string INFOq\0 SymbOS DOX document 26735 26736# Symbos driver 267370 string SMD1 SymbOS driver 26738>19 byte x \b, name: %c 26739>20 byte x \b%c 26740>21 byte x \b%c 26741>22 byte x \b%c 26742>23 byte x \b%c 26743>24 byte x \b%c 26744>25 byte x \b%c 26745>26 byte x \b%c 26746>27 byte x \b%c 26747>28 byte x \b%c 26748>29 byte x \b%c 26749>30 byte x \b%c 26750>31 byte x \b%c 26751 26752# Symbos video 267530 string SymVid SymbOS video 26754>6 ubyte x v%c 26755>7 ubyte x \b.%c 26756 26757# Soundtrakker 128 ST2 music 267580 byte 0 26759>0xC string \x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00 Soundtrakker 128 ST2 music, 26760>>1 string x name: %s 26761 26762 26763 26764#------------------------------------------------------------------------ 26765# $File: sysex,v 1.10 2019/04/19 00:42:27 christos Exp $ 26766# sysex: file(1) magic for MIDI sysex files 26767# 26768# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems 26769# where real SYStem EXclusive messages at offset 1 are limited to seven bits 26770# https://en.wikipedia.org/wiki/MIDI 267710 ubeshort&0xFF80 0xF000 SysEx File - 26772 26773# North American Group 26774>1 byte 0x01 Sequential 26775>1 byte 0x02 IDP 26776>1 byte 0x03 OctavePlateau 26777>1 byte 0x04 Moog 26778>1 byte 0x05 Passport 26779>1 byte 0x06 Lexicon 26780>1 byte 0x07 Kurzweil/Future Retro 26781>>3 byte 0x77 777 26782>>4 byte 0x00 Bank 26783>>4 byte 0x01 Song 26784>>5 byte 0x0f 16 26785>>5 byte 0x0e 15 26786>>5 byte 0x0d 14 26787>>5 byte 0x0c 13 26788>>5 byte 0x0b 12 26789>>5 byte 0x0a 11 26790>>5 byte 0x09 10 26791>>5 byte 0x08 9 26792>>5 byte 0x07 8 26793>>5 byte 0x06 7 26794>>5 byte 0x05 6 26795>>5 byte 0x04 5 26796>>5 byte 0x03 4 26797>>5 byte 0x02 3 26798>>5 byte 0x01 2 26799>>5 byte 0x00 1 26800>>5 byte 0x10 (ALL) 26801>>2 byte x \b, Channel %d 26802>1 byte 0x08 Fender 26803>1 byte 0x09 Gulbransen 26804>1 byte 0x0a AKG 26805>1 byte 0x0b Voyce 26806>1 byte 0x0c Waveframe 26807>1 byte 0x0d ADA 26808>1 byte 0x0e Garfield 26809>1 byte 0x0f Ensoniq 26810>1 byte 0x10 Oberheim 26811>>2 byte 0x06 Matrix 6 series 26812>>3 byte 0x0A Dump (All) 26813>>3 byte 0x01 Dump (Bank) 26814>>4 belong 0x0002040E Matrix 1000 26815>>>11 byte <2 User bank %d 26816>>>11 byte >1 Preset bank %d 26817>1 byte 0x11 Apple 26818>1 byte 0x12 GreyMatter 26819>1 byte 0x14 PalmTree 26820>1 byte 0x15 JLCooper 26821>1 byte 0x16 Lowrey 26822>1 byte 0x17 AdamsSmith 26823>1 byte 0x18 E-mu 26824>1 byte 0x19 Harmony 26825>1 byte 0x1a ART 26826>1 byte 0x1b Baldwin 26827>1 byte 0x1c Eventide 26828>1 byte 0x1d Inventronics 26829>1 byte 0x1f Clarity 26830 26831# European Group 26832>1 byte 0x21 SIEL 26833>1 byte 0x22 Synthaxe 26834>1 byte 0x24 Hohner 26835>1 byte 0x25 Twister 26836>1 byte 0x26 Solton 26837>1 byte 0x27 Jellinghaus 26838>1 byte 0x28 Southworth 26839>1 byte 0x29 PPG 26840>1 byte 0x2a JEN 26841>1 byte 0x2b SSL 26842>1 byte 0x2c AudioVertrieb 26843 26844>1 byte 0x2f ELKA 26845>>3 byte 0x09 EK-44 26846 26847>1 byte 0x30 Dynacord 26848>1 byte 0x31 Jomox 26849>1 byte 0x33 Clavia 26850>1 byte 0x39 Soundcraft 26851# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs 26852>1 byte 0x3e Waldorf 26853>>2 byte 0x00 microWave 26854>>2 byte 0x0E microwave2 / XT 26855>>2 byte 0x0F Q / Q+ 26856>>3 byte =0 (default id) 26857>>3 byte >0 ( 26858>>>3 byte <0x7F \bdevice %d) 26859>>>3 byte =0x7F \bbroadcast id) 26860>>3 byte 0x7f Microwave I 26861>>>4 byte 0x00 SNDR (Sound Request) 26862>>>4 byte 0x10 SNDD (Sound Dump) 26863>>>4 byte 0x20 SNDP (Sound Parameter Change) 26864>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 26865>>>4 byte 0x70 BOOT (Sound Reserved) 26866>>>4 byte 0x01 MULR (Multi Request) 26867>>>4 byte 0x11 MULD (Multi Dump) 26868>>>4 byte 0x21 MULP (Multi Parameter Change) 26869>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 26870>>>4 byte 0x71 OS (Multi Reserved) 26871>>>4 byte 0x02 DRMR (Drum Map Request) 26872>>>4 byte 0x12 DRMD (Drum Map Dump) 26873>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 26874>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 26875>>>4 byte 0x72 BIN (Drum Map Reserved) 26876>>>4 byte 0x03 PATR (Sequencer Pattern Request) 26877>>>4 byte 0x13 PATD (Sequencer Pattern Dump) 26878>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) 26879>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) 26880>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) 26881>>>4 byte 0x04 GLBR (Global Parameter Request) 26882>>>4 byte 0x14 GLBD (Global Parameter Dump) 26883>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 26884>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 26885>>>4 byte 0x07 MODR (Mode Parameter Request) 26886>>>4 byte 0x17 MODD (Mode Parameter Dump) 26887>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) 26888>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) 26889>>2 byte 0x10 microQ 26890>>>4 byte 0x00 SNDR (Sound Request) 26891>>>4 byte 0x10 SNDD (Sound Dump) 26892>>>4 byte 0x20 SNDP (Sound Parameter Change) 26893>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) 26894>>>4 byte 0x70 (Sound Reserved) 26895>>>4 byte 0x01 MULR (Multi Request) 26896>>>4 byte 0x11 MULD (Multi Dump) 26897>>>4 byte 0x21 MULP (Multi Parameter Change) 26898>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) 26899>>>4 byte 0x71 OS (Multi Reserved) 26900>>>4 byte 0x02 DRMR (Drum Map Request) 26901>>>4 byte 0x12 DRMD (Drum Map Dump) 26902>>>4 byte 0x22 DRMP (Drum Map Parameter Change) 26903>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) 26904>>>4 byte 0x72 BIN (Drum Map Reserved) 26905>>>4 byte 0x04 GLBR (Global Parameter Request) 26906>>>4 byte 0x14 GLBD (Global Parameter Dump) 26907>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 26908>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 26909>>2 byte 0x11 rackAttack 26910>>>4 byte 0x00 SNDR (Sound Parameter Request) 26911>>>4 byte 0x10 SNDD (Sound Parameter Dump) 26912>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) 26913>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) 26914>>>4 byte 0x01 PRGR (Program Parameter Request) 26915>>>4 byte 0x11 PRGD (Program Parameter Dump) 26916>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) 26917>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) 26918>>>4 byte 0x71 OS (Program Parameter Reserved) 26919>>>4 byte 0x03 PATR (Pattern Parameter Request) 26920>>>4 byte 0x13 PATD (Pattern Parameter Dump) 26921>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) 26922>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) 26923>>>4 byte 0x04 GLBR (Global Parameter Request) 26924>>>4 byte 0x14 GLBD (Global Parameter Dump) 26925>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) 26926>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) 26927>>>4 byte 0x05 EFXR (FX Parameter Request) 26928>>>4 byte 0x15 EFXD (FX Parameter Dump) 26929>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) 26930>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) 26931>>>4 byte 0x07 MODR (Mode Command Request) 26932>>>4 byte 0x17 MODD (Mode Command Dump) 26933>>>4 byte 0x27 MODP (Mode Command Parameter Change) 26934>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) 26935>>2 byte 0x03 Wave 26936>>>4 byte 0x00 SBPR (Soundprogram) 26937>>>4 byte 0x01 SAPR (Performance) 26938>>>4 byte 0x02 SWAVE (Wave) 26939>>>4 byte 0x03 SWTBL (Wave control table) 26940>>>4 byte 0x04 SVT (Velocity Curve) 26941>>>4 byte 0x05 STT (Tuning Table) 26942>>>4 byte 0x06 SGLB (Global Parameters) 26943>>>4 byte 0x07 SARRMAP (Performance Program Change Map) 26944>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) 26945>>>4 byte 0x09 SBPRPAR (Sound Parameter) 26946>>>4 byte 0x0A SARRPAR (Performance Parameter) 26947>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) 26948>>>4 byte 0x0F SBULK (Bulk Switch on/off) 26949 26950# Japanese Group 26951>1 byte 0x40 Kawai 26952>>3 byte 0x20 K1 26953>>3 byte 0x22 K4 26954 26955>1 byte 0x41 Roland 26956>>3 byte 0x14 D-50 26957>>3 byte 0x2b U-220 26958>>3 byte 0x02 TR-707 26959 26960>1 byte 0x42 Korg 26961>>3 byte 0x19 M1 26962 26963>1 byte 0x43 Yamaha 26964>1 byte 0x44 Casio 26965>1 byte 0x46 Kamiya 26966>1 byte 0x47 Akai 26967>1 byte 0x48 Victor 26968>1 byte 0x49 Mesosha 26969>1 byte 0x4b Fujitsu 26970>1 byte 0x4c Sony 26971>1 byte 0x4e Teac 26972>1 byte 0x50 Matsushita 26973>1 byte 0x51 Fostex 26974>1 byte 0x52 Zoom 26975>1 byte 0x54 Matsushita 26976>1 byte 0x57 Acoustic tech. lab. 26977# https://www.midi.org/techspecs/manid.php 26978>1 belong&0xffffff00 0x00007400 Ta Horng 26979>1 belong&0xffffff00 0x00007500 e-Tek 26980>1 belong&0xffffff00 0x00007600 E-Voice 26981>1 belong&0xffffff00 0x00007700 Midisoft 26982>1 belong&0xffffff00 0x00007800 Q-Sound 26983>1 belong&0xffffff00 0x00007900 Westrex 26984>1 belong&0xffffff00 0x00007a00 Nvidia* 26985>1 belong&0xffffff00 0x00007b00 ESS 26986>1 belong&0xffffff00 0x00007c00 Mediatrix 26987>1 belong&0xffffff00 0x00007d00 Brooktree 26988>1 belong&0xffffff00 0x00007e00 Otari 26989>1 belong&0xffffff00 0x00007f00 Key Electronics 26990>1 belong&0xffffff00 0x00010000 Shure 26991>1 belong&0xffffff00 0x00010100 AuraSound 26992>1 belong&0xffffff00 0x00010200 Crystal 26993>1 belong&0xffffff00 0x00010300 Rockwell 26994>1 belong&0xffffff00 0x00010400 Silicon Graphics 26995>1 belong&0xffffff00 0x00010500 Midiman 26996>1 belong&0xffffff00 0x00010600 PreSonus 26997>1 belong&0xffffff00 0x00010800 Topaz 26998>1 belong&0xffffff00 0x00010900 Cast Lightning 26999>1 belong&0xffffff00 0x00010a00 Microsoft 27000>1 belong&0xffffff00 0x00010b00 Sonic Foundry 27001>1 belong&0xffffff00 0x00010c00 Line 6 27002>1 belong&0xffffff00 0x00010d00 Beatnik Inc. 27003>1 belong&0xffffff00 0x00010e00 Van Koerving 27004>1 belong&0xffffff00 0x00010f00 Altech Systems 27005>1 belong&0xffffff00 0x00011000 S & S Research 27006>1 belong&0xffffff00 0x00011100 VLSI Technology 27007>1 belong&0xffffff00 0x00011200 Chromatic 27008>1 belong&0xffffff00 0x00011300 Sapphire 27009>1 belong&0xffffff00 0x00011400 IDRC 27010>1 belong&0xffffff00 0x00011500 Justonic Tuning 27011>1 belong&0xffffff00 0x00011600 TorComp 27012>1 belong&0xffffff00 0x00011700 Newtek Inc. 27013>1 belong&0xffffff00 0x00011800 Sound Sculpture 27014>1 belong&0xffffff00 0x00011900 Walker Technical 27015>1 belong&0xffffff00 0x00011a00 Digital Harmony 27016>1 belong&0xffffff00 0x00011b00 InVision 27017>1 belong&0xffffff00 0x00011c00 T-Square 27018>1 belong&0xffffff00 0x00011d00 Nemesys 27019>1 belong&0xffffff00 0x00011e00 DBX 27020>1 belong&0xffffff00 0x00011f00 Syndyne 27021>1 belong&0xffffff00 0x00012000 Bitheadz 27022>1 belong&0xffffff00 0x00012100 Cakewalk 27023>1 belong&0xffffff00 0x00012200 Staccato 27024>1 belong&0xffffff00 0x00012300 National Semicon. 27025>1 belong&0xffffff00 0x00012400 Boom Theory 27026>1 belong&0xffffff00 0x00012500 Virtual DSP Corp 27027>1 belong&0xffffff00 0x00012600 Antares 27028>1 belong&0xffffff00 0x00012700 Angel Software 27029>1 belong&0xffffff00 0x00012800 St Louis Music 27030>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX 27031>1 belong&0xffffff00 0x00012a00 Ashley Audio 27032>1 belong&0xffffff00 0x00012b00 Vari-Lite 27033>1 belong&0xffffff00 0x00012c00 Summit Audio 27034>1 belong&0xffffff00 0x00012d00 Aureal Semicon. 27035>1 belong&0xffffff00 0x00012e00 SeaSound 27036>1 belong&0xffffff00 0x00012f00 U.S. Robotics 27037>1 belong&0xffffff00 0x00013000 Aurisis 27038>1 belong&0xffffff00 0x00013100 Nearfield Multimedia 27039>1 belong&0xffffff00 0x00013200 FM7 Inc. 27040>1 belong&0xffffff00 0x00013300 Swivel Systems 27041>1 belong&0xffffff00 0x00013400 Hyperactive 27042>1 belong&0xffffff00 0x00013500 MidiLite 27043>1 belong&0xffffff00 0x00013600 Radical 27044>1 belong&0xffffff00 0x00013700 Roger Linn 27045>1 belong&0xffffff00 0x00013800 Helicon 27046>1 belong&0xffffff00 0x00013900 Event 27047>1 belong&0xffffff00 0x00013a00 Sonic Network 27048>1 belong&0xffffff00 0x00013b00 Realtime Music 27049>1 belong&0xffffff00 0x00013c00 Apogee Digital 27050 27051>1 belong&0xffffff00 0x00202b00 Medeli Electronics 27052>1 belong&0xffffff00 0x00202c00 Charlie Lab 27053>1 belong&0xffffff00 0x00202d00 Blue Chip Music 27054>1 belong&0xffffff00 0x00202e00 BEE OH Corp 27055>1 belong&0xffffff00 0x00202f00 LG Semicon America 27056>1 belong&0xffffff00 0x00203000 TESI 27057>1 belong&0xffffff00 0x00203100 EMAGIC 27058>1 belong&0xffffff00 0x00203200 Behringer 27059>1 belong&0xffffff00 0x00203300 Access Music 27060>1 belong&0xffffff00 0x00203400 Synoptic 27061>1 belong&0xffffff00 0x00203500 Hanmesoft Corp 27062>1 belong&0xffffff00 0x00203600 Terratec 27063>1 belong&0xffffff00 0x00203700 Proel SpA 27064>1 belong&0xffffff00 0x00203800 IBK MIDI 27065>1 belong&0xffffff00 0x00203900 IRCAM 27066>1 belong&0xffffff00 0x00203a00 Propellerhead Software 27067>1 belong&0xffffff00 0x00203b00 Red Sound Systems 27068>1 belong&0xffffff00 0x00203c00 Electron ESI AB 27069>1 belong&0xffffff00 0x00203d00 Sintefex Audio 27070>1 belong&0xffffff00 0x00203e00 Music and More 27071>1 belong&0xffffff00 0x00203f00 Amsaro 27072>1 belong&0xffffff00 0x00204000 CDS Advanced Technology 27073>1 belong&0xffffff00 0x00204100 Touched by Sound 27074>1 belong&0xffffff00 0x00204200 DSP Arts 27075>1 belong&0xffffff00 0x00204300 Phil Rees Music 27076>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH 27077>1 belong&0xffffff00 0x00204500 Soundart 27078>1 belong&0xffffff00 0x00204600 C-Mexx Software 27079>1 belong&0xffffff00 0x00204700 Klavis Tech. 27080>1 belong&0xffffff00 0x00204800 Noteheads AB 27081 270820 string T707 Roland TR-707 Data 27083#------------------------------------------------------------------------------ 27084# file: file(1) magic for Tcl scripting language 27085# URL: https://www.tcl.tk/ 27086# From: gustaf neumann 27087 27088# Tcl scripts 270890 search/1/w #!\ /usr/bin/tcl Tcl script text executable 27090!:mime text/x-tcl 270910 search/1/w #!\ /usr/local/bin/tcl Tcl script text executable 27092!:mime text/x-tcl 270930 search/1 #!/usr/bin/env\ tcl Tcl script text executable 27094!:mime text/x-tcl 270950 search/1 #!\ /usr/bin/env\ tcl Tcl script text executable 27096!:mime text/x-tcl 270970 search/1/w #!\ /usr/bin/wish Tcl/Tk script text executable 27098!:mime text/x-tcl 270990 search/1/w #!\ /usr/local/bin/wish Tcl/Tk script text executable 27100!:mime text/x-tcl 271010 search/1 #!/usr/bin/env\ wish Tcl/Tk script text executable 27102!:mime text/x-tcl 271030 search/1 #!\ /usr/bin/env\ wish Tcl/Tk script text executable 27104!:mime text/x-tcl 27105 27106# check the first line 271070 search/1 package\ req 27108>0 regex \^package[\ \t]+req Tcl script 27109# not 'p', check other lines 271100 search/1 !p 27111>0 regex \^package[\ \t]+req Tcl script 27112 27113#------------------------------------------------------------------------------ 27114# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $ 27115# teapot: file(1) magic for "teapot" spreadsheet 27116# 271170 string #!teapot\012xdr teapot work sheet (XDR format) 27118 27119#------------------------------------------------------------------------------ 27120# $File: terminfo,v 1.11 2019/04/19 00:42:27 christos Exp $ 27121# terminfo: file(1) magic for terminfo 27122# 27123# URL: https://invisible-island.net/ncurses/man/term.5.html 27124# URL: https://invisible-island.net/ncurses/man/scr_dump.5.html 27125# 27126# Workaround for Targa image type by Joerg Jenderek 27127# GRR: line below too general as it catches also 27128# Targa image type 1 with 26 long identification field 27129# and HELP.DSK 271300 string \032\001 27131# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32) 27132>16 ubyte >32 27133# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0.4.1" 27134>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled terminfo entry "%-s" 27135!:mime application/x-terminfo 27136# no extension 27137#!:ext 27138# 27139#------------------------------------------------------------------------------ 27140# The following was added for ncurses6 development: 27141#------------------------------------------------------------------------------ 27142# 271430 string \036\002 27144# imitate the legacy compiled-format, to get the entry-name printed 27145>16 ubyte >32 27146# namelist, if more than 1 separated by "|" like "st|stterm| simpleterm 0. 4.1" 27147>>12 regex \^[a-zA-Z0-9][a-zA-Z0-9.][^|]* Compiled 32-bit terminfo entry "%-s" 27148!:mime application/x-terminfo2 27149# 27150# While the compiled terminfo uses little-endian format irregardless of 27151# platform, SystemV screen dumps do not. They came later, and that detail was 27152# overlooked. 27153# 27154# AIX and HPUX use the SVr4 big-endian format 27155# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness) 271560 beshort 0433 SVr2 curses screen image, big-endian 271570 beshort 0434 SVr3 curses screen image, big-endian 271580 beshort 0435 SVr4 curses screen image, big-endian 27159# 271600 leshort 0433 SVr2 curses screen image, little-endian 271610 leshort 0434 SVr3 curses screen image, little-endian 271620 leshort 0435 SVr4 curses screen image, little-endian 27163# 27164# Rather than SVr4, Solaris "xcurses" writes this header: 271650 regex \^MAX=[0-9]+,[0-9]+$ 27166>1 regex \^BEG=[0-9]+,[0-9]+$ 27167>2 regex \^SCROLL=[0-9]+,[0-9]+$ 27168>3 regex \^VMIN=[0-9]+$ 27169>4 regex \^VTIME=[0-9]+$ 27170>5 regex \^FLAGS=0x[[:xdigit:]]+$ 27171>6 regex \^FG=[0-9],[0-9]+$ 27172>7 regex \^BG=[0-9]+,[0-9]+, Solaris xcurses screen image 27173# 27174# ncurses5 (and before) did not use a magic number, making screen dumps "data". 27175# ncurses6 (2015) uses this format, ignoring byte-order 271760 string \210\210\210\210ncurses ncurses6 screen image 27177# 27178# PDCurses added this in 2005 271790 string PDC\001 PDCurses screen image 27180 27181#------------------------------------------------------------------------------ 27182# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $ 27183# tex: file(1) magic for TeX files 27184# 27185# XXX - needs byte-endian stuff (big-endian and little-endian DVI?) 27186# 27187# From <conklin@talisman.kaleida.com> 27188 27189# Although we may know the offset of certain text fields in TeX DVI 27190# and font files, we can't use them reliably because they are not 27191# zero terminated. [but we do anyway, christos] 271920 string \367\002 TeX DVI file 27193!:mime application/x-dvi 27194>16 string >\0 (%s) 271950 string \367\203 TeX generic font data 271960 string \367\131 TeX packed font data 27197>3 string >\0 (%s) 271980 string \367\312 TeX virtual font data 271990 search/1 This\ is\ TeX, TeX transcript text 272000 search/1 This\ is\ METAFONT, METAFONT transcript text 27201 27202# There is no way to detect TeX Font Metric (*.tfm) files without 27203# breaking them apart and reading the data. The following patterns 27204# match most *.tfm files generated by METAFONT or afm2tfm. 272052 string \000\021 TeX font metric data 27206!:mime application/x-tex-tfm 27207>33 string >\0 (%s) 272082 string \000\022 TeX font metric data 27209!:mime application/x-tex-tfm 27210>33 string >\0 (%s) 27211 27212# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 272130 search/1 \\input\ texinfo Texinfo source text 27214!:mime text/x-texinfo 272150 search/1 This\ is\ Info\ file GNU Info text 27216!:mime text/x-info 27217 27218# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) 272190 search/4096 \\input TeX document text 27220!:mime text/x-tex 27221!:strength + 15 272220 search/4096 \\begin LaTeX document text 27223!:mime text/x-tex 27224!:strength + 15 272250 search/4096 \\section LaTeX document text 27226!:mime text/x-tex 27227!:strength + 18 272280 search/4096 \\setlength LaTeX document text 27229!:mime text/x-tex 27230!:strength + 15 272310 search/4096 \\documentstyle LaTeX document text 27232!:mime text/x-tex 27233!:strength + 18 272340 search/4096 \\chapter LaTeX document text 27235!:mime text/x-tex 27236!:strength + 18 272370 search/4096 \\documentclass LaTeX 2e document text 27238!:mime text/x-tex 27239!:strength + 15 272400 search/4096 \\relax LaTeX auxiliary file 27241!:mime text/x-tex 27242!:strength + 15 272430 search/4096 \\contentsline LaTeX table of contents 27244!:mime text/x-tex 27245!:strength + 15 272460 search/4096 %\ -*-latex-*- LaTeX document text 27247!:mime text/x-tex 27248 27249# Tex document, from Hendrik Scholz <hendrik@scholz.net> 272500 search/1 \\ifx TeX document text 27251 27252# Index and glossary files 272530 search/4096 \\indexentry LaTeX raw index file 272540 search/4096 \\begin{theindex} LaTeX sorted index 272550 search/4096 \\glossaryentry LaTeX raw glossary 272560 search/4096 \\begin{theglossary} LaTeX sorted glossary 272570 search/4096 This\ is\ makeindex Makeindex log file 27258 27259# End of TeX 27260 27261#------------------------------------------------------------------------------ 27262# file(1) magic for BibTex text files 27263# From Hendrik Scholz <hendrik@scholz.net> 27264 272650 search/1/c @article{ BibTeX text file 272660 search/1/c @book{ BibTeX text file 272670 search/1/c @inbook{ BibTeX text file 272680 search/1/c @incollection{ BibTeX text file 272690 search/1/c @inproceedings{ BibTeX text file 272700 search/1/c @manual{ BibTeX text file 272710 search/1/c @misc{ BibTeX text file 272720 search/1/c @preamble{ BibTeX text file 272730 search/1/c @phdthesis{ BibTeX text file 272740 search/1/c @techreport{ BibTeX text file 272750 search/1/c @unpublished{ BibTeX text file 27276 2727773 search/1 %%%\ \ BibTeX-file{ BibTex text file (with full header) 27278 2727973 search/1 %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header) 27280 272810 search/1 %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file 27282 272830 search/1 %\ BibTeX\ ` BibTeX custom bibliography style text file 27284 272850 search/1 @c\ @mapfile{ TeX font aliases text file 27286 272870 string #LyX LyX document text 27288 27289# ConTeXt documents 27290# https://wiki.contextgarden.net/ 272910 search/4096 \\setupcolors[ ConTeXt document text 27292!:strength + 15 272930 search/4096 \\definecolor[ ConTeXt document text 27294!:strength + 15 272950 search/4096 \\setupinteraction[ ConTeXt document text 27296!:strength + 15 272970 search/4096 \\useURL[ ConTeXt document text 27298!:strength + 15 272990 search/4096 \\setuppapersize[ ConTeXt document text 27300!:strength + 15 273010 search/4096 \\setuplayout[ ConTeXt document text 27302!:strength + 15 273030 search/4096 \\setupfooter[ ConTeXt document text 27304!:strength + 15 273050 search/4096 \\setupfootertexts[ ConTeXt document text 27306!:strength + 15 273070 search/4096 \\setuppagenumbering[ ConTeXt document text 27308!:strength + 15 273090 search/4096 \\setupbodyfont[ ConTeXt document text 27310!:strength + 15 273110 search/4096 \\setuphead[ ConTeXt document text 27312!:strength + 15 273130 search/4096 \\setupitemize[ ConTeXt document text 27314!:strength + 15 273150 search/4096 \\setupwhitespace[ ConTeXt document text 27316!:strength + 15 273170 search/4096 \\setupindenting[ ConTeXt document text 27318!:strength + 15 27319 27320#------------------------------------------------------------------------------ 27321# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $ 27322# file(1) magic for tgif(1) files 27323# From Hendrik Scholz <hendrik@scholz.net> 273240 string %TGIF\ Tgif file version 27325>6 string x %s 27326 27327#------------------------------------------------------------------------------ 27328# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $ 27329# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators. 27330# 27331# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). 27332# 27333# Update: Romain Lievin (roms@lpg.ticalc.org). 27334# 27335# NOTE: This list is not complete. 27336# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the 27337# program/group magic numbers in here because I cannot find any. 273380 string **TI80** TI-80 Graphing Calculator File. 273390 string **TI81** TI-81 Graphing Calculator File. 27340# 27341# Magic Numbers for the TI-73 27342# 273430 string **TI73** TI-73 Graphing Calculator 27344>0x00003B byte 0x00 (real number) 27345>0x00003B byte 0x01 (list) 27346>0x00003B byte 0x02 (matrix) 27347>0x00003B byte 0x03 (equation) 27348>0x00003B byte 0x04 (string) 27349>0x00003B byte 0x05 (program) 27350>0x00003B byte 0x06 (assembly program) 27351>0x00003B byte 0x07 (picture) 27352>0x00003B byte 0x08 (gdb) 27353>0x00003B byte 0x0C (complex number) 27354>0x00003B byte 0x0F (window settings) 27355>0x00003B byte 0x10 (zoom) 27356>0x00003B byte 0x11 (table setup) 27357>0x00003B byte 0x13 (backup) 27358 27359# Magic Numbers for the TI-82 27360# 273610 string **TI82** TI-82 Graphing Calculator 27362>0x00003B byte 0x00 (real) 27363>0x00003B byte 0x01 (list) 27364>0x00003B byte 0x02 (matrix) 27365>0x00003B byte 0x03 (Y-variable) 27366>0x00003B byte 0x05 (program) 27367>0x00003B byte 0x06 (protected prgm) 27368>0x00003B byte 0x07 (picture) 27369>0x00003B byte 0x08 (gdb) 27370>0x00003B byte 0x0B (window settings) 27371>0x00003B byte 0x0C (window settings) 27372>0x00003B byte 0x0D (table setup) 27373>0x00003B byte 0x0E (screenshot) 27374>0x00003B byte 0x0F (backup) 27375# 27376# Magic Numbers for the TI-83 27377# 273780 string **TI83** TI-83 Graphing Calculator 27379>0x00003B byte 0x00 (real) 27380>0x00003B byte 0x01 (list) 27381>0x00003B byte 0x02 (matrix) 27382>0x00003B byte 0x03 (Y-variable) 27383>0x00003B byte 0x04 (string) 27384>0x00003B byte 0x05 (program) 27385>0x00003B byte 0x06 (protected prgm) 27386>0x00003B byte 0x07 (picture) 27387>0x00003B byte 0x08 (gdb) 27388>0x00003B byte 0x0B (window settings) 27389>0x00003B byte 0x0C (window settings) 27390>0x00003B byte 0x0D (table setup) 27391>0x00003B byte 0x0E (screenshot) 27392>0x00003B byte 0x13 (backup) 27393# 27394# Magic Numbers for the TI-83+ 27395# 273960 string **TI83F* TI-83+ Graphing Calculator 27397>0x00003B byte 0x00 (real number) 27398>0x00003B byte 0x01 (list) 27399>0x00003B byte 0x02 (matrix) 27400>0x00003B byte 0x03 (equation) 27401>0x00003B byte 0x04 (string) 27402>0x00003B byte 0x05 (program) 27403>0x00003B byte 0x06 (assembly program) 27404>0x00003B byte 0x07 (picture) 27405>0x00003B byte 0x08 (gdb) 27406>0x00003B byte 0x0C (complex number) 27407>0x00003B byte 0x0F (window settings) 27408>0x00003B byte 0x10 (zoom) 27409>0x00003B byte 0x11 (table setup) 27410>0x00003B byte 0x13 (backup) 27411>0x00003B byte 0x15 (application variable) 27412>0x00003B byte 0x17 (group of variable) 27413 27414# 27415# Magic Numbers for the TI-85 27416# 274170 string **TI85** TI-85 Graphing Calculator 27418>0x00003B byte 0x00 (real number) 27419>0x00003B byte 0x01 (complex number) 27420>0x00003B byte 0x02 (real vector) 27421>0x00003B byte 0x03 (complex vector) 27422>0x00003B byte 0x04 (real list) 27423>0x00003B byte 0x05 (complex list) 27424>0x00003B byte 0x06 (real matrix) 27425>0x00003B byte 0x07 (complex matrix) 27426>0x00003B byte 0x08 (real constant) 27427>0x00003B byte 0x09 (complex constant) 27428>0x00003B byte 0x0A (equation) 27429>0x00003B byte 0x0C (string) 27430>0x00003B byte 0x0D (function GDB) 27431>0x00003B byte 0x0E (polar GDB) 27432>0x00003B byte 0x0F (parametric GDB) 27433>0x00003B byte 0x10 (diffeq GDB) 27434>0x00003B byte 0x11 (picture) 27435>0x00003B byte 0x12 (program) 27436>0x00003B byte 0x13 (range) 27437>0x00003B byte 0x17 (window settings) 27438>0x00003B byte 0x18 (window settings) 27439>0x00003B byte 0x19 (window settings) 27440>0x00003B byte 0x1A (window settings) 27441>0x00003B byte 0x1B (zoom) 27442>0x00003B byte 0x1D (backup) 27443>0x00003B byte 0x1E (unknown) 27444>0x00003B byte 0x2A (equation) 27445>0x000032 string ZS4 - ZShell Version 4 File. 27446>0x000032 string ZS3 - ZShell Version 3 File. 27447# 27448# Magic Numbers for the TI-86 27449# 274500 string **TI86** TI-86 Graphing Calculator 27451>0x00003B byte 0x00 (real number) 27452>0x00003B byte 0x01 (complex number) 27453>0x00003B byte 0x02 (real vector) 27454>0x00003B byte 0x03 (complex vector) 27455>0x00003B byte 0x04 (real list) 27456>0x00003B byte 0x05 (complex list) 27457>0x00003B byte 0x06 (real matrix) 27458>0x00003B byte 0x07 (complex matrix) 27459>0x00003B byte 0x08 (real constant) 27460>0x00003B byte 0x09 (complex constant) 27461>0x00003B byte 0x0A (equation) 27462>0x00003B byte 0x0C (string) 27463>0x00003B byte 0x0D (function GDB) 27464>0x00003B byte 0x0E (polar GDB) 27465>0x00003B byte 0x0F (parametric GDB) 27466>0x00003B byte 0x10 (diffeq GDB) 27467>0x00003B byte 0x11 (picture) 27468>0x00003B byte 0x12 (program) 27469>0x00003B byte 0x13 (range) 27470>0x00003B byte 0x17 (window settings) 27471>0x00003B byte 0x18 (window settings) 27472>0x00003B byte 0x19 (window settings) 27473>0x00003B byte 0x1A (window settings) 27474>0x00003B byte 0x1B (zoom) 27475>0x00003B byte 0x1D (backup) 27476>0x00003B byte 0x1E (unknown) 27477>0x00003B byte 0x2A (equation) 27478# 27479# Magic Numbers for the TI-89 27480# 274810 string **TI89** TI-89 Graphing Calculator 27482>0x000048 byte 0x00 (expression) 27483>0x000048 byte 0x04 (list) 27484>0x000048 byte 0x06 (matrix) 27485>0x000048 byte 0x0A (data) 27486>0x000048 byte 0x0B (text) 27487>0x000048 byte 0x0C (string) 27488>0x000048 byte 0x0D (graphic data base) 27489>0x000048 byte 0x0E (figure) 27490>0x000048 byte 0x10 (picture) 27491>0x000048 byte 0x12 (program) 27492>0x000048 byte 0x13 (function) 27493>0x000048 byte 0x14 (macro) 27494>0x000048 byte 0x1C (zipped) 27495>0x000048 byte 0x21 (assembler) 27496# 27497# Magic Numbers for the TI-92 27498# 274990 string **TI92** TI-92 Graphing Calculator 27500>0x000048 byte 0x00 (expression) 27501>0x000048 byte 0x04 (list) 27502>0x000048 byte 0x06 (matrix) 27503>0x000048 byte 0x0A (data) 27504>0x000048 byte 0x0B (text) 27505>0x000048 byte 0x0C (string) 27506>0x000048 byte 0x0D (graphic data base) 27507>0x000048 byte 0x0E (figure) 27508>0x000048 byte 0x10 (picture) 27509>0x000048 byte 0x12 (program) 27510>0x000048 byte 0x13 (function) 27511>0x000048 byte 0x14 (macro) 27512>0x000048 byte 0x1D (backup) 27513# 27514# Magic Numbers for the TI-92+/V200 27515# 275160 string **TI92P* TI-92+/V200 Graphing Calculator 27517>0x000048 byte 0x00 (expression) 27518>0x000048 byte 0x04 (list) 27519>0x000048 byte 0x06 (matrix) 27520>0x000048 byte 0x0A (data) 27521>0x000048 byte 0x0B (text) 27522>0x000048 byte 0x0C (string) 27523>0x000048 byte 0x0D (graphic data base) 27524>0x000048 byte 0x0E (figure) 27525>0x000048 byte 0x10 (picture) 27526>0x000048 byte 0x12 (program) 27527>0x000048 byte 0x13 (function) 27528>0x000048 byte 0x14 (macro) 27529>0x000048 byte 0x1C (zipped) 27530>0x000048 byte 0x21 (assembler) 27531# 27532# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades 27533# 275340x0000016 string Advanced TI-XX Graphing Calculator (FLASH) 275350 string **TIFL** TI-XX Graphing Calculator (FLASH) 27536>8 byte >0 - Revision %d 27537>>9 byte x \b.%d, 27538>12 byte >0 Revision date %02x 27539>>13 byte x \b/%02x 27540>>14 beshort x \b/%04x, 27541>17 string >/0 name: '%s', 27542>48 byte 0x74 device: TI-73, 27543>48 byte 0x73 device: TI-83+, 27544>48 byte 0x98 device: TI-89, 27545>48 byte 0x88 device: TI-92+, 27546>49 byte 0x23 type: OS upgrade, 27547>49 byte 0x24 type: application, 27548>49 byte 0x25 type: certificate, 27549>49 byte 0x3e type: license, 27550>74 lelong >0 size: %d bytes 27551 27552# VTi & TiEmu skins (TI Graphing Calculators). 27553# From: Romain Lievin (roms@lpg.ticalc.org). 27554# Magic Numbers for the VTi skins 275550 string VTI Virtual TI skin 27556>3 string v - Version 27557>>4 byte >0 \b %c 27558>>6 byte x \b.%c 27559# Magic Numbers for the TiEmu skins 275600 string TiEmu TiEmu skin 27561>6 string v - Version 27562>>7 byte >0 \b %c 27563>>9 byte x \b.%c 27564>>10 byte x \b%c 27565 27566#------------------------------------------------------------------------------ 27567# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $ 27568# timezone: file(1) magic for timezone data 27569# 27570# from Daniel Quinlan (quinlan@yggdrasil.com) 27571# this should work on Linux, SunOS, and maybe others 27572# Added new official magic number for recent versions of the Olson code 275730 string TZif timezone data 27574>4 byte 0 \b, old version 27575>4 byte >0 \b, version %c 27576>20 belong 0 \b, no gmt time flags 27577>20 belong 1 \b, 1 gmt time flag 27578>20 belong >1 \b, %d gmt time flags 27579>24 belong 0 \b, no std time flags 27580>20 belong 1 \b, 1 std time flag 27581>24 belong >1 \b, %d std time flags 27582>28 belong 0 \b, no leap seconds 27583>28 belong 1 \b, 1 leap second 27584>28 belong >1 \b, %d leap seconds 27585>32 belong 0 \b, no transition times 27586>32 belong 1 \b, 1 transition time 27587>32 belong >1 \b, %d transition times 27588>36 belong 0 \b, no abbreviation chars 27589>36 belong 1 \b, 1 abbreviation char 27590>36 belong >1 \b, %d abbreviation chars 275910 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data 275920 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data 275930 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data 275940 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data 275950 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data 275960 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data 27597 27598#------------------------------------------------------------------------------ 27599# $File: tplink,v 1.4 2019/04/19 00:42:27 christos Exp $ 27600# tplink: File magic for openwrt firmware files 27601 27602# URL: https://wiki.openwrt.org/doc/techref/header 27603# Reference: https://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c 27604# From: Joerg Jenderek 27605# check for valid header version 1 or 2 276060 ulelong <3 27607>0 ulelong !0 27608# test for header padding with nulls 27609>>0x100 long 0 27610# skip Norton Commander Cleanup Utility NCCLEAN.INI by looking for valid vendor 27611>>>4 ubelong >0x1F000000 27612>>>>0 use firmware-tplink 27613 276140 name firmware-tplink 27615>0 ubyte x firmware 27616!:mime application/x-tplink-bin 27617!:ext bin 27618# hardware id like 10430001 07410001 09410004 09410006 27619>0x40 ubeshort x %x 27620>0x42 ubeshort x v%x 27621# hardware revision like 1 27622>0x44 ubelong !1 (revision %u) 27623# vendor_name[24] like OpenWrt or TP-LINK Technologies 27624>4 string x %.24s 27625# fw_version[36] like r49389 or ver. 1.0 27626>0x1c string x %.36s 27627# header version 1 or 2 27628>0 ubyte !1 V%X 27629# ver_hi.ver_mid.ver_lo 27630>0x98 long !0 \b, version 27631>>0x98 ubeshort x %u 27632>>0x9A ubeshort x \b.%u 27633>>0x9C ubeshort x \b.%u 27634# region code 0~universal 1~US 27635>0x48 ubelong x 27636#>>0x48 ubelong 0 (universal) 27637>>0x48 ubelong 1 (US) 27638>>0x48 ubelong >1 (region %u) 27639# total length of the firmware. not always true 27640>0x7C ubelong x \b, %u bytes or less 27641# unknown 1 27642>0x48 ubelong !0 \b, UNKNOWN1 0x%x 27643# md5sum1[16] 27644#>0x4c ubequad x \b, MD5 %llx 27645#>>0x54 ubequad x \b%llx 27646# unknown 2 27647>0x5c ubelong !0 \b, UNKNOWN2 0x%x 27648# md5sum2[16] 27649#>0x60 ubequad !0 \b, 2nd MD5 %llx 27650#>>0x68 ubequad x \b%llx 27651# unknown 3 27652>0x70 ubelong !0 \b, UNKNOWN3 0x%x 27653# kernel load address 27654#>0x74 ubelong x \b, 0x%x load 27655# kernel entry point 27656#>0x78 ubelong x \b, 0x%x entry 27657# kernel data offset. 200h means direct after header 27658>0x80 ubelong x \b, at 0x%x 27659# kernel data length and 1 space 27660>0x84 ubelong x %u bytes 27661# look for kernel type (gzip compressed vmlinux.bin by ./compress) 27662>(0x80.L) indirect x 27663# root file system data offset 27664# WRONG in 5.35 with above indirect expression 27665>0x88 ubelong x \b, at 0x%x 27666# rootfs data length and 1 space 27667>0x8C ubelong x %u bytes 27668# in 5.32 only true for offset ~< FILE_BYTES_MAX=9 MB defined in ../../src/file.h 27669>(0x88.L) indirect x 27670# 'qshs' for wr940nv1_en_3_13_7_up(111228).bin 27671#>(0x88.L) string x \b, file system '%.4s' 27672#>(0x88.L) ubequad x \b, file system 0x%llx 27673# bootloader data offset 27674>0x90 ubelong !0 \b, at 0x%x 27675# bootloader data length only resonable if bootloader offset not null 27676>>0x94 ubelong !0 %u bytes 27677# pad[354] should be 354 null bytes. 27678#>0x9E ubequad !0 \b, padding 0x%llx 27679# But at 0x120 18 non null bytes in examples like 27680# wr940nv4_eu_3_16_9_up_boot(160620).bin 27681# wr940nv6_us_3_18_1_up_boot(171030).bin 27682#>0x120 ubequad !0 \b, other padding 0x%llx 27683 27684#------------------------------------------------------------------------------ 27685# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $ 27686# troff: file(1) magic for *roff 27687# 27688# updated by Daniel Quinlan (quinlan@yggdrasil.com) 27689 27690# troff input 276910 search/1 .\\" troff or preprocessor input text 27692!:mime text/troff 276930 search/1 '\\" troff or preprocessor input text 27694!:mime text/troff 276950 search/1 '.\\" troff or preprocessor input text 27696!:mime text/troff 276970 search/1 \\" troff or preprocessor input text 27698!:mime text/troff 276990 search/1 ''' troff or preprocessor input text 27700!:mime text/troff 277010 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9][\ \t] troff or preprocessor input text 27702!:mime text/troff 277030 regex/20l \^\\.[A-Za-z0-9][A-Za-z0-9]$ troff or preprocessor input text 27704!:mime text/troff 27705 27706# ditroff intermediate output text 277070 search/1 x\ T ditroff output text 27708>4 search/1 cat for the C/A/T phototypesetter 27709>4 search/1 ps for PostScript 27710>4 search/1 dvi for DVI 27711>4 search/1 ascii for ASCII 27712>4 search/1 lj4 for LaserJet 4 27713>4 search/1 latin1 for ISO 8859-1 (Latin 1) 27714>4 search/1 X75 for xditview at 75dpi 27715>>7 search/1 -12 (12pt) 27716>4 search/1 X100 for xditview at 100dpi 27717>>8 search/1 -12 (12pt) 27718 27719# output data formats 277200 string \100\357 very old (C/A/T) troff output data 27721 27722#------------------------------------------------------------------------------ 27723# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $ 27724# tuxedo: file(1) magic for BEA TUXEDO data files 27725# 27726# from Ian Springer <ispringer@hotmail.com> 27727# 277280 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data 27729 27730#------------------------------------------------------------------------------ 27731# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $ 27732# typeset: file(1) magic for other typesetting 27733# 277340 string Interpress/Xerox Xerox InterPress data 27735>16 string / (version 27736>>17 string >\0 %s) 27737 27738#------------------------------------------------------------------------------ 27739# $File: unicode,v 1.7 2019/02/19 20:34:42 christos Exp $ 27740# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> 27741# These types are recognised in file_ascmagic so these encodings can be 27742# treated by text patterns. Missing types are already dealt with internally. 27743# 277440 string +/v8 Unicode text, UTF-7 277450 string +/v9 Unicode text, UTF-7 277460 string +/v+ Unicode text, UTF-7 277470 string +/v/ Unicode text, UTF-7 277480 string \335\163\146\163 Unicode text, UTF-8-EBCDIC 277490 string \000\000\376\377 Unicode text, UTF-32, big-endian 277500 string \377\376\000\000 Unicode text, UTF-32, little-endian 277510 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) 27752 27753#------------------------------------------------------------------------------ 27754# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $ 27755# unknown: file(1) magic for unknown machines 27756# 27757# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11 27758# (executable, pure, and split I&D, respectively), but the PDP-11 version 27759# doesn't have the "version %ld", which may be a bogus COFFism (I don't 27760# think there was ever COFF for the PDP-11). 27761# 27762# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a 27763# long, as it would be on a VAX. In any case, that could collide with 27764# VAX demand-paged files, as the magic number is little-endian on those 27765# binaries, so the first 16 bits of the file would contain 0x10B. 27766# 27767# Therefore, those entries are commented out. 27768# 27769# 0x10C is 0414 and 0x10E is 0416; those *are* unknown. 27770# 27771#0 short 0x107 unknown machine executable 27772#>8 short >0 not stripped 27773#>15 byte >0 - version %ld 27774#0 short 0x108 unknown pure executable 27775#>8 short >0 not stripped 27776#>15 byte >0 - version %ld 27777#0 short 0x109 PDP-11 separate I&D 27778#>8 short >0 not stripped 27779#>15 byte >0 - version %ld 27780#0 short 0x10b unknown pure executable 27781#>8 short >0 not stripped 27782#>15 byte >0 - version %ld 277830 long 0x10c unknown demand paged pure executable 27784>16 long >0 not stripped 277850 long 0x10e unknown readable demand paged pure executable 27786 27787#------------------------------------------------------------------------------ 27788# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $ 27789# file(1) magic for uterus files 27790# http://freecode.com/projects/uterus 27791# 277920 string UTE+ uterus file 27793>4 string v \b, version 27794>5 byte x %c 27795>6 string . \b. 27796>7 byte x \b%c 27797>8 string \<\> \b, big-endian 27798>>16 belong >0 \b, slut size %u 27799>8 string \>\< \b, litte-endian 27800>>16 lelong >0 \b, slut size %u 27801>10 byte &8 \b, compressed 27802 27803#------------------------------------------------------------------------------ 27804# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $ 27805# uuencode: file(1) magic for ASCII-encoded files 27806# 27807 27808# GRR: the first line of xxencoded files is identical to that in uuencoded 27809# files, but the first character in most subsequent lines is 'h' instead of 27810# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's 27811# punctuation and survives BITNET gateways better.) If regular expressions 27812# were supported, this entry could possibly be split into two with 27813# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs). 278140 search/1 begin\ uuencoded or xxencoded text 27815 27816# btoa(1) is an alternative to uuencode that requires less space. 278170 search/1 xbtoa\ Begin btoa'd text 27818 27819# ship(1) is another, much cooler alternative to uuencode. 27820# Greg Roelofs, newt@uchicago.edu 278210 search/1 $\012ship ship'd binary text 27822 27823# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?) 27824# Greg Roelofs, newt@uchicago.edu 278250 search/1 Decode\ the\ following\ with\ bdeco bencoded News text 27826 27827# BinHex is the Macintosh ASCII-encoded file format (see also "apple") 27828# Daniel Quinlan, quinlan@yggdrasil.com 2782911 search/1 must\ be\ converted\ with\ BinHex BinHex binary text 27830>41 search/1 x \b, version %.3s 27831 27832# GRR: handle BASE64 27833 27834#------------------------------------------------------------------------------ 27835# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $ 27836# vacuum cleaner magic by Thomas M. Ott (ThMO) 27837# 27838# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx 27839# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk 27840# -> yyyymmdd: year, month, day of cleaning 27841# -> hhmmss: hour, minute, second of cleaning 27842# -> xxxxxx: 6 digits 27843# -> cc: cleaning runs counter 27844# size: 136044 bytes 27845# 27846# struct maphdr { 27847# int32_t map_cnt; /* 0: single map */ 27848# int32_t min_ceil; /* 4: 100 mm == 10 cm == min. ceil */ 27849# int32_t max_ceil; /* 8: 10000 mm == 100 m == max. ceil */ 27850# int32_t max_climb; /* 12: 50 mm = 5 cm == max. height to climb */ 27851# int32_t unknown; /* 16: 50000 ??? */ 27852# int32_t cell_bytes; /* 20: # of bytes for cells per block */ 27853# int32_t block_max; /* 24: 1000 == max. # of blocks */ 27854# int32_t route_max; /* 28: 1000 == max. # of routes */ 27855# int32_t used_blocks; /* 32: 5/45/33/... == # of block entries used! */ 27856# int32_t cell_dim; /* 36: 10 == cell dimension */ 27857# int32_t clock_tick; /* 40: 100 == clock ticks */ 27858# #if 0 27859# struct { /* 44: 1000 blocks for 10x10 cells */ 27860# int32_t yoffset; 27861# int32_t xoffset; 27862# int32_t posxy; 27863# int32_t timecode; 27864# } blocks[ 1000]; 27865# char cells[ 1000* 100]; /* 16044: 1000 10x10 cells */ 27866# int16_t routes[ 1000* 10]; /* 116044: 1000 10-routes */ 27867# #endif 27868# }; 27869 278700 lelong =1 27871>4 lelong =100 27872>>8 lelong =10000 27873>>>12 lelong =50 27874>>>>16 lelong =50000 27875>>>>>20 lelong =100 27876>>>>>>24 lelong =1000 27877>>>>>>>28 lelong =1000 27878>>>>>>>>36 lelong =10 27879>>>>>>>>>40 lelong =100 27880>>>>>>>>>>32 lelong x LG robot VR6[234]xx %dm^2 navigation 27881>>>>>>>>>>136040 lelong =-1 reuse map data 27882>>>>>>>>>>136040 lelong =0 map data 27883>>>>>>>>>>136040 lelong >0 spurious map data 27884>>>>>>>>>>136040 lelong <-1 spurious map data 27885 27886 27887 27888#------------------------------------------------------------------------------ 27889# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $ 27890# varied.out: file(1) magic for various USG systems 27891# 27892# Herewith many of the object file formats used by USG systems. 27893# Most have been moved to files for a particular processor, 27894# and deleted if they duplicate other entries. 27895# 278960 short 0610 Perkin-Elmer executable 27897# AMD 29K 278980 beshort 0572 amd 29k coff noprebar executable 278990 beshort 01572 amd 29k coff prebar executable 279000 beshort 0160007 amd 29k coff archive 27901# Cray 279026 beshort 0407 unicos (cray) executable 27903# Ultrix 4.3 27904596 string \130\337\377\377 Ultrix core file 27905>600 string >\0 from '%s' 27906# BeOS and MAcOS PEF executables 27907# From: hplus@zilker.net (Jon Watte) 279080 string Joy!peffpwpc header for PowerPC PEF executable 27909# 27910# ava assembler/linker Uros Platise <uros.platise@ijs.si> 279110 string avaobj AVR assembler object code 27912>7 string >\0 version '%s' 27913# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr> 279140 string gmon GNU prof performance data 27915>4 long x - version %d 27916# From: Dave Pearson <davep@davep.org> 27917# Harbour <URL:http://harbour-project.org/> HRB files. 279180 string \xc0HRB Harbour HRB file 27919>4 leshort x version %d 27920# Harbour HBV files 279210 string \xc0HBV Harbour variable dump file 27922>4 leshort x version %d 27923 27924# From: Alex Beregszaszi <alex@fsn.hu> 27925# 0 string exec BugOS executable 27926# 0 string pack BugOS archive 27927 27928# From: Jason Spence <jspence@lightconsulting.com> 27929# Generated by the "examples" in STM's ST40 devkit, and derived code. 279300 lelong 0x13a9f17e ST40 component image format 27931>4 string >\0 \b, name '%s' 27932 27933#------------------------------------------------------------------------------ 27934# $File: varied.script,v 1.12 2019/04/19 00:42:27 christos Exp $ 27935# varied.script: file(1) magic for various interpreter scripts 27936 279370 string/t #!\ / a 27938>3 string >\0 %s script text executable 27939 279400 string/b #!\ / a 27941>3 string >\0 %s script executable (binary data) 27942 279430 string/t #!\t/ a 27944>3 string >\0 %s script text executable 27945 279460 string/b #!\t/ a 27947>3 string >\0 %s script executable (binary data) 27948 279490 string/t #!/ a 27950>2 string >\0 %s script text executable 27951 279520 string/b #!/ a 27953>2 string >\0 %s script executable (binary data) 27954 279550 string/t #!\ script text executable 27956>3 string >\0 for %s 27957 279580 string/b #!\ script executable 27959>3 string >\0 for %s (binary data) 27960 27961# using env 279620 string/t #!/usr/bin/env a 27963>15 string/t >\0 %s script text executable 27964!:strength / 10 27965 279660 string/b #!/usr/bin/env a 27967>15 string/b >\0 %s script executable (binary data) 27968!:strength / 10 27969 279700 string/t #!\ /usr/bin/env a 27971>16 string/t >\0 %s script text executable 27972!:strength / 10 27973 279740 string/b #!\ /usr/bin/env a 27975>16 string/b >\0 %s script executable (binary data) 27976!:strength / 10 27977 27978# From: arno <arenevier@fdn.fr> 27979# mozilla xpconnect typelib 27980# see https://www.mozilla.org/scriptable/typelib_file.html 279810 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib 27982>0x10 byte x version %d 27983>>0x11 byte x \b.%d 27984 27985#------------------------------------------------------------------------------ 27986# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $ 27987# vax: file(1) magic for VAX executable/object and APL workspace 27988# 279890 lelong 0101557 VAX single precision APL workspace 279900 lelong 0101556 VAX double precision APL workspace 27991 27992# 27993# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian 27994# executables, and are handled in aout) 27995# 279960 lelong 0420 a.out VAX demand paged (first page unmapped) pure executable 27997>16 lelong >0 not stripped 27998 27999# 28000# VAX COFF 28001# 28002# The `versions' were commented out, but have been un-commented out. 28003# (Was the problem just one of endianness?) 28004# 280050 leshort 0570 VAX COFF executable 28006>12 lelong >0 not stripped 28007>22 leshort >0 - version %d 280080 leshort 0575 VAX COFF pure executable 28009>12 lelong >0 not stripped 28010>22 leshort >0 - version %d 28011 28012#------------------------------------------------------------------------------ 28013# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $ 28014# vicar: file(1) magic for VICAR files. 28015# 28016# From: Ossama Othman <othman@astrosun.tn.cornell.edu 28017# VICAR is JPL's in-house spacecraft image processing program 28018# VICAR image 280190 string LBLSIZE= VICAR image data 28020>32 string BYTE \b, 8 bits = VAX byte 28021>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 28022>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 28023>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 28024>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 28025>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 28026# VICAR label file 2802743 string SFDU_LABEL VICAR label file 28028 28029#------------------------------------------------------------------------------ 28030# $File: virtual,v 1.10 2019/04/19 00:42:27 christos Exp $ 28031# From: James Nobis <quel@quelrod.net> 28032# Microsoft hard disk images for: 28033# Virtual Server 28034# Virtual PC 28035# VirtualBox 28036# URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk) 28037# Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/ 28038# Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc 280390 string conectix Microsoft Disk Image, Virtual Server or Virtual PC 28040# alternative shorter names 28041#0 string conectix Microsoft Virtual Hard Disk image 28042#0 string conectix Microsoft Virtual HD image 28043!:mime application/x-virtualbox-vhd 28044!:ext vhd 28045# Features is a bit field used to indicate specific feature support 28046#>8 ubelong !0x00000002 \b, Features 0x%x 28047# Reserved. This bit must always be set to 1. 28048#>8 ubelong &0x00000002 \b, Reserved 0x%x 28049# File Format Version for the current specification 0x00010000 28050#>12 ubelong !0x00010000 \b, Version 0x%8.8x 28051# Data Offset only found 0x200 28052#>16 ubequad !0x200 \b, Data Offset 0x%llx 28053#>16 ubequad x \b, at 0x%llx 28054# Dynamic Disk Header cookie like cxsparse 28055#>(16.Q) string x "%-.8s" 28056# This field contains a Unicode string (UTF-16) of the parent hard disk filename 28057#>(16.Q+64) ubequad x \b, parent name 0x%llx 28058# Creator Application 28059# vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd 28060>28 string x \b, Creator %-4.4s 28061# Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004 28062# holds the major/minor version of the application that created the image 28063>32 ubeshort x %x 28064>34 ubeshort x \b.%x 28065#>32 ubelong x \b, Version 0x%8.8x 28066# Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac) 28067>36 ubelong x ( 28068>>36 ubelong 0x5769326B \bW2k 28069>>36 ubelong 0x4D616320 \bMac 28070>>36 default x \b0x 28071>>>36 ubelong x \b%8.8x 28072# creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch 28073>24 bedate+946684800 x \b) %s 28074# Original Size 28075#>40 ubequad x \b, o.-Size 0x%llx 28076# Current Size is same as original size, but change when disk is expanded 28077#>48 ubequad x \b, Size 0x%llx 28078>48 ubequad x \b, %llu bytes 28079# Disk Geometry: cylinder, heads, and sectors/track for hard disk 28080#>56 ubeshort x \b, Cylinder 0x%x 28081>56 ubeshort x \b, CHS %u 28082# Heads 28083#>58 ubyte x \b, Heads 0x%x 28084>58 ubyte x \b/%u 28085# Sectors per track 28086#>59 ubyte x \b, Sectors 0x%x 28087>59 ubyte x \b/%u 28088# Disk Type: 3~Dynamic hard disk 28089>60 ubelong !0x3 \b, type 0x%x 28090# Checksum 28091#>64 ubelong x \b, cksum 0x%x 28092# universally unique identifier (UUID) to associate a parent with its differencing image 28093#>68 ubequad x \b, id 0x%16.16llx 28094#>76 ubequad x \b-%16.16llx 28095# Saved State: 1~Saved State 28096>84 ubyte !0 \b, State 0x%x 28097# Reserved 427 bytes with nils 28098#>85 ubequad !0 \b, Reserved 0x%16.16llx 28099 28100# From: Joerg Jenderek 28101# URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx 28102# Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/ 28103# MS-VHDX/[MS-VHDX].pdf 28104# Note: extends the VHD format with new capabilities, such as a 16TB maximum size 28105# TODO: find and display values like virtual size, disk size, cluster_size, etc 28106# display id in GUID format 28107# 28108# VHDX_FILE_IDENTIFIER signature 0x656C696678646876 281090 string vhdxfile 28110# VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB 28111>0x10000 string head Microsoft Disk Image eXtended 28112#>0x20000 string head \b, 2nd header 28113#!:mime application/x-virtualbox-vhdx 28114!:ext vhdx 28115# Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512" 28116>>8 lestring16 x \b, by %.256s 28117# The Checksum field is a CRC-32C hash over the entire 4 KB structure 28118#>>0x10004 ulelong x \b, CRC 0x%x 28119# SequenceNumber 28120>>0x10008 ulequad x \b, sequence 0x%llx 28121# FileWriteGuid 28122#>>0x10010 ubequad x \b, file id 0x%llx 28123#>>>0x10018 ubequad x \b-%llx 28124# DataWriteGuid 28125#>>0x10020 ubequad x \b, data id 0x%llx 28126#>>>0x10028 ubequad x \b-%llx 28127# LogGuid. If this field is zero, then the log is empty or has no valid entries 28128>>0x10030 ubequad >0 \b, log id 0x%llx 28129>>>0x10038 ubequad x \b-%llx 28130# LogVersion. If not 0 there is a log to replay 28131>>0x10040 uleshort >0 \b, LogVersion 0x%x 28132# Version. This field must be set to 1 28133>>0x10042 uleshort !1 \b, Version 0x%x 28134# LogLength must be multiples of 1 MB 28135>>0x10044 ulelong/1048576 >1 \b, LogLength %u MB 28136# LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB 28137>>0x10048 ulequad !0x100000 \b, LogOffset 0x%llx 28138# Log Entry Signature must be 0x65676F6C~loge 28139>>(0x10048.q) ulelong !0x65676F6C \b, NO Log Signature 28140>>(0x10048.q) ulelong =0x65676F6C \b; LOG 28141# Log Entry Checksum 28142#>>>(0x10048.q+4) ulelong x \b, Log CRC 0x%x 28143# Log Entry Length must be a multiple of 4 KB 28144>>>(0x10048.q+8) ulelong/1024 >4 \b, EntryLength %u KB 28145# Log Entry Tail must be a multiple of 4 KB 28146#>>>(0x10048.q+12) ulelong x \b, Tail 0x%x 28147# Log Entry SequenceNumber 28148#>>>(0x10048.q+16) ulequad x \b, # 0x%llx 28149# Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8 28150#>>>(0x10048.q+24) ulelong x \b, DescriptorCount 0x%llx 28151# Log Entry Reserved must be set to 0 28152>>>(0x10048.q+28) ulelong !0 \b, Reserved 0x%x 28153# Log Entry LogGuid 28154#>>>(0x10048.q+32) ubequad x \b, Log id 0x%llx 28155#>>>(0x10048.q+40) ubequad x \b-%llx 28156# Log Entry FlushedFileOffset should VHDX size when entry is written. 28157#>>>(0x10048.q+48) ulequad x \b, FlushedFileOffset %llu 28158# Log Entry LastFileOffset 28159#>>>(0x10048.q+56) ulequad x \b, LastFileOffset %llu 28160# filling 28161#>>>(0x10048.q+64) ulequad >0 \b, filling %llx 28162# Reserved[4016] 28163#>>0x10050 ulequad >0 \b, Reserved 0x%llx 28164# VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB 28165>0x30000 ulelong !0x69676572 \b, 1st region INVALID 28166>0x30000 ulelong =0x69676572 \b; region 28167# region Checksum. CRC-32C hash over the entire 64-KB table 28168#>>0x30004 ulelong x \b, CRC 0x%x 28169# The EntryCount specifies number of valid entries; Found 2; This must be =< 2047. 28170>>0x30008 ulelong x \b, %u entries 28171# reserved must be zero 28172#>>0x3000C ulelong !0 \b, RESERVED 0x%x 28173# Region Table Entry starts with identifier for the object. often BAT id 28174>>0x30010 use vhdx-id 28175# FileOffset 28176>>0x30020 ulequad x \b, at 0x%llx 28177# Length. Specifies the length of the object within the file 28178#>>0x30028 ulelong x \b, Length 0x%x 28179# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 28180>>0x3002C ulelong x \b, Required %u 28181# 2nd region entry often metadata id 28182>>0x30030 use vhdx-id 28183# 2nd entry FileOffset 28184>>0x30040 ulequad x \b, at 0x%llx 28185# 1 means region entry is required. if region not recognized, then REFUSE to load VHDX 28186>>0x3004C ulelong x \b, Required %u 28187# 2nd region 28188>>0x40000 ulelong !0x69676572 \b, 2nd region INVALID 28189# check in vhdx images for known id and show names instead hexadecimal 281900 name vhdx-id 28191# https://www.windowstricks.in/online-windows-guid-converter 28192# 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID 28193# 6677C22D23F600429D64115E9BFD4A08 BAT ID 28194>0 ubequad =0x6677C22D23F60042 28195>>8 ubequad =0x9D64115E9BFD4A08 \b, id BAT 28196# no BAT id 28197>>8 default x 28198>>>0 use vhdx-id-hex 28199# 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID 28200# 06A27C8B90479A4BB8FE575F050F886E Metadata region ID 28201>0 ubequad =0x06A27C8B90479A4B 28202>>8 ubequad =0xB8FE575F050F886E \b, id Metadata 28203# no Metadata id 28204>>8 default x 28205>>>0 use vhdx-id-hex 28206# 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID 28207# 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID 28208# value "virtual size" can be verified by command `qemu-img info ` 28209>0 ubequad =0x2442A52F1BCD7648 28210>>8 ubequad =0xB2115DBED83BF4B8 \b, id vsize 28211# no Virtual Disk Size ID 28212>>8 default x 28213>>>0 use vhdx-id-hex 28214# other ids 28215>0 default x 28216>>0 use vhdx-id-hex 28217# in vhdx images show id as hexadecimal 282180 name vhdx-id-hex 28219>0 ubequad x \b, ID 0x%16.16llx 28220>8 ubequad x \b-%16.16llx 28221# 28222# libvirt 28223# From: Philipp Hahn <hahn@univention.de> 282240 string LibvirtQemudSave Libvirt QEMU Suspend Image 28225>0x10 lelong x \b, version %u 28226>0x14 lelong x \b, XML length %u 28227>0x18 lelong 1 \b, running 28228>0x1c lelong 1 \b, compressed 28229 282300 string LibvirtQemudPart Libvirt QEMU partial Suspend Image 28231# From: Alex Beregszaszi <alex@fsn.hu> 282320 string/b COWD VMWare3 28233>4 byte 3 disk image 28234>>32 lelong x (%d/ 28235>>36 lelong x \b%d/ 28236>>40 lelong x \b%d) 28237>4 byte 2 undoable disk image 28238>>32 string >\0 (%s) 28239 282400 string/b VMDK VMware4 disk image 282410 string/b KDMV VMware4 disk image 28242 28243#-------------------------------------------------------------------- 28244# Qemu Emulator Images 28245# Lines written by Friedrich Schwittay (f.schwittay@yousable.de) 28246# Updated by Adam Buchbinder (adam.buchbinder@gmail.com) 28247# Made by reading sources, reading documentation, and doing trial and error 28248# on existing QCOW files 282490 string/b QFI\xFB 28250 28251# Uncomment the following line to display Magic (only used for debugging 28252# this magic number) 28253#>0 string/b x , Magic: %s 28254 28255# There are currently 2 Versions: "1" and "2". 28256# https://www.gnome.org/~markmc/qcow-image-format-version-1.html 28257>4 belong !1 QEMU QCOW2 Image 28258>4 belong 1 QEMU QCOW Image (v1) 28259 28260# Using the existence of the Backing File Offset to determine whether 28261# to read Backing File Information 28262>>12 belong >0 \b, has backing file ( 28263# Note that this isn't a null-terminated string; the length is actually 28264# (16.L). Assuming a null-terminated string happens to work usually, but it 28265# may spew junk until it reaches a \0 in some cases. 28266>>>(12.L) string >\0 \bpath %s 28267 28268# Modification time of the Backing File 28269# Really useful if you want to know if your backing 28270# file is still usable together with this image 28271>>>>20 bedate >0 \b, mtime %s) 28272>>>>20 default x \b) 28273 28274# Size is stored in bytes in a big-endian u64. 28275>>24 bequad x \b, %lld bytes 28276 28277# 1 for AES encryption, 0 for none. 28278>>36 belong 1 \b, AES-encrypted 28279 28280# https://www.gnome.org/~markmc/qcow-image-format.html 28281>4 belong 2 (v2) 28282# Using the existence of the Backing File Offset to determine whether 28283# to read Backing File Information 28284>>8 bequad >0 \b, has backing file 28285# Note that this isn't a null-terminated string; the length is actually 28286# (16.L). Assuming a null-terminated string happens to work usually, but it 28287# may spew junk until it reaches a \0 in some cases. Also, since there's no 28288# .Q modifier, we just use the bottom four bytes as an offset. Note that if 28289# the file is over 4G, and the backing file path is stored after the first 4G, 28290# the wrong filename will be printed. (This should be (8.Q), when that syntax 28291# is introduced.) 28292>>>(12.L) string >\0 (path %s) 28293>>24 bequad x \b, %lld bytes 28294>>32 belong 1 \b, AES-encrypted 28295 28296>4 belong 3 (v3) 28297# Using the existence of the Backing File Offset to determine whether 28298# to read Backing File Information 28299>>8 bequad >0 \b, has backing file 28300# Note that this isn't a null-terminated string; the length is actually 28301# (16.L). Assuming a null-terminated string happens to work usually, but it 28302# may spew junk until it reaches a \0 in some cases. Also, since there's no 28303# .Q modifier, we just use the bottom four bytes as an offset. Note that if 28304# the file is over 4G, and the backing file path is stored after the first 4G, 28305# the wrong filename will be printed. (This should be (8.Q), when that syntax 28306# is introduced.) 28307>>>(12.L) string >\0 (path %s) 28308>>24 bequad x \b, %lld bytes 28309>>32 belong 1 \b, AES-encrypted 28310 28311>4 default x (unknown version) 28312 283130 string/b QEVM QEMU suspend to disk image 28314 28315# QEMU QED Image 28316# https://wiki.qemu.org/Features/QED/Specification 283170 string/b QED\0 QEMU QED Image 28318 28319# VDI Image 28320# Sun xVM VirtualBox Disk Image 28321# From: Richard W.M. Jones <rich@annexia.org> 28322# VirtualBox Disk Image 283230x40 ulelong 0xbeda107f VirtualBox Disk Image 28324>0x44 uleshort >0 \b, major %u 28325>0x46 uleshort >0 \b, minor %u 28326>0 string >\0 (%s) 28327>368 lequad x \b, %lld bytes 28328 283290 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, 28330>32 string x type %s, 28331>48 string x subtype %s 28332 283330 lelong 0x02468ace Bochs Sparse disk image 28334 28335 28336#------------------------------------------------------------------------------ 28337# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $ 28338# Virtutech Compressed Random Access File Format 28339# 28340# From <gustav@virtutech.com> 283410 string \211\277\036\203 Virtutech CRAFF 28342>4 belong x v%d 28343>20 belong 0 uncompressed 28344>20 belong 1 bzipp2ed 28345>20 belong 2 gzipped 28346>24 belong 0 not clean 28347 28348#------------------------------------------------------------------------------ 28349# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $ 28350# visx: file(1) magic for Visx format files 28351# 283520 short 0x5555 VISX image file 28353>2 byte 0 (zero) 28354>2 byte 1 (unsigned char) 28355>2 byte 2 (short integer) 28356>2 byte 3 (float 32) 28357>2 byte 4 (float 64) 28358>2 byte 5 (signed char) 28359>2 byte 6 (bit-plane) 28360>2 byte 7 (classes) 28361>2 byte 8 (statistics) 28362>2 byte 10 (ascii text) 28363>2 byte 15 (image segments) 28364>2 byte 100 (image set) 28365>2 byte 101 (unsigned char vector) 28366>2 byte 102 (short integer vector) 28367>2 byte 103 (float 32 vector) 28368>2 byte 104 (float 64 vector) 28369>2 byte 105 (signed char vector) 28370>2 byte 106 (bit plane vector) 28371>2 byte 121 (feature vector) 28372>2 byte 122 (feature vector library) 28373>2 byte 124 (chain code) 28374>2 byte 126 (bit vector) 28375>2 byte 130 (graph) 28376>2 byte 131 (adjacency graph) 28377>2 byte 132 (adjacency graph library) 28378>2 string .VISIX (ascii text) 28379 28380#------------------------------------------------------------------------------ 28381# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $ 28382# vms: file(1) magic for VMS executables (experimental) 28383# 28384# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu) 28385 28386# GRR 950122: I'm just guessing on these, based on inspection of the headers 28387# of three executables each for Alpha and VAX architectures. The VAX files 28388# all had headers similar to this: 28389# 28390# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205 28391# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................ 28392# 283930 string \xb0\0\x30\0 VMS VAX executable 28394>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 28395# 28396# The AXP files all looked like this, except that the byte at offset 0x22 28397# was 06 in some of them and 07 in others: 28398# 28399# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................ 28400# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h............... 28401# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 28402# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 28403# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................ 28404# 28405# GRR this test is still too general as it catches example adressen.dbt 284060 belong 0x03000000 28407>8 ubelong 0xec020000 VMS Alpha executable 28408>>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption 28409 28410#------------------------------------------------------------------------------ 28411# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $ 28412# VMware specific files (deducted from version 1.1 and log file entries) 28413# Anthon van der Neut (anthon@mnt.org) 284140 belong 0x4d52564e VMware nvram 28415 28416#------------------------------------------------------------------------------ 28417# $File: vorbis,v 1.24 2018/03/14 04:38:44 christos Exp $ 28418# vorbis: file(1) magic for Ogg/Vorbis files 28419# 28420# From Felix von Leitner <leitner@fefe.de> 28421# Extended by Beni Cherniavsky <cben@crosswinds.net> 28422# Further extended by Greg Wooledge <greg@wooledge.org> 28423# 28424# Most (everything but the number of channels and bitrate) is commented 28425# out with `##' as it's not interesting to the average user. The most 28426# probable things advanced users would want to uncomment are probably 28427# the number of comments and the encoder version. 28428# 28429# FIXME: The first match has been made a search, so that it can skip 28430# over prepended ID3 tags. This will work for MIME type detection, but 28431# won't work for detecting other properties of the file (they all need 28432# to be made relative to the search). In any case, if the file has ID3 28433# tags, the ID3 information will be printed, not the Ogg information, 28434# so until that's fixed, this doesn't matter. 28435# FIXME[2]: Disable the above for now, since search assumes text mode. 28436# 28437# --- Ogg Framing --- 28438#0 search/1000 OggS Ogg data 284390 string OggS Ogg data 28440>4 byte !0 UNKNOWN REVISION %u 28441##>4 byte 0 revision 0 28442>4 byte 0 28443##>>14 lelong x (Serial %lX) 28444# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) 28445>>28 string \x7fFLAC \b, FLAC audio 28446# non-Vorbis content: Theora 28447!:mime audio/ogg 28448>>28 string \x80theora \b, Theora video 28449!:mime video/ogg 28450# non-Vorbis content: Kate 28451>>28 string \x80kate\0\0\0\0 \b, Kate (Karaoke and Text) 28452!:mime application/ogg 28453>>>37 ubyte x v%u 28454>>>38 ubyte x \b.%u, 28455>>>40 byte 0 utf8 encoding, 28456>>>40 byte !0 unknown character encoding, 28457>>>60 string >\0 language %s, 28458>>>60 string \0 no language set, 28459>>>76 string >\0 category %s 28460>>>76 string \0 no category set 28461# non-Vorbis content: Skeleton 28462>>28 string fishead\0 \b, Skeleton 28463!:mime video/ogg 28464>>>36 leshort x v%u 28465>>>40 leshort x \b.%u 28466# non-Vorbis content: Speex 28467>>28 string Speex\ \ \ \b, Speex audio 28468!:mime audio/ogg 28469# non-Vorbis content: OGM 28470>>28 string \x01video\0\0\0 \b, OGM video 28471!:mime video/ogg 28472>>>37 string/c div3 (DivX 3) 28473>>>37 string/c divx (DivX 4) 28474>>>37 string/c dx50 (DivX 5) 28475>>>37 string/c xvid (XviD) 28476# --- First vorbis packet - general header --- 28477>>28 string \x01vorbis \b, Vorbis audio, 28478!:mime audio/ogg 28479>>>35 lelong !0 UNKNOWN VERSION %u, 28480##>>>35 lelong 0 version 0, 28481>>>35 lelong 0 28482>>>>39 ubyte 1 mono, 28483>>>>39 ubyte 2 stereo, 28484>>>>39 ubyte >2 %u channels, 28485>>>>40 lelong x %u Hz 28486# Minimal, nominal and maximal bitrates specified when encoding 28487>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, 28488# The above tests if at least one of these is specified: 28489>>>>>52 lelong !-1 28490# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields 28491# instead of -1. 28492# Vorbis 1.0 uses 0 instead of -1. 28493>>>>>>52 lelong !0 28494>>>>>>>52 lelong !-1000 28495>>>>>>>>52 lelong x <%u 28496>>>>>48 lelong !-1 28497>>>>>>48 lelong x ~%u 28498>>>>>44 lelong !-1 28499>>>>>>44 lelong !-1000 28500>>>>>>>44 lelong !0 28501>>>>>>>>44 lelong x >%u 28502>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps 28503# -- Second vorbis header packet - the comments 28504# A kludge to read the vendor string. It's a counted string, not a 28505# zero-terminated one, so file(1) can't read it in a generic way. 28506# libVorbis is the only one existing currently, so I detect specifically 28507# it. The interesting value is the cvs date (8 digits decimal). 28508# Post-RC1 Ogg files have the second header packet (and thus the version) 28509# in a different place, so we must use an indirect offset. 28510>>>(84.b+85) string \x03vorbis 28511>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I 28512>>>>>(84.b+120) string >00000000 28513# Map to beta version numbers: 28514>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) 28515>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) 28516>>>>>>(84.b+120) string >20000508 28517>>>>>>>(84.b+120) string <20001031 (beta2-3) 28518>>>>>>(84.b+120) string 20001031 (1.0 beta 3) 28519>>>>>>(84.b+120) string >20001031 28520>>>>>>>(84.b+120) string <20010225 (beta3-4) 28521>>>>>>(84.b+120) string 20010225 (1.0 beta 4) 28522>>>>>>(84.b+120) string >20010225 28523>>>>>>>(84.b+120) string <20010615 (beta4-RC1) 28524>>>>>>(84.b+120) string 20010615 (1.0 RC1) 28525>>>>>>(84.b+120) string 20010813 (1.0 RC2) 28526>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) 28527>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) 28528>>>>>>(84.b+120) string 20011217 (1.0 RC3) 28529>>>>>>(84.b+120) string 20011231 (1.0 RC3) 28530# Some pre-1.0 CVS snapshots still had "Xiphphorus"... 28531>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) 28532# For the 1.0 release, Xiphophorus is replaced by Xiph.Org 28533>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I 28534>>>>>(84.b+117) string >00000000 28535>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) 28536>>>>>>(84.b+117) string 20020717 (1.0) 28537>>>>>>(84.b+117) string 20030909 (1.0.1) 28538>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) 28539>>>>>>(84.b+117) string 20050304 (1.1.2) 28540>>>>>>(84.b+117) string 20070622 (1.2.0) 28541>>>>>>(84.b+117) string 20090624 (1.2.2) 28542>>>>>>(84.b+117) string 20090709 (1.2.3) 28543>>>>>>(84.b+117) string 20100325 (1.3.1) 28544>>>>>>(84.b+117) string 20101101 (1.3.2) 28545>>>>>>(84.b+117) string 20120203 (1.3.3) 28546>>>>>>(84.b+117) string 20140122 (1.3.4) 28547>>>>>>(84.b+117) string 20150105 (1.3.5) 28548 28549# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5 28550>>28 string OpusHead \b, Opus audio, 28551!:mime audio/ogg 28552>>>36 ubyte >0x0F UNKNOWN VERSION %u, 28553>>>36 ubyte &0x0F version 0.%d 28554>>>>46 ubyte >1 28555>>>>>46 ubyte !255 unknown channel mapping family %u, 28556>>>>>37 ubyte x %u channels 28557>>>>46 ubyte 0 28558>>>>>37 ubyte 1 mono 28559>>>>>37 ubyte 2 stereo 28560>>>>46 ubyte 1 28561>>>>>37 ubyte 1 mono 28562>>>>>37 ubyte 2 stereo 28563>>>>>37 ubyte 3 linear surround 28564>>>>>37 ubyte 4 quadraphonic 28565>>>>>37 ubyte 5 5.0 surround 28566>>>>>37 ubyte 6 5.1 surround 28567>>>>>37 ubyte 7 6.1 surround 28568>>>>>37 ubyte 8 7.1 surround 28569>>>>40 lelong !0 \b, %u Hz 28570 28571#------------------------------------------------------------------------------ 28572# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $ 28573# VXL: file(1) magic for VXL binary IO data files 28574# 28575# from Ian Scott <scottim@sf.net> 28576# 28577# VXL is a collection of C++ libraries for Computer Vision. 28578# See the vsl chapter in the VXL Book for more info 28579# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html 28580# http:/vxl.sf.net 28581 285822 lelong 0x472b2c4e VXL data file, 28583>0 leshort >0 schema version no %d 28584 28585#------------------------------------------------------------------------------ 28586# $File: warc,v 1.4 2019/04/19 00:42:27 christos Exp $ 28587# warc: file(1) magic for WARC files 28588 285890 string WARC/ WARC Archive 28590>5 string x version %.4s 28591!:mime application/warc 28592 28593#------------------------------------------------------------------------------ 28594# Arc File Format from Internet Archive 28595# see https://www.archive.org/web/researcher/ArcFileFormat.php 285960 string filedesc:// Internet Archive File 28597!:mime application/x-ia-arc 28598>11 search/256 \x0A \b 28599>>&0 ubyte >0 \b version %c 28600 28601#------------------------------------------------------------------------------ 28602# weak: file(1) magic for very weak magic entries, disabled by default 28603# 28604# These entries are so weak that they might interfere identification of 28605# other formats. Example include: 28606# - Only identify for 1 or 2 bytes 28607# - Match against very wide range of values 28608# - Match against generic word in some spoken languages (e.g. English) 28609 28610# Summary: Computer Graphics Metafile 28611# Extension: .cgm 28612#0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile 28613#0 beshort 0x3020 character Computer Graphics Metafile 28614 28615#0 string =!! Bennet Yee's "face" format 28616#------------------------------------------------------------------------------ 28617# $File: webassembly,v 1.3 2019/04/19 00:42:27 christos Exp $ 28618# webassembly: file(1) magic for WebAssembly modules 28619# 28620# WebAssembly is a virtual architecture developed by a W3C Community 28621# Group at https://webassembly.org/. The file extension is .wasm, and 28622# the MIME type is application/wasm. 28623# 28624# https://webassembly.org/docs/binary-encoding/ is the main 28625# document describing the binary format. 28626# From: Pip Cet <pipcet@gmail.com> and Joel Martin 28627 286280 string \0asm WebAssembly (wasm) binary module 28629>4 lelong =1 version %#x (MVP) 28630>4 lelong >1 version %#x 28631 28632#------------------------------------------------------------------------------ 28633# $File: windows,v 1.26 2019/05/01 17:55:25 christos Exp $ 28634# windows: file(1) magic for Microsoft Windows 28635# 28636# This file is mainly reserved for files where programs 28637# using them are run almost always on MS Windows 3.x or 28638# above, or files only used exclusively in Windows OS, 28639# where there is no better category to allocate for. 28640# For example, even though WinZIP almost run on Windows 28641# only, it is better to treat them as "archive" instead. 28642# For format usable in DOS, such as generic executable 28643# format, please specify under "msdos" file. 28644# 28645 28646 28647# Summary: Outlook Express DBX file 28648# Extension: .dbx 28649# Created by: Christophe Monniez 286500 string \xCF\xAD\x12\xFE MS Outlook Express DBX file 28651>4 byte =0xC5 \b, message database 28652>4 byte =0xC6 \b, folder database 28653>4 byte =0xC7 \b, account information 28654>4 byte =0x30 \b, offline database 28655 28656 28657# Summary: Windows crash dump 28658# Extension: .dmp 28659# Created by: Andreas Schuster (https://computer.forensikblog.de/) 28660# Reference (1): https://computer.forensikblog.de/en/2008/02/64bit_magic.html 28661# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only) 286620 string PAGE 28663>4 string DUMP MS Windows 32bit crash dump 28664>>0x05c byte 0 \b, no PAE 28665>>0x05c byte 1 \b, PAE 28666>>0xf88 lelong 1 \b, full dump 28667>>0xf88 lelong 2 \b, kernel dump 28668>>0xf88 lelong 3 \b, small dump 28669>>0x068 lelong x \b, %d pages 28670>4 string DU64 MS Windows 64bit crash dump 28671>>0xf98 lelong 1 \b, full dump 28672>>0xf98 lelong 2 \b, kernel dump 28673>>0xf98 lelong 3 \b, small dump 28674>>0x090 lequad x \b, %lld pages 28675 28676 28677# Summary: Vista Event Log 28678# Extension: .evtx 28679# Created by: Andreas Schuster (https://computer.forensikblog.de/) 28680# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html 286810 string ElfFile\0 MS Windows Vista Event Log 28682>0x2a leshort x \b, %d chunks 28683>>0x10 lelong x \b (no. %d in use) 28684>0x18 lelong >1 \b, next record no. %d 28685>0x18 lelong =1 \b, empty 28686>0x78 lelong &1 \b, DIRTY 28687>0x78 lelong &2 \b, FULL 28688 28689# Summary: Windows System Deployment Image 28690# Created by: Joerg Jenderek 28691# URL: http://en.wikipedia.org/wiki/System_Deployment_Image 28692# Reference: http://skolk.livejournal.com/1320.html 286930 string $SDI 28694>4 string 0001 System Deployment Image 28695!:mime application/x-ms-sdi 28696#!:mime application/octet-stream 28697# \Boot\boot.sdi 28698!:ext sdi 28699# MDBtype: 0~Unspecified 1~RAM 2~ROM 28700>>8 ulequad !0 \b, MDBtype 0x%llx 28701# BootCodeOffset 28702>>16 ulequad !0 \b, BootCodeOffset 0x%llx 28703# BootCodeSize 28704>>24 ulequad !0 \b, BootCodeSize 0x%llx 28705# VendorID 28706>>32 ulequad !0 \b, VendorID 0x%llx 28707# DeviceID 28708>>40 ulequad !0 \b, DeviceID 0x%llx 28709# DeviceModel 28710>>48 ulequad !0 \b, DeviceModel 0x%llx 28711>>>56 ulequad !0 \b%llx 28712# DeviceRole 28713>>64 ulequad !0 \b, DeviceRole 0x%llx 28714# Reserved1; reserved fields and gaps between BLOBs are padded with \0 28715#>>72 ulequad !0 \b, Reserved1 0x%llx 28716# RuntimeGUID 28717>>80 ulequad !0 \b, RuntimeGUID 0x%llx 28718>>>88 ulequad !0 \b%llx 28719# RuntimeOEMrev 28720>>96 ulequad !0 \b, RuntimeOEMrev 0x%llx 28721# Reserved2 28722#>>104 ulequad !0 \b, Reserved2 0x%llx 28723# BLOB alignment value in pages, as specified in sdimgr /pack: 1~4K 2~8k 28724>>112 ulequad !0 \b, PageAlignment %llu 28725# Reserved3[48] 28726#>>120 ulequad !0 \b, Reserved3 0x%llx 28727# SDI checksum 39h 28728>>0x1f8 ulequad x \b, checksum 0x%llx 28729# BLOBtype[8] \0-padded: PART, WIM , BOOT, LOAD, DISK 28730>>0x400 string >\0 \b, type %-3.8s 28731# 0~non-filesystem 7~NTFS 6~BIGFAT 28732>>>0x420 ulequad !0 (0x%llx) 28733# ATTRibutes 28734>>>0x408 ulequad !0 0x%llx attributes 28735# Offset 28736>>>0x410 ulequad x at 0x%llx 28737# print 1 space after size and then handles NTFS boot sector by ./filesystems 28738>>>0x418 ulequad >0 %llu bytes 28739>>>>(0x410.l) indirect x 28740# 2nd BLOB: WIM 28741>>0x440 string >\0 \b, type %-3.8s 28742>>>0x428 ulequad !0 (0x%llx) 28743# ATTRibutes 28744>>>0x448 ulequad !0 0x%llx attributes 28745# Offset 28746>>>0x450 ulequad x at 0x%llx 28747>>>0x458 ulequad >0 %llu bytes 28748>>>>(0x450.l) indirect x 28749# 3rd BLOB 28750>>0x480 string >\0 \b, type %-3.8s 28751 28752# Summary: Windows Error Report text files 28753# URL: https://en.wikipedia.org/wiki/Windows_Error_Reporting 28754# Reference: https://www.nirsoft.net/utils/app_crash_view.html 28755# Created by: Joerg Jenderek 28756# Note: in directories %ProgramData%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 28757# %LOCALAPPDATA%\Microsoft\Windows\WER\{ReportArchive,ReportQueue} 287580 lestring16 Version= 28759>22 lestring16 EventType Windows Error Report 28760!:mime text/plain 28761# Report.wer 28762!:ext wer 28763 28764# Summary: Windows 3.1 group files 28765# Extension: .grp 28766# Created by: unknown 287670 string \120\115\103\103 MS Windows 3.1 group files 28768 28769 28770# Summary: Old format help files 28771# URL: https://en.wikipedia.org/wiki/WinHelp 28772# Reference: https://www.oocities.org/mwinterhoff/helpfile.htm 28773# Update: Joerg Jenderek 28774# Created by: Dirk Jagdmann <doj@cubic.org> 28775# 28776# check and then display version and date inside MS Windows HeLP file fragment 287770 name help-ver-date 28778# look for Magic of SYSTEMHEADER 28779>0 leshort 0x036C 28780# version Major 1 for right file fragment 28781>>4 leshort 1 Windows 28782# print non empty string above to avoid error message 28783# Warning: Current entry does not yet have a description for adding a MIME type 28784!:mime application/winhelp 28785!:ext hlp 28786# version Minor of help file format is hint for windows version 28787>>>2 leshort 0x0F 3.x 28788>>>2 leshort 0x15 3.0 28789>>>2 leshort 0x21 3.1 28790>>>2 leshort 0x27 x.y 28791>>>2 leshort 0x33 95 28792>>>2 default x y.z 28793>>>>2 leshort x 0x%x 28794# to complete message string like "MS Windows 3.x help file" 28795>>>2 leshort x help 28796# GenDate often older than file creation date 28797>>>6 ldate x \b, %s 28798# 28799# Magic for HeLP files 288000 lelong 0x00035f3f 28801# ./windows (version 5.25) labeled the entry as "MS Windows 3.x help file" 28802# file header magic 0x293B at DirectoryStart+9 28803>(4.l+9) uleshort 0x293B MS 28804# look for @VERSION bmf.. like IBMAVW.ANN 28805>>0xD4 string =\x62\x6D\x66\x01\x00 Windows help annotation 28806!:mime application/x-winhelp 28807!:ext ann 28808>>0xD4 string !\x62\x6D\x66\x01\x00 28809# "GID Help index" by TrID 28810>>>(4.l+0x65) string =|Pete Windows help Global Index 28811!:mime application/x-winhelp 28812!:ext gid 28813# HeLP Bookmark or 28814# "Windows HELP File" by TrID 28815>>>(4.l+0x65) string !|Pete 28816# maybe there exist a cleaner way to detect HeLP fragments 28817# brute search for Magic 0x036C with matching Major maximal 7 iterations 28818# discapp.hlp 28819>>>>16 search/0x49AF/s \x6c\x03 28820>>>>>&0 use help-ver-date 28821>>>>>&4 leshort !1 28822# putty.hlp 28823>>>>>>&0 search/0x69AF/s \x6c\x03 28824>>>>>>>&0 use help-ver-date 28825>>>>>>>&4 leshort !1 28826>>>>>>>>&0 search/0x49AF/s \x6c\x03 28827>>>>>>>>>&0 use help-ver-date 28828>>>>>>>>>&4 leshort !1 28829>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 28830>>>>>>>>>>>&0 use help-ver-date 28831>>>>>>>>>>>&4 leshort !1 28832>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 28833>>>>>>>>>>>>>&0 use help-ver-date 28834>>>>>>>>>>>>>&4 leshort !1 28835>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 28836>>>>>>>>>>>>>>>&0 use help-ver-date 28837>>>>>>>>>>>>>>>&4 leshort !1 28838>>>>>>>>>>>>>>>>&0 search/0x49AF/s \x6c\x03 28839# GCC.HLP is detected after 7 iterations 28840>>>>>>>>>>>>>>>>>&0 use help-ver-date 28841# this only happens if bigger hlp file is detected after used search iterations 28842>>>>>>>>>>>>>>>>>&4 leshort !1 Windows y.z help 28843!:mime application/winhelp 28844!:ext hlp 28845# repeat search again or following default line does not work 28846>>>>16 search/0x49AF/s \x6c\x03 28847# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit) 28848>>>>16 default x Windows help Bookmark 28849!:mime application/x-winhelp 28850!:ext bmk 28851## FirstFreeBlock normally FFFFFFFFh 10h for *ANN 28852##>>8 lelong x \b, FirstFreeBlock 0x%8.8x 28853# EntireFileSize 28854>>12 lelong x \b, %d bytes 28855## ReservedSpace normally 042Fh AFh for *.ANN 28856#>>(4.l) lelong x \b, ReservedSpace 0x%8.8x 28857## UsedSpace normally 0426h A6h for *.ANN 28858#>>(4.l+4) lelong x \b, UsedSpace 0x%8.8x 28859## FileFlags normally 04... 28860#>>(4.l+5) lelong x \b, FileFlags 0x%8.8x 28861## file header magic 0x293B 28862#>>(4.l+9) uleshort x \b, file header magic 0x%4.4x 28863## file header Flags 0x0402 28864#>>(4.l+11) uleshort x \b, file header Flags 0x%4.4x 28865## file header PageSize 0400h 80h for *.ANN 28866#>>(4.l+13) uleshort x \b, PageSize 0x%4.4x 28867## Structure[16] z4 28868#>>(4.l+15) string >\0 \b, Structure_"%-.16s" 28869## MustBeZero 0 28870#>>(4.l+31) uleshort x \b, MustBeZero 0x%4.4x 28871## PageSplits 28872#>>(4.l+33) uleshort x \b, PageSplits 0x%4.4x 28873## RootPage 28874#>>(4.l+35) uleshort x \b, RootPage 0x%4.4x 28875## MustBeNegOne 0xffff 28876#>>(4.l+37) uleshort x \b, MustBeNegOne 0x%4.4x 28877## TotalPages 1 28878#>>(4.l+39) uleshort x \b, TotalPages 0x%4.4x 28879## NLevels 0x0001 28880#>>(4.l+41) uleshort x \b, NLevels 0x%4.4x 28881## TotalBtreeEntries 28882#>>(4.l+43) ulelong x \b, TotalBtreeEntries 0x%8.8x 28883## pages of the B+ tree 28884#>>(4.l+47) ubequad x \b, PageStart 0x%16.16llx 28885 28886# start with colon or semicolon for comment line like Back2Life.cnt 288870 regex \^(:|;) 28888# look for first keyword Base 28889>0 search/45 :Base 28890>>&0 use cnt-name 28891# only solution to search again from beginning , because relative offsets changes when use is called 28892>0 search/45 :Base 28893>0 default x 28894# look for other keyword Title like in putty.cnt 28895>>0 search/45 :Title 28896>>>&0 use cnt-name 28897# 28898# display mime type and name of Windows help Content source 288990 name cnt-name 28900# skip space at beginning 28901>0 string \040 28902# name without extension and greater character or name with hlp extension 28903>>1 regex/c \^([^\xd>]*|.*\.hlp) MS Windows help file Content, based "%s" 28904!:mime text/plain 28905!:apple ????TEXT 28906!:ext cnt 28907# 28908# Windows creates an full text search from hlp file, if the user clicks the "Find" tab and enables keyword indexing 289090 string tfMR MS Windows help Full Text Search index 28910!:mime application/x-winhelp-fts 28911!:ext fts 28912>16 string >\0 for "%s" 28913 28914# Summary: Hyper terminal 28915# Extension: .ht 28916# Created by: unknown 289170 string HyperTerminal\040 28918>15 string 1.0\ --\ HyperTerminal\ data\ file MS Windows HyperTerminal profile 28919 28920# https://ithreats.files.wordpress.com/2009/05/\040 28921# lnk_the_windows_shortcut_file_format.pdf 28922# Summary: Windows shortcut 28923# Extension: .lnk 28924# Created by: unknown 28925# 'L' + GUUID 289260 string \114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106 MS Windows shortcut 28927>20 lelong&1 1 \b, Item id list present 28928>20 lelong&2 2 \b, Points to a file or directory 28929>20 lelong&4 4 \b, Has Description string 28930>20 lelong&8 8 \b, Has Relative path 28931>20 lelong&16 16 \b, Has Working directory 28932>20 lelong&32 32 \b, Has command line arguments 28933>20 lelong&64 64 \b, Icon 28934>>56 lelong x \b number=%d 28935>24 lelong&1 1 \b, Read-Only 28936>24 lelong&2 2 \b, Hidden 28937>24 lelong&4 4 \b, System 28938>24 lelong&8 8 \b, Volume Label 28939>24 lelong&16 16 \b, Directory 28940>24 lelong&32 32 \b, Archive 28941>24 lelong&64 64 \b, Encrypted 28942>24 lelong&128 128 \b, Normal 28943>24 lelong&256 256 \b, Temporary 28944>24 lelong&512 512 \b, Sparse 28945>24 lelong&1024 1024 \b, Reparse point 28946>24 lelong&2048 2048 \b, Compressed 28947>24 lelong&4096 4096 \b, Offline 28948>28 leqwdate x \b, ctime=%s 28949>36 leqwdate x \b, mtime=%s 28950>44 leqwdate x \b, atime=%s 28951>52 lelong x \b, length=%u, window= 28952>60 lelong&1 1 \bhide 28953>60 lelong&2 2 \bnormal 28954>60 lelong&4 4 \bshowminimized 28955>60 lelong&8 8 \bshowmaximized 28956>60 lelong&16 16 \bshownoactivate 28957>60 lelong&32 32 \bminimize 28958>60 lelong&64 64 \bshowminnoactive 28959>60 lelong&128 128 \bshowna 28960>60 lelong&256 256 \brestore 28961>60 lelong&512 512 \bshowdefault 28962#>20 lelong&1 0 28963#>>20 lelong&2 2 28964#>>>(72.l-64) pstring/h x \b [%s] 28965#>20 lelong&1 1 28966#>>20 lelong&2 2 28967#>>>(72.s) leshort x 28968#>>>&75 pstring/h x \b [%s] 28969 28970# Summary: Outlook Personal Folders 28971# Created by: unknown 289720 lelong 0x4E444221 Microsoft Outlook email folder 28973>10 leshort 0x0e (<=2002) 28974>10 leshort 0x17 (>=2003) 28975 28976 28977# Summary: Windows help cache 28978# Created by: unknown 289790 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache 28980 28981 28982# Summary: IE cache file 28983# Created by: Christophe Monniez 289840 string Client\ UrlCache\ MMF Internet Explorer cache file 28985>20 string >\0 version %s 28986 28987 28988# Summary: Registry files 28989# Created by: unknown 28990# Modified by (1): Joerg Jenderek 289910 string regf MS Windows registry file, NT/2000 or above 289920 string CREG MS Windows 95/98/ME registry file 289930 string SHCC3 MS Windows 3.1 registry file 28994 28995 28996# Summary: Windows Registry text 28997# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files 28998# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry 28999# Submitted by: Abel Cheung <abelcheung@gmail.com> 29000# Update: Joerg Jenderek 29001# Windows 3-9X variant 290020 string REGEDIT 29003# skip ASCII text like "REGEDITor.txt" but match 29004# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL 29005>7 search/3 \n Windows Registry text 29006!:mime text/x-ms-regedit 29007!:ext reg 29008# Windows 9X variant 29009>>0 string REGEDIT4 (Win95 or above) 29010# Windows 2K ANSI variant 290110 string Windows\ Registry\ Editor\ 29012>&0 string Version\ 5.00\r\n\r\n Windows Registry text (Win2K or above) 29013!:mime text/x-ms-regedit 29014!:ext reg 29015# Windows 2K UTF-16 variant 290162 lestring16 Windows\ Registry\ Editor\ 29017>0x32 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 29018# relative offset not working 29019#>&0 lestring16 Version\ 5.00\r\n\r\n Windows Registry little-endian text (Win2K or above) 29020!:mime text/x-ms-regedit 29021!:ext reg 29022# WINE variant 29023# URL: https://en.wikipedia.org/wiki/Wine_(software) 29024# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html 29025# Note: WINE use text based registry (system.reg,user.reg,userdef.reg) 29026# instead binary hiv structure like Windows 290270 string WINE\ REGISTRY\ Version\ WINE registry text 29028# version 2 29029>&0 string x \b, version %s 29030!:mime text/x-wine-extension-reg 29031!:ext reg 29032 29033# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018 29034# empty ,comment , section 29035# PR/383: remove unicode BOM because it is not portable across regex impls 29036#0 regex/s \\`(\\r\\n|;|[[]) 29037# empty line CRLF 290380 ubeshort 0x0D0A 29039>0 use ini-file 29040# comment line 290410 string ; 29042>0 use ini-file 29043# section line 290440 string [ 29045>0 use ini-file 29046# check and then display Windows INItialization configuration 290470 name ini-file 29048# look for left bracket in section line 29049>0 search/8192 [ 29050# https://en.wikipedia.org/wiki/Autorun.inf 29051# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx 29052# space after right bracket 29053# or AutoRun.Amd64 for 64 bit systems 29054# or only NL separator 29055>>&0 regex/c \^(autorun) 29056# but sometimes total commander directory tree file "treeinfo.wc" with lines like 29057# [AUTORUN] 29058# [boot] 29059>>>&0 string =]\r\n[ Total commander directory treeinfo.wc 29060!:mime text/plain 29061!:ext wc 29062# From: Pal Tamas <folti@balabit.hu> 29063# Autorun File 29064>>>&0 string !]\r\n[ Microsoft Windows Autorun file 29065!:mime application/x-setupscript 29066!:ext inf 29067# https://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx 29068# version strings ASCII coded case-independent for Windows setup information script file 29069>>&0 regex/c \^(version|strings)] Windows setup INFormation 29070!:mime application/x-setupscript 29071#!:mime application/x-wine-extension-inf 29072!:ext inf 29073# NETCRC.INF OEMCPL.INF 29074>>&0 regex/c \^(WinsockCRCList|OEMCPL)] Windows setup INFormation 29075!:mime application/x-setupscript 29076!:ext inf 29077# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm 29078# https://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx 29079# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent 29080>>&0 regex/c \^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] Windows desktop.ini 29081!:mime application/x-wine-extension-ini 29082#!:mime text/plain 29083# https://support.microsoft.com/kb/84709/ 29084>>&0 regex/c \^(don't\ load)] Windows CONTROL.INI 29085!:mime application/x-wine-extension-ini 29086!:ext ini 29087>>&0 regex/c \^(ndishlp\\$|protman\\$|NETBEUI\\$)] Windows PROTOCOL.INI 29088!:mime application/x-wine-extension-ini 29089!:ext ini 29090# https://technet.microsoft.com/en-us/library/cc722567.aspx 29091# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm 29092>>&0 regex/c \^(windows|Compatibility|embedding)] Windows WIN.INI 29093!:mime application/x-wine-extension-ini 29094!:ext ini 29095# https://en.wikipedia.org/wiki/SYSTEM.INI 29096>>&0 regex/c \^(boot|386enh|drivers)] Windows SYSTEM.INI 29097!:mime application/x-wine-extension-ini 29098!:ext ini 29099# http://www.mdgx.com/newtip6.htm 29100>>&0 regex/c \^(SafeList)] Windows IOS.INI 29101!:mime application/x-wine-extension-ini 29102!:ext ini 29103# https://en.wikipedia.org/wiki/NTLDR Windows Boot Loader information 29104>>&0 regex/c \^(boot\x20loader)] Windows boot.ini 29105!:mime application/x-wine-extension-ini 29106!:ext ini 29107# https://en.wikipedia.org/wiki/CONFIG.SYS 29108>>&0 regex/c \^(menu)] MS-DOS CONFIG.SYS 29109# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE 29110# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYTEM\MSCONFIG.EXE 29111# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYTEM\MSCONFIG.EXE 29112# dos and w40 used in dual booting scene 29113!:ext sys/dos/w40 29114# https://support.microsoft.com/kb/118579/ 29115>>&0 regex/c \^(Paths)]\r\n MS-DOS MSDOS.SYS 29116!:ext sys/dos 29117# http://chmspec.nongnu.org/latest/INI.html#HHP 29118>>&0 regex/c \^(options)]\r\n Microsoft HTML Help Project 29119!:mime text/plain 29120!:ext hhp 29121# unknown keyword after opening bracket 29122>>&0 default x 29123#>>>&0 string/c x UNKNOWN [%s 29124# look for left bracket of second section 29125>>>&0 search/8192 [ 29126# version Strings FileIdentification 29127>>>>&0 string/c version Windows setup INFormation 29128!:mime application/x-setupscript 29129!:ext inf 29130# https://en.wikipedia.org/wiki/Initialization_file Windows Initialization File or other 29131>>>>&0 default x 29132>>>>>&0 ubyte x 29133# characters, digits, underscore and white space followed by right bracket 29134# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT 29135>>>>>>&-1 regex \^([A-Za-z0-9_\(\)\ ]+)\]\r Generic INItialization configuration [%-.40s 29136# NETDEF.INF multiarc.ini 29137#!:mime application/x-setupscript 29138!:mime application/x-wine-extension-ini 29139#!:mime text/plain 29140!:ext ini/inf 29141# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00 291420 ubelong&0xFFff89FF =0xFFFE0900 29143# look for left bracket in section line 29144>2 search/8192 [ 29145# keyword without 1st letter which is maybe up-/down-case 29146>>&3 lestring16 ersion] Windows setup INFormation 29147!:mime application/x-setupscript 29148!:ext inf 29149>>&3 lestring16 trings] Windows setup INFormation 29150!:mime application/x-setupscript 29151!:ext inf 29152>>&3 lestring16 ourceDisksNames] Windows setup INFormation 29153!:mime application/x-setupscript 29154!:ext inf 29155# netnwcli.inf start with ;---[ NetNWCli.INX ] 29156>>&3 default x 29157# look for NL followed by left bracket 29158>>>&0 search/8192 \x0A\x00\x5b 29159>>>>&3 lestring16 ersion] Windows setup INFormation 29160!:mime application/x-setupscript 29161!:ext inf 29162 29163# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h 29164# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm 29165# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp 291660 leshort&0xFeFe 0x0000 29167!:strength -5 29168# test for unused null bits in PNF_FLAGs 29169>4 ulelong&0xFCffFe00 0x00000000 29170# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure 29171>>68 ulelong >0x57 29172# test for zero high byte of InfValueBlockSize, followed by WinDirPath like 29173# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT 29174>>>(68.l-1) ubelong&0xffE0C519 =0x00400018 Windows Precompiled iNF 29175!:mime application/x-pnf 29176# currently only found Major Version=1 and Minor Version=1 29177#>>>>0 uleshort =0x0101 29178#>>>>>1 ubyte x \b, version %u 29179#>>>>>0 ubyte x \b.%u 29180>>>>0 uleshort !0x0101 29181>>>>>1 ubyte x \b, version %u 29182>>>>>0 ubyte x \b.%u 29183# 1 ,2 (windows 98 SE) 29184#>>>>2 uleshort =2 \b, InfStyle %u 29185>>>>2 uleshort !2 \b, InfStyle %u 29186# PNF_FLAG_IS_UNICODE 0x00000001 29187# PNF_FLAG_HAS_STRINGS 0x00000002 29188# PNF_FLAG_SRCPATH_IS_URL 0x00000004 29189# PNF_FLAG_HAS_VOLATILE_DIRIDS 0x00000008 29190# PNF_FLAG_INF_VERIFIED 0x00000010 29191# PNF_FLAG_INF_DIGITALLY_SIGNED 0x00000020 29192# ?? 0x00000100 29193# ?? 0x01000000 29194# ?? 0x02000000 29195>>>>4 ulelong&0x00000001 0x00000001 \b, unicoded 29196>>>>4 ulelong&0x00000020 0x00000020 \b, digitally signed 29197#>>>>8 ulelong x \b, InfSubstValueListOffset 0x%x 29198# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF 29199#>>>>12 uleshort x \b, InfSubstValueCount 0x%x 29200# only < 9 found 29201#>>>>14 uleshort x \b, InfVersionDatumCount 0x%x 29202# only found values lower 0x0000ffff 29203#>>>>16 ulelong x \b, InfVersionDataSize 0x%x 29204# only found positive values lower 0x00ffFFff for InfVersionDataOffset 29205>>>>20 ulelong x \b, at 0x%x 29206>>>>4 ulelong&0x00000001 =0x00000001 29207# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature 29208>>>>>(20.l) lestring16 x "%s" 29209>>>>4 ulelong&0x00000001 !0x00000001 29210>>>>>(20.l) string x "%s" 29211# FILETIME is number of 100-nanosecond intervals since 1 January 1601 29212#>>>>24 ulequad x \b, InfVersionLastWriteTime %16.16llx 29213# only found values lower 0x00ffFFff 29214#>>>>32 ulelong x \b, StringTableBlockOffset 0x%x 29215#>>>>36 ulelong x \b, StringTableBlockSize 0x%x 29216#>>>>40 ulelong x \b, InfSectionCount 0x%x 29217#>>>>44 ulelong x \b, InfSectionBlockOffset 0x%x 29218#>>>>48 ulelong x \b, InfSectionBlockSize 0x%x 29219#>>>>52 ulelong x \b, InfLineBlockOffset 0x%x 29220#>>>>56 ulelong x \b, InfLineBlockSize 0x%x 29221#>>>>60 ulelong x \b, InfValueBlockOffset 0x%x 29222#>>>>64 ulelong x \b, InfValueBlockSize 0x%x 29223# WinDirPathOffset 29224#>>>>68 ulelong x \b, at 0x%x 29225>>>>68 ulelong >0x57 29226>>>>>4 ulelong&0x00000001 =0x00000001 29227>>>>>>(68.l) ubequad =0x43003a005c005700 29228# normally unicoded C:\Windows 29229#>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 29230>>>>>>(68.l) ubequad !0x43003a005c005700 29231>>>>>>>(68.l) lestring16 x \b, WinDirPath "%s" 29232>>>>>4 ulelong&0x00000001 !0x00000001 29233# normally ASCII C:\WINDOWS 29234#>>>>>>(68.l) string =C:\\WINDOWS \b, WinDirPath "%s" 29235>>>>>>(68.l) string !C:\\WINDOWS \b, WinDirPath "%s" 29236# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF 29237#>>>>72 ulelong >0 \b, at 0x%x 29238>>>>72 ulelong >0 \b, 29239>>>>>4 ulelong&0x00000001 =0x00000001 29240>>>>>>(72.l) lestring16 x OsLoaderPath "%s" 29241>>>>>4 ulelong&0x00000001 !0x00000001 29242# seldom C:\ instead empty 29243>>>>>>(72.l) string x OsLoaderPath "%s" 29244# 1fdh 29245#>>>>76 uleshort x \b, StringTableHashBucketCount 0x%x 29246>>>>78 uleshort !0x407 \b, LanguageId %x 29247# only 407h found 29248#>>>>78 uleshort =0x407 \b, LanguageId %x 29249# InfSourcePathOffset often 0 29250#>>>>80 ulelong >0 \b, at 0x%x 29251>>>>80 ulelong >0 \b, 29252>>>>>4 ulelong&0x00000001 =0x00000001 29253>>>>>>(80.l) lestring16 x SourcePath "%s" 29254>>>>>4 ulelong&0x00000001 !0x00000001 29255>>>>>>(80.l) string >\0 SourcePath "%s" 29256# OriginalInfNameOffset often 0 29257#>>>>84 ulelong >0 \b, at 0x%x 29258>>>>84 ulelong >0 \b, 29259>>>>>4 ulelong&0x00000001 =0x00000001 29260>>>>>>(84.l) lestring16 x InfName "%s" 29261>>>>>4 ulelong&0x00000001 !0x00000001 29262>>>>>>(84.l) string >\0 InfName "%s" 29263 29264# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003 29265# Extension: .bkf 29266# Created by: Joerg Jenderek 29267# URL: https://en.wikipedia.org/wiki/NTBackup 29268# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF 29269# Descriptor BloCK name of Microsoft Tape Format 292700 string TAPE 29271# Format Logical Address is zero 29272>20 ulequad 0 29273# Reserved for MBC is zero 29274>>28 uleshort 0 29275# Control Block ID is zero 29276>>>36 ulelong 0 29277# BIT4-BIT15, BIT18-BIT31 of block attributes are unused 29278>>>>4 ulelong&0xFFfcFFe0 0 Windows NTbackup archive 29279#!:mime application/x-ntbackup 29280!:ext bkf 29281# OS ID 29282>>>>>10 ubyte 1 \b NetWare 29283>>>>>10 ubyte 13 \b NetWare SMS 29284>>>>>10 ubyte 14 \b NT 29285>>>>>10 ubyte 24 \b 3 29286>>>>>10 ubyte 25 \b OS/2 29287>>>>>10 ubyte 26 \b 95 29288>>>>>10 ubyte 27 \b Macintosh 29289>>>>>10 ubyte 28 \b UNIX 29290# OS Version (2) 29291#>>>>>11 ubyte x OS V=%x 29292# MTF_CONTINUATION Media Sequence Number > 1 29293#>>>>>4 ulelong&0x00000001 !0 \b, continued 29294# MTF_COMPRESSION 29295>>>>>4 ulelong&0x00000004 !0 \b, compressed 29296# MTF_EOS_AT_EOM End Of Medium was hit during end of set processing 29297>>>>>4 ulelong&0x00000008 !0 \b, End Of Medium hit 29298>>>>>4 ulelong&0x00020000 0 29299# MTF_SET_MAP_EXISTS A Media Based Catalog Set Map may exist on tape 29300>>>>>>4 ulelong&0x00010000 !0 \b, with catalog 29301# MTF_FDD_ALLOWED However File/Directory Detail can only exist if a Set Map is also present 29302>>>>>4 ulelong&0x00020000 !0 \b, with file catalog 29303# Offset To First Event 238h,240h,28Ch 29304#>>>>>8 uleshort x \b, event offset %4.4x 29305# Displayable Size (20e0230h 20e024ch 20e0224h) 29306#>>>>>8 ulequad x dis. size %16.16llx 29307# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h) 29308#>>>>>52 ulelong x family ID %8.8x 29309# TAPE Attributes (3) 29310#>>>>>56 ulelong x TAPE %8.8x 29311# Media Sequence Number 29312>>>>>60 uleshort >1 \b, sequence %u 29313# Password Encryption Algorithm (3) 29314>>>>>62 uleshort >0 \b, 0x%x encrypted 29315# Soft Filemark Block Size * 512 (2) 29316#>>>>>64 uleshort =2 \b, soft size %u*512 29317>>>>>64 uleshort !2 \b, soft size %u*512 29318# Media Based Catalog Type (1,2) 29319#>>>>>66 uleshort x \b, catalog type %4.4x 29320# size of Media Name (66,68,6Eh) 29321>>>>>68 uleshort >0 29322# offset of Media Name (5Eh) 29323>>>>>>70 uleshort >0 29324# 0~, 1~ANSI, 2~UNICODE 29325>>>>>>>48 ubyte 1 29326# size terminated ansi coded string normally followed by "MTF Media Label" 29327>>>>>>>>(70.s) string >\0 \b, name: %s 29328>>>>>>>48 ubyte 2 29329# Not null, but size terminated unicoded string 29330>>>>>>>>(70.s) lestring16 x \b, name: %s 29331# size of Media Label (104h) 29332>>>>>72 uleshort >0 29333# offset of Media Label (C4h,C6h,CCh) 29334>>>>>74 uleshort >0 29335>>>>>>48 ubyte 1 29336#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields 29337>>>>>>>(74.s) string >\0 \b, label: %s 29338>>>>>>48 ubyte 2 29339>>>>>>>(74.s) lestring16 x \b, label: %s 29340# size of password name (0,1Ch) 29341#>>>>>76 uleshort >0 \b, password size %4.4x 29342# Software Vendor ID (CBEh) 29343>>>>>86 uleshort x \b, software (0x%x) 29344# size of Software Name (6Eh) 29345>>>>>80 uleshort >0 29346# offset of Software Name (1C8h,1CAh,1D0h) 29347>>>>>>82 uleshort >0 29348# 1~ANSI, 2~UNICODE 29349>>>>>>>48 ubyte 1 29350>>>>>>>>(82.s) string >\0 \b: %s 29351>>>>>>>48 ubyte 2 29352# size terminated unicoded coded string normally followed by "SPAD" 29353>>>>>>>>(82.s) lestring16 x \b: %s 29354# Format Logical Block Size (512,1024) 29355#>>>>>84 uleshort =1024 \b, block size %u 29356>>>>>84 uleshort !1024 \b, block size %u 29357# Media Date of MTF_DATE_TIME type with 5 bytes 29358#>>>>>>88 ubequad x DATE %16.16llx 29359# MTF Major Version (1) 29360#>>>>>>93 ubyte x \b, MFT version %x 29361# 29362 29363# URL: https://en.wikipedia.org/wiki/PaintShop_Pro 29364# Reference: https://www.cryer.co.uk/file-types/p/pal.htm 29365# Created by: Joerg Jenderek 29366# Note: there exist other color palette formats also with .pal extension 293670 string JASC-PAL\r\n PaintShop Pro color palette 29368#!:mime text/plain 29369# PspPalette extension is used by newer (probably 8) PaintShopPro versions 29370!:ext pal/PspPalette 29371# 2nd line contains palette file version. For example "0100" 29372>10 string !0100 \b, version %.4s 29373# third line contains the number of colours: 16 256 ... 29374>16 string x \b, %.3s colors 29375 29376# URL: https://en.wikipedia.org/wiki/Innosetup 29377# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas 29378# Created by: Joerg Jenderek 29379# Note: created by like "InnoSetup self-extracting archive" inside ./msdos 29380# TrID labeles the entry as "Inno Setup Uninstall Log" 29381# TUninstallLogID 293820 string Inno\ Setup\ Uninstall\ Log\ (b) InnoSetup Log 29383!:mime application/x-innosetup 29384# unins000.dat, unins001.dat, ... 29385!:ext dat 29386# " 64-bit" variant 29387>0x1c string >\0 \b%.7s 29388# AppName[0x80] like "Minimal SYStem", ClamWin Free Antivirus , ... 29389>0xc0 string x %s 29390# AppId[0x80] is simliar to AppName or 29391# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace 29392>0x40 ubyte 0x7b 29393>>0x40 string x %-.38s 29394# do not know how this log version correlates to program version 29395>0x140 ulelong x \b, version 0x%x 29396# NumRecs 29397#>0x144 ulelong x \b, 0x%4.4x records 29398# EndOffset means files size 29399>0x148 ulelong x \b, %u bytes 29400# Flags 5 25h 35h 29401#>0x14c ulelong x \b, flags %8.8x 29402# Reserved: array[0..26] of Longint 29403# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000 29404>0x140 ulelong <1000 29405# hostname 29406>>0x1d6 pstring x \b, %s 29407# user name 29408>>>&0 pstring x \b\%s 29409# directory like C:\Program Files (x86)\GnuWin32 29410>>>>&0 pstring x \b, "%s" 29411# version 1000 or higher implies unicode 29412>0x140 ulelong >999 29413# hostname 29414>>0x1db lestring16 x \b, %-.9s 29415# utf string variant with prepending fe??ffFFff 29416>>0x1db search/43 \xFF\xFF\xFF 29417# user name 29418>>>&0 lestring16 x \b\%-.9s 29419>>>&0 search/43 \xFF\xFF\xFF 29420# directory like C:\Program Files\GIMP 2 29421>>>>&0 lestring16 x \b, %-.42s 29422 29423# Windows Imaging (WIM) Image 29424# Update: Joerg Jenderek at Mar 2019 29425# URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format 29426# Reference: https://download.microsoft.com/download/f/e/f/ 29427# fefdc36e-392d-4678-9e4e-771ffa2692ab/Windows%20Imaging%20File%20Format.rtf 29428# Note: verified by like `7z t boot.wim` `wiminfo install.esd --header` 294290 string MSWIM\000\000\000 29430>0 use wim-archive 29431# https://wimlib.net/man1/wimoptimize.html 294320 string WLPWM\000\000\000 29433>0 use wim-archive 294340 name wim-archive 29435# _WIMHEADER_V1_PACKED ImageTag[8] 29436>0 string x Windows imaging 29437!:mime application/x-ms-wim 29438# TO avoid in file version 5.36 error like 29439# Magdir/windows, 760: Warning: Current entry does not yet have a description 29440# file: could not find any valid magic files! (No error) 29441# splitted WIM 29442>16 ulelong &0x00000008 (SWM 29443!:ext swm 29444# usPartNumber; 1, unless the file was split into multiple parts 29445>>40 uleshort x \b %u 29446# usTotalParts; The total number of WIM file parts in a spanned set 29447>>42 uleshort x \b of %u) image 29448# non splitted WIM 29449>16 ulelong ^0x00000008 29450# https://wimlib.net/man1/wimmount.html 29451# solid WIMs; version 3584; usually contain LZMS-compressed and the .esd extension 29452>>12 ulelong 3584 (ESD) image 29453!:ext esd 29454>>12 ulelong !3584 (WIM) image 29455!:ext wim 29456>0 string/b WLPWM\000\000\000 \b, wimlib pipable format 29457# cbSize size of the WIM header in bytes like 208 29458#>8 ulelong x \b, headersize %u 29459# dwVersion version of the WIM file 00010d00h~1.13 00000e00h~0.14 29460>14 uleshort x v%u 29461>13 ubyte x \b.%u 29462# dwImageCount; The number of images contained in the WIM file 29463>44 ulelong >1 \b, %u images 29464# dwBootIndex 29465# 1-based index of the bootable image of the WIM, or 0 if no image is bootable 29466>0x78 ulelong >0 \b, bootable no. %u 29467# dwFlags 29468#>16 ulelong x \b, flags 0x%8.8x 29469#define FLAG_HEADER_COMPRESSION 0x00000002 29470#define FLAG_HEADER_READONLY 0x00000004 29471#define FLAG_HEADER_SPANNED 0x00000008 29472#define FLAG_HEADER_RESOURCE_ONLY 0x00000010 29473#define FLAG_HEADER_METADATA_ONLY 0x00000020 29474#define FLAG_HEADER_WRITE_IN_PROGRESS 0x00000040 29475#define FLAG_HEADER_RP_FIX 0x00000080 reparse point fixup 29476#define FLAG_HEADER_COMPRESS_RESERVED 0x00010000 29477#define FLAG_HEADER_COMPRESS_XPRESS 0x00020000 29478#define FLAG_HEADER_COMPRESS_LZX 0x00040000 29479#define FLAG_HEADER_COMPRESS_LZMS 0x00080000 29480#define FLAG_HEADER_COMPRESS_XPRESS2 0x00100000 wimlib-1.13.0\include\wimlib\header.h 29481# XPRESS, with small chunk size 29482>16 ulelong &0x00100000 \b, XPRESS2 29483>16 ulelong &0x00080000 \b, LZMS 29484>16 ulelong &0x00040000 \b, LZX 29485>16 ulelong &0x00020000 \b, XPRESS 29486>16 ulelong &0x00000002 compressed 29487>16 ulelong &0x00000004 \b, read only 29488>16 ulelong &0x00000010 \b, resource only 29489>16 ulelong &0x00000020 \b, metadata only 29490>16 ulelong &0x00000080 \b, reparse point fixup 29491#>16 ulelong &0x00010000 \b, RESERVED 29492# dwCompressionSize; Uncompressed chunk size for resources or 0 if uncompressed 29493#>20 ulelong >0 \b, chunk size %u bytes 29494# gWIMGuid 29495#>24 ubequad x \b, GUID 0x%16.16llx 29496#>>32 ubequad x \b%16.16llx 29497# rhOffsetTable; the location of the resource lookup table 29498# wim_reshdr_disk[24]= u8 size_in_wim[7] + u8 flags + le64 offset_in_wim + le64 uncompressed_size 29499#>48 ubequad x \b, rhOffsetTable 0x%16.16llx 29500# rhXmlData; the location of the XML data 29501#>0x50 ulelong x \b, at 0x%8.8x 29502# NOT WORKING \xff\xfe<\0W\0I\0M\0 29503#>(0x50.l) ubequad x \b, xml=%16.16llx 29504# rhBootMetadata; the location of the metadata resource 29505#>0x60 ubequad x \b, rhBootMetadata 0x%16.16llx 29506# rhIntegrity; the location of integrity table used to verify files 29507#>0x7c ubequad x \b, rhIntegrity 0x%16.16llx 29508# Unused[60] 29509#>148 ubequad !0 \b,unused 0x%16.16llx 29510# 29511 29512 29513#------------------------------------------------------------------------------ 29514# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $ 29515# wireless-regdb: file(1) magic for CRDA wireless-regdb file format 29516# 295170 string RGDB CRDA wireless regulatory database file 29518>4 belong 19 (Version 1) 29519 29520#------------------------------------------------------------------------------ 29521# $File: wordprocessors,v 1.20 2019/04/19 00:42:27 christos Exp $ 29522# wordprocessors: file(1) magic fo word processors. 29523# 29524####### PWP file format used on Smith Corona Personal Word Processors: 295252 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP 29526>24 byte 2 \b, single spaced 29527>24 byte 3 \b, 1.5 spaced 29528>24 byte 4 \b, double spaced 29529>25 byte 0x42 \b, letter 29530>25 byte 0x54 \b, legal 29531>26 byte 0x46 \b, A4 29532 29533# Corel/WordPerfect 295340 string \xffWPC 29535# WordPerfect 29536>8 byte 1 29537>>9 byte 1 WordPerfect macro 29538>>9 byte 2 WordPerfect help file 29539>>9 byte 3 WordPerfect keyboard file 29540>>9 byte 10 WordPerfect document 29541>>9 byte 11 WordPerfect dictionary 29542>>9 byte 12 WordPerfect thesaurus 29543>>9 byte 13 WordPerfect block 29544>>9 byte 14 WordPerfect rectangular block 29545>>9 byte 15 WordPerfect column block 29546>>9 byte 16 WordPerfect printer data 29547>>9 byte 19 WordPerfect printer data 29548>>9 byte 20 WordPerfect driver resource data 29549>>9 byte 22 WordPerfect graphic image 29550>>9 byte 23 WordPerfect hyphenation code 29551>>9 byte 24 WordPerfect hyphenation data 29552>>9 byte 25 WordPerfect macro resource data 29553>>9 byte 27 WordPerfect hyphenation lex 29554>>9 byte 29 WordPerfect wordlist 29555>>9 byte 30 WordPerfect equation resource data 29556>>9 byte 33 WordPerfect spell rules 29557>>9 byte 34 WordPerfect dictionary rules 29558>>9 byte 39 WordPerfect spell rules (Microlytics) 29559>>9 byte 43 WordPerfect settings file 29560>>9 byte 44 WordPerfect 3.5 document 29561>>9 byte 45 WordPerfect 4.2 document 29562>>9 byte 69 WordPerfect dialog file 29563>>9 byte 76 WordPerfect button bar 29564>>9 default x 29565>>>9 byte x Corel WordPerfect: Unknown filetype %d 29566# Corel Shell 29567>8 byte 2 29568>>9 byte 1 Corel shell macro 29569>>9 byte 10 Corel shell definition 29570>>9 default x 29571>>>9 byte x Corel Shell: Unknown filetype %d 29572# Corel Notebook 29573>8 byte 3 29574>>9 byte 1 Corel Notebook macro 29575>>9 byte 2 Corel Notebook help file 29576>>9 byte 3 Corel Notebook keyboard file 29577>>9 byte 10 Corel Notebook definition 29578>>9 default x 29579>>>9 byte x Corel Notebook: Unknown filetype %d 29580# Corel Calculator 29581>8 byte 4 29582>>9 byte 2 Corel Calculator help file 29583>>9 default x 29584>>>9 byte x Corel Calculator: Unknown filetype %d 29585# Corel File Manager 29586>8 byte 5 29587>>9 default x 29588>>>9 byte x Corel File Manager: Unknown filetype %d 29589# Corel Calendar 29590>8 byte 6 29591>>9 byte 2 Corel Calendar help file 29592>>9 byte 10 Corel Calendar data file 29593>>9 default x 29594>>>9 byte x Corel Calendar: Unknown filetype %d 29595# Corel Program Editor/Ed Editor 29596>8 byte 7 29597>>9 byte 1 Corel Editor macro 29598>>9 byte 2 Corel Editor help file 29599>>9 byte 3 Corel Editor keyboard file 29600>>9 byte 25 Corel Editor macro resource file 29601>>9 default x 29602>>>9 byte x Corel Program Editor/Ed Editor: Unknown filetype %d 29603# Corel Macro Editor 29604>8 byte 8 29605>>9 byte 1 Corel Macro editor macro 29606>>9 byte 2 Corel Macro editor help file 29607>>9 byte 3 Corel Macro editor keyboard file 29608>>9 default x 29609>>>9 byte x Corel Macro Editor: Unknown filetype %d 29610# Corel Plan Perfect 29611>8 byte 9 29612>>9 default x 29613>>>9 byte x Corel Plan Perfect: Unknown filetype %d 29614# Corel DataPerfect 29615>8 byte 10 29616# CHECK: Don't these belong into product 9? 29617>>9 byte 1 Corel PlanPerfect macro 29618>>9 byte 2 Corel PlanPerfect help file 29619>>9 byte 3 Corel PlanPerfect keyboard file 29620>>9 byte 10 Corel PlanPerfect worksheet 29621>>9 byte 15 Corel PlanPerfect printer definition 29622>>9 byte 18 Corel PlanPerfect graphic definition 29623>>9 byte 19 Corel PlanPerfect data 29624>>9 byte 20 Corel PlanPerfect temporary printer 29625>>9 byte 25 Corel PlanPerfect macro resource data 29626>>9 default x 29627>>>9 byte x Corel DataPerfect: Unknown filetype %d 29628# Corel Mail 29629>8 byte 11 29630>>9 byte 2 Corel Mail help file 29631>>9 byte 5 Corel Mail distribution list 29632>>9 byte 10 Corel Mail out box 29633>>9 byte 11 Corel Mail in box 29634>>9 byte 20 Corel Mail users archived mailbox 29635>>9 byte 21 Corel Mail archived message database 29636>>9 byte 22 Corel Mail archived attachments 29637>>9 default x 29638>>>9 byte x Corel Mail: Unknown filetype %d 29639# Corel Printer 29640>8 byte 12 29641>>9 byte 11 Corel Printer temporary file 29642>>9 default x 29643>>>9 byte x Corel Printer: Unknown filetype %d 29644# Corel Scheduler 29645>8 byte 13 29646>>9 byte 2 Corel Scheduler help file 29647>>9 byte 10 Corel Scheduler in file 29648>>9 byte 11 Corel Scheduler out file 29649>>9 default x 29650>>>9 byte x Corel Scheduler: Unknown filetype %d 29651# Corel WordPerfect Office 29652>8 byte 14 29653>>9 byte 10 Corel GroupWise settings file 29654>>9 byte 17 Corel GroupWise directory services 29655>>9 byte 43 Corel GroupWise settings file 29656>>9 default x 29657>>>9 byte x Corel WordPerfect Office: Unknown filetype %d 29658# Corel DrawPerfect 29659>8 byte 15 29660>>9 default x 29661>>>9 byte x Corel DrawPerfect: Unknown filetype %d 29662# Corel LetterPerfect 29663>8 byte 16 29664>>9 default x 29665>>>9 byte x Corel LetterPerfect: Unknown filetype %d 29666# Corel Terminal 29667>8 byte 17 29668>>9 byte 10 Corel Terminal resource data 29669>>9 byte 11 Corel Terminal resource data 29670>>9 byte 43 Corel Terminal resource data 29671>>9 default x 29672>>>9 byte x Corel Terminal: Unknown filetype %d 29673# Corel loadable file 29674>8 byte 18 29675>>9 byte 10 Corel loadable file 29676>>9 byte 11 Corel GUI loadable text 29677>>9 byte 12 Corel graphics resource data 29678>>9 byte 13 Corel printer settings file 29679>>9 byte 14 Corel port definition file 29680>>9 byte 15 Corel print queue parameters 29681>>9 byte 16 Corel compressed file 29682>>9 default x 29683>>>9 byte x Corel loadable file: Unknown filetype %d 29684>>15 byte 0 \b, optimized for Intel 29685>>15 byte 1 \b, optimized for Non-Intel 29686# Network service 29687>8 byte 20 29688>>9 byte 10 Corel Network service msg file 29689>>9 byte 11 Corel Network service msg file 29690>>9 byte 12 Corel Async gateway login msg 29691>>9 byte 14 Corel GroupWise message file 29692>>9 default x 29693>>>9 byte x Corel Network service: Unknown filetype %d 29694# GroupWise 29695>8 byte 31 29696>>9 byte 20 GroupWise admin domain database 29697>>9 byte 21 GroupWise admin host database 29698>>9 byte 23 GroupWise admin remote host database 29699>>9 byte 24 GroupWise admin ADS deferment data file 29700>>9 default x 29701>>>9 byte x GroupWise: Unknown filetype %d 29702# IntelliTAG 29703>8 byte 33 29704>>9 byte 10 IntelliTAG (SGML) compiled DTD 29705>>9 default x 29706>>>9 byte x IntelliTAG: Unknown filetype %d 29707# everything else 29708>8 default x 29709>>8 byte x Unknown Corel/Wordperfect product %d, 29710>>>9 byte x file type %d 29711>10 byte 0 \b, v5. 29712>10 byte !0 \b, v%d. 29713>11 byte x \b%d 29714 29715# Hangul (Korean) Word Processor File 297160 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 29717# From: Won-Kyu Park <wkpark@kldp.org> 29718512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 29719!:mime application/x-hwp 29720 29721# CosmicBook, from Benoit Rouits 297220 string CSBK Ted Neslson's CosmicBook hypertext file 29723 297242 string EYWR AmigaWriter file 29725 29726# chi: file(1) magic for ChiWriter files 297270 string \\1cw\ ChiWriter file 29728>5 string >\0 version %s 297290 string \\1cw ChiWriter file 29730 29731# Quark Express from https://www.garykessler.net/library/file_sigs.html 297322 string IIXPR3 Intel Quark Express Document (English) 297332 string IIXPRa Intel Quark Express Document (Korean) 297342 string MMXPR3 Motorola Quark Express Document (English) 29735!:mime application/x-quark-xpress-3 297362 string MMXPRa Motorola Quark Express Document (Korean) 29737 29738# adobe indesign (document, whatever...) from querkan 297390 belong 0x0606edf5 Adobe InDesign 29740>16 string DOCUMENT Document 29741 29742#------------------------------------------------------------------------------ 29743# ichitaro456: file(1) magic for Just System Word Processor Ichitaro 29744# 29745# Contributor kenzo-: 29746# Reversed-engineered JS Ichitaro magic numbers 29747# 29748 297490 string DOC 29750>43 byte 0x14 Just System Word Processor Ichitaro v4 29751!:mime application/x-ichitaro4 29752>144 string JDASH application/x-ichitaro4 29753 297540 string DOC 29755>43 byte 0x15 Just System Word Processor Ichitaro v5 29756!:mime application/x-ichitaro5 29757 297580 string DOC 29759>43 byte 0x16 Just System Word Processor Ichitaro v6 29760!:mime application/x-ichitaro6 29761 29762# Type: Freemind mindmap documents 29763# From: Jamie Thompson <debian-bugs@jamie-thompson.co.uk> 297640 string/w \<map\ version Freemind document 29765!:mime application/x-freemind 29766 29767# Type: Freeplane mindmap documents 29768# From: Felix Natter <fnatter@gmx.net> 297690 string/w \<map\ version="freeplane Freeplane document 29770!:mime application/x-freeplane 29771 29772# Type: Scribus 29773# From: Werner Fink <werner@suse.de> 297740 string \<SCRIBUSUTF8\ Version Scribus Document 297750 string \<SCRIBUSUTF8NEW\ Version Scribus Document 29776!:mime application/x-scribus 29777 29778# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek 29779# markups page=0x04,label=0x12, followed by strings like "opt" or "main" and title=0x14 297800 ulelong&0x8080FFFF 0x00001204 gfxboot compiled html help file 29781 29782#------------------------------------------------------------------------------ 29783# $File: wsdl,v 1.5 2019/04/19 00:42:27 christos Exp $ 29784# wsdl: PHP WSDL Cache, https://www.php.net/manual/en/book.soap.php 29785# Cache format extracted from source: 29786# https://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&view=markup 29787# Requires file >= 5.05 29788# By Elan Ruusamae <glen@delfi.ee>, Patryk Zawadzki <patrys@pld-linux.org>, 2010-2011 297890 string wsdl PHP WSDL cache, 29790>4 byte x version 0x%02x 29791>6 ledate x \b, created %s 29792 29793# uri 29794>10 lelong <0x7fffffff 29795>>10 pstring/l x \b, uri: "%s" 29796 29797# source 29798>>>&0 lelong <0x7fffffff 29799>>>>&-4 pstring/l x \b, source: "%s" 29800 29801# target_ns 29802>>>>>&0 lelong <0x7fffffff 29803>>>>>>&-4 pstring/l x \b, target_ns: "%s" 29804#------------------------------------------------------------------------------ 29805# x68000: file(1) magic for the Sharp Home Computer 29806# v1.0 29807# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net> 29808 29809# Yanagisawa PIC picture 298100 string PIC 29811>3 search/0x200 \x1A 29812>>&0 search/0x200 \x0 29813>>>&0 ubyte 0 Yanagisawa PIC image file, 29814>>>>&0 ubyte&15 0 model: X68000, 29815>>>>&0 ubyte&15 1 model: PC-88VA, 29816>>>>&0 ubyte&15 2 model: FM-TOWNS, 29817>>>>&0 ubyte&15 3 model: MAC, 29818>>>>&0 ubyte&15 15 model: Generic, 29819>>>>&3 ubeshort x %dx 29820>>>>&5 ubeshort x \b%d, 29821>>>>&1 ubeshort 4 colors: 16 29822>>>>&1 ubeshort 8 colors: 256 29823>>>>&1 ubeshort 12 colors: 4096 29824>>>>&1 ubeshort 15 colors: 32768 29825>>>>&1 ubeshort 16 colors: 65536 29826>>>>&1 ubeshort >16 colors: %d-bit 29827 29828 29829 29830#------------------------------------------------------------------------------ 29831# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $ 29832# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU> 29833# 298340 string %XDELTA% XDelta binary patch file 0.14 298350 string %XDZ000% XDelta binary patch file 0.18 298360 string %XDZ001% XDelta binary patch file 0.20 298370 string %XDZ002% XDelta binary patch file 1.0 298380 string %XDZ003% XDelta binary patch file 1.0.4 298390 string %XDZ004% XDelta binary patch file 1.1 29840 298410 string \xD6\xC3\xC4\x00 VCDIFF binary diff 29842 29843#------------------------------------------------------------------------------ 29844# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $ 29845# xenix: file(1) magic for Microsoft Xenix 29846# 29847# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small 29848# model" lifted from "magic.xenix", with comment "derived empirically; 29849# treat as folklore until proven" 29850# 29851# "small model", "large model", "huge model" stuff lifted from XXX 29852# 29853# XXX - "x.out" collides with PDP-11 archives 29854# 298550 string core core file (Xenix) 29856# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 29857# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 29858# Update: Joerg Jenderek 29859# recordtype~TranslatorHEADerRecord 298600 byte 0x80 29861# GRR: line above is too general as it catches also Extensible storage engine DataBase 29862# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 29863>1 uleshort <1022 29864# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length 29865>>1 uleshort >0 29866# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length 29867>>>3 ubyte >0 29868# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c" 29869>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft) 29870#!:mime application/octet-stream 29871!:mime application/x-object 29872!:ext o/a 29873>>>>>3 pstring x \b, "%s" 29874# checksum 29875#>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x 298760 leshort 0xff65 x.out 29877>2 string __.SYMDEF randomized 29878>0 byte x archive 298790 leshort 0x206 Microsoft a.out 29880>8 leshort 1 Middle model 29881>0x1e leshort &0x10 overlay 29882>0x1e leshort &0x2 separate 29883>0x1e leshort &0x4 pure 29884>0x1e leshort &0x800 segmented 29885>0x1e leshort &0x400 standalone 29886>0x1e leshort &0x8 fixed-stack 29887>0x1c byte &0x80 byte-swapped 29888>0x1c byte &0x40 word-swapped 29889>0x10 lelong >0 not-stripped 29890>0x1e leshort ^0xc000 pre-SysV 29891>0x1e leshort &0x4000 V2.3 29892>0x1e leshort &0x8000 V3.0 29893>0x1c byte &0x4 86 29894>0x1c byte &0xb 186 29895>0x1c byte &0x9 286 29896>0x1c byte &0xa 386 29897>0x1f byte <0x040 small model 29898>0x1f byte =0x048 large model 29899>0x1f byte =0x049 huge model 29900>0x1e leshort &0x1 executable 29901>0x1e leshort ^0x1 object file 29902>0x1e leshort &0x40 Large Text 29903>0x1e leshort &0x20 Large Data 29904>0x1e leshort &0x120 Huge Objects Enabled 29905>0x10 lelong >0 not stripped 29906 299070 leshort 0x140 old Microsoft 8086 x.out 29908>0x3 byte &0x4 separate 29909>0x3 byte &0x2 pure 29910>0 byte &0x1 executable 29911>0 byte ^0x1 relocatable 29912>0x14 lelong >0 not stripped 29913 299140 lelong 0x206 b.out 29915>0x1e leshort &0x10 overlay 29916>0x1e leshort &0x2 separate 29917>0x1e leshort &0x4 pure 29918>0x1e leshort &0x800 segmented 29919>0x1e leshort &0x400 standalone 29920>0x1e leshort &0x1 executable 29921>0x1e leshort ^0x1 object file 29922>0x1e leshort &0x4000 V2.3 29923>0x1e leshort &0x8000 V3.0 29924>0x1c byte &0x4 86 29925>0x1c byte &0xb 186 29926>0x1c byte &0x9 286 29927>0x1c byte &0x29 286 29928>0x1c byte &0xa 386 29929>0x1e leshort &0x4 Large Text 29930>0x1e leshort &0x2 Large Data 29931>0x1e leshort &0x102 Huge Objects Enabled 29932 299330 leshort 0x580 XENIX 8086 relocatable or 80286 small model 29934 29935#------------------------------------------------------------------------------ 29936# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $ 29937# This is Aaron's attempt at a MAGIC file for Xilinx .bit files. 29938# Xilinx-Magic@RevRagnarok.com 29939# Got the info from FPGA-FAQ 0026 29940# 29941# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth, 29942# fixes at least reading of bitfiles from Spartan 2, 3, 6. 29943# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm 29944# 29945# First there is the sync header and its length 299460 beshort 0x0009 29947>2 belong =0x0ff00ff0 29948>>&0 belong =0x0ff00ff0 29949>>>&0 byte =0x00 29950>>>&1 beshort =0x0001 29951>>>&3 string a Xilinx BIT data 29952# Next is a Pascal-style string with the NCD name. We want to capture that. 29953>>>>&0 pstring/H x - from %s 29954# And then 'b' 29955>>>>>&1 string b 29956# Then the model / part number: 29957>>>>>>&0 pstring/H x - for %s 29958# Then 'c' 29959>>>>>>>&1 string c 29960# Then the build-date 29961>>>>>>>>&0 pstring/H x - built %s 29962# Then 'd' 29963>>>>>>>>>&1 string d 29964# Then the build-time 29965>>>>>>>>>>&0 pstring/H x \b(%s) 29966# Then 'e' 29967>>>>>>>>>>>&1 string e 29968# And length of data 29969>>>>>>>>>>>>&0 belong x - data length 0x%x 29970 29971# Raw bitstream files 299720 long 0xffffffff 29973>&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN) 29974 29975#------------------------------------------------------------------------------ 29976# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $ 29977# xo65 object files 29978# From: "Ullrich von Bassewitz" <uz@cc65.org> 29979# 299800 string \x55\x7A\x6E\x61 xo65 object, 29981>4 leshort x version %d, 29982>6 leshort&0x0001 =0x0001 with debug info 29983>6 leshort&0x0001 =0x0000 no debug info 29984 29985# xo65 library files 299860 string \x6E\x61\x55\x7A xo65 library, 29987>4 leshort x version %d 29988 29989# o65 object files 299900 string \x01\x00\x6F\x36\x35 o65 29991>6 leshort&0x1000 =0x0000 executable, 29992>6 leshort&0x1000 =0x1000 object, 29993>5 byte x version %d, 29994>6 leshort&0x8000 =0x8000 65816, 29995>6 leshort&0x8000 =0x0000 6502, 29996>6 leshort&0x2000 =0x2000 32 bit, 29997>6 leshort&0x2000 =0x0000 16 bit, 29998>6 leshort&0x4000 =0x4000 page reloc, 29999>6 leshort&0x4000 =0x0000 byte reloc, 30000>6 leshort&0x0003 =0x0000 alignment 1 30001>6 leshort&0x0003 =0x0001 alignment 2 30002>6 leshort&0x0003 =0x0002 alignment 4 30003>6 leshort&0x0003 =0x0003 alignment 256 30004 30005#------------------------------------------------------------------------------ 30006# $File: xwindows,v 1.11 2019/04/19 00:42:27 christos Exp $ 30007# xwindows: file(1) magic for various X/Window system file formats. 30008 30009# Compiled X Keymap 30010# XKM (compiled X keymap) files (including version and byte ordering) 300111 string mkx Compiled XKB Keymap: lsb, 30012>0 byte >0 version %d 30013>0 byte =0 obsolete 300140 string xkm Compiled XKB Keymap: msb, 30015>3 byte >0 version %d 30016>3 byte =0 obsolete 30017 30018# xfsdump archive 300190 string xFSdump0 xfsdump archive 30020>8 belong x (version %d) 30021 30022# Jaleo XFS files 300230 long 395726 Jaleo XFS file 30024>4 long x - version %d 30025>8 long x - [%d - 30026>20 long x \b%dx 30027>24 long x \b%dx 30028>28 long 1008 \bYUV422] 30029>28 long 1000 \bRGB24] 30030 30031# Xcursor data 30032# X11 mouse cursor format defined in libXcursor, see 30033# https://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html 30034# https://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h 300350 string Xcur Xcursor data 30036!:mime image/x-xcursor 30037>10 leshort x version %d 30038>>8 leshort x \b.%d 30039 30040 30041#------------------------------------------------------------------------------ 30042# $File: yara,v 1.3 2019/04/19 00:42:27 christos Exp $ 30043# yara: file(1) magic for https://virustotal.github.io/yara/ 30044# 30045 300460 string YARA 30047>4 lelong >2047 30048>8 byte <20 YARA 3.x compiled rule set 30049# version 30050>>8 clear x 30051>>8 byte 6 created with version 3.3.0 30052>>8 byte 8 created with version 3.4.0 30053>>8 byte 11 created with version 3.5.0 30054>>8 default x 30055>>>8 byte x development version 0x%02x 30056#------------------------------------------------------------------------------ 30057# zfs: file(1) magic for ZFS dumps 30058# 30059# From <rea-fbsd@codelabs.ru> 30060# ZFS dump header has the following structure (as per zfs_ioctl.h 30061# in FreeBSD with drr_type is set to DRR_BEGIN) 30062# 30063# enum { 30064# DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS, 30065# DRR_WRITE, DRR_FREE, DRR_END, 30066# } drr_type; 30067# uint32_t drr_pad; 30068# uint64_t drr_magic; 30069# uint64_t drr_version; 30070# uint64_t drr_creation_time; 30071# dmu_objset_type_t drr_type; 30072# uint32_t drr_pad; 30073# uint64_t drr_toguid; 30074# uint64_t drr_fromguid; 30075# char drr_toname[MAXNAMELEN]; 30076# 30077# Backup magic is 0x00000002f5bacbac (quad word) 30078# The drr_type is defined as 30079# typedef enum dmu_objset_type { 30080# DMU_OST_NONE, 30081# DMU_OST_META, 30082# DMU_OST_ZFS, 30083# DMU_OST_ZVOL, 30084# DMU_OST_OTHER, /* For testing only! */ 30085# DMU_OST_ANY, /* Be careful! */ 30086# DMU_OST_NUMTYPES 30087# } dmu_objset_type_t; 30088# 30089# Almost all uint64_t fields are printed as the 32-bit ones (with high 30090# 32 bits zeroed), because there is no simple way to print them as the 30091# full 64-bit values. 30092 30093# Big-endian values 300948 string \000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine), 30095>20 belong x version %u, 30096>32 belong 0 type: NONE, 30097>32 belong 1 type: META, 30098>32 belong 2 type: ZFS, 30099>32 belong 3 type: ZVOL, 30100>32 belong 4 type: OTHER, 30101>32 belong 5 type: ANY, 30102>32 belong >5 type: UNKNOWN (%u), 30103>40 byte x destination GUID: %02X 30104>41 byte x %02X 30105>42 byte x %02X 30106>43 byte x %02X 30107>44 byte x %02X 30108>45 byte x %02X 30109>46 byte x %02X 30110>47 byte x %02X, 30111>48 ulong >0 30112>>52 ulong >0 30113>>>48 byte x source GUID: %02X 30114>>>49 byte x %02X 30115>>>50 byte x %02X 30116>>>51 byte x %02X 30117>>>52 byte x %02X 30118>>>53 byte x %02X 30119>>>54 byte x %02X 30120>>>55 byte x %02X, 30121>56 string >\0 name: '%s' 30122 30123# Little-endian values 301248 string \254\313\272\365\002\000\000\000 ZFS shapshot (little-endian machine), 30125>16 lelong x version %u, 30126>32 lelong 0 type: NONE, 30127>32 lelong 1 type: META, 30128>32 lelong 2 type: ZFS, 30129>32 lelong 3 type: ZVOL, 30130>32 lelong 4 type: OTHER, 30131>32 lelong 5 type: ANY, 30132>32 lelong >5 type: UNKNOWN (%u), 30133>47 byte x destination GUID: %02X 30134>46 byte x %02X 30135>45 byte x %02X 30136>44 byte x %02X 30137>43 byte x %02X 30138>42 byte x %02X 30139>41 byte x %02X 30140>40 byte x %02X, 30141>48 ulong >0 30142>>52 ulong >0 30143>>>55 byte x source GUID: %02X 30144>>>54 byte x %02X 30145>>>53 byte x %02X 30146>>>52 byte x %02X 30147>>>51 byte x %02X 30148>>>50 byte x %02X 30149>>>49 byte x %02X 30150>>>48 byte x %02X, 30151>56 string >\0 name: '%s' 30152 30153#------------------------------------------------------------------------------ 30154# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $ 30155# zilog: file(1) magic for Zilog Z8000. 30156# 30157# Was it big-endian or little-endian? My Product Specification doesn't 30158# say. 30159# 301600 long 0xe807 object file (z8000 a.out) 301610 long 0xe808 pure object file (z8000 a.out) 301620 long 0xe809 separate object file (z8000 a.out) 301630 long 0xe805 overlay object file (z8000 a.out) 30164#------------------------------------------------------------------------------ 30165# $File: zip,v 1.2 2019/04/09 18:34:15 christos Exp $ 30166# zip: file(1) magic for zip files; this is not use 30167# Note the version of magic in archive is currently stronger, this is 30168# just an example until negative offsets are supported better 30169 30170# Zip Central Cirectory record 301710 name zipcd 30172>0 string PK\001\002 Zip archive data 30173>>4 leshort x \b, made by 30174>>4 use zipversion 30175>>6 leshort x \b, extract using at least 30176>>6 use zipversion 30177>>12 ledate x \b, last modified %s 30178>>24 lelong >0 \b, uncompressed size %d 30179>>10 leshort x \b, method= 30180>>10 use zipcompression 30181 30182# Zip known compressions 301830 name zipcompression 30184>0 leshort 0 \bstore 30185>0 leshort 8 \bdeflate 30186>0 leshort 9 \bdeflate64 30187>0 leshort 12 \bbzip2 30188>0 leshort 14 \blzma 30189>0 leshort 94 \bMP3 30190>0 leshort 95 \bxz 30191>0 leshort 96 \bJpeg 30192>0 leshort 97 \bWavPack 30193>0 leshort 98 \bPPMd 30194>0 leshort 99 \bAES Encrypted 30195>0 default x 30196>>0 leshort x \b[%#x] 30197 30198# Zip known versions 301990 name zipversion 30200>0 leshort 0x09 v0.9 30201>0 leshort 0x0a v1.0 30202>0 leshort 0x0b v1.1 30203>0 leshort 0x14 v2.0 30204>0 leshort 0x15 v2.1 30205>0 leshort 0x19 v2.5 30206>0 leshort 0x1b v2.7 30207>0 leshort 0x2d v4.5 30208>0 leshort 0x2e v4.6 30209>0 leshort 0x32 v5.0 30210>0 leshort 0x33 v5.1 30211>0 leshort 0x34 v5.2 30212>0 leshort 0x3d v6.1 30213>0 leshort 0x3e v6.2 30214>0 leshort 0x3f v6.3 30215>0 default x 30216>>0 leshort x v?[%#x] 30217 30218# Zip End Of Central Directory record 30219-22 string PK\005\006 30220#>4 leshort >1 \b, %d disks 30221#>6 leshort >1 \b, central directory disk %d 30222#>8 leshort >1 \b, %d central directories on this disk 30223#>10 leshort >1 \b, %d central directories 30224#>12 lelong x \b, %d central directory bytes 30225>(16.l) use zipcd 30226>20 pstring/l >0 \b, %s 30227 30228#------------------------------------------------------------------------------ 30229# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $ 30230# zyxel: file(1) magic for ZyXEL modems 30231# 30232# From <rob@pe1chl.ampr.org> 30233# These are the /etc/magic entries to decode datafiles as used for the 30234# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a 30235# ZyXEL-defined standard) 30236 302370 string ZyXEL\002 ZyXEL voice data 30238>10 byte 0 - CELP encoding 30239>10 byte&0x0B 1 - ADPCM2 encoding 30240>10 byte&0x0B 2 - ADPCM3 encoding 30241>10 byte&0x0B 3 - ADPCM4 encoding 30242>10 byte&0x0B 8 - New ADPCM3 encoding 30243>10 byte&0x04 4 with resync 30244
